From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nikhil Kshirsagar Subject: [PATCH] mdadm --detail --scan causes SIGABRT Date: Fri, 10 Jun 2016 09:50:40 +0530 Message-ID: <575A4018.8050500@redhat.com> Reply-To: nkshirsa@redhat.com Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------050006060209040006040905" Return-path: Sender: linux-raid-owner@vger.kernel.org To: linux-raid@vger.kernel.org List-Id: linux-raid.ids This is a multi-part message in MIME format. --------------050006060209040006040905 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Please find attached a patch to fix BZ 1343809. Details: mdadm has a buffer overflow if mdinfo->sys_name needs to store a name larger than 20 characters. Core was generated by `mdadm --detail /dev/md0'. Program terminated with signal 6, Aborted. #0 0x0000003a93e325e5 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 64 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig); (gdb) where #0 0x0000003a93e325e5 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 #1 0x0000003a93e33dc5 in abort () at abort.c:92 #2 0x0000003a93e704f7 in __libc_message (do_abort=2, fmt=0x3a93f578cf "*** %s ***: %s terminated\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:198 #3 0x0000003a93f026d7 in __fortify_fail (msg=0x3a93f57875 "buffer overflow detected") at fortify_fail.c:32 #4 0x0000003a93f005c0 in __chk_fail () at chk_fail.c:29 #5 0x000000000044fe59 in strcpy (fd=, devnm=, options=) at /usr/include/bits/string3.h:105 #6 sysfs_read (fd=, devnm=, options=) at sysfs.c:272 #7 0x000000000041cdfa in Detail (dev=0x7fffe35f1473 "/dev/md0", c=0x7fffe35ef590) at Detail.c:106 #8 0x0000000000405ed3 in misc_list (argc=, argv=) at mdadm.c:1747 #9 main (argc=, argv=) at mdadm.c:1425 (gdb) The line that causes the fault is "sysfs.c" line 272 strcpy(dev->sys_name, de->d_name); (gdb) print *de $9 = {d_ino = 14458, d_off = 14471, d_reclen = 40, d_type = 4 '\004', d_name = "dev-oczpcie_23_0_ssd\000\207\070\000\000\000\000\000\000\264\070\000\000\000\000\000\000(\000\004dev-oczpcie_11_0_ssd\000\264\070\000\000\000\000\000\000\265\070\000\000\000\000\000\000 \000\bsync_action\000\b\265\070\000\000\000\000\000\000\266\070\000\000\000\000\000\000(\000\blast_sync_action\000\000\000\000\b\266\070\000\000\000\000\000\000\267\070\000\000\000\000\000\000 \000\bmismatch_cnt\000\267\070\000\000\000\000\000\000\270\070\000\000\000\000\000\000(\000\bsync_speed_min\000\000\000\000\000\000\b\270\070\000\000\000\000\000\000\271\070\000\000\000\000\000\000(\000\bsync_speed_max\000\000\000\000\000\000\b\271\070\000\000\000\000\000\000\272\070"} (gdb) dev-oczpcie_23_0_ssd itself is 20 bytes. There is no place left for the terminating \0, (gdb) ptype dev type = struct mdinfo { mdu_array_info_t array; mdu_disk_info_t disk; __u64 events; int uuid[4]; char name[33]; long long unsigned int data_offset; long long unsigned int new_data_offset; long long unsigned int component_size; long long unsigned int custom_array_size; int reshape_active; long long unsigned int reshape_progress; int recovery_blocked; long long unsigned int space_before; long long unsigned int space_after; union { long long unsigned int resync_start; long long unsigned int recovery_start; }; long int bitmap_offset; long unsigned int safe_mode_delay; int new_level; int delta_disks; int new_layout; int new_chunk; int errors; long unsigned int cache_size; int mismatch_cnt; char text_version[50]; int container_member; int container_enough; char sys_name[20]; <--- 20 . struct mdinfo *devs; struct mdinfo *next; int recovery_fd; int state_fd; int prev_state; int curr_state; int next_state; } * (gdb) The patch increases the size of sys_name[] to 32 bytes to match the size of other device name arrays in the mdadm codebase. A customer reported this issue in SFDC case 01621749. Thanks, nikhil. --------------050006060209040006040905 Content-Type: text/x-patch; name="0001-Fix-for-bz-1343809.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0001-Fix-for-bz-1343809.patch" >From 2c3b5692f8c5933e8746305f589efa4edcc00f3c Mon Sep 17 00:00:00 2001 From: Nikhil Kshirsagar Date: Fri, 10 Jun 2016 08:50:10 +0530 Subject: [PATCH] Fix for bz 1343809. The sys_name array in the mdinfo structure is 20 bytes of storage. Increasing the size of this array to 32 bytes. --- mdadm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdadm.h b/mdadm.h index b597658..eb2333a 100644 --- a/mdadm.h +++ b/mdadm.h @@ -235,7 +235,7 @@ struct mdinfo { int container_enough; /* flag external handlers can set to * indicate that subarrays have not enough (-1), * enough to start (0), or all expected disks (1) */ - char sys_name[20]; + char sys_name[32]; struct mdinfo *devs; struct mdinfo *next; -- 1.8.3.1 --------------050006060209040006040905--