Package: mdadm
Version: 4.4-11
Severity: normal
On Debian GNU/Linux 13 (trixie), mdadm 4.4-11 crashes with SIGSEGV
during explicit read-only assembly of four DDF member devices.
Command:
mdadm --assemble --verbose --readonly /dev/md/ddf-recovery \
/dev/loop0 /dev/loop1 /dev/loop2 /dev/loop3
Output immediately before the crash:
mdadm: looking for devices for /dev/md/ddf-recovery
mdadm: /dev/loop0 is identified as a member of /dev/md/ddf-recovery, slot 0.
mdadm: /dev/loop1 is identified as a member of /dev/md/ddf-recovery, slot 1.
mdadm: /dev/loop2 is identified as a member of /dev/md/ddf-recovery, slot 7.
mdadm: /dev/loop3 is identified as a member of /dev/md/ddf-recovery, slot 2.
mdadm: ignoring /dev/loop3 as it reports /dev/loop0 as failed
The crash was reproduced under GDB:
#0 0x0000000000000000 in ?? ()
#1 Assemble (...) at ./Assemble.c:1773
#2 main (...) at ./mdadm.c:1436
The instruction immediately preceding the return address in frame #1:
mov (%rbx),%rax
call *0x78(%rax)
Offline inspection of the saved core confirms:
- $rax points to super_ddf.
- offsetof(struct superswitch, update_super) is 0x78.
- The supertype object passed to the callback uses super_ddf.
- super_ddf.update_super is NULL.
GDB output:
0x5555555f36d8 <super_ddf+120>: 0x0000000000000000
super_ddf in section .data of /usr/sbin/mdadm
The update_super field evaluates to:
(int (*)(struct supertype *, struct mdinfo *, enum update_opt,
char *, int, int, char *)) 0x0
Relevant context:
info.text_version = "ddf"
info.array.level = -100
c.readonly = 1
c.force = 0
c.scan = 0
Expected result:
Successful read-only assembly, or rejection with a diagnostic,
rather than a NULL callback invocation.
Actual result:
Assemble() calls the NULL super_ddf.update_super callback.
System:
Debian GNU/Linux 13 (trixie), DEBIAN_VERSION_FULL=13.7
mdadm package version: 4.4-11
Architecture: x86_64
Kernel: 7.2.6+deb13-amd64
Kernel package/build: Debian 7.2.6-1~bpo13+1 (2026-09-30)
This appears related to upstream PR #136, which describes an
unchecked ss->update_super callback in DDF assembly.
I have not verified whether that change was merged or included in
a subsequent release.
A symbolized backtrace and core dump are available locally.
The core is not attached because it may contain sensitive data.
Reproduction with a newer upstream release has not yet been tested.
-- System Information:
Debian Release: 13.7
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 7.2.6+deb13-amd64 (SMP w/32 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages mdadm depends on:
ii debconf [debconf-2.0] 1.5.91
ii libc6 2.41-12+deb13u4
ii libudev1 257.13-1~deb13u1
ii udev 257.13-1~deb13u1
Versions of packages mdadm recommends:
ii kmod 34.2-2
Versions of packages mdadm suggests:
ii postfix [mail-transport-agent] 3.10.13-0+deb13u1
