lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 6 Dec 2020 18:27:48 +0000
From:   Colin Watson <>
To:     Paul Menzel <>
Cc:     "Theodore Y. Ts'o" <>,
        Andreas Dilger <>,, Dimitri John Ledkov <>
Subject: Re: ext4: Funny characters appended to file names

On Sun, Dec 06, 2020 at 02:44:16PM +0000, Colin Watson wrote:
> So, in the RESTORE_BACKUP case, shouldn't that be:
>   char *dstf = grub_util_path_concat (2, di, de->d_name);
> ... rather than grub_util_path_concat_ext?  Otherwise it seems to me
> that it's going to try to append an additional argument which doesn't
> exist, and may well add random uninitialised stuff from memory.  Running
> grub-install under valgrind would probably show this up (I can't get it
> to do it for me so far, but most likely I just haven't set up quite the
> right initial conditions).

While I couldn't reproduce this on amd64 (and valgrind didn't show any
errors), I can reproduce it just fine on i386, which is what Paul is
using.  I guess the va_list layout in memory is different enough between
the two ABIs to tickle this.

I'll apply this patch for Debian grub2 2.04-11, which I've confirmed
fixes it for me:

diff --git a/util/grub-install-common.c b/util/grub-install-common.c
index a883b6dae..61f9075bc 100644
--- a/util/grub-install-common.c
+++ b/util/grub-install-common.c
@@ -247,7 +247,7 @@ clean_grub_dir_real (const char *di, enum clean_grub_dir_mode mode)
 	  else if (mode == RESTORE_BACKUP)
-	      char *dstf = grub_util_path_concat_ext (2, di, de->d_name);
+	      char *dstf = grub_util_path_concat (2, di, de->d_name);
 	      dstf[strlen (dstf) - 1] = 0;
 	      if (grub_util_rename (srcf, dstf) < 0)
 		grub_util_error (_("cannot restore `%s': %s"), dstf,

Dimitri, I know Ubuntu isn't very interested in supporting i386, but IMO
you should apply this patch to Ubuntu in any case; it might affect other
architectures, and anyway leaving known undefined behaviour around isn't
a good idea.

Paul, note that you'll also need to run "sudo rm -f
/boot/grub/i386-pc/*.{img,lst,mo,mod,o,sh}-*" to clean up the stray
files created by this bug.

Colin Watson (he/him)                              []

Powered by blists - more mailing lists