Array-info crash which used with "-l" option

[Daniël van Eeden]

Binary package hint: array-info

Array info version 0.15-1 on Ubuntu 8.04.02

# /usr/sbin/array-info -ld /dev/cciss/c0d1
*** glibc detected *** /usr/sbin/array-info: malloc(): memory corruption: 0x0000000000603050 ***
======= Backtrace: =========
/lib/libc.so.6[0x7fb3c52c5a14]
/lib/libc.so.6(__libc_malloc+0x90)[0x7fb3c52c7360]
/usr/sbin/array-info[0x401757]
/usr/lib/array-info/plugins/cciss_info.so(compaq_ctrl_infos+0x52)[0x7fb3c4c4a79e]
/usr/lib/array-info/plugins/cciss_info.so[0x7fb3c4c4a20e]
/usr/sbin/array-info[0x4011b0]
/usr/sbin/array-info[0x401603]
/lib/libc.so.6(__libc_start_main+0xf4)[0x7fb3c526f1c4]
/usr/sbin/array-info[0x400bf9]
======= Memory map: ========
00400000-00403000 r-xp 00000000 68:05 360455 /usr/sbin/array-info
00602000-00603000 rw-p 00002000 68:05 360455 /usr/sbin/array-info
00603000-00625000 rw-p 00603000 00:00 0 [heap]
7fb3c0000000-7fb3c0021000 rw-p 7fb3c0000000 00:00 0
7fb3c0021000-7fb3c4000000 ---p 7fb3c0021000 00:00 0
7fb3c4a3b000-7fb3c4a48000 r-xp 00000000 68:01 226213 /lib/libgcc_s.so.1
7fb3c4a48000-7fb3c4c48000 ---p 0000d000 68:01 226213 /lib/libgcc_s.so.1
7fb3c4c48000-7fb3c4c49000 rw-p 0000d000 68:01 226213 /lib/libgcc_s.so.1
7fb3c4c49000-7fb3c4c4c000 r-xp 00000000 68:05 196926 /usr/lib/array-info/plugins/cciss_info.so
7fb3c4c4c000-7fb3c4e4b000 ---p 00003000 68:05 196926 /usr/lib/array-info/plugins/cciss_info.so
7fb3c4e4b000-7fb3c4e4c000 rw-p 00002000 68:05 196926 /usr/lib/array-info/plugins/cciss_info.so
7fb3c4e4c000-7fb3c4e4e000 r-xp 00000000 68:05 196925 /usr/lib/array-info/plugins/md_info.so
7fb3c4e4e000-7fb3c504d000 ---p 00002000 68:05 196925 /usr/lib/array-info/plugins/md_info.so
7fb3c504d000-7fb3c504e000 rw-p 00001000 68:05 196925 /usr/lib/array-info/plugins/md_info.so
7fb3c504e000-7fb3c5050000 r-xp 00000000 68:05 196927 /usr/lib/array-info/plugins/ida_info.so
7fb3c5050000-7fb3c5250000 ---p 00002000 68:05 196927 /usr/lib/array-info/plugins/ida_info.so
7fb3c5250000-7fb3c5251000 rw-p 00002000 68:05 196927 /usr/lib/array-info/plugins/ida_info.so
7fb3c5251000-7fb3c53a9000 r-xp 00000000 68:01 226219 /lib/libc-2.7.so
7fb3c53a9000-7fb3c55a9000 ---p 00158000 68:01 226219 /lib/libc-2.7.so
7fb3c55a9000-7fb3c55ac000 r--p 00158000 68:01 226219 /lib/libc-2.7.so
7fb3c55ac000-7fb3c55ae000 rw-p 0015b000 68:01 226219 /lib/libc-2.7.so
7fb3c55ae000-7fb3c55b3000 rw-p 7fb3c55ae000 00:00 0
7fb3c55b3000-7fb3c55b5000 r-xp 00000000 68:01 226222 /lib/libdl-2.7.so
7fb3c55b5000-7fb3c57b5000 ---p 00002000 68:01 226222 /lib/libdl-2.7.so
7fb3c57b5000-7fb3c57b7000 rw-p 00002000 68:01 226222 /lib/libdl-2.7.so
7fb3c57b7000-7fb3c57d4000 r-xp 00000000 68:01 226216 /lib/ld-2.7.so
7fb3c59cb000-7fb3c59cd000 rw-p 7fb3c59cb000 00:00 0
7fb3c59d1000-7fb3c59d4000 rw-p 7fb3c59d1000 00:00 0
7fb3c59d4000-7fb3c59d6000 rw-p 0001d000 68:01 226216 /lib/ld-2.7.so
7fffcd9c1000-7fffcd9d6000 rw-p 7ffffffea000 00:00 0 [stack]
7fffcd9fe000-7fffcda00000 r-xp 7fffcd9fe000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Aborted

# gdb --args /usr/sbin/array-info -ld /dev/cciss/c0d1
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
(gdb) r
Starting program: /usr/sbin/array-info -ld /dev/cciss/c0d1
*** glibc detected *** /usr/sbin/array-info: malloc(): memory corruption: 0x0000000000603050 ***
======= Backtrace: =========
/lib/libc.so.6[0x7f5d371f7a14]
/lib/libc.so.6(__libc_malloc+0x90)[0x7f5d371f9360]
/usr/sbin/array-info[0x401757]
/usr/lib/array-info/plugins/cciss_info.so(compaq_ctrl_infos+0x52)[0x7f5d36b7c79e]
/usr/lib/array-info/plugins/cciss_info.so[0x7f5d36b7c20e]
/usr/sbin/array-info[0x4011b0]
/usr/sbin/array-info[0x401603]
/lib/libc.so.6(__libc_start_main+0xf4)[0x7f5d371a11c4]
/usr/sbin/array-info[0x400bf9]
======= Memory map: ========
00400000-00403000 r-xp 00000000 68:05 360455 /usr/sbin/array-info
00602000-00603000 rw-p 00002000 68:05 360455 /usr/sbin/array-info
00603000-00625000 rw-p 00603000 00:00 0 [heap]
7f5d30000000-7f5d30021000 rw-p 7f5d30000000 00:00 0
7f5d30021000-7f5d34000000 ---p 7f5d30021000 00:00 0
7f5d3696d000-7f5d3697a000 r-xp 00000000 68:01 226213 /lib/libgcc_s.so.1
7f5d3697a000-7f5d36b7a000 ---p 0000d000 68:01 226213 /lib/libgcc_s.so.1
7f5d36b7a000-7f5d36b7b000 rw-p 0000d000 68:01 226213 /lib/libgcc_s.so.1
7f5d36b7b000-7f5d36b7e000 r-xp 00000000 68:05 196926 /usr/lib/array-info/plugins/cciss_info.so
7f5d36b7e000-7f5d36d7d000 ---p 00003000 68:05 196926 /usr/lib/array-info/plugins/cciss_info.so
7f5d36d7d000-7f5d36d7e000 rw-p 00002000 68:05 196926 /usr/lib/array-info/plugins/cciss_info.so
7f5d36d7e000-7f5d36d80000 r-xp 00000000 68:05 196925 /usr/lib/array-info/plugins/md_info.so
7f5d36d80000-7f5d36f7f000 ---p 00002000 68:05 196925 /usr/lib/array-info/plugins/md_info.so
7f5d36f7f000-7f5d36f80000 rw-p 00001000 68:05 196925 /usr/lib/array-info/plugins/md_info.so
7f5d36f80000-7f5d36f82000 r-xp 00000000 68:05 196927 /usr/lib/array-info/plugins/ida_info.so
7f5d36f82000-7f5d37182000 ---p 00002000 68:05 196927 /usr/lib/array-info/plugins/ida_info.so
7f5d37182000-7f5d37183000 rw-p 00002000 68:05 196927 /usr/lib/array-info/plugins/ida_info.so
7f5d37183000-7f5d372db000 r-xp 00000000 68:01 226219 /lib/libc-2.7.so
7f5d372db000-7f5d374db000 ---p 00158000 68:01 226219 /lib/libc-2.7.so
7f5d374db000-7f5d374de000 r--p 00158000 68:01 226219 /lib/libc-2.7.so
7f5d374de000-7f5d374e0000 rw-p 0015b000 68:01 226219 /lib/libc-2.7.so
7f5d374e0000-7f5d374e5000 rw-p 7f5d374e0000 00:00 0
7f5d374e5000-7f5d374e7000 r-xp 00000000 68:01 226222 /lib/libdl-2.7.so
7f5d374e7000-7f5d376e7000 ---p 00002000 68:01 226222 /lib/libdl-2.7.so
7f5d376e7000-7f5d376e9000 rw-p 00002000 68:01 226222 /lib/libdl-2.7.so
7f5d376e9000-7f5d37706000 r-xp 00000000 68:01 226216 /lib/ld-2.7.so
7f5d378fd000-7f5d378ff000 rw-p 7f5d378fd000 00:00 0
7f5d37903000-7f5d37906000 rw-p 7f5d37903000 00:00 0
7f5d37906000-7f5d37908000 rw-p 0001d000 68:01 226216 /lib/ld-2.7.so
7fff3f8f3000-7fff3f908000 rw-p 7ffffffea000 00:00 0 [stack]
7fff3f9fe000-7fff3fa00000 r-xp 7fff3f9fe000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

Program received signal SIGABRT, Aborted.
0x00007f5d371b5095 in raise () from /lib/libc.so.6
(gdb) bt full
#0 0x00007f5d371b5095 in raise () from /lib/libc.so.6
No symbol table info available.
#1 0x00007f5d371b6af0 in abort () from /lib/libc.so.6
No symbol table info available.
#2 0x00007f5d371efa7b in ?? () from /lib/libc.so.6
No symbol table info available.
#3 0x00007f5d371f7a14 in ?? () from /lib/libc.so.6
No symbol table info available.
#4 0x00007f5d371f9360 in malloc () from /lib/libc.so.6
No symbol table info available.
#5 0x0000000000401757 in array_add_infos (info=0x7fff3f906fd8, level=1 '\001', string=0x7f5d36b7cee8 "%s\n") at array_plugin_api.c:64
 ap = {{gp_offset = 808333824, fp_offset = 312, overflow_arg_area = 0x3234103c, reg_save_area = 0x0}}
 new = (array_infos_t *) 0x604f78
 final_str = 0x2 <Address 0x2 out of bounds>
 nb = 0
#6 0x00007f5d36b7c79e in compaq_ctrl_infos (ctrl=0x7f5d36d7d748, callbacks=0x7fff3f907050, query_flags=1 '\001', log_drive=1 '\001') at compaq_info.c:180
 compaq_infos = (array_infos_t *) 0x0
#7 0x00007f5d36b7c20e in cciss_ctrl_infos (data=0x7f5d36d7d740, callbacks=0x7fff3f907050) at cciss_info.c:170
 ctrl_data = (cciss_ctrl_data_t *) 0x7f5d36d7d740
 ctrl = (compaq_ctrl_t *) 0x7f5d36d7d748
#8 0x00000000004011b0 in array_dispatch (plugin_list=0x605260, array_data=0x603010) at array_plugin.c:181
 plugin = (array_plugin_t *) 0x7f5d36d7d460
 info = (array_infos_t *) 0x500604c40
 callbacks = {array_add_infos = 0x4016bd <array_add_infos>}
#9 0x0000000000401603 in main (argc=3, argv=0x7fff3f9071c8) at main.c:180
 query_flags = 1 '\001'
 dump_flags = 0 '\0'
 device_path = 0x7fff3f907a9f "/dev/cciss/c0d1"
 plugin_path = 0x401ac4 "/usr/lib/array-info/plugins"
 plugin_list = (array_plugin_list_t *) 0x605260
 array_data = (array_data_t *) 0x603010
 opt_ok = 1
 opt_sh_plugin = 0
 long_options = {{name = 0x401daa "device", has_arg = 1, flag = 0x0, val = 100}, {name = 0x401db1 "all-drives", has_arg = 0, flag = 0x0, val = 97}, {name = 0x401dbc "log-drive", has_arg = 0,
    flag = 0x0, val = 108}, {name = 0x401dc6 "show-all", has_arg = 0, flag = 0x0, val = 65}, {name = 0x401dcf "show-satus", has_arg = 0, flag = 0x0, val = 115}, {name = 0x401dda "show-ctrl", has_arg = 0,
    flag = 0x0, val = 99}, {name = 0x401de4 "show-log", has_arg = 0, flag = 0x0, val = 76}, {name = 0x401ded "plugin-path", has_arg = 1, flag = 0x0, val = 48}, {name = 0x401df9 "plugin-list", has_arg = 0,
    flag = 0x0, val = 49}, {name = 0x401e05 "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x401e0d "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
(gdb) info registers
rax 0x0 0
rbx 0x7fff3f9063c0 140734259815360
rcx 0xffffffffffffffff -1
rdx 0x6 6
rsi 0x56bc 22204
rdi 0x56bc 22204
rbp 0x7f5d378fd6e0 0x7f5d378fd6e0
rsp 0x7fff3f906318 0x7fff3f906318
r8 0x0 0
r9 0x7f5d372a15a0 140038334191008
r10 0x8 8
r11 0x246 582
r12 0x7 7
r13 0x7fff3f906640 140734259816000
r14 0x7fff3f9064e0 140734259815648
r15 0x7f5d372aac20 140038334229536
rip 0x7f5d371b5095 0x7f5d371b5095 <raise+53>
eflags 0x246 [ PF ZF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
(gdb) thread apply all backtrace
(gdb) quit
The program is running. Exit anyway? (y or n) y

[Daniël van Eeden (dveeden)]

Platform: x86_64
Kernel: 2.6.24-22-server
System: HP ProLiant DL380 G5

[Daniël van Eeden (dveeden)]

Valgrind output (logfile will be uploaded):

# G_SLICE=always-malloc G_DEBUG=gc-friendly valgrind -v --tool=memcheck --leak-check=full --num-callers=40 --log-file=/tmp/valgrind.log /usr/sbin/array-info -ld /dev/cciss/c0d1
Unknown Controller id 0x3234103c
 Firmware revision : 2.08
 Rom revision : 2.08
 2 logical drives configured.

 Logical drive 1 :
   Fault tolerance : RAID 1 (Mirroring)
   Size : 205.00 GiB (429925920 blocks of 512 bytes)
   Status : Logical drive is using interim recovery mode (100.00% done)

[Daniël van Eeden (dveeden)]

# ls -l /dev/cciss/
total 0
brw-rw---- 1 root disk 104, 0 Feb 3 14:20 c0d0
brw-rw---- 1 root disk 104, 1 Feb 3 14:20 c0d0p1
brw-rw---- 1 root disk 104, 2 Feb 3 14:20 c0d0p2
brw-rw---- 1 root disk 104, 3 Feb 3 14:20 c0d0p3
brw-rw---- 1 root disk 104, 5 Feb 3 14:20 c0d0p5
brw-rw---- 1 root disk 104, 6 Feb 3 14:21 c0d0p6
brw-rw---- 1 root disk 104, 7 Feb 3 14:21 c0d0p7
brw-rw---- 1 root disk 104, 8 Feb 3 14:21 c0d0p8
brw-rw---- 1 root disk 104, 16 Feb 3 14:20 c0d1
brw-rw---- 1 root disk 104, 17 Feb 3 14:20 c0d1p1

[Raphaël Pinson (raphink)]

I cannot reproduce this bug. On a DL 380G5 running Hardy Heron:

# array-info -l
array-info v0.13.0 by Benoit Gaussen (<email address hidden>)

Usage:
  array-info -d array_device_path [-a|-l|-A|-c|-s|-L|-h]

Options:
  --device=PATH -d path to array device
  --all-drives -a show informations about all drives
  --logical-drive -l show informations about selected logical drive
  --show-ctrl -c show informations about controller
  --show-logical -L show informations about logical drives
  --show-status -s show status of logical drives
  --show-all -A show all informations
  --plugin-path=PATH path to plugins directory (/usr/lib/array-info/plugins)
  --plugin-list show plugin list
  --version -V show version
  --help -h display this help message

(appart from the bug showing version 0.13.0 instead of 0.15.0, this is really a 0.15 version). Do you still experience this bug (very sorry for the huge time taken to answer this bug report) ?

[Raphaël Pinson (raphink)]

The kernel I'm using is 2.6.24-25-server.

[Raphaël Pinson (raphink)]

# /usr/sbin/array-info -ld /dev/cciss/c0d0
Unknown Controller id 0x3234103c
 Firmware revision : 5.20
 Rom revision : 5.20
 1 logical drive configured.

 Logical drive 0 :
   Fault tolerance : RAID 1 (Mirroring)
   Size : 136.70 GiB (286677120 blocks of 512 bytes)
   Status : Logical drive is ok