Bug#498505: mdadm: mdadm segfaults on superblock detection

[Steinar H. Gunderson]

Package: mdadm
Version: 2.6.7-3
Severity: important
File: mdadm

Hi,

A friend of mine had a problem with a system that refused to boot properly
after losing power during a RAID-6 reshape. After some fiddling and newer
mdadm, we crashed into the problem that mdadm simply segfaulted on assemble.
The backtrace showed that it was crashing in match_home0, in memcmp(), since
st->sb was NULL.

I didn't debug it a lot further (I don't know the inner workings of mdadm; if
it helps, "st" was NULL on Assemble() entry), but simply giving the right
superblock type (0.90) on the command line made the RAID assemble and continue
reshaping, so I assume the bug is somehow in the superblock detection. FWIW,
here's a superblock from one of the disks before assembling:

/dev/sda1:
          Magic : a92b4efc
        Version : 00.91.00
           UUID : c568c44e:0c9c4ba5:c8cfeb02:e466cd1e
  Creation Time : Tue Jun 10 06:43:48 2008
     Raid Level : raid6
  Used Dev Size : 976759936 (931.51 GiB 1000.20 GB)
     Array Size : 2930279808 (2794.53 GiB 3000.61 GB)
   Raid Devices : 5
  Total Devices : 5
Preferred Minor : 6

  Reshape pos'n : 1276426944 (1217.30 GiB 1307.06 GB)
  Delta Devices : 1 (4->5)

    Update Time : Sat Sep  6 16:46:16 2008
          State : clean
 Active Devices : 5
Working Devices : 5
 Failed Devices : 0
  Spare Devices : 0
       Checksum : 8be433d0 - correct
         Events : 282948

     Chunk Size : 64K

      Number   Major   Minor   RaidDevice State
this     2       8        1        2      active sync   /dev/sda1

   0     0       8       17        0      active sync   /dev/sdb1
   1     1       8       49        1      active sync   /dev/sdd1
   2     2       8        1        2      active sync   /dev/sda1
   3     3       8       33        3      active sync   /dev/sdc1
   4     4       8       97        4      active sync   /dev/sdg1