ipmi_locate segfault on Focal (Dell iDRAC6/9)

Bug #1875771 reported by Jeff Lane 
14
This bug affects 1 person
Affects Status Importance Assigned to Milestone
freeipmi (Ubuntu)
Fix Released
Medium
Unassigned
Focal
Fix Released
Medium
Unassigned
Groovy
Fix Released
Medium
Unassigned

Bug Description

[Impact]

 * A variable was badly initialized leading to a 0x0 pointer that was
   accessed and segfaulting the program. In older versions this was
   hidden due to other fails leading to an early exit on such platforms
   (those we don't have to touch)

 * The Patch was upstreamed and hereby backported (applies as-is) to Focal

[Test Case]

 * There might be more affected systems, but he one we know so far
   are dell idrac6/9 so please test on those if possible.
   Obviously "regression tests" can be done on any system.
   - run ipmi-locate
   - without the fix it will segfault

[Regression Potential]

 * The initialization is done right at the beginning of the function
   and not accessed until the bad one we remove. So any user of that
   variable would have crashed. Due to that I think we can't regress a
   case that wasn't formerly segfaulting - which should be fine.
   The one change of behavior is that if people just ran the command (not
   checking output) and checked RC for further actions it might now on
   some systems actually work and return a difference RC.

[Other Info]

 * n/a

---

Ran ipmi-locate on a system running Focal. ipmi-locate returns the info I expect to see, and then segfaults (no core dump that I'm aware of).

ubuntu@mayapple:~$ sudo ipmi-locate --version
ipmi-locate - 1.6.4
Copyright (C) 2005-2015 FreeIPMI Core Team
This program is free software; you may redistribute it under the terms of
the GNU General Public License. This program has absolutely no warranty.
ubuntu@mayapple:~$ sudo ipmi-locate
Probing KCS device using DMIDECODE... done
IPMI Version: 2.0
IPMI locate driver: DMIDECODE
IPMI interface: KCS
BMC driver device:
BMC I/O base address: 0xCA8
Register spacing: 4

Probing SMIC device using DMIDECODE... FAILED

Probing BT device using DMIDECODE... FAILED

Probing SSIF device using DMIDECODE... FAILED

Probing KCS device using SMBIOS... FAILED

Probing SMIC device using SMBIOS... FAILED

Probing BT device using SMBIOS... FAILED

Probing SSIF device using SMBIOS... FAILED

Segmentation fault

On a machine running Bionic, it returns similar data but does not segfault afterwards:
bladernr@weavile:~$ sudo ipmi-locate --version
ipmi-locate - 1.4.11
Copyright (C) 2005-2014 FreeIPMI Core Team
This program is free software; you may redistribute it under the terms of
the GNU General Public License. This program has absolutely no warranty.
bladernr@weavile:~$ sudo ipmi-locate
Probing KCS device using DMIDECODE... done
IPMI Version: 2.0
IPMI locate driver: DMIDECODE
IPMI interface: KCS
BMC driver device:
BMC I/O base address: 0xCA2
Register spacing: 1

Probing SMIC device using DMIDECODE... FAILED

Probing BT device using DMIDECODE... FAILED

Probing SSIF device using DMIDECODE... FAILED

Probing KCS device using SMBIOS... FAILED

Probing SMIC device using SMBIOS... FAILED

Probing BT device using SMBIOS... FAILED

Probing SSIF device using SMBIOS... FAILED

Probing KCS device using ACPI... done
IPMI Version: 2.0
IPMI locate driver: ACPI
IPMI interface: KCS
BMC driver device:
BMC I/O base address: 0xCA3
Register spacing: 1

Probing SMIC device using ACPI... FAILED

Probing BT device using ACPI... FAILED

Probing SSIF device using ACPI... FAILED

Probing KCS device using PCI... FAILED

Probing SMIC device using PCI... FAILED

Probing BT device using PCI... FAILED

Probing SSIF device using PCI... FAILED

ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: freeipmi-tools 1.6.4-3ubuntu1
ProcVersionSignature: User Name 5.4.0-26.30-generic 5.4.30
Uname: Linux 5.4.0-26-generic x86_64
ApportVersion: 2.20.11-0ubuntu27
Architecture: amd64
CasperMD5CheckResult: skip
Date: Tue Apr 28 22:56:41 2020
ProcEnviron:
 TERM=screen-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=C.UTF-8
 SHELL=/bin/bash
SourcePackage: freeipmi
UpgradeStatus: No upgrade log present (probably fresh install)

Related branches

Revision history for this message
Jeff Lane  (bladernr) wrote :
Revision history for this message
Jeff Lane  (bladernr) wrote :

The issue appears to be with the version of freeipmi-tools in Focal.

I installed version 1.4.11 from Bionic on the Focal machine and ipmi-locate does not segfault:
ubuntu@mayapple:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04 LTS"
ubuntu@mayapple:~$ sudo ipmi-locate --version
ipmi-locate - 1.4.11
Copyright (C) 2005-2014 FreeIPMI Core Team
This program is free software; you may redistribute it under the terms of
the GNU General Public License. This program has absolutely no warranty.
ubuntu@mayapple:~$ sudo ipmi-locate
Probing KCS device using DMIDECODE... done
IPMI Version: 2.0
IPMI locate driver: DMIDECODE
IPMI interface: KCS
BMC driver device:
BMC I/O base address: 0xCA8
Register spacing: 4

Probing SMIC device using DMIDECODE... FAILED

Probing BT device using DMIDECODE... FAILED

Probing SSIF device using DMIDECODE... FAILED

Probing KCS device using SMBIOS... FAILED

Probing SMIC device using SMBIOS... FAILED

Probing BT device using SMBIOS... FAILED

Probing SSIF device using SMBIOS... FAILED

Probing KCS device using ACPI... FAILED

Probing SMIC device using ACPI... FAILED

Probing BT device using ACPI... FAILED

Probing SSIF device using ACPI... FAILED

Probing KCS device using PCI... FAILED

Probing SMIC device using PCI... FAILED

Probing BT device using PCI... FAILED

Probing SSIF device using PCI... FAILED

Revision history for this message
Paride Legovini (paride) wrote :

Hi Jeff,

No objection ipmi-locate shouldn't crash, so we have almost certainly have a bug here, however I couldn't reproduce the crash on a couple of Focal machines where I tried. Is there anything relevant you can think of which may play a role in the crash?

There is no Debian bug on this failure mode apparently.

Revision history for this message
Jeff Lane  (bladernr) wrote :

Hi Paride...

I did some additional testing and so far I have started seeing a pattern. The failing systems (the segfaulting ones) are all Dells with iDRAC6 (they're older Dells, 11G). I have one newer Dell system and it did not segfault. I also ran on HP, Supermicro, Quanta and Lenovo systems without issue. It seems limited to the older Dells with iDRAC6.

These are systems in my test lab, so I'm happy to run commands and such if it helps, just let me know if there's anything you may need from me. I wish ipmi-locate had some debug output... I'd have provided that if so.

Revision history for this message
Paride Legovini (paride) wrote :

Hi Jeff,

Interesting, thanks for the digging. I did search on the relevant bug trackers and mailing lists I could think of but couldn't find any similar bug report. I think this will require some debugging on an affected machine. To start with I'd try to find out which version of the freeipmi Ubuntu package first shows the problem. I'll discuss this bug with the team.

tags: added: server-triage-discuss
tags: removed: server-triage-discuss
Changed in freeipmi (Ubuntu):
importance: Undecided → Medium
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

I wonder how common those systems would be for the overall Ubuntu users?
Might be important for the priority.

Is there any chance you could report upstream to see if they are aware (or even intentional drop of something).

And on the other side is there a way to easily get a login to a system - not to work on all of it until it resolves completely. But maybe one can at least do a quick check what exactly crashes for a better upstream report.

Changed in freeipmi (Ubuntu):
status: New → Incomplete
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for freeipmi (Ubuntu) because there has been no activity for 60 days.]

Changed in freeipmi (Ubuntu):
status: Incomplete → Expired
Revision history for this message
Jeff Lane  (bladernr) wrote :

Bah... I was going to let this just die, because the only thing we could ever reproduce it on were old iDRAC6 systems.

But now, according to this bug: #1893136 it appears that this is also segfaulting on some very new Dell systems with iDRAC9, so we definitely will need to get this issue resolved.

Changed in freeipmi (Ubuntu):
status: Expired → Confirmed
Revision history for this message
Bryce Harrington (bryce) wrote :

I confirmed Paride's finding that it neither reproduces on my own hardware nor are forum/blog/google searches turn up anything useful. Bug #1893136 does indeed appear to be a dupe to this bug (once confirmed by the reporter it can be set as a dupe of this).

Given that the affected systems appear to all be Dell PowerEdge servers, and only Dell, if someone has a support contract with Dell it would be good to get them involved. Forwarding upstream also makes sense however they likely will not have the HW in question so will want additional detail.

A full stack trace is probably the most important first step, as that will reveal what is going on. Having stack traces for both iDRAC9 and iDRAC9 systems would allow confirming that it is indeed the same bug.

I would try installing debug packages for freeipmi, and then running the command while logged into the physical system, via `gdb ipmi-locate`, then:

(gdb) set logging file gdb-freeipmi.txt
(gdb) set logging on
(gdb) backtrace full

Then attach gdb-freeipmi.txt here.

I don't know for certain if the debug packages need to be installed in order to get symbols shown, but if so directions for installing them can be found online (e.g. at https://wiki.ubuntu.com/DebuggingProgramCrash).

Changed in freeipmi (Ubuntu):
status: Confirmed → Incomplete
Bryce Harrington (bryce)
summary: - ipmi_locate segfault on Focal
+ ipmi_locate segfault on Focal (Dell iDRAC6/9)
Revision history for this message
Jeff Lane  (bladernr) wrote :

Here's the gdb log from version 1.6.4 on groovy on the older iDRAC6 system. I'm waiting on Michael to get the same from the newer iDRAC9 system.

Revision history for this message
Jeff Lane  (bladernr) wrote :

One further comment, this was discovered while trying to do certification at the Dell labs in Austin. So unfortunately, I don't know that we have any avenue to involve them, but we can poke our contacts in the Dell testing team to see if they can assist further.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

The log has no line numbers in most places.
So I guess we need debug packages.

I've looked at the bit we see, the call from ipmi-locate.c:283 is the same in Bionic and Focal.

275 static void
276 acpi_probe_display (ipmi_locate_ctx_t ctx)
277 {
278 struct ipmi_locate_info info;
279
280 assert (ctx);
281
282 printf ("Probing KCS device using ACPI... ");
283 if (!ipmi_locate_acpi_spmi_get_device_info (ctx,
284 IPMI_INTERFACE_KCS,
285 &info))

That function then in libfreeipmi/locate/ipmi-locate-acpi-spmi.c is the same (due to patches on top of Bionic that were later part of upstream).

For better debug actually a debug build and then a core dump of it would be awesome (more knowledge, less guessing).
Please:
- use the package from this PPA [1] for further tests
- also install debug symbols from the PPA [2]

The interesting bits seem to happen in /lib/libfreeipmi.so.17 according to your dump.

Please install these:
$ apt install libfreeipmi17-dbgsym freeipmi-tools-dbgsym

To ensure we get a core dump this might be helpful:
$ apt install apport whoopsie

With the above in place trigger the crash:
- once as bryce showed with gdb and report the output file (hopefully with better info now)
- once without gdb which should create a /var/crash/ file
  - use apport-retrace and report the output here
    $ apport-retrace /var/crash/<yourfile>.crash --stdout
  - attach the .crash file to this bug

P.S. @Jeff/Michael is there any chance we could get a login to such a system for an hour to do some debugging in place?

[1]: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4237
[2]: https://wiki.ubuntu.com/DebuggingProgramCrash#Installing_dbgsym_packages_from_a_PPA

Revision history for this message
Jeff Lane  (bladernr) wrote :

Sorry about that... I had the debug for freeipmi-tools installed, but not for libfreeipmi17. Corrected and here's the gdb trace.

This is for 1.6.4 on Focal on an older Dell w/ iDRAC6

Revision history for this message
Jeff Lane  (bladernr) wrote :

And here's the crash file for ipmi-locate on the older iDRAC6 machine w/ Focal...

Note, apport-retrace errors out saying:
# apport-retrace /var/crash/_usr_sbin_ipmi-locate.0.crash --stdout
ERROR: report file does not contain one of the required fields: Package

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Just add --rebuild-package-info and it will add the Package data

Revision history for this message
Jeff Lane  (bladernr) wrote : Re: [Bug 1875771] Re: ipmi_locate segfault on Focal (Dell iDRAC6/9)
Download full text (4.3 KiB)

ahhh thanks.

Here's a text dump of that adding --rebuild-package-info.

On Tue, Sep 1, 2020 at 11:10 AM Christian Ehrhardt 
<email address hidden> wrote:
>
> Just add --rebuild-package-info and it will add the Package data
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1875771
>
> Title:
> ipmi_locate segfault on Focal (Dell iDRAC6/9)
>
> Status in freeipmi package in Ubuntu:
> Incomplete
>
> Bug description:
> Ran ipmi-locate on a system running Focal. ipmi-locate returns the
> info I expect to see, and then segfaults (no core dump that I'm aware
> of).
>
> ubuntu@mayapple:~$ sudo ipmi-locate --version
> ipmi-locate - 1.6.4
> Copyright (C) 2005-2015 FreeIPMI Core Team
> This program is free software; you may redistribute it under the terms of
> the GNU General Public License. This program has absolutely no warranty.
> ubuntu@mayapple:~$ sudo ipmi-locate
> Probing KCS device using DMIDECODE... done
> IPMI Version: 2.0
> IPMI locate driver: DMIDECODE
> IPMI interface: KCS
> BMC driver device:
> BMC I/O base address: 0xCA8
> Register spacing: 4
>
> Probing SMIC device using DMIDECODE... FAILED
>
> Probing BT device using DMIDECODE... FAILED
>
> Probing SSIF device using DMIDECODE... FAILED
>
> Probing KCS device using SMBIOS... FAILED
>
> Probing SMIC device using SMBIOS... FAILED
>
> Probing BT device using SMBIOS... FAILED
>
> Probing SSIF device using SMBIOS... FAILED
>
> Segmentation fault
>
>
> On a machine running Bionic, it returns similar data but does not segfault afterwards:
> bladernr@weavile:~$ sudo ipmi-locate --version
> ipmi-locate - 1.4.11
> Copyright (C) 2005-2014 FreeIPMI Core Team
> This program is free software; you may redistribute it under the terms of
> the GNU General Public License. This program has absolutely no warranty.
> bladernr@weavile:~$ sudo ipmi-locate
> Probing KCS device using DMIDECODE... done
> IPMI Version: 2.0
> IPMI locate driver: DMIDECODE
> IPMI interface: KCS
> BMC driver device:
> BMC I/O base address: 0xCA2
> Register spacing: 1
>
> Probing SMIC device using DMIDECODE... FAILED
>
> Probing BT device using DMIDECODE... FAILED
>
> Probing SSIF device using DMIDECODE... FAILED
>
> Probing KCS device using SMBIOS... FAILED
>
> Probing SMIC device using SMBIOS... FAILED
>
> Probing BT device using SMBIOS... FAILED
>
> Probing SSIF device using SMBIOS... FAILED
>
> Probing KCS device using ACPI... done
> IPMI Version: 2.0
> IPMI locate driver: ACPI
> IPMI interface: KCS
> BMC driver device:
> BMC I/O base address: 0xCA3
> Register spacing: 1
>
> Probing SMIC device using ACPI... FAILED
>
> Probing BT device using ACPI... FAILED
>
> Probing SSIF device using ACPI... FAILED
>
> Probing KCS device using PCI... FAILED
>
> Probing SMIC device using PCI... FAILED
>
> Probing BT device using PCI... FAILED
>
> Probing SSIF device using PCI... FAILED
>
> ProblemType: Bug
> DistroRelease: Ubuntu 20.04
> Package: freeipmi-tools 1.6.4-3ubuntu1
> ProcVersionSignature: User Name 5.4.0-26.30-generic 5.4...

Read more...

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Thanks Jeff!

Fail at _ipmi_acpi_get_table
  1031: *acpi_table = NULL;
At this time we see acpi_table=0x0
So dereference 0x0 and segfault.

Now how far up does this crash have data...

_ipmi_acpi_get_firmware_table does
1485 uint8_t *acpi_table = NULL;
...
1498 if ((_ipmi_acpi_get_table_sysfs (ctx, signature, table_instance,
1499 &acpi_table, &acpi_table_length) != 0))

So if _ipmi_acpi_get_table_sysfs returns != 0 BUT keeps acpi_table unset our bug will happen.
The crash no more holds the execution stack of _ipmi_acpi_get_table_sysfs as that is completed, but we can check the function if anything obvious is there (and different to Bionic).

 _ipmi_acpi_get_firmware_table (signature=0x7f731c71582e "SPMI", sign_table_data_length=<synthetic pointer>, sign_table_data=<synthetic pointer>, table_instance=0, ctx=0x55c6e4ab4510)

To reach rv=0 it needs to reach
1233 *acpi_table = acpi_table_buf;

The "malloc of" and "read into" of acpi_table_buf have to succeed to not hit "cleanup".
But if acpi_table_length would be zero, then malloc can return NULL and read returning 0 would be accepted.

acpi_table_length is from
  lseek (sysfs_acpi_fd, 0, SEEK_END)

Theory: /sys/firmware/acpi/tables/SPMI* contains an empty file - that might lead to the crash.

Example of a HP system:
$ sudo cat /sys/firmware/acpi/tables/SPMI
SPMIA�HP ProLiantHP �

Comparing Focal/Bionic in regard to _ipmi_acpi_get_firmware_table / _ipmi_acpi_get_table_sysfs doesn't point to anything obvious. I'd assume the change that makes one work is in a different place (e.g. not calling into the function at all).

@Jeff
 - what does the system have at /sys/firmware/acpi/tables/SPMI ?
   file list and stat please
   $ ls -laF /sys/firmware/acpi/tables/SPMI*
   $ stat /sys/firmware/acpi/tables/SPMI*
 - if not too much attaching the file(s) here would be awesome

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Yeah, there is no /sys/firmware/acpi/tables/SPMI* at all on that system.
So the difference must be in the code that makes it reach that path with the Focal code but not on Bionic.

Revision history for this message
Andrew Cloke (andrew-cloke) wrote :

Marking as "confirmed" as it sounds as if Christian & Jeff are homing in on the root cause.

Changed in freeipmi (Ubuntu):
status: Incomplete → Confirmed
Revision history for this message
Bryce Harrington (bryce) wrote :

1260: static int
1261: _ipmi_acpi_get_table_dev_mem (ipmi_locate_ctx_t ctx,
1262: char *signature,
1263: unsigned int table_instance,
1264: uint8_t **acpi_table,
1265: uint32_t *acpi_table_length)
1266: {
...
1305: assert (acpi_table);
1306: assert (acpi_table_length);
1307:
1308: *acpi_table = NULL;
...
1387: acpi_table = NULL;
1388: acpi_table_length = 0;
1389: for (i = 0, signature_table_count = 0; i < acpi_table_count; i++)
1340: {
...
1429: if (_ipmi_acpi_get_table (ctx,
1430: table_address,
1431: signature,
1432: acpi_table,
1433: acpi_table_length) < 0)
1434: continue;
...
1440: free (acpi_table);
1441: acpi_table = NULL;
1442: acpi_table_length = 0;
1443: }

_ipmi_acpi_get_table() is documented as requiring malloc'd memory passed in via its acpi_table argument, and in fact asserts that it's non null before using it. So passing acpi_table=NULL is a programming error, yet it appears this is what happens via line 1387.

I wonder if perhaps what was meant on line 1387 was:

1387: *acpi_table = NULL;

If it was, that seems redundant with line 1308 so still seems odd. In any case, setting acpi_table = NULL and then passing that to _ipmi_acpi_get_table() seems very suspect. It might be interesting to see what would happen if you try commenting out line 1387 and trying to reproduce the crash? It looks like this code was added in 0.7.15-1 (Nov 2009).

Revision history for this message
Jeff Lane  (bladernr) wrote :

On Wed, Sep 2, 2020 at 1:20 PM Bryce Harrington
<email address hidden> wrote:

> If it was, that seems redundant with line 1308 so still seems odd. In
> any case, setting acpi_table = NULL and then passing that to
> _ipmi_acpi_get_table() seems very suspect. It might be interesting to
> see what would happen if you try commenting out line 1387 and trying to
> reproduce the crash? It looks like this code was added in 0.7.15-1 (Nov
> 2009).

So I tried that, and no segfault...

Output before:
ubuntu@mayapple:~/source$ sudo ipmi-locate
Probing KCS device using DMIDECODE... done
IPMI Version: 2.0
IPMI locate driver: DMIDECODE
IPMI interface: KCS
BMC driver device:
BMC I/O base address: 0xCA8
Register spacing: 4

Probing SMIC device using DMIDECODE... FAILED

Probing BT device using DMIDECODE... FAILED

Probing SSIF device using DMIDECODE... FAILED

Probing KCS device using SMBIOS... FAILED

Probing SMIC device using SMBIOS... FAILED

Probing BT device using SMBIOS... FAILED

Probing SSIF device using SMBIOS... FAILED

Segmentation fault

And output after:
ubuntu@mayapple:~/source$ sudo ipmi-locate
Probing KCS device using DMIDECODE... done
IPMI Version: 2.0
IPMI locate driver: DMIDECODE
IPMI interface: KCS
BMC driver device:
BMC I/O base address: 0xCA8
Register spacing: 4

Probing SMIC device using DMIDECODE... FAILED

Probing BT device using DMIDECODE... FAILED

Probing SSIF device using DMIDECODE... FAILED

Probing KCS device using SMBIOS... FAILED

Probing SMIC device using SMBIOS... FAILED

Probing BT device using SMBIOS... FAILED

Probing SSIF device using SMBIOS... FAILED

Probing KCS device using ACPI... FAILED

Probing SMIC device using ACPI... FAILED

Probing BT device using ACPI... FAILED

Probing SSIF device using ACPI... FAILED

Probing KCS device using PCI... FAILED

Probing SMIC device using PCI... FAILED

Probing BT device using PCI... FAILED

Probing SSIF device using PCI... FAILED

all I did was, as you suggested, commented out line 1387, and this
runs to completion and exits successfully.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Waaaaay back it seems it set this to zero for a reason.
http://git.savannah.gnu.org/cgit/freeipmi.git/commit/?id=68ed819225bdb529f34baca74e499a9645da5197

acpi_table was a global vaiable before and the predecessor of "_ipmi_acpi_get_table" called "ipmi_acpi_get_table" was called with an & operator.

+ if (ipmi_acpi_get_table (table_address, signature,
+ &acpi_table,
+ &acpi_table_length) != 0)

Back then it cleared the former value, just as today line 1308 still does with "*acpi_table = NULL;" (clears the value not the pointer).

Things changed a lot since then and as Bryce stated "_ipmi_acpi_get_table" expects malloc'ed memory which it isn't anymore after setting the pointer itself back to NULL.

The last piece to the puzzle is why it wasn't broken before as Jeff reported Bionic to work.
This is true, but the error we found is there.

It has an early exit in "_ipmi_acpi_get_table_dev_mem" before it gets to the bad code.
In Bionic _ipmi_acpi_get_rsdp always returns -1 and never finds anything.
This was fixed by the massive cleanup of
http://git.savannah.gnu.org/cgit/freeipmi.git/commit/?id=094cd5ce63aff8597ff8f45f2efd014d24995747

That is in freeipmi since 1.6.0 and unblocks the code in Focal to reach the bad acpi_table re-initialization.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Now that we have the root cause and also explain why we see it now and not in the past I have prepped this as a fix and submitted it:
https://lists.gnu.org/archive/html/freeipmi-devel/2020-09/msg00001.html

Let us see what the response there is and then consider applying the fix in Focal and Groovy.

Revision history for this message
Bryce Harrington (bryce) wrote :

Jeff, thanks for testing that, and yeah that confirms the line in question is in error.

Christian, good work on the additional archaeology which reveals how this error originated, and on the packaging to get this into the distro.

Removing the bad line seems like the good fix/workaround for this problem, and I've +1'd the MP to get this repaired in Ubuntu.

Nicely done all around. :-)

Changed in freeipmi (Ubuntu Focal):
status: New → Triaged
Changed in freeipmi (Ubuntu Groovy):
status: Confirmed → Triaged
Changed in freeipmi (Ubuntu Focal):
importance: Undecided → Medium
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package freeipmi - 1.6.4-3ubuntu2

---------------
freeipmi (1.6.4-3ubuntu2) groovy; urgency=medium

  * d/p/lp-1875771-libfreeipmi-fix-segfault-in-SPMI-parsing.patch: fix
    crash on Dell iDRAC6/9 (LP: #1875771

 -- Christian Ehrhardt <email address hidden> Thu, 03 Sep 2020 09:25:11 +0200

Changed in freeipmi (Ubuntu Groovy):
status: Triaged → Fix Released
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Upstream as
commit 7afb97681d5ccdc237891a8d2a3ec1c994958dd0
Author: Christian Ehrhardt <email address hidden>
Date: Thu Sep 3 03:48:57 2020 -0700

    libfreeipmi: fix segfault in SPMI parsing

on branch:
upstream/freeipmi-1-6-0-stable

Prepping this for Focal

=> https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4251/+packages
=> https://code.launchpad.net/~paelzer/ubuntu/+source/freeipmi/+git/freeipmi/+merge/390350

description: updated
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Jeff, or anyone else affected,

Accepted freeipmi into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/freeipmi/1.6.4-3ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in freeipmi (Ubuntu Focal):
status: Triaged → Fix Committed
tags: added: verification-needed verification-needed-focal
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Download full text (4.4 KiB)

Pre:
ii freeipmi-common 1.6.4-3ubuntu1 all GNU implementation of the IPMI protocol - common files
ii freeipmi-tools 1.6.4-3ubuntu1 amd64 GNU implementation of the IPMI protocol - tools
ii libfreeipmi17 1.6.4-3ubuntu1 amd64 GNU IPMI - libraries
ii libipmiconsole2 1.6.4-3ubuntu1 amd64 GNU IPMI - Serial-over-Lan library
ii libipmidetect0 1.6.4-3ubuntu1 amd64 GNU IPMI - IPMI node detection library

$ sudo ipmi-locate
Probing KCS device using DMIDECODE... done
IPMI Version: 2.0
IPMI locate driver: DMIDECODE
IPMI interface: KCS
BMC driver device:
BMC I/O base address: 0xCA8
Register spacing: 4

Probing SMIC device using DMIDECODE... FAILED

Probing BT device using DMIDECODE... FAILED

Probing SSIF device using DMIDECODE... FAILED

Probing KCS device using SMBIOS... FAILED

Probing SMIC device using SMBIOS... FAILED

Probing BT device using SMBIOS... FAILED

Probing SSIF device using SMBIOS... FAILED

Segmentation fault

## Upgrade to proposed
$ v="1.6.4-3ubuntu1.1"; sudo apt install freeipmi-tools=$v libfreeipmi17=$v freeipmi-common=$v libipmiconsole2=$v libipmidetect0=$v
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libmysqlclient21 libopenipmi0 libsnmp-base libsnmp35 mysql-common openipmi
Use 'sudo apt autoremove' to remove them.
Suggested packages:
  freeipmi-ipmidetect freeipmi-bmc-watchdog
The following packages will be upgraded:
  freeipmi-common freeipmi-tools libfreeipmi17 libipmiconsole2 libipmidetect0
5 upgraded, 0 newly installed, 0 to remove and 88 not upgraded.
Need to get 1810 kB of archives.
After this operation, 4096 B disk space will be freed.
Get:1 http://us.archive.ubuntu.com/ubuntu focal-proposed/main amd64 libipmidetect0 amd64 1.6.4-3ubuntu1.1 [32.3 kB]
Get:2 http://us.archive.ubuntu.com/ubuntu focal-proposed/main amd64 libfreeipmi17 amd64 1.6.4-3ubuntu1.1 [875 kB]
Get:3 http://us.archive.ubuntu.com/ubuntu focal-proposed/main amd64 libipmiconsole2 amd64 1.6.4-3ubuntu1.1 [86.9 kB]
Get:4 http://us.archive.ubuntu.com/ubuntu focal-proposed/main amd64 freeipmi-tools amd64 1.6.4-3ubuntu1.1 [636 kB]
Get:5 http://us.archive.ubuntu.com/ubuntu focal-proposed/main amd64 freeipmi-common all 1.6.4-3ubuntu1.1 [179 kB]
Fetched 1810 kB in 0s (32.1 MB/s)
(Reading database ... 106008 files and directories currently installed.)
Preparing to unpack .../libipmidetect0_1.6.4-3ubuntu1.1_amd64.deb ...
Unpacking libipmidetect0 (1.6.4-3ubuntu1.1) over (1.6.4-3ubuntu1) ...
Preparing to unpack .../libfreeipmi17_1.6.4-3ubuntu1.1_amd64.deb ...
Unpacking libfreeipmi17 (1.6.4-3ubuntu1.1) over (1.6.4-3ubuntu1) ...
Preparing to unpack .../libipmiconsole2_1.6.4-3ubuntu1.1_amd64.deb ...
Unpacking libipmiconsole2 (1.6.4-3ubuntu1.1) over (1.6.4-3ubuntu1) ...
Preparing to unpack .../freeipmi-tools_1.6.4-3ubuntu1.1_amd64.deb ...
Unpacking freeipmi-tools (1.6.4-3ubuntu1.1) over (1.6.4-3ubuntu1) ...
Preparing to unpack .../freeipmi-common_1.6.4-3ubuntu1.1_all.deb ...
Unpacking freeipmi-common (1.6.4-3ubuntu1.1) over (1.6.4-3ubuntu1) ...
Setting up freeipmi-common (1.6.4-3ubuntu1.1) ......

Read more...

tags: added: verification-done verification-done-focal
removed: verification-needed verification-needed-focal
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package freeipmi - 1.6.4-3ubuntu1.1

---------------
freeipmi (1.6.4-3ubuntu1.1) focal; urgency=medium

  * d/p/lp-1875771-libfreeipmi-fix-segfault-in-SPMI-parsing.patch: fix
    crash on Dell iDRAC6/9 (LP: #1875771)

 -- Christian Ehrhardt <email address hidden> Mon, 07 Sep 2020 09:02:06 +0200

Changed in freeipmi (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Update Released

The verification of the Stable Release Update for freeipmi has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.