* [PATCH] fsck.cramfs: Fix bus error on broken file system.
@ 2017-10-26 20:01 Tobias Stoeckmann
2017-10-27 5:47 ` Tobias Stoeckmann
0 siblings, 1 reply; 6+ messages in thread
From: Tobias Stoeckmann @ 2017-10-26 20:01 UTC (permalink / raw)
To: util-linux
The utility fsck.cramfs is prone to a bus error on file systems for
big endian systems with non-standard header sizes. While calculating
the crc32 checksum, it does not properly handle a possible offset
for bootcodes, resulting in out of boundary access of mmap'ed area.
You can trigger the issue with the following commands:
$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
---
disk-utils/fsck.cramfs.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/disk-utils/fsck.cramfs.c b/disk-utils/fsck.cramfs.c
index 50c7d33b9..3d0b9de58 100644
--- a/disk-utils/fsck.cramfs.c
+++ b/disk-utils/fsck.cramfs.c
@@ -219,24 +219,24 @@ static void test_crc(int start)
crc = crc32(0L, NULL, 0);
- buf =
- mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+ buf = mmap(NULL, start + super.size, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE, fd, 0);
if (buf == MAP_FAILED) {
- buf =
- mmap(NULL, super.size, PROT_READ | PROT_WRITE,
- MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ buf = mmap(NULL, start + super.size, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (buf != MAP_FAILED) {
- if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
+ if (lseek(fd, start, SEEK_SET) == (off_t) -1)
err(FSCK_EX_ERROR, _("seek on %s failed"), filename);
- if (read(fd, buf, super.size) != (ssize_t) super.size)
+ if (read(fd, (unsigned char *) buf + start, super.size) !=
+ (ssize_t) super.size)
err(FSCK_EX_ERROR, _("cannot read %s"), filename);
}
}
if (buf != MAP_FAILED) {
((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
crc32(0L, NULL, 0);
- crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
- munmap(buf, super.size);
+ crc = crc32(crc, (unsigned char *) buf + start, super.size);
+ munmap(buf, start + super.size);
} else {
int retval;
size_t length = 0;
--
2.14.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] fsck.cramfs: Fix bus error on broken file system.
2017-10-26 20:01 [PATCH] fsck.cramfs: Fix bus error on broken file system Tobias Stoeckmann
@ 2017-10-27 5:47 ` Tobias Stoeckmann
2017-10-30 10:43 ` Karel Zak
0 siblings, 1 reply; 6+ messages in thread
From: Tobias Stoeckmann @ 2017-10-27 5:47 UTC (permalink / raw)
To: util-linux
The utility fsck.cramfs is prone to a bus error on file systems for
big endian systems with non-standard header sizes. While calculating
the crc32 checksum, it does not properly handle a possible offset
for bootcodes, resulting in out of boundary access of mmap'ed area.
You can trigger the issue with the following commands:
$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
---
This is the second and much cleaner version of the initial patch.
We can easily use the offset of mmap, which heavily reduces the
manual buf + start calculation.
---
disk-utils/fsck.cramfs.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/disk-utils/fsck.cramfs.c b/disk-utils/fsck.cramfs.c
index 50c7d33b9..cafa659af 100644
--- a/disk-utils/fsck.cramfs.c
+++ b/disk-utils/fsck.cramfs.c
@@ -220,7 +220,7 @@ static void test_crc(int start)
crc = crc32(0L, NULL, 0);
buf =
- mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+ mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, start);
if (buf == MAP_FAILED) {
buf =
mmap(NULL, super.size, PROT_READ | PROT_WRITE,
@@ -233,9 +233,8 @@ static void test_crc(int start)
}
}
if (buf != MAP_FAILED) {
- ((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
- crc32(0L, NULL, 0);
- crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
+ ((struct cramfs_super *) buf)->fsid.crc = crc32(0L, NULL, 0);
+ crc = crc32(crc, buf, super.size);
munmap(buf, super.size);
} else {
int retval;
--
2.14.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] fsck.cramfs: Fix bus error on broken file system.
2017-10-27 5:47 ` Tobias Stoeckmann
@ 2017-10-30 10:43 ` Karel Zak
2017-10-30 12:47 ` Tobias Stoeckmann
2017-10-30 12:49 ` Tobias Stoeckmann
0 siblings, 2 replies; 6+ messages in thread
From: Karel Zak @ 2017-10-30 10:43 UTC (permalink / raw)
To: Tobias Stoeckmann; +Cc: util-linux
On Fri, Oct 27, 2017 at 07:47:43AM +0200, Tobias Stoeckmann wrote:
> The utility fsck.cramfs is prone to a bus error on file systems for
> big endian systems with non-standard header sizes. While calculating
> the crc32 checksum, it does not properly handle a possible offset
> for bootcodes, resulting in out of boundary access of mmap'ed area.
>
> You can trigger the issue with the following commands:
>
> $ mkdir -p cramfs-poc/root/subdir
> $ cd cramfs-poc
> $ mkfs.cramfs -p -N big root cramfs
> $ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
> $ fsck.cramfs cramfs
>
> Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
> ---
> This is the second and much cleaner version of the initial patch.
> We can easily use the offset of mmap, which heavily reduces the
> manual buf + start calculation.
> ---
> disk-utils/fsck.cramfs.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/disk-utils/fsck.cramfs.c b/disk-utils/fsck.cramfs.c
> index 50c7d33b9..cafa659af 100644
> --- a/disk-utils/fsck.cramfs.c
> +++ b/disk-utils/fsck.cramfs.c
> @@ -220,7 +220,7 @@ static void test_crc(int start)
> crc = crc32(0L, NULL, 0);
>
> buf =
> - mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
> + mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, start);
mmap() offset should be aligned to PAGE_SIZE. The function test_super()
is able to set "start" to PAD_SIZE (=512). It does not seem correct.
> if (buf == MAP_FAILED) {
> buf =
> mmap(NULL, super.size, PROT_READ | PROT_WRITE,
on failed mmap() it tries to use open+read to get "buf" and it reads
it from the begin of the file. It seems incompatible with mmap() now.
I guess we need seek(start) there too.
> @@ -233,9 +233,8 @@ static void test_crc(int start)
> }
> }
> if (buf != MAP_FAILED) {
> - ((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
> - crc32(0L, NULL, 0);
> - crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
> + ((struct cramfs_super *) buf)->fsid.crc = crc32(0L, NULL, 0);
> + crc = crc32(crc, buf, super.size);
> munmap(buf, super.size);
> } else {
> int retval;
Karel
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] fsck.cramfs: Fix bus error on broken file system.
2017-10-30 10:43 ` Karel Zak
@ 2017-10-30 12:47 ` Tobias Stoeckmann
2017-10-30 12:49 ` Tobias Stoeckmann
1 sibling, 0 replies; 6+ messages in thread
From: Tobias Stoeckmann @ 2017-10-30 12:47 UTC (permalink / raw)
To: Karel Zak; +Cc: util-linux
The utility fsck.cramfs is prone to a bus error on file systems for
big endian systems with non-standard header sizes. While calculating
the crc32 checksum, it does not properly handle a possible offset
for bootcodes, resulting in out of boundary access of mmap'ed area.
You can trigger the issue with the following commands:
$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
---
This version avoids mmap offset again and properly sets lseek offset.
---
disk-utils/fsck.cramfs.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/disk-utils/fsck.cramfs.c b/disk-utils/fsck.cramfs.c
index 50c7d33b9..2da14d17a 100644
--- a/disk-utils/fsck.cramfs.c
+++ b/disk-utils/fsck.cramfs.c
@@ -220,23 +220,23 @@ static void test_crc(int start)
crc = crc32(0L, NULL, 0);
buf =
- mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+ mmap(NULL, start + super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
if (buf == MAP_FAILED) {
buf =
- mmap(NULL, super.size, PROT_READ | PROT_WRITE,
+ mmap(NULL, start + super.size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (buf != MAP_FAILED) {
- if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
+ if (lseek(fd, start, SEEK_SET) == (off_t) -1)
err(FSCK_EX_ERROR, _("seek on %s failed"), filename);
- if (read(fd, buf, super.size) != (ssize_t) super.size)
+ if (read(fd, buf + start, super.size) != (ssize_t) super.size)
err(FSCK_EX_ERROR, _("cannot read %s"), filename);
}
}
if (buf != MAP_FAILED) {
((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
crc32(0L, NULL, 0);
- crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
- munmap(buf, super.size);
+ crc = crc32(crc, (unsigned char *) buf + start, super.size);
+ munmap(buf, start + super.size);
} else {
int retval;
size_t length = 0;
--
2.14.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] fsck.cramfs: Fix bus error on broken file system.
2017-10-30 10:43 ` Karel Zak
2017-10-30 12:47 ` Tobias Stoeckmann
@ 2017-10-30 12:49 ` Tobias Stoeckmann
2017-11-02 13:26 ` Karel Zak
1 sibling, 1 reply; 6+ messages in thread
From: Tobias Stoeckmann @ 2017-10-30 12:49 UTC (permalink / raw)
To: Karel Zak; +Cc: util-linux
The utility fsck.cramfs is prone to a bus error on file systems for
big endian systems with non-standard header sizes. While calculating
the crc32 checksum, it does not properly handle a possible offset
for bootcodes, resulting in out of boundary access of mmap'ed area.
You can trigger the issue with the following commands:
$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
---
Update to last patch: read lacked a proper cast to (unsigned char *).
---
disk-utils/fsck.cramfs.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/disk-utils/fsck.cramfs.c b/disk-utils/fsck.cramfs.c
index 50c7d33b9..b2a3cc153 100644
--- a/disk-utils/fsck.cramfs.c
+++ b/disk-utils/fsck.cramfs.c
@@ -220,23 +220,24 @@ static void test_crc(int start)
crc = crc32(0L, NULL, 0);
buf =
- mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+ mmap(NULL, start + super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
if (buf == MAP_FAILED) {
buf =
- mmap(NULL, super.size, PROT_READ | PROT_WRITE,
+ mmap(NULL, start + super.size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (buf != MAP_FAILED) {
- if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
+ if (lseek(fd, start, SEEK_SET) == (off_t) -1)
err(FSCK_EX_ERROR, _("seek on %s failed"), filename);
- if (read(fd, buf, super.size) != (ssize_t) super.size)
+ if (read(fd, (unsigned char *) buf + start, super.size) !=
+ (ssize_t) super.size)
err(FSCK_EX_ERROR, _("cannot read %s"), filename);
}
}
if (buf != MAP_FAILED) {
((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
crc32(0L, NULL, 0);
- crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
- munmap(buf, super.size);
+ crc = crc32(crc, (unsigned char *) buf + start, super.size);
+ munmap(buf, start + super.size);
} else {
int retval;
size_t length = 0;
--
2.14.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] fsck.cramfs: Fix bus error on broken file system.
2017-10-30 12:49 ` Tobias Stoeckmann
@ 2017-11-02 13:26 ` Karel Zak
0 siblings, 0 replies; 6+ messages in thread
From: Karel Zak @ 2017-11-02 13:26 UTC (permalink / raw)
To: Tobias Stoeckmann; +Cc: util-linux
On Mon, Oct 30, 2017 at 01:49:53PM +0100, Tobias Stoeckmann wrote:
> The utility fsck.cramfs is prone to a bus error on file systems for
> big endian systems with non-standard header sizes. While calculating
> the crc32 checksum, it does not properly handle a possible offset
> for bootcodes, resulting in out of boundary access of mmap'ed area.
>
> You can trigger the issue with the following commands:
>
> $ mkdir -p cramfs-poc/root/subdir
> $ cd cramfs-poc
> $ mkfs.cramfs -p -N big root cramfs
> $ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
> $ fsck.cramfs cramfs
Added between tests.
> disk-utils/fsck.cramfs.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
Applied, thanks.
Karel
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-11-02 13:26 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-10-26 20:01 [PATCH] fsck.cramfs: Fix bus error on broken file system Tobias Stoeckmann
2017-10-27 5:47 ` Tobias Stoeckmann
2017-10-30 10:43 ` Karel Zak
2017-10-30 12:47 ` Tobias Stoeckmann
2017-10-30 12:49 ` Tobias Stoeckmann
2017-11-02 13:26 ` Karel Zak
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.