Debian Bug report logs - #444682
mdadm segfault at super1.c:100 on amd64

version graph

Package: mdadm; Maintainer for mdadm is (unknown); Source for mdadm is src:mdadm (PTS, buildd, popcon).

Reported by: Daniel van Eeden <daniel_e@dds.nl>

Date: Sun, 30 Sep 2007 10:30:02 UTC

Severity: critical

Tags: help

Found in version mdadm/2.6.3+200709292116+4450e59-1

Fixed in version mdadm/2.6.3+200709292116+4450e59-2

Done: madduck@debian.org (martin f. krafft)

Bug is archived. No further changes may be made.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>:
Bug#444682; Package mdadm. (full text, mbox, link).


Acknowledgement sent to Daniel van Eeden <daniel_e@dds.nl>:
New Bug report received and forwarded. Copy sent to Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>. (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Daniel van Eeden <daniel_e@dds.nl>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: mdadm segfault at super1.c:1004
Date: Sun, 30 Sep 2007 12:25:42 +0200
Package: mdadm
Version: 2.6.3+200709292116+4450e59-1
Severity: critical
Justification: breaks the whole system

Subject: mdadm dumps core (super1.c:1004)
Package: mdadm
Version: 2.6.3+200709292116+4450e59-1
Severity: critical
Justification: breaks the whole system

Today I installed a package update for mdadm.

Setting up mdadm (2.6.3+200709292116+4450e59-1) ...
Installing new version of config file /etc/init.d/mdadm-raid ...
Installing new version of config file /etc/init.d/mdadm ...
Installing new version of config file /etc/cron.d/mdadm ...
update-initramfs: Generating /boot/initrd.img-2.6.22-2-amd64
W: mdadm: unchecked configuration file: /etc/mdadm/mdadm.conf
W: mdadm: please read /usr/share/doc/mdadm/README.upgrading-2.5.3.gz .
/usr/share/mdadm/mkconf: line 98: 11858 Segmentation fault      (core
dumped) $MDADM --examine --scan --config=partitions
W: mkconf: failed to scan for partitions.
W: mdadm: failed to auto-generate temporary mdadm.conf file.
W: mdadm: using the unchecked file and hoping for the best...
Warning: LBA32 addressing assumed
Added Linux *
Skipping /vmlinuz.old
One warning was issued.
Starting MD monitoring service: mdadm --monitor.
Generating udev events for MD arrays...done.

This could cause an unbootable system in case of rootfs on a mirror and
a faulty mdadm.conf. This is not my situation, but this is why i filed
a critical bugreport.

I did a rebuild to get a backtrace w/ symbols:
export DEB_BUILD_OPTIONS=nostrip
apt-get source -b mdadm
dpkg -i mdadm_2.6.3+200709292116+4450e59-1_amd64.deb

-- Package-specific info:
--- mount output
/dev/ide/host0/bus0/target1/lun0/part3 on / type xfs (rw)
tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw,mode=0755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=620)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
/dev/ide/host0/bus0/target1/lun0/part4 on /home type xfs (rw)
/dev/md/0 on /data type xfs (rw)
nfsd on /proc/fs/nfsd type nfsd (rw)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
/dev/scsi/host4/bus0/target0/lun0/part1 on /data/backup type xfs (rw)
rpc_pipefs on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
/dev/ide/host0/bus1/target1/lun0/cd on /media/Debian 4.0 r0 i386 Bin-1 type iso9660 (ro,nosuid,nodev,uid=1000)

--- mdadm.conf
DEVICE /dev/hdb1 /dev/hda1
ARRAY /dev/md0 devices=/dev/hdb1,/dev/hda1
MAILADDR root

--- /proc/mdstat:
Personalities : [raid1] 
md0 : active raid1 hda1[0] hdb1[1]
      195358336 blocks [2/2] [UU]
      
unused devices: <none>

--- /proc/partitions:
major minor  #blocks  name

   3     0  199148544 hda
   3     1  195358401 hda1
   3    64  293057352 hdb
   3    65  195358401 hdb1
   3    66    1004062 hdb2
   3    67    7823655 hdb3
   3    68   40925587 hdb4
   9     0  195358336 md0
   8     0  488386584 sda
   8     1  488384001 sda1
   8    16     508928 sdb

--- initrd.img-2.6.22-2-amd64:
34991 blocks
etc/mdadm
etc/mdadm/mdadm.conf
lib/modules/2.6.22-2-amd64/kernel/drivers/md/md-mod.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/linear.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/multipath.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/raid0.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/raid1.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/xor.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/raid456.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/raid10.ko
sbin/mdadm
scripts/local-top/mdadm

--- /proc/modules:
dm_snapshot 21320 0 - Live 0xffffffff883b5000
dm_mirror 26240 0 - Live 0xffffffff883ad000
dm_mod 64112 2 dm_snapshot,dm_mirror, Live 0xffffffff8839c000
raid1 27520 1 - Live 0xffffffff88105000
md_mod 83996 3 raid1, Live 0xffffffff880ef000

--- /var/log/syslog:

--- volume detail:

--- /proc/cmdline
BOOT_IMAGE=Linux ro root=343 console=tty0

--- grub:
kernel		/boot/vmlinuz root=/dev/hdb3 ro 
kernel		/boot/vmlinuz root=/dev/hdb3 ro single
kernel		/boot/vmlinuz.old root=/dev/hdb3 ro 
kernel		/boot/vmlinuz.old root=/dev/hdb3 ro single
kernel		/boot/vmlinuz-2.6.20-1-amd64 root=/dev/hdb3 ro 
kernel		/boot/vmlinuz-2.6.20-1-amd64 root=/dev/hdb3 ro single
kernel		/boot/vmlinuz-2.6.18-4-amd64 root=/dev/hdb3 ro 
kernel		/boot/vmlinuz-2.6.18-4-amd64 root=/dev/hdb3 ro single

--- lilo:
root=/dev/hdb3


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.22-2-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.utf8)
Shell: /bin/sh linked to /bin/bash

Versions of packages mdadm depends on:
ii  debconf [debconf-2.0]         1.5.14     Debian configuration management sy
ii  libc6                         2.6.1-5    GNU C Library: Shared libraries
ii  lsb-base                      3.1-24     Linux Standard Base 3.1 init scrip
ii  makedev                       2.3.1-84   creates device files in /dev
ii  udev                          0.114-2    /dev/ and hotplug management daemo

Versions of packages mdadm recommends:
ii  exim4-daemon-light [mail-tra 4.67-8      lightweight Exim MTA (v4) daemon
ii  module-init-tools            3.3-pre11-4 tools for managing Linux kernel mo

-- debconf information:
* mdadm/initrdstart: all
  mdadm/initrdstart_msg_errexist:
* mdadm/warning:
* mdadm/start_daemon: true
* mdadm/mail_to: root
  mdadm/initrdstart_msg_errmd:
* mdadm/autocheck: true
* mdadm/autostart: true
  mdadm/initrdstart_notinconf: false
  mdadm/initrdstart_msg_intro:
  mdadm/initrdstart_msg_errblock:
  mdadm/initrdstart_msg_errconf:

-- Package-specific info:
--- mount output
/dev/ide/host0/bus0/target1/lun0/part3 on / type xfs (rw)
tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw,mode=0755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=620)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
/dev/ide/host0/bus0/target1/lun0/part4 on /home type xfs (rw)
/dev/md/0 on /data type xfs (rw)
nfsd on /proc/fs/nfsd type nfsd (rw)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
/dev/scsi/host4/bus0/target0/lun0/part1 on /data/backup type xfs (rw)
rpc_pipefs on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
/dev/ide/host0/bus1/target1/lun0/cd on /media/Debian 4.0 r0 i386 Bin-1 type iso9660 (ro,nosuid,nodev,uid=1000)

--- mdadm.conf
DEVICE /dev/hdb1 /dev/hda1
ARRAY /dev/md0 devices=/dev/hdb1,/dev/hda1
MAILADDR root

--- /proc/mdstat:
Personalities : [raid1] 
md0 : active raid1 hda1[0] hdb1[1]
      195358336 blocks [2/2] [UU]
      
unused devices: <none>

--- /proc/partitions:
major minor  #blocks  name

   3     0  199148544 hda
   3     1  195358401 hda1
   3    64  293057352 hdb
   3    65  195358401 hdb1
   3    66    1004062 hdb2
   3    67    7823655 hdb3
   3    68   40925587 hdb4
   9     0  195358336 md0
   8     0  488386584 sda
   8     1  488384001 sda1
   8    16     508928 sdb

--- initrd.img-2.6.22-2-amd64:
34991 blocks
etc/mdadm
etc/mdadm/mdadm.conf
lib/modules/2.6.22-2-amd64/kernel/drivers/md/md-mod.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/linear.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/multipath.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/raid0.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/raid1.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/xor.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/raid456.ko
lib/modules/2.6.22-2-amd64/kernel/drivers/md/raid10.ko
sbin/mdadm
scripts/local-top/mdadm

--- /proc/modules:
dm_snapshot 21320 0 - Live 0xffffffff883b5000
dm_mirror 26240 0 - Live 0xffffffff883ad000
dm_mod 64112 2 dm_snapshot,dm_mirror, Live 0xffffffff8839c000
raid1 27520 1 - Live 0xffffffff88105000
md_mod 83996 3 raid1, Live 0xffffffff880ef000

--- /var/log/syslog:

--- volume detail:

--- /proc/cmdline
BOOT_IMAGE=Linux ro root=343 console=tty0

--- grub:
kernel		/boot/vmlinuz root=/dev/hdb3 ro 
kernel		/boot/vmlinuz root=/dev/hdb3 ro single
kernel		/boot/vmlinuz.old root=/dev/hdb3 ro 
kernel		/boot/vmlinuz.old root=/dev/hdb3 ro single
kernel		/boot/vmlinuz-2.6.20-1-amd64 root=/dev/hdb3 ro 
kernel		/boot/vmlinuz-2.6.20-1-amd64 root=/dev/hdb3 ro single
kernel		/boot/vmlinuz-2.6.18-4-amd64 root=/dev/hdb3 ro 
kernel		/boot/vmlinuz-2.6.18-4-amd64 root=/dev/hdb3 ro single

--- lilo:
root=/dev/hdb3


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.22-2-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.utf8)
Shell: /bin/sh linked to /bin/bash

Versions of packages mdadm depends on:
ii  debconf [debconf-2.0]         1.5.14     Debian configuration management sy
ii  libc6                         2.6.1-5    GNU C Library: Shared libraries
ii  lsb-base                      3.1-24     Linux Standard Base 3.1 init scrip
ii  makedev                       2.3.1-84   creates device files in /dev
ii  udev                          0.114-2    /dev/ and hotplug management daemo

Versions of packages mdadm recommends:
ii  exim4-daemon-light [mail-tra 4.67-8      lightweight Exim MTA (v4) daemon
ii  module-init-tools            3.3-pre11-4 tools for managing Linux kernel mo

-- debconf information excluded





Information forwarded to debian-bugs-dist@lists.debian.org, Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>:
Bug#444682; Package mdadm. (full text, mbox, link).


Acknowledgement sent to Daniel van Eeden <daniel.van.eeden@myname.nl>:
Extra info received and forwarded to list. Copy sent to Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>. (full text, mbox, link).


Message #10 received at 444682@bugs.debian.org (full text, mbox, reply):

From: Daniel van Eeden <daniel.van.eeden@myname.nl>
To: 444682@bugs.debian.org
Subject: backtrace
Date: Sun, 30 Sep 2007 12:34:57 +0200
GNU gdb 6.6.90.20070912-debian
Copyright (C) 2007 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
Using host libthread_db library "/lib/libthread_db.so.1".
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux-x86-64.so.2...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Core was generated by `/sbin/mdadm --examine --scan --config=partitions'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000418290 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
1004                            switch(load_super1(st, fd, sbp, devname)) {
(gdb) bt
#0  0x0000000000418290 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#1  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#2  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#3  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#4  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#5  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#6  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#7  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#8  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#9  0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004
#10 0x0000000000418295 in load_super1 (st=0x630af0, fd=4, sbp=0x7fff43639c38, 
    devname=0x0) at super1.c:1004






Information forwarded to debian-bugs-dist@lists.debian.org, Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>:
Bug#444682; Package mdadm. (full text, mbox, link).


Message #13 received at 444682@bugs.debian.org (full text, mbox, reply):

From: martin f krafft <madduck@debian.org>
To: Daniel van Eeden <daniel_e@dds.nl>, 444682@bugs.debian.org
Cc: debian developers <debian-devel@lists.debian.org>
Subject: Re: Bug#444682: mdadm segfault at super1.c:1004
Date: Sun, 30 Sep 2007 12:34:56 +0100
[Message part 1 (text/plain, inline)]
retitle 444682 mdadm segfault at super1.c:100 on amd64
tags 444682 help
thanks

also sprach Daniel van Eeden <daniel_e@dds.nl> [2007.09.30.1125 +0100]:
> Package: mdadm
> Version: 2.6.3+200709292116+4450e59-1
> Severity: critical
> Justification: breaks the whole system

Lovely. This is exactly why I sent
  http://lists.debian.org/debian-devel/2007/09/msg00712.html

Oh well, I think this is an amd64-specific problem. Daniel, are you
around today to debug this? Or anyone else with amd64? I don't have
an amd64 machine around to test this for another three weeks, so I'd
really appreciate if someone else stepped in.

A version of the binary with debugging symbols is available here:

  http://scratch.madduck.net/debian__pkg__mdadm__mdadm__mdadm
  size:416964 md5:e2744a35914946efb3e839f092cc7b9d

Or even better, git the code:

  apt-get install git-core
  git clone git://git.debian.org/git/pkg-mdadm/mdadm
  cd mdadm
  git checkout -b $LOGNAME-debug-segv
  make
  // while segv
  gdb mdadm ...
  // edit file
  // git add file
  // git commit -m'log message'
  // done

When you're done, you can submit a patch easily:

  git checkout -b temp-squash master
  git merge --squash $LOGNAME-debug-segv
  git commit // ... remove the "Squashed commit of the following:" leader
  git format-patch -M -s master
  // now inspect the files this created in $PWD
  // when you're ready to submit, do:
  git send-email --to your@email.address 
  // check that it's okay when it arrives
  git send-email --to pkg-mdadm-devel@lists.alioth.debian.org 

Thanks!

-- 
 .''`.   martin f. krafft <madduck@debian.org>
: :'  :  proud Debian developer, author, administrator, and user
`. `'`   http://people.debian.org/~madduck - http://debiansystem.info
  `-  Debian - when you have better things to do than fixing systems
[digital_signature_gpg.asc (application/pgp-signature, inline)]

Changed Bug title to `mdadm segfault at super1.c:100 on amd64' from `mdadm segfault at super1.c:1004'. Request was from martin f krafft <madduck@debian.org> to control@bugs.debian.org. (Sun, 30 Sep 2007 11:39:31 GMT) (full text, mbox, link).


Tags added: help Request was from martin f krafft <madduck@debian.org> to control@bugs.debian.org. (Sun, 30 Sep 2007 11:39:33 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>:
Bug#444682; Package mdadm. (full text, mbox, link).


Message #20 received at 444682@bugs.debian.org (full text, mbox, reply):

From: martin f krafft <madduck@debian.org>
To: Daniel van Eeden <daniel_e@dds.nl>, 444682@bugs.debian.org
Subject: Re: Bug#444682: mdadm segfault at super1.c:1004
Date: Sun, 30 Sep 2007 12:39:40 +0100
[Message part 1 (text/plain, inline)]
For reference: http://www.spinics.net/lists/raid/msg17007.html

-- 
 .''`.   martin f. krafft <madduck@debian.org>
: :'  :  proud Debian developer, author, administrator, and user
`. `'`   http://people.debian.org/~madduck - http://debiansystem.info
  `-  Debian - when you have better things to do than fixing systems
[digital_signature_gpg.asc (application/pgp-signature, inline)]

Message sent on to Daniel van Eeden <daniel_e@dds.nl>:
Bug#444682. (full text, mbox, link).


Message #23 received at 444682-submitter@bugs.debian.org (full text, mbox, reply):

From: "martin f. krafft" <madduck@debian.org>
To: linux-raid@vger.kernel.org
Cc: 444682-submitter@bugs.debian.org
Subject: [solved] Bug#444682: mdadm segfault at super1.c:1004
Date: Sun, 30 Sep 2007 13:22:55 +0100
also sprach martin f krafft <madduck@debian.org> [2007.09.30.1234 +0100]:
> Oh well, I think this is an amd64-specific problem. Daniel, are you
> around today to debug this? Or anyone else with amd64? I don't have
> an amd64 machine around to test this for another three weeks, so I'd
> really appreciate if someone else stepped in.

Okay, I did find one and I can reproduce. First thing to note:

#535 0x000000000041f07c in load_super1 (st=0x634030, fd=8, sbp=0x7fff9f4fefd0, 
    devname=0x0) at super1.c:1005
#536 0x000000000041f07c in load_super1 (st=0x634030, fd=8, sbp=0x7fff9f4fefd0, 
    devname=0x0) at super1.c:1005

load_super1 apparently recurses infinitely. Looking at the code:

  static int load_super1(struct supertype *st, int fd, void **sbp, char *devname)
  {
          unsigned long long dsize;
          unsigned long long sb_offset;
          struct mdp_superblock_1 *super;
          int uuid[4];
          struct bitmap_super_s *bsb;
          struct misc_dev_info *misc;

          if (st->ss == NULL || st->minor_version == -1) {
                  int bestvers = -1;
                  struct supertype tst;
                  __u64 bestctime = 0;
                  /* guess... choose latest ctime */
                  tst.ss = &super1;
                  for (tst.minor_version = 0; tst.minor_version <= 2 ; tst.minor_version++) {
                          switch(load_super1(st, fd, sbp, devname)) {

I can't help but note that there is no way to break out of this
loop if (st->ss == NULL || st->minor_version == -1) is true when
it's called the first time.

So it turns out that I think Neil simply forgot to replace the first
argument by &tst in commit a40b4fe, as the forthcoming patch does.

-- 
 .''`.   martin f. krafft <madduck@debian.org>
: :'  :  proud Debian developer, author, administrator, and user
`. `'`   http://people.debian.org/~madduck - http://debiansystem.info
  `-  Debian - when you have better things to do than fixing systems
 
because light travels faster than sound,
some people appear to be intelligent,
until you hear them speak.




Message sent on to Daniel van Eeden <daniel_e@dds.nl>:
Bug#444682. (full text, mbox, link).


Message #26 received at 444682-submitter@bugs.debian.org (full text, mbox, reply):

From: "martin f. krafft" <madduck@debian.org>
To: linux-raid@vger.kernel.org
Cc: 444682-submitter@bugs.debian.org, "martin f. krafft" <madduck@debian.org>
Subject: [PATCH] Fix segfault on assembly on amd64 with v1 superblocks
Date: Sun, 30 Sep 2007 13:22:56 +0100
Commit a40b4fe introduced a temporary supertype variable tst, instead of
manipulating st directly. However, it was forgotton to pass &tst into the
recursive load_super1 call, causing an infinite recursion.

Signed-off-by: martin f. krafft <madduck@debian.org>
---
 super1.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/super1.c b/super1.c
index 52783e7..06c2655 100644
--- a/super1.c
+++ b/super1.c
@@ -1001,7 +1001,7 @@ static int load_super1(struct supertype *st, int fd, void **sbp, char *devname)
 		/* guess... choose latest ctime */
 		tst.ss = &super1;
 		for (tst.minor_version = 0; tst.minor_version <= 2 ; tst.minor_version++) {
-			switch(load_super1(st, fd, sbp, devname)) {
+			switch(load_super1(&tst, fd, sbp, devname)) {
 			case 0: super = *sbp;
 				if (bestvers == -1 ||
 				    bestctime < __le64_to_cpu(super->ctime)) {
-- 
1.5.3.1





Information stored:
Bug#444682; Package mdadm. (full text, mbox, link).


Acknowledgement sent to Daniel van Eeden <daniel.van.eeden@myname.nl>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #31 received at 444682-quiet@bugs.debian.org (full text, mbox, reply):

From: Daniel van Eeden <daniel.van.eeden@myname.nl>
To: "martin f. krafft" <madduck@debian.org>, 444682-quiet@bugs.debian.org
Cc: linux-raid@vger.kernel.org, 444682-submitter@bugs.debian.org
Subject: Re: Bug#444682: [PATCH] Fix segfault on assembly on amd64 with v1 superblocks
Date: Sun, 30 Sep 2007 14:43:01 +0200
I've tested this patch and it works :)

Daniel


On Sun, 2007-09-30 at 13:22 +0100, martin f. krafft wrote:
> Commit a40b4fe introduced a temporary supertype variable tst, instead of
> manipulating st directly. However, it was forgotton to pass &tst into the
> recursive load_super1 call, causing an infinite recursion.
> 
> Signed-off-by: martin f. krafft <madduck@debian.org>
> ---
>  super1.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/super1.c b/super1.c
> index 52783e7..06c2655 100644
> --- a/super1.c
> +++ b/super1.c
> @@ -1001,7 +1001,7 @@ static int load_super1(struct supertype *st, int fd, void **sbp, char *devname)
>  		/* guess... choose latest ctime */
>  		tst.ss = &super1;
>  		for (tst.minor_version = 0; tst.minor_version <= 2 ; tst.minor_version++) {
> -			switch(load_super1(st, fd, sbp, devname)) {
> +			switch(load_super1(&tst, fd, sbp, devname)) {
>  			case 0: super = *sbp;
>  				if (bestvers == -1 ||
>  				    bestctime < __le64_to_cpu(super->ctime)) {





Message sent on to Daniel van Eeden <daniel_e@dds.nl>:
Bug#444682. (full text, mbox, link).


Reply sent to madduck@debian.org (martin f. krafft):
You have taken responsibility. (full text, mbox, link).


Notification sent to Daniel van Eeden <daniel_e@dds.nl>:
Bug acknowledged by developer. (full text, mbox, link).


Message #39 received at 444682-close@bugs.debian.org (full text, mbox, reply):

From: madduck@debian.org (martin f. krafft)
To: 444682-close@bugs.debian.org
Subject: Bug#444682: fixed in mdadm 2.6.3+200709292116+4450e59-2
Date: Sun, 30 Sep 2007 13:47:05 +0000
Source: mdadm
Source-Version: 2.6.3+200709292116+4450e59-2

We believe that the bug you reported is fixed in the latest version of
mdadm, which is due to be installed in the Debian FTP archive:

mdadm-udeb_2.6.3+200709292116+4450e59-2_i386.udeb
  to pool/main/m/mdadm/mdadm-udeb_2.6.3+200709292116+4450e59-2_i386.udeb
mdadm_2.6.3+200709292116+4450e59-2.diff.gz
  to pool/main/m/mdadm/mdadm_2.6.3+200709292116+4450e59-2.diff.gz
mdadm_2.6.3+200709292116+4450e59-2.dsc
  to pool/main/m/mdadm/mdadm_2.6.3+200709292116+4450e59-2.dsc
mdadm_2.6.3+200709292116+4450e59-2_i386.deb
  to pool/main/m/mdadm/mdadm_2.6.3+200709292116+4450e59-2_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 444682@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
martin f. krafft <madduck@debian.org> (supplier of updated mdadm package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun, 30 Sep 2007 14:10:41 +0100
Source: mdadm
Binary: mdadm mdadm-udeb
Architecture: source i386
Version: 2.6.3+200709292116+4450e59-2
Distribution: unstable
Urgency: low
Maintainer: Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>
Changed-By: martin f. krafft <madduck@debian.org>
Description: 
 mdadm      - tool to administer Linux MD arrays (software RAID)
 mdadm-udeb - tool to administer Linux MD arrays (software RAID) (udeb)
Closes: 444682
Changes: 
 mdadm (2.6.3+200709292116+4450e59-2) unstable; urgency=low
 .
   * Patch the routine loading v1 superblocks to fix a segfault on amd64
     (closes: #444682).
Files: 
 cb2d067a341843544d4cccf68fe0a6bb 834 admin optional mdadm_2.6.3+200709292116+4450e59-2.dsc
 57aa357f58c1ca532c70c58e4bfada5d 117099 admin optional mdadm_2.6.3+200709292116+4450e59-2.diff.gz
 ed3f27268538184079aba1e737027129 249012 admin optional mdadm_2.6.3+200709292116+4450e59-2_i386.deb
 ef5acb5bd47a16a620c48206d3a2d92c 76628 debian-installer optional mdadm-udeb_2.6.3+200709292116+4450e59-2_i386.udeb
Package-Type: udeb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG/6G9IgvIgzMMSnURAkMtAKDAAeGbVjhlOgpGWdZid989mXy1WACeJT6a
zYn6t6Ub9xKmQeGIMe/R9FY=
=uX/t
-----END PGP SIGNATURE-----





Information stored:
Bug#444682; Package mdadm. (full text, mbox, link).


Acknowledgement sent to Jérémy Bobbio <lunar@debian.org>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #44 received at 444682-quiet@bugs.debian.org (full text, mbox, reply):

From: Jérémy Bobbio <lunar@debian.org>
To: "martin f. krafft" <madduck@debian.org>, 444682-quiet@bugs.debian.org
Subject: Re: Bug#444682: [PATCH] Fix segfault on assembly on amd64 with v1 superblocks
Date: Sun, 30 Sep 2007 22:40:59 +0200
[Message part 1 (text/plain, inline)]
Hi!

On Sun, Sep 30, 2007 at 01:22:56PM +0100, martin f. krafft wrote:
> Commit a40b4fe introduced a temporary supertype variable tst, instead of
> manipulating st directly. However, it was forgotton to pass &tst into the
> recursive load_super1 call, causing an infinite recursion.
> 
> Signed-off-by: martin f. krafft <madduck@debian.org>
> ---
>  super1.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/super1.c b/super1.c
> index 52783e7..06c2655 100644
> --- a/super1.c
> +++ b/super1.c
> @@ -1001,7 +1001,7 @@ static int load_super1(struct supertype *st, int fd, void **sbp, char *devname)
>  		/* guess... choose latest ctime */
>  		tst.ss = &super1;
>  		for (tst.minor_version = 0; tst.minor_version <= 2 ; tst.minor_version++) {
> -			switch(load_super1(st, fd, sbp, devname)) {
> +			switch(load_super1(&tst, fd, sbp, devname)) {
>  			case 0: super = *sbp;
>  				if (bestvers == -1 ||
>  				    bestctime < __le64_to_cpu(super->ctime)) {

I have independently tried to understand why the installer was not able
to create RAID devices anymore.  After digging the source code, I think
you have missing half of the fix:

--- mdadm-2.6.3+200709292116+4450e59.orig/super1.c
+++ mdadm-2.6.3+200709292116+4450e59/super1.c
@@ -1020,7 +1020,7 @@
			tst.minor_version = bestvers;
			tst.ss = &super1;
			tst.max_devs = 384;
-			rv = load_super1(st, fd, sbp, devname);
+			rv = load_super1(&tst, fd, sbp, devname);
			if (rv == 0)
				*st = tst;
			return rv;

As far as I can read, it will loop indefinetely as well, in in this
second call without the former change.

Anyway, thanks for promptly figuring out this issue. :)

Cheers,
-- 
Jérémy Bobbio                        .''`. 
lunar@debian.org                    : :Ⓐ  :  # apt-get install anarchism
                                    `. `'` 
                                      `-   
[signature.asc (application/pgp-signature, inline)]

Information stored:
Bug#444682; Package mdadm. (full text, mbox, link).


Message #47 received at 444682-quiet@bugs.debian.org (full text, mbox, reply):

From: martin f krafft <madduck@debian.org>
To: Jérémy Bobbio <lunar@debian.org>, 444682-quiet@bugs.debian.org
Subject: Re: Bug#444682: [PATCH] Fix segfault on assembly on amd64 with v1 superblocks
Date: Mon, 1 Oct 2007 16:18:33 +0100
[Message part 1 (text/plain, inline)]
also sprach Jérémy Bobbio <lunar@debian.org> [2007.09.30.2140 +0100]:
> --- mdadm-2.6.3+200709292116+4450e59.orig/super1.c
> +++ mdadm-2.6.3+200709292116+4450e59/super1.c
> @@ -1020,7 +1020,7 @@
> 			tst.minor_version = bestvers;
> 			tst.ss = &super1;
> 			tst.max_devs = 384;
> -			rv = load_super1(st, fd, sbp, devname);
> +			rv = load_super1(&tst, fd, sbp, devname);
> 			if (rv == 0)
> 				*st = tst;
> 			return rv;
> 
> As far as I can read, it will loop indefinetely as well, in in this
> second call without the former change.
> 
> Anyway, thanks for promptly figuring out this issue. :)

Many thanks, -3 is in preparation.

-- 
 .''`.   martin f. krafft <madduck@debian.org>
: :'  :  proud Debian developer, author, administrator, and user
`. `'`   http://people.debian.org/~madduck - http://debiansystem.info
  `-  Debian - when you have better things to do than fixing systems
[digital_signature_gpg.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>:
Bug#444682; Package mdadm. (full text, mbox, link).


Acknowledgement sent to Jan De Luyck <bugs_debian@kcore.org>:
Extra info received and forwarded to list. Copy sent to Debian mdadm maintainers <pkg-mdadm-devel@lists.alioth.debian.org>. (full text, mbox, link).


Message #52 received at 444682@bugs.debian.org (full text, mbox, reply):

From: Jan De Luyck <bugs_debian@kcore.org>
To: Debian Bug Tracking System <444682@bugs.debian.org>
Subject: -2 causes mdadm segfault (fixed in -3)
Date: Mon, 01 Oct 2007 20:31:13 +0200
Package: mdadm
Followup-For: Bug #444682


After upgrading to -2 of this package, I got the following during bootup 
(or when trying to activate md4, which is running on top of lvm)

md: md4 stopped.
mdadm[5176]: segfault at 00007fff9538cfe0 rip 00002b04151acd78 rsp 
00007fff9538cfa0 error 6

I confirm that -3 of this package fixes this problem.

-- Package-specific info:
--- /proc/mdstat:
Personalities : [raid1] 
md4 : active raid1 dm-0[0] sdc1[1]
      116117716 blocks super 1.0 [2/2] [UU]
      
md1 : active raid1 sdb5[1] sda10[0]
      4883648 blocks [2/2] [UU]
      
md2 : active raid1 sdb6[1] sda11[0]
      19534912 blocks [2/2] [UU]
      
md0 : active raid1 sdb2[1] sda9[0]
      9767424 blocks [2/2] [UU]
      
unused devices: <none>

--- /proc/partitions:
major minor  #blocks  name

   8     0  156290904 sda
   8     1   10480640 sda1
   8     2     979965 sda2
   8     3      32130 sda3
   8     4          1 sda4
   8     5     497983 sda5
   8     6     634536 sda6
   8     7    9767488 sda7
   8     8    4883728 sda8
   8     9    9767488 sda9
   8    10    4883728 sda10
   8    11   19535008 sda11
   8    12   94823631 sda12
   8    16  156290904 sdb
   8    17     979965 sdb1
   8    18    9767520 sdb2
   8    19          1 sdb3
   8    20   39110211 sdb4
   8    21    4883728 sdb5
   8    22   19535008 sdb6
   8    23    4996183 sdb7
   8    24   77015578 sdb8
   8    32  312571224 sdc
   8    33  116117788 sdc1
   8    34  196450852 sdc2
   8    48  312571224 sdd
   8    49  312568641 sdd1
   8    64  312571224 sde
   8    65   20480000 sde1
   8    66  292088832 sde2
   9     0    9767424 md0
   9     2   19534912 md2
   9     1    4883648 md1
 253     0  116121600 dm-0
   9     4  116117716 md4

--- initrd.img-2.6.22.9-cfs-v22:

--- /proc/modules:

--- volume detail:

--- /proc/cmdline
BOOT_IMAGE=Linux ro root=805

--- lilo:
lilo.conf file not readable.


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.22.9-cfs-v22 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=en_GB.ISO-8859-15, LC_CTYPE=en_GB.ISO-8859-15 (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Versions of packages mdadm depends on:
ii  debconf [debconf-2.0]         1.5.14     Debian configuration management sy
ii  libc6                         2.6.1-5    GNU C Library: Shared libraries
ii  lsb-base                      3.1-24     Linux Standard Base 3.1 init scrip
ii  makedev                       2.3.1-84   creates device files in /dev
ii  udev                          0.114-2    /dev/ and hotplug management daemo

Versions of packages mdadm recommends:
ii  exim4-daemon-light [mail-tra 4.67-8      lightweight Exim MTA (v4) daemon
ii  module-init-tools            3.3-pre11-4 tools for managing Linux kernel mo

-- debconf information:
  mdadm/autostart: true
* mdadm/initrdstart: all
  mdadm/initrdstart_notinconf: false
  mdadm/initrdstart_msg_errexist:
  mdadm/initrdstart_msg_intro:
  mdadm/initrdstart_msg_errblock:
  mdadm/warning:
  mdadm/start_daemon: true
  mdadm/mail_to: root
  mdadm/initrdstart_msg_errmd:
  mdadm/initrdstart_msg_errconf:
  mdadm/autocheck: true




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 30 Oct 2007 07:30:51 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Tue Aug 20 17:20:51 2024; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.