bugdmidecode - Bugs: bug #46066, Crash with SIGBUS

 
 

bug #46066: Crash with SIGBUS

Submitter:  None
Submitted:  Mon 28 Sep 2015 03:18:00 PM UTC
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  khali
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Mon 02 Nov 2015 08:51:18 AM UTC, comment #5: 
Jean Delvare <khali>
Project Administrator
Thu 01 Oct 2015 08:21:19 AM UTC, comment #4: 

Hello Jean,

thanks for the patch. I have check it with the img file.

Now I get a error message instead of the SIGBUS.
For me looks the patch ok.

At Debian I have uploaded a patched version.

Many thanks again.

CU
Jörg

Jörg Frings-Fürst <joergff>
Tue 29 Sep 2015 09:45:36 AM UTC, comment #3: 

I have attached a candidate fix that will replace the SIGBUS by an error message.

Jean Delvare <khali>
Project Administrator
Mon 28 Sep 2015 03:57:56 PM UTC, comment #2: 

Hi,

sorry for my posting without login.

My mail: Jörg Frings-Fürst <debian@jff-webhosting.net>

Link to the orginal BTS: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796963

The image smbios.thinkpad.img is available.

CU
Jörg

Jörg Frings-Fürst <joergff>
Mon 28 Sep 2015 03:54:38 PM UTC, comment #1: 

What does the "extracted smbios file" look like? How was it generated? The DMI table is beyond the first MB of memory on this laptop. Unless you dumped all 4 GB of memory to the file, the table is not in it. The SIGBUS happens because mmap() is called beyond the end of the file (as documented in mmap(2).)

The problem here is that you are abusing option -d. If you want to keep a copy of the DMI table and/or decode the DMI table on a different machine, please use options --dump-bin and --from-dump which were introduced in dmidecode version 2.10 (November 2008.) Option -d only works reliably when operating on an actual device file.

Jean Delvare <khali>
Project Administrator
Mon 28 Sep 2015 03:18:00 PM UTC, original submission:  

Hello,

I forward this bug from the Debian BTS:

Dear Maintainer,

running dmidecode on the extracted smbios file from a thinkpad T450s causes a
crash.  The way we extracted the smbios works with other laptops. While the
file may be corrupt, dmidecode should not crash in any case. Backtrace is below
(on an amd64 jessie system).

I can probably send the file to you if necessary, but I don't want to put it
into the public bts.

Cheers,
Stefan

$ gdb --args /usr/sbin/dmidecode -d smbios.thinkpad.img
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/dmidecode...Reading symbols from /usr/lib/debug/.build-id/8a/3aed0a8c9faebcb07ca6a3cef59133e8d1c812.debug...done.
done.
(gdb) run
Starting program: /usr/sbin/dmidecode -d smbios.thinkpad.img
# dmidecode 2.12
SMBIOS 2.7 present.
66 structures occupying 3201 bytes.
Table at 0xBCBFD000.

Program received signal SIGBUS, Bus error.
0x000055555556200d in memcpy (__len=3201, __src=0x7ffff7ff4000, __dest=0x55555577d020) at /usr/include/x86_64-linux-gnu/bits/string3.h:51
warning: Source file is more recent than executable.
51   return __builtin___memcpy_chk (__dest, __src, __len, __bos0 (__dest));
(gdb) bt full
#0  0x000055555556200d in memcpy (__len=3201, __src=0x7ffff7ff4000, __dest=0x55555577d020) at /usr/include/x86_64-linux-gnu/bits/string3.h:51
No locals.
#1  mem_chunk (base=3166687232, len=3201, devmem=0x7fffffffe72e "smbios.thinkpad.img") at util.c:131
        p = 0x55555577d020
        mmoffset = 0
        mmp = 0x7ffff7ff4000
#2  0x000055555555c49c in dmi_table (base=3166687232, len=3201, num=66, ver=519, devmem=0x7fffffffe72e "smbios.thinkpad.img") at dmidecode.c:4356
        buf = <optimized out>
        data = <optimized out>
        i = 0
#3  0x0000555555561682 in smbios_decode (buf=0x55555576d0f0 "_SM_e\037\002\a\024\001", devmem=0x7fffffffe72e "smbios.thinkpad.img") at dmidecode.c:4493
        ver = 519
        devmem = 0x7fffffffe72e "smbios.thinkpad.img"
        buf = 0x55555576d0f0 "_SM_e\037\002\a\024\001"
#4  0x000055555555b3eb in main (argc=<optimized out>, argv=<optimized out>) at dmidecode.c:4682
        ret = 0
        found = 0
        fp = 224
        buf = 0x55555576d010 "Phoenix SCT"
(gdb) q

### End of forwarding

With 3.0 I get:

gdb --args /usr/sbin/dmidecode -d smbios.thinkpad.img
GNU gdb (Ubuntu 7.9-1ubuntu1) 7.9
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/dmidecode...Reading symbols from /usr/lib/debug/.build-id/8b/a3dc1dbe8c0b28f09311984bf317f9b87ff722.debug...done.
done.
(gdb) run
Starting program: /usr/sbin/dmidecode -d smbios.thinkpad.img
# dmidecode 3.0
Scanning smbios.thinkpad.img for entry point.
SMBIOS 2.7 present.
66 structures occupying 3201 bytes.
Table at 0xBCBFD000.

Program received signal SIGBUS, Bus error.
0x0000555555562bfb in memcpy (__len=3201, __src=0x7ffff7ff6000, __dest=0x55555577e020)
    at /usr/include/x86_64-linux-gnu/bits/string3.h:51
51        size_t __len))
(gdb) bt full
#0  0x0000555555562bfb in memcpy (__len=3201, __src=0x7ffff7ff6000, __dest=0x55555577e020)
    at /usr/include/x86_64-linux-gnu/bits/string3.h:51
No locals.
#1  mem_chunk (base=3166687232, len=3201, devmem=0x7fffffffe1f9 "smbios.thinkpad.img") at util.c:186
        p = 0x55555577e020
        mmoffset = 0
        mmp = 0x7ffff7ff6000
#2  0x000055555555c872 in dmi_table (base=3166687232, len=3201, num=<optimized out>, ver=519,
    devmem=0x7fffffffe1f9 "smbios.thinkpad.img", flags=0) at dmidecode.c:4533
        buf = <optimized out>
#3  0x0000555555561df9 in smbios_decode (buf=0x55555576e0f0 "_SM_e\037\002\a\024\001",
    devmem=0x7fffffffe1f9 "smbios.thinkpad.img", flags=0) at dmidecode.c:4651
        ver = 519
        flags = 0
        devmem = 0x7fffffffe1f9 "smbios.thinkpad.img"
        buf = 0x55555576e0f0 "_SM_e\037\002\a\024\001"
#4  0x000055555555b90d in main (argc=<optimized out>, argv=<optimized out>) at dmidecode.c:4893
        ret = 0
        found = 0
        fp = 224
        buf = 0x55555576e010 "Phoenix SCT"
(gdb) q

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #35008:  dmidecode-avoid-sigbus.patch added by khali (1KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by joergff (Posted a comment)
  • -email is unavailable- added by khali (Posted a comment)
  • -email is unavailable- added by joergff (submitter)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-11-02 khali Open/ClosedOpen Closed
    2015-11-02 khali StatusNeed Info Fixed
    2015-09-29 khali Attached File- Added dmidecode-avoid-sigbus.patch, #35008
    2015-09-28 khali StatusNone Need Info
        Assigned toNone khali
    2015-09-28 joergff Carbon-Copy- Added -email is unavailable-

    Back to the top


    Powered by Savane 3.9