> 2023年2月27日 11:12，Li Xiao Keng <lixiaokeng@xxxxxxxxxx> 写道： > > When we create 100 partitions (major is 259 not 254) in a raid device, > mdadm may coredump: > > Core was generated by `/usr/sbin/mdadm --detail --export /dev/md1p7'. > Program terminated with signal SIGSEGV, Segmentation fault. > #0 __strlen_avx2_rtm () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74 > 74 VPCMPEQ (%rdi), %ymm0, %ymm1 > (gdb) bt > #0 __strlen_avx2_rtm () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74 > #1 0x00007fbb9a7e4139 in __strcpy_chk (dest=dest@entry=0x55d55d6a13ac "", src=0x0, destlen=destlen@entry=32) at strcpy_chk.c:28 > #2 0x000055d55ba1766d in strcpy (__src=<optimized out>, __dest=0x55d55d6a13ac "") at /usr/include/bits/string_fortified.h:79 > #3 super_by_fd (fd=fd@entry=3, subarrayp=subarrayp@entry=0x7fff44dfcc48) at util.c:1289 > #4 0x000055d55ba273a6 in Detail (dev=0x7fff44dfef0b "/dev/md1p7", c=0x7fff44dfe440) at Detail.c:101 > #5 0x000055d55ba0de61 in misc_list (c=<optimized out>, ss=<optimized out>, dump_directory=<optimized out>, ident=<optimized out>, devlist=<optimized out>) at mdadm.c:1959 > #6 main (argc=<optimized out>, argv=<optimized out>) at mdadm.c:1629 > > The direct cause is fd2devnm returning NULL, so add a check. > > Signed-off-by: Li Xiao Keng <lixiaokeng@xxxxxxxxxx> > Signed-off-by: Wu Guang Hao <wuguanghao3@xxxxxxxxxx> Acked-by: Coly Li <colyli@xxxxxxx <mailto:colyli@xxxxxxx>> Thanks. Coly Li > --- > V1->V2: When fd2devnm return NULL, super_by_fd return NULL but not an > incomplete 'st' entry. At the same time, add a check in map_by_devnm > to avoid coredump. > > V2->V3: Fix style issues. > V3->V4: Change strcpy() to strncpy(). > V4->V5: Move changelog to the location after '---' > > mapfile.c | 4 ++++ > util.c | 7 ++++++- > 2 files changed, 10 insertions(+), 1 deletion(-) > > diff --git a/mapfile.c b/mapfile.c > index 8d7acb3..f72fe0d 100644 > --- a/mapfile.c > +++ b/mapfile.c > @@ -292,6 +292,10 @@ struct map_ent *map_by_uuid(struct map_ent **map, int uuid[4]) > struct map_ent *map_by_devnm(struct map_ent **map, char *devnm) > { > struct map_ent *mp; > + > + if (!devnm) > + return NULL; > + > if (!*map) > map_read(map); > > diff --git a/util.c b/util.c > index 64dd409..3a84ee3 100644 > --- a/util.c > +++ b/util.c > @@ -1241,6 +1241,11 @@ struct supertype *super_by_fd(int fd, char **subarrayp) > int i; > char *subarray = NULL; > char container[32] = ""; > + char *devnm = NULL; > + > + devnm = fd2devnm(fd); > + if (!devnm) > + return NULL; > > sra = sysfs_read(fd, NULL, GET_VERSION); > > @@ -1286,7 +1291,7 @@ struct supertype *super_by_fd(int fd, char **subarrayp) > if (subarrayp) > *subarrayp = subarray; > strcpy(st->container_devnm, container); > - strcpy(st->devnm, fd2devnm(fd)); > + strncpy(st->devnm, devnm, MD_NAME_MAX - 1); > } else > free(subarray); > > -- > 1.8.3.1
