Bug 24677

Summary: "mdconfig -t vnode -f floppy.bin" seg fault's
Product: Base System Reporter: sydney13 <sydney13>
Component: binAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 5.0-CURRENT   
Hardware: Any   
OS: Any   

Description sydney13 2001-01-27 12:40:02 UTC
mdconfig seg fault's when called with "-t vnode -f someflp.bin"

# file floppy.bin
floppy.bin: x86 boot sector, system MSDOS5.0, FAT (12 bit)

# /tmp/mdconfig/mdconfig -a -t vnode -f floppy.bin -u 0
Segmentation fault (core dumped)

# gdb -core mdconfig.core /tmp/mdconfig/mdconfig
GNU gdb 4.18
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...
Core was generated by `mdconfig'.
Program terminated with signal 11, Segmentation fault.
#0  0x8048c52 in strncpy (dst=0x0, src=0xbfbffcda "floppy.bin", n=3)
    at /usr/src/lib/libc/../libc/string/strncpy.c:59
59				if ((*d++ = *s++) == 0) {
(gdb) bt
#0  0x8048c52 in strncpy (dst=0x0, src=0xbfbffcda "floppy.bin", n=3)
    at /usr/src/lib/libc/../libc/string/strncpy.c:59
#1  0x80483e0 in main (argc=8, argv=0xbfbffbb0) at mdconfig.c:87
#2  0x8048135 in _start ()
(gdb) quit

How-To-Repeat: Use the FreeBSD boot floppy image (or any other) and do:

mdconfig -a -t vnode -f boot.flp -u 0
Comment 1 dima 2001-01-27 19:34:59 UTC
> 
> >Number:         24677
> >Category:       bin
> >Synopsis:       "mdconfig -t vnode -f floppy.bin" seg fault's
> >How-To-Repeat:
> Use the FreeBSD boot floppy image (or any other) and do:
> 
> mdconfig -a -t vnode -f boot.flp -u 0

I was just going to mail a fix for this to -current or -hackers.  It's
attached below if you want to test it.

The problem is that mdconfig thinks md_file in struct mdioctl is an
array while it's really a pointer.

					Dima Dorfman
					dima@unixfreak.org

> >Fix:

Index: mdconfig.c
===================================================================
RCS file: /st/src/FreeBSD/src/sbin/mdconfig/mdconfig.c,v
retrieving revision 1.4
diff -u -r1.4 mdconfig.c
--- mdconfig.c	2001/01/01 23:08:20	1.4
+++ mdconfig.c	2001/01/27 19:32:40
@@ -84,7 +84,7 @@
 		case 'f':
 			if (cmdline != 2)
 				usage();
-			strncpy(mdio.md_file, optarg, sizeof(mdio.md_file) - 1);
+			mdio.md_file = optarg;
 			break;
 		case 'o':
 			if (cmdline != 2)
Comment 2 Poul-Henning Kamp 2001-01-28 18:03:09 UTC
>>Synopsis:       "mdconfig -t vnode -f floppy.bin" seg fault's

Your mdconfig and kernel are out of sync.  Make sure to build world
or at least includes.

--
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.
Comment 3 Poul-Henning Kamp freebsd_committer freebsd_triage 2001-01-29 06:12:25 UTC
State Changed
From-To: open->closed

fixed.