NetBSD Problem Report #51652

From www@NetBSD.org  Fri Nov 25 19:32:14 2016
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 485DD7A308
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 25 Nov 2016 19:32:14 +0000 (UTC)
Message-Id: <20161125193212.DD6F87A336@mollari.NetBSD.org>
Date: Fri, 25 Nov 2016 19:32:12 +0000 (UTC)
From: venture37@geeklan.co.uk
Reply-To: venture37@geeklan.co.uk
To: gnats-bugs@NetBSD.org
Subject: makefs dies due to segmentation fault
X-Send-Pr-Version: www-1.0

>Number:         51652
>Category:       bin
>Synopsis:       makefs dies due to segmentation fault
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 25 19:35:00 +0000 2016
>Closed-Date:    Sat Nov 26 03:33:25 +0000 2016
>Last-Modified:  Sat Nov 26 03:33:25 +0000 2016
>Originator:     Sevan Janiyan
>Release:        NetBSD-Head
>Organization:
>Environment:
NetBSD 7.99.42 (GENERIC) #0: Sat Nov 12 17:28:54 UTC 2016 amd64 x86_64
>Description:
Running makefs with a trivial test case of a couple of empty directories results in a coredump.

Is is also present on downstream consumers such as FreeBSD
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=212370

Heads up by Sascha Wildner.

GNU gdb (GDB) 7.12
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/makefs...(no debugging symbols found)...done.
[New process 1]
Core was generated by `makefs'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000000124407931 in cd9660_convert_structure ()
(gdb) bt
#0  0x0000000124407931 in cd9660_convert_structure ()
#1  0x00000001244092f4 in cd9660_makefs ()
#2  0x000000012442f5a2 in main ()
>How-To-Repeat:
mkdir /tmp/isoroot; cd /tmp/isoroot; mkdir t T; makefs -t cd9660 /tmp/t.iso .
>Fix:

>Release-Note:

>Audit-Trail:
From: Sevan Janiyan <venture37@geeklan.co.uk>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: bin/51652: makefs dies due to segmentation fault
Date: Fri, 25 Nov 2016 19:36:39 +0000

 From FreeBSD 12.0-CURRENT r308359

 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain
 conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "amd64-marcel-freebsd"...
 Core was generated by `makefs -t cd9660 /tmp/t.iso .'.
 Program terminated with signal 11, Segmentation fault.
 Reading symbols from /lib/libutil.so.9...Reading symbols from
 /usr/lib/debug//lib/libutil.so.9.debug...done.
 done.
 Loaded symbols for /lib/libutil.so.9
 Reading symbols from /lib/libsbuf.so.6...Reading symbols from
 /usr/lib/debug//lib/libsbuf.so.6.debug...done.
 done.
 Loaded symbols for /lib/libsbuf.so.6
 Reading symbols from /lib/libc.so.7...Reading symbols from
 /usr/lib/debug//lib/libc.so.7.debug...done.
 done.
 Loaded symbols for /lib/libc.so.7
 Reading symbols from /libexec/ld-elf.so.1...Reading symbols from
 /usr/lib/debug//libexec/ld-elf.so.1.debug...done.
 done.
 Loaded symbols for /libexec/ld-elf.so.1
 #0  cd9660_convert_structure (root=<value optimized out>,
     parent_node=<value optimized out>, level=<value optimized out>,
     numDirectories=0x7fff00000001, error=<value optimized out>)
     at /usr/src/usr.sbin/makefs/cd9660.c:1092
 1092				if (*naming == ';')
 (gdb) bt
 #0  cd9660_convert_structure (root=<value optimized out>,
     parent_node=<value optimized out>, level=<value optimized out>,
     numDirectories=0x7fff00000001, error=<value optimized out>)
     at /usr/src/usr.sbin/makefs/cd9660.c:1092
 #1  0x0000000000403a58 in cd9660_makefs (image=0x7fffffffed61 "/tmp/t.iso",
     dir=0x7fffffffed6c ".", root=0x80141d060, fsopts=<value optimized out>)
     at /usr/src/usr.sbin/makefs/cd9660.c:503
 #2  0x0000000000409400 in main (argc=<value optimized out>,
     argv=<value optimized out>) at /usr/src/usr.sbin/makefs/makefs.c:335
 #3  0x0000000000402d6f in _start ()
 #4  0x0000000800642000 in ?? ()
 #5  0x0000000000000000 in ?? ()
 Current language:  auto; currently minimal

From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: bin/51652: makefs dies due to segmentation fault
Date: Fri, 25 Nov 2016 21:24:50 +0100

 Note that the original report places the output file inside the content
 area - probably not a good idea.

 However, cd9660_handle_collisions calls cd9660_rename_filename with
 iter == NULL when I run this test on NetBSD-current.

 Martin

From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/51652 CVS commit: src/usr.sbin/makefs
Date: Fri, 25 Nov 2016 18:02:45 -0500

 Module Name:	src
 Committed By:	christos
 Date:		Fri Nov 25 23:02:45 UTC 2016

 Modified Files:
 	src/usr.sbin/makefs: cd9660.c

 Log Message:
 PR/51652: Sevan Janiyan: makefs dies due to segmentation fault
 Don't dereference NULL when running out of nodes during rename.


 To generate a diff of this commit:
 cvs rdiff -u -r1.52 -r1.53 src/usr.sbin/makefs/cd9660.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: sevan@NetBSD.org
State-Changed-When: Sat, 26 Nov 2016 03:33:25 +0000
State-Changed-Why:
Issue is resolved


>Unformatted:

Home	PR Database Search