fsck.cramfs: Fix bus error on broken file system.

PATCH Applied Tobias Stoeckmann 2 participants 6 messages Oct 26, 2017 – Nov 2, 2017 Util-Linux package

Share & tools

Tobias Stoeckmann

author

2017-10-26 20:01 UTC #0 lore raw

PATCH 1/1 fsck.cramfs: Fix bus error on broken file system.

The utility fsck.cramfs is prone to a bus error on file systems for big endian systems with non-standard header sizes. While calculating the crc32 checksum, it does not properly handle a possible offset for bootcodes, resulting in out of boundary access of mmap'ed area.

You can trigger the issue with the following commands:

$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs

Signed-off-by Tobias Stoeckmann <[email protected]>

---
 disk-utils/fsck.cramfs.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

disk-utils/fsck.cramfs.c +9 -9

index 50c7d33b9..3d0b9de58 100644
@@ -219,24 +219,24 @@ static void test_crc(int start)
 
 	crc = crc32(0L, NULL, 0);
 
-	buf =
-	    mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+	buf = mmap(NULL, start + super.size, PROT_READ | PROT_WRITE,
+		   MAP_PRIVATE, fd, 0);
 	if (buf == MAP_FAILED) {
-		buf =
-		    mmap(NULL, super.size, PROT_READ | PROT_WRITE,
-			 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+		buf = mmap(NULL, start + super.size, PROT_READ | PROT_WRITE,
+			   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 		if (buf != MAP_FAILED) {
-			if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
+			if (lseek(fd, start, SEEK_SET) == (off_t) -1)
 				err(FSCK_EX_ERROR, _("seek on %s failed"), filename);
-			if (read(fd, buf, super.size) != (ssize_t) super.size)
+			if (read(fd, (unsigned char *) buf + start, super.size) !=
+			    (ssize_t) super.size)
 				err(FSCK_EX_ERROR, _("cannot read %s"), filename);
 		}
 	}
 	if (buf != MAP_FAILED) {
 		((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
 		    crc32(0L, NULL, 0);
-		crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
-		munmap(buf, super.size);
+		crc = crc32(crc, (unsigned char *) buf + start, super.size);
+		munmap(buf, start + super.size);
 	} else {
 		int retval;
 		size_t length = 0;

Signature · 1 line

2.14.3

Tobias Stoeckmann

author

2017-10-27 05:47 UTC #1 lore raw

You can trigger the issue with the following commands:

$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs

Signed-off-by Tobias Stoeckmann <[email protected]>

---
This is the second and much cleaner version of the initial patch. We can easily use the offset of mmap, which heavily reduces the manual buf + start calculation.

---
 disk-utils/fsck.cramfs.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

disk-utils/fsck.cramfs.c +3 -4

index 50c7d33b9..cafa659af 100644
@@ -220,7 +220,7 @@ static void test_crc(int start)
 	crc = crc32(0L, NULL, 0);
 
 	buf =
-	    mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+	    mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, start);
 	if (buf == MAP_FAILED) {
 		buf =
 		    mmap(NULL, super.size, PROT_READ | PROT_WRITE,

@@ -233,9 +233,8 @@ static void test_crc(int start)
 		}
 	}
 	if (buf != MAP_FAILED) {
-		((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
-		    crc32(0L, NULL, 0);
-		crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
+		((struct cramfs_super *) buf)->fsid.crc = crc32(0L, NULL, 0);
+		crc = crc32(crc, buf, super.size);
 		munmap(buf, super.size);
 	} else {
 		int retval;

Signature · 1 line

2.14.3

Karel Zak

maintainer

2017-10-30 10:44 UTC #2 lore raw

Quoted 27 lines · Tobias Stoeckmann

The utility fsck.cramfs is prone to a bus error on file systems for big endian systems with non-standard header sizes. While calculating the crc32 checksum, it does not properly handle a possible offset for bootcodes, resulting in out of boundary access of mmap'ed area.
You can trigger the issue with the following commands:
$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs
Signed-off-by Tobias Stoeckmann <[email protected]>
---
This is the second and much cleaner version of the initial patch. We can easily use the offset of mmap, which heavily reduces the manual buf + start calculation.
---
 disk-utils/fsck.cramfs.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
disk-utils/fsck.cramfs.c +0 -0
index 50c7d33b9..cafa659af 100644

disk-utils/fsck.cramfs.c static void test_crc(int start) · line 223

Quoted 5 lines

disk-utils/fsck.cramfs.c +1 -1

@@ -220,7 +220,7 @@ static void test_crc(int start)
 	crc = crc32(0L, NULL, 0);
 
 	buf =
-	    mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+	    mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, start);

mmap() offset should be aligned to PAGE_SIZE. The function test_super() is able to set "start" to PAD_SIZE (=512). It does not seem correct.

disk-utils/fsck.cramfs.c static void test_crc(int start) · line 226

Quoted 3 lines

disk-utils/fsck.cramfs.c +0 -0

 	if (buf == MAP_FAILED) {
 		buf =
 		    mmap(NULL, super.size, PROT_READ | PROT_WRITE,

on failed mmap() it tries to use open+read to get "buf" and it reads it from the begin of the file. It seems incompatible with mmap() now. I guess we need seek(start) there too.

disk-utils/fsck.cramfs.c static void test_crc(int start) · line 240

Quoted 12 lines

disk-utils/fsck.cramfs.c +2 -3

@@ -233,9 +233,8 @@ static void test_crc(int start)
 		}
 	}
 	if (buf != MAP_FAILED) {
-		((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
-		    crc32(0L, NULL, 0);
-		crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
+		((struct cramfs_super *) buf)->fsid.crc = crc32(0L, NULL, 0);
+		crc = crc32(crc, buf, super.size);
 		munmap(buf, super.size);
 	} else {
 		int retval;

Karel

Signature · 2 lines

 Karel Zak  <[email protected]>
 http://karelzak.blogspot.com

Tobias Stoeckmann

author

2017-10-30 12:47 UTC #3 lore raw

You can trigger the issue with the following commands:

$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs

Signed-off-by Tobias Stoeckmann <[email protected]>

---
This version avoids mmap offset again and properly sets lseek offset.

---
 disk-utils/fsck.cramfs.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

disk-utils/fsck.cramfs.c +6 -6

index 50c7d33b9..2da14d17a 100644
@@ -220,23 +220,23 @@ static void test_crc(int start)
 	crc = crc32(0L, NULL, 0);
 
 	buf =
-	    mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+	    mmap(NULL, start + super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
 	if (buf == MAP_FAILED) {
 		buf =
-		    mmap(NULL, super.size, PROT_READ | PROT_WRITE,
+		    mmap(NULL, start + super.size, PROT_READ | PROT_WRITE,
 			 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 		if (buf != MAP_FAILED) {
-			if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
+			if (lseek(fd, start, SEEK_SET) == (off_t) -1)
 				err(FSCK_EX_ERROR, _("seek on %s failed"), filename);
-			if (read(fd, buf, super.size) != (ssize_t) super.size)
+			if (read(fd, buf + start, super.size) != (ssize_t) super.size)
 				err(FSCK_EX_ERROR, _("cannot read %s"), filename);
 		}
 	}
 	if (buf != MAP_FAILED) {
 		((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
 		    crc32(0L, NULL, 0);
-		crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
-		munmap(buf, super.size);
+		crc = crc32(crc, (unsigned char *) buf + start, super.size);
+		munmap(buf, start + super.size);
 	} else {
 		int retval;
 		size_t length = 0;

Signature · 1 line

2.14.3

Tobias Stoeckmann

author

2017-10-30 12:50 UTC #4 lore raw

In reply to Karel Zak

You can trigger the issue with the following commands:

$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs

Signed-off-by Tobias Stoeckmann <[email protected]>

---
Update to last patch: read lacked a proper cast to (unsigned char *).

---
 disk-utils/fsck.cramfs.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

disk-utils/fsck.cramfs.c +7 -6

index 50c7d33b9..b2a3cc153 100644
@@ -220,23 +220,24 @@ static void test_crc(int start)
 	crc = crc32(0L, NULL, 0);
 
 	buf =
-	    mmap(NULL, super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+	    mmap(NULL, start + super.size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
 	if (buf == MAP_FAILED) {
 		buf =
-		    mmap(NULL, super.size, PROT_READ | PROT_WRITE,
+		    mmap(NULL, start + super.size, PROT_READ | PROT_WRITE,
 			 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 		if (buf != MAP_FAILED) {
-			if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
+			if (lseek(fd, start, SEEK_SET) == (off_t) -1)
 				err(FSCK_EX_ERROR, _("seek on %s failed"), filename);
-			if (read(fd, buf, super.size) != (ssize_t) super.size)
+			if (read(fd, (unsigned char *) buf + start, super.size) !=
+			    (ssize_t) super.size)
 				err(FSCK_EX_ERROR, _("cannot read %s"), filename);
 		}
 	}
 	if (buf != MAP_FAILED) {
 		((struct cramfs_super *)((unsigned char *) buf + start))->fsid.crc =
 		    crc32(0L, NULL, 0);
-		crc = crc32(crc, (unsigned char *) buf + start, super.size - start);
-		munmap(buf, super.size);
+		crc = crc32(crc, (unsigned char *) buf + start, super.size);
+		munmap(buf, start + super.size);
 	} else {
 		int retval;
 		size_t length = 0;

Signature · 1 line

2.14.3

Karel Zak

maintainer Applied

2017-11-02 13:26 UTC #5 lore raw

Quoted 5 lines · Tobias Stoeckmann

The utility fsck.cramfs is prone to a bus error on file systems for big endian systems with non-standard header sizes. While calculating the crc32 checksum, it does not properly handle a possible offset for bootcodes, resulting in out of boundary access of mmap'ed area.

Quoted 7 lines

You can trigger the issue with the following commands:

$ mkdir -p cramfs-poc/root/subdir
$ cd cramfs-poc
$ mkfs.cramfs -p -N big root cramfs
$ echo -ne \\00\\x4c | dd of=cramfs bs=1 seek=518 count=2 conv=notrunc
$ fsck.cramfs cramfs

Added between tests.

Quoted 2 lines

 disk-utils/fsck.cramfs.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

Applied, thanks.

Karel

Signature · 2 lines

 Karel Zak  <[email protected]>
 http://karelzak.blogspot.com