Bug 808421 - Segfault in ext2fs_new_inode
Summary: Segfault in ext2fs_new_inode
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: e2fsprogs
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Eric Sandeen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-30 11:05 UTC by Richard W.M. Jones
Modified: 2012-07-06 20:40 UTC (History)
4 users (show)

Fixed In Version: e2fsprogs-1.42.2-4
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-07-06 20:40:00 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Richard W.M. Jones 2012-03-30 11:05:44 UTC
Description of problem:

febootstrap uses ext2fs as a library to build ext2 filesystems.
Since the latest version in Fedora, febootstrap now segfaults
when calling ext2_mkdir.

Version-Release number of selected component (if applicable):

e2fsprogs-1.42.2-3.fc18.x86_64

How reproducible:

100%

Steps to Reproduce:

febootstrap-supermin-helper --verbose -f ext2 /usr/lib64/guestfs/supermin.d x86_64 /tmp/kernel /tmp/initrd /tmp/root
  
Actual results:

Program received signal SIGSEGV, Segmentation fault.
ext2fs_find_first_zero_generic_bmap (bitmap=0x70b990, start=11, end=8193, 
    out=0x7fffffffc608) at gen_bitmap64.c:771
771		if (bitmap->bitmap_ops->find_first_zero)
Missing separate debuginfos, use: debuginfo-install glibc-2.15-28.fc17.x86_64
(gdb) bt
#0  ext2fs_find_first_zero_generic_bmap (bitmap=0x70b990, start=11, end=8193, 
    out=0x7fffffffc608) at gen_bitmap64.c:771
#1  0x00007ffff7da1878 in ext2fs_find_first_zero_inode_bitmap2 (
    out=<synthetic pointer>, end=8193, start=11, bitmap=0x70b990)
    at ../../lib/ext2fs/bitops.h:630
#2  ext2fs_new_inode (fs=0x70b780, dir=dir@entry=2, mode=mode@entry=16877, 
    map=0x70b990, map@entry=0x0, ret=ret@entry=0x7fffffffc65c) at alloc.c:146
#3  0x00000000004040be in ext2_mkdir (dir_ino=2, 
    dirname=dirname@entry=0x7fffffffc758 "bin", 
    basename=basename@entry=0x7fffffffc758 "bin", mode=mode@entry=16877, 
    uid=500, gid=500, ctime=1333039498, atime=1333039498, mtime=1333039498)
    at ext2.c:142
#4  0x0000000000405664 in read_file () at ext2cpio.c:268
#5  0x00000000004059e5 in parse_next_entry () at ext2cpio.c:123
#6  ext2_cpio_file (cpio_file=<optimized out>) at ext2cpio.c:72
#7  0x0000000000402f6f in iterate_inputs (inputs=inputs@entry=0x7fffffffcab0, 
    nr_inputs=nr_inputs@entry=1, writer=writer@entry=0x60fe00)
    at appliance.c:114
#8  0x00000000004030e1 in iterate_input_directory (dirname=<optimized out>, 
    dirfd=dirfd@entry=8, writer=writer@entry=0x60fe00) at appliance.c:188
#9  0x0000000000402efe in iterate_inputs (inputs=inputs@entry=0x7fffffffded0, 
    nr_inputs=nr_inputs@entry=1, writer=writer@entry=0x60fe00)
    at appliance.c:108
#10 0x0000000000403212 in create_appliance (
    hostcpu=hostcpu@entry=0x7fffffffe2bc "x86_64", 
    inputs=inputs@entry=0x7fffffffded0, nr_inputs=nr_inputs@entry=1, 
    whitelist=whitelist@entry=0x0, 
    modpath=0x6e65c0 "/lib/modules/3.3.0-1.fc17.x86_64", 
    initrd=initrd@entry=0x7fffffffe2cf "/tmp/initrd", 
    appliance=appliance@entry=0x7fffffffe2db "/tmp/root", 
    writer=writer@entry=0x60fe00) at appliance.c:78
#11 0x000000000040295e in main (argc=<optimized out>, argv=<optimized out>)
    at main.c:316
(gdb) print bitmap
$1 = (struct ext2fs_struct_generic_bitmap *) 0x70b990
(gdb) print *bitmap
$2 = {magic = 2133571337, fs = 0x70b780, bitmap_ops = 0x4000000000001, 
  flags = 262144, start = 7386736, end = 7630864, real_end = 2133571376, 
  cluster_bits = -1239742424, description = 0x0, private = 0x0, 
  base_error_code = 0, stats = {type = 81, created = {tv_sec = 226393524216, 
      tv_usec = 226393524216}}}

Notice that bitmap->bitmap_ops seems bogus.

Comment 1 Richard W.M. Jones 2012-03-30 13:22:45 UTC
I started a thread on the linux-ext4 mailing list:
http://thread.gmane.org/gmane.comp.file-systems.ext4/31736

I found a workaround (or fix??) and pushed it upstream in
febootstrap:
https://github.com/libguestfs/febootstrap/commit/386b5985098fedf7bcd111553b8b6b73599df6c9

Comment 2 Eric Sandeen 2012-07-06 20:40:00 UTC
Fixed since:

* Mon Apr 09 2012 Eric Sandeen <sandeen@@redhat.com> 1.42.2-4
- Handle 32-bit bitmaps in new find_first_zero functions


Note You need to log in before you can comment on or make changes to this bug.