bugdmidecode - Bugs: bug #46066, Crash with SIGBUS

 
 

bug #46066: Crash with SIGBUS

Submitted by:  None
Submitted on:  Mon 28 Sep 2015 03:18:00 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Jean Delvare <khali>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 02 Nov 2015 08:51:18 AM UTC, comment #5:

Fixed:

http://git.savannah.gnu.org/cgit/dmidecode.git/commit/?id=c081fa410e7c466df4b3b257e7b974b71fb7f250

Jean Delvare <khali>
Project AdministratorIn charge of this item.
Thu 01 Oct 2015 08:21:19 AM UTC, comment #4:

Hello Jean,

thanks for the patch. I have check it with the img file.

Now I get a error message instead of the SIGBUS.
For me looks the patch ok.

At Debian I have uploaded a patched version.

Many thanks again.

CU
Jörg

Jörg Frings-Fürst <joergff>
Tue 29 Sep 2015 09:45:36 AM UTC, comment #3:

I have attached a candidate fix that will replace the SIGBUS by an error message.

Jean Delvare <khali>
Project AdministratorIn charge of this item.
Mon 28 Sep 2015 03:57:56 PM UTC, comment #2:

Hi,

sorry for my posting without login.

My mail: Jörg Frings-Fürst <debian@jff-webhosting.net>

Link to the orginal BTS: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796963

The image smbios.thinkpad.img is available.

CU
Jörg

Jörg Frings-Fürst <joergff>
Mon 28 Sep 2015 03:54:38 PM UTC, comment #1:

What does the "extracted smbios file" look like? How was it generated? The DMI table is beyond the first MB of memory on this laptop. Unless you dumped all 4 GB of memory to the file, the table is not in it. The SIGBUS happens because mmap() is called beyond the end of the file (as documented in mmap(2).)

The problem here is that you are abusing option -d. If you want to keep a copy of the DMI table and/or decode the DMI table on a different machine, please use options --dump-bin and --from-dump which were introduced in dmidecode version 2.10 (November 2008.) Option -d only works reliably when operating on an actual device file.

Jean Delvare <khali>
Project AdministratorIn charge of this item.
Mon 28 Sep 2015 03:18:00 PM UTC, original submission:

Hello,

I forward this bug from the Debian BTS:

Dear Maintainer,

running dmidecode on the extracted smbios file from a thinkpad T450s causes a
crash. The way we extracted the smbios works with other laptops. While the
file may be corrupt, dmidecode should not crash in any case. Backtrace is below
(on an amd64 jessie system).

I can probably send the file to you if necessary, but I don't want to put it
into the public bts.

Cheers,
Stefan

$ gdb --args /usr/sbin/dmidecode -d smbios.thinkpad.img
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/dmidecode...Reading symbols from /usr/lib/debug/.build-id/8a/3aed0a8c9faebcb07ca6a3cef59133e8d1c812.debug...done.
done.
(gdb) run
Starting program: /usr/sbin/dmidecode -d smbios.thinkpad.img
# dmidecode 2.12
SMBIOS 2.7 present.
66 structures occupying 3201 bytes.
Table at 0xBCBFD000.

Program received signal SIGBUS, Bus error.
0x000055555556200d in memcpy (__len=3201, __src=0x7ffff7ff4000, __dest=0x55555577d020) at /usr/include/x86_64-linux-gnu/bits/string3.h:51
warning: Source file is more recent than executable.
51 return __builtin___memcpy_chk (__dest, __src, __len, __bos0 (__dest));
(gdb) bt full
#0 0x000055555556200d in memcpy (__len=3201, __src=0x7ffff7ff4000, __dest=0x55555577d020) at /usr/include/x86_64-linux-gnu/bits/string3.h:51
No locals.
#1 mem_chunk (base=3166687232, len=3201, devmem=0x7fffffffe72e "smbios.thinkpad.img") at util.c:131
p = 0x55555577d020
mmoffset = 0
mmp = 0x7ffff7ff4000
#2 0x000055555555c49c in dmi_table (base=3166687232, len=3201, num=66, ver=519, devmem=0x7fffffffe72e "smbios.thinkpad.img") at dmidecode.c:4356
buf = <optimized out>
data = <optimized out>
i = 0
#3 0x0000555555561682 in smbios_decode (buf=0x55555576d0f0 "_SM_e\037\002\a\024\001", devmem=0x7fffffffe72e "smbios.thinkpad.img") at dmidecode.c:4493
ver = 519
devmem = 0x7fffffffe72e "smbios.thinkpad.img"
buf = 0x55555576d0f0 "_SM_e\037\002\a\024\001"
#4 0x000055555555b3eb in main (argc=<optimized out>, argv=<optimized out>) at dmidecode.c:4682
ret = 0
found = 0
fp = 224
buf = 0x55555576d010 "Phoenix SCT"
(gdb) q

### End of forwarding

With 3.0 I get:

gdb --args /usr/sbin/dmidecode -d smbios.thinkpad.img
GNU gdb (Ubuntu 7.9-1ubuntu1) 7.9
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/dmidecode...Reading symbols from /usr/lib/debug/.build-id/8b/a3dc1dbe8c0b28f09311984bf317f9b87ff722.debug...done.
done.
(gdb) run
Starting program: /usr/sbin/dmidecode -d smbios.thinkpad.img
# dmidecode 3.0
Scanning smbios.thinkpad.img for entry point.
SMBIOS 2.7 present.
66 structures occupying 3201 bytes.
Table at 0xBCBFD000.

Program received signal SIGBUS, Bus error.
0x0000555555562bfb in memcpy (__len=3201, __src=0x7ffff7ff6000, __dest=0x55555577e020)
at /usr/include/x86_64-linux-gnu/bits/string3.h:51
51 size_t __len))
(gdb) bt full
#0 0x0000555555562bfb in memcpy (__len=3201, __src=0x7ffff7ff6000, __dest=0x55555577e020)
at /usr/include/x86_64-linux-gnu/bits/string3.h:51
No locals.
#1 mem_chunk (base=3166687232, len=3201, devmem=0x7fffffffe1f9 "smbios.thinkpad.img") at util.c:186
p = 0x55555577e020
mmoffset = 0
mmp = 0x7ffff7ff6000
#2 0x000055555555c872 in dmi_table (base=3166687232, len=3201, num=<optimized out>, ver=519,
devmem=0x7fffffffe1f9 "smbios.thinkpad.img", flags=0) at dmidecode.c:4533
buf = <optimized out>
#3 0x0000555555561df9 in smbios_decode (buf=0x55555576e0f0 "_SM_e\037\002\a\024\001",
devmem=0x7fffffffe1f9 "smbios.thinkpad.img", flags=0) at dmidecode.c:4651
ver = 519
flags = 0
devmem = 0x7fffffffe1f9 "smbios.thinkpad.img"
buf = 0x55555576e0f0 "_SM_e\037\002\a\024\001"
#4 0x000055555555b90d in main (argc=<optimized out>, argv=<optimized out>) at dmidecode.c:4893
ret = 0
found = 0
fp = 224
buf = 0x55555576e010 "Phoenix SCT"
(gdb) q

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35008:  dmidecode-avoid-sigbus.patch added by khali (1KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by joergff (Posted a comment)
  • -unavailable- added by khali (Posted a comment)
  • -unavailable- added by joergff (submitter)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 02 Nov 2015 08:53:05 AM UTCkhaliOpen/ClosedOpen=>Closed
    Mon 02 Nov 2015 08:51:18 AM UTCkhaliStatusNeed Info=>Fixed
    Tue 29 Sep 2015 09:44:52 AM UTCkhaliAttached File-=>Added dmidecode-avoid-sigbus.patch, #35008
    Mon 28 Sep 2015 03:54:38 PM UTCkhaliStatusNone=>Need Info
      Assigned toNone=>khali
    Mon 28 Sep 2015 03:53:28 PM UTCjoergffCarbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1