SRU: partx wraps partition offset and length mod 2^32 (2^23 sectors)
| Affects | Status | Importance | Assigned to | Milestone | ||
|---|---|---|---|---|---|---|
| util-linux (Ubuntu) | ||||||
| Trusty |
Fix Released
|
High
|
Phillip Susi | |||
Bug Description
[Impact]
Partx is used to activate partitions on loopback devices. It is had a bug causing it to overflow and wraparound at the 4 GB mark, causing it to put the partitions in the wrong place giving access to the wrong areas of the disk, which at best, renders the activated partitions unusable, and at worst, may cause corrupt data to be written to disk.
[Test Case]
truncate -s 6g img
sudo losetup /dev/loop0 img
sudo parted -s /dev/loop0 mklabel msdos mkpart primary ext2 5g 6g
cat /sys/block/
The value should be 9764864, which corresponds to 4999610368 bytes. Instead the bug causes it to be 1376256, or 704643072 bytes.
[Regression Potential]
None. The fix was simply to change the data type of the argument to partx_add_partition from 32 bit ( unsigned long ) to 64 bit ( unsigned long long ), which upstream did long ago.
Related branches
- Martin Pitt: Approve
-
Diff: 27 lines (+8/-1)2 files modifieddebian/changelog (+7/-0)
partx/partx.h (+1/-1)
| Changed in util-linux (Ubuntu): | |
| assignee: | nobody → Phillip Susi (psusi) |
| importance: | Undecided → High |
| status: | New → In Progress |
| Phillip Susi (psusi) wrote | #1 |
| Phillip Susi (psusi) wrote | #2 |
| description: | updated |
| summary: |
- partx wraps partition offset and length mod 2^32 (2^23 sectors) + SRU: partx wraps partition offset and length mod 2^32 (2^23 sectors) |
| Changed in util-linux (Ubuntu Trusty): | |
| status: | New → In Progress |
| importance: | Undecided → High |
| assignee: | nobody → Phillip Susi (psusi) |
| no longer affects: | util-linux (Ubuntu) |
| Martin Pitt (pitti) wrote | #3 |
| Phillip Susi (psusi) wrote | #4 |
| Brian Murray (brian-murray) wrote Please test proposed package | #5 |
| Changed in util-linux (Ubuntu Trusty): | |
| status: | In Progress → Fix Committed |
| tags: |
added: verification-done removed: verfication-done |
| Launchpad Janitor (janitor) wrote | #7 |
| Changed in util-linux (Ubuntu Trusty): | |
| status: | Fix Committed → Fix Released |
| Brian Murray (brian-murray) wrote Update Released | #8 |
Yep, it's using the wrong data type. On amd64 it maps to a 64 bit int, which is why I never noticed this. On 32 bit platforms however, it maps to 32 bits.