[v4,1/2] Mdmonitor: Fix segfault

Commit Message

Kinga Tanska June 6, 2022, 10:32 a.m. UTC

Mdadm with "--monitor" parameter requires md device
as an argument to be monitored. If given argument is
not a md device, error shall be returned. Previously
it was not checked and invalid argument caused
segmentation fault. This commit adds checking
that devices passed to mdmonitor are md devices.

Signed-off-by: Kinga Tanska <[e-mail]>
---
 Monitor.c | 10 +++++++++-
 mdadm.h   |  1 +
 mdopen.c  | 17 +++++++++++++++++
 3 files changed, 27 insertions(+), 1 deletion(-)

Comments

Jes Sorensen June 14, 2022, 2:37 p.m. UTC | #1

On 6/6/22 06:32, Kinga Tanska wrote:
> Mdadm with "--monitor" parameter requires md device
> as an argument to be monitored. If given argument is
> not a md device, error shall be returned. Previously
> it was not checked and invalid argument caused
> segmentation fault. This commit adds checking
> that devices passed to mdmonitor are md devices.
> 
> Signed-off-by: Kinga Tanska <[e-mail]>
> ---
>  Monitor.c | 10 +++++++++-
>  mdadm.h   |  1 +
>  mdopen.c  | 17 +++++++++++++++++
>  3 files changed, 27 insertions(+), 1 deletion(-)
> 

Applied!

Thanks,
Jes

Patch

diff --git a/Monitor.c b/Monitor.c
index f5412299..3d0c147a 100644
--- a/Monitor.c
+++ b/Monitor.c
@@ -183,6 +183,7 @@  int Monitor(struct mddev_dev *devlist,
 				continue;
 			if (strcasecmp(mdlist->devname, "<ignore>") == 0)
 				continue;
+
 			st = xcalloc(1, sizeof *st);
 			if (mdlist->devname[0] == '/')
 				st->devname = xstrdup(mdlist->devname);
@@ -191,6 +192,8 @@  int Monitor(struct mddev_dev *devlist,
 				strcpy(strcpy(st->devname, "/dev/md/"),
 				       mdlist->devname);
 			}
+			if (!is_mddev(mdlist->devname))
+				return 1;
 			st->next = statelist;
 			st->devnm[0] = 0;
 			st->percent = RESYNC_UNKNOWN;
@@ -204,7 +207,12 @@  int Monitor(struct mddev_dev *devlist,
 		struct mddev_dev *dv;
 
 		for (dv = devlist; dv; dv = dv->next) {
-			struct state *st = xcalloc(1, sizeof *st);
+			struct state *st;
+
+			if (!is_mddev(dv->devname))
+				return 1;
+
+			st = xcalloc(1, sizeof *st);
 			mdlist = conf_get_ident(dv->devname);
 			st->devname = xstrdup(dv->devname);
 			st->next = statelist;
diff --git a/mdadm.h b/mdadm.h
index 8f8841d8..03151c34 100644
--- a/mdadm.h
+++ b/mdadm.h
@@ -1607,6 +1607,7 @@  extern int create_mddev(char *dev, char *name, int autof, int trustworthy,
 #define	FOREIGN	2
 #define	METADATA 3
 extern int open_mddev(char *dev, int report_errors);
+extern int is_mddev(char *dev);
 extern int open_container(int fd);
 extern int metadata_container_matches(char *metadata, char *devnm);
 extern int metadata_subdev_matches(char *metadata, char *devnm);
diff --git a/mdopen.c b/mdopen.c
index 245be537..d18c9319 100644
--- a/mdopen.c
+++ b/mdopen.c
@@ -475,6 +475,23 @@  int open_mddev(char *dev, int report_errors)
 	return mdfd;
 }
 
+/**
+ * is_mddev() - check that file name passed is an md device.
+ * @dev: file name that has to be checked.
+ * Return: 1 if file passed is an md device, 0 if not.
+ */
+int is_mddev(char *dev)
+{
+	int fd = open_mddev(dev, 1);
+
+	if (fd >= 0) {
+		close(fd);
+		return 1;
+	}
+
+	return 0;
+}
+
 char *find_free_devnm(int use_partitions)
 {
 	static char devnm[32];