linux-ext4 - RE: [PATCH] libext2fs: fix to read the bitmaps for image file correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Mar 2018 06:42:29 +0000
From:   Kazuya Mio <k-mio@...jp.nec.com>
To:     "Theodore Y. Ts'o" <tytso@....edu>
CC:     "adilger.kernel@...ger.ca" <adilger.kernel@...ger.ca>,
        "linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>
Subject: RE: [PATCH] libext2fs: fix to read the bitmaps for image file
 correctly

Thank you for your kind advices. However, after applying the patch,
debugfs caused segfault by the following steps:

# mke2fs -t ext4 /dev/sda8
# e2image /dev/sda8 test.img
# debugfs -R stats -i test.img
debugfs 1.44.0 (7-Mar-2018)
Segmentation fault

According to the following backtrace, read_bitmaps() called by
ext2fs_read_inode_bitmap() reads not only inode bitmap, but also block bitmap.
We would need to consider about do_inode/do_block arguments in read_bitmaps().

#0  0x00007ffff72fa61d in __memcpy_ssse3 () from /lib64/libc.so.6
#1  0x0000000000436072 in unix_read_blk64 (channel=0x6611c0, block=819227, count=<optimized out>, buf=<optimized out>)
    at ../../../lib/ext2fs/unix_io.c:873
#2  0x0000000000432f72 in read_bitmaps (fs=0x661030, do_inode=do_inode@...ry=1, do_block=do_block@...ry=0)
    at ../../../lib/ext2fs/rw_bitmaps.c:278
#3  0x000000000043351c in ext2fs_read_inode_bitmap (fs=<optimized out>) at ../../../lib/ext2fs/rw_bitmaps.c:395
#4  0x0000000000404105 in open_filesystem (device=0x7fffffffe298 "default.image", open_flags=open_flags@...ry=172032, 
    superblock=0, blocksize=blocksize@...ry=0, catastrophic=catastrophic@...ry=0, data_filename=data_filename@...ry=0x0, 
    undo_file=undo_file@...ry=0x0) at ../../debugfs/debugfs.c:196
#5  0x0000000000403bb9 in main (argc=5, argv=0x7fffffffdf08) at ../../debugfs/debugfs.c:2517

Regards,
Kazuya Mio