[Cluster-devel] gfs2-utils: mkfs segfault with 4.16 kernel

[Andrew Price]

On 04/05/18 14:01, Andrew Price wrote:
> On 04/05/18 13:01, Valentin Vidic wrote:
>> On Fri, May 04, 2018 at 12:07:01PM +0100, Andrew Price wrote:
>>> Hm curious. I *can* reproduce the same segfaults but only if I build 
>>> with
>>> the 4.15 header and then rebuild with the 4.16 header *without* first
>>> running ./configure. If I run ./configure the problem resolves itself.
>>
>> Thanks, I removed all traces of 4.15 from the system, did a clean
>> checkout of the repo and master does not segfault anymore :)
> 
> Ok good, we're on the same page :)
> 
>> I will try to fix 3.1.10 now...
> 
> I suspect you'll find the problem in gfs2/libgfs2/ondisk.h where 
> gfs2_rgrp_{in,out} copies the reserved data fields. As the field is 
> smaller in the new gfs2_ondisk.h, the copies could write past the end of 
> the struct into subsequent fields of the containing structure (the 
> rgrp_tree). We should probably use sizeof() there. Same with 
> gfs2_rindex_{in,out}.

Try this.

Andy

diff --git a/gfs2/libgfs2/ondisk.c b/gfs2/libgfs2/ondisk.c
index 66de2234..bf3c6638 100644
--- a/gfs2/libgfs2/ondisk.c
+++ b/gfs2/libgfs2/ondisk.c
@@ -189,7 +189,7 @@ void gfs2_rindex_in(struct gfs2_rindex *ri, char *buf)
         CPIN_64(ri, str, ri_data0);
         CPIN_32(ri, str, ri_data);
         CPIN_32(ri, str, ri_bitbytes);
-       CPIN_08(ri, str, ri_reserved, 64);
+       CPIN_08(ri, str, ri_reserved, sizeof(ri->ri_reserved));
  }

  void gfs2_rindex_out(const struct gfs2_rindex *ri, char *buf)
@@ -205,7 +205,7 @@ void gfs2_rindex_out(const struct gfs2_rindex *ri, 
char *buf)

         CPOUT_32(ri, str, ri_bitbytes);

-       CPOUT_08(ri, str, ri_reserved, 64);
+       CPOUT_08(ri, str, ri_reserved, sizeof(ri->ri_reserved));
  }

  void gfs2_rindex_print(const struct gfs2_rindex *ri)
@@ -228,7 +228,7 @@ void gfs2_rgrp_in(struct gfs2_rgrp *rg, struct 
gfs2_buffer_head *bh)
         CPIN_32(rg, str, rg_free);
         CPIN_32(rg, str, rg_dinodes);

-       CPIN_08(rg, str, rg_reserved, 80);
+       CPIN_08(rg, str, rg_reserved, sizeof(rg->rg_reserved));
  }

  void gfs2_rgrp_out(const struct gfs2_rgrp *rg, char *buf)
@@ -240,7 +240,7 @@ void gfs2_rgrp_out(const struct gfs2_rgrp *rg, char 
*buf)
         CPOUT_32(rg, str, rg_free);
         CPOUT_32(rg, str, rg_dinodes);

-       CPOUT_08(rg, str, rg_reserved, 80);
+       CPOUT_08(rg, str, rg_reserved, sizeof(rg->rg_reserved));
  }

  void gfs2_rgrp_out_bh(const struct gfs2_rgrp *rg, struct 
gfs2_buffer_head *bh)