Bug 276517 - disklabel(8) buffer overflow/crash when editing label with more than 8 partitions
Summary: disklabel(8) buffer overflow/crash when editing label with more than 8 partit...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 13.2-RELEASE
Hardware: amd64 Any
: --- Affects Many People
Assignee: Ed Maste
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-22 09:42 UTC by Don Yuniskis
Modified: 2024-04-02 13:59 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Don Yuniskis 2024-01-22 09:42:15 UTC
Running the LiveCD option of the "bootonly" iso on an Atom 330 1.6GHz
with 4G of RAM

(I am assuming disklabel(8) executable on "bootonly" media is same as release)

Alter "8 partitions" to reflect "10 partitions", as desired.
Only fully specify 9 of them -- a-i.  Exiting disklabel
complains about j -- which I had not specified (uninitialized
structure member, perhaps?).

Reedit to specify j.  Disklabel(8) complains of stack overflow
and abends.

Return to "8 partitions" and delete the 'i' entry.
Installer complains that 'h' (the 8th entry) has an
invalid type -- dspite being the same (4.2BSD) as
the other non-swap partitions.

Note that resorting to manual partitioning was an expedient as
the installer is really clunky when it comes to this.  (but,
while NetBSD's is much friendlier, it still leaves a lot to
be desired!)

I've not pursued this as it is likely easier for me to
port the package I'm interested in to NetBSD than to
try to ferret out all the differences in FreeBSD since
I left the camp (decades? ago).

[Shout-out to Joerg Wunsch -- if he's still kicking about!]
Comment 1 Ed Maste freebsd_committer freebsd_triage 2024-01-22 15:58:22 UTC
Can you please provide detailed reproduction steps - it is not clear to me if you are using the partition editor built into the installer, or attempting to partition the target disk from the command line.

Note that BSD diskabels support a maximum of 8 entries, and the 'c' partition has a predefined purpose and isn't available for use.
Comment 2 Don Yuniskis 2024-01-22 20:30:01 UTC
(In reply to Ed Maste from comment #1)

Note my actions are the result of NOT being able to get
the installer to "do what I wanted".

Drop to shell.  Invoke disklabel(8) from command line.
s/8 partitions/10 partitions/
Append "i: blah blah 4.2BSD blah blah"
Exit

(note result returning to bsdinstall)

Reinvoke disklabel from CLI.
Append "j: blah blah 4.2BSD blah blah"
Exit

(note result returning to bsdinstall)

From shell, invoke disklabel.
Remove all but first 8 partitions.
Exit

Let installer try to use label.  'h' complains of bad type.

I am aware of the special significance of the 'c' partition
(In NetBSD, 'b', c' and 'd' have had similar treatment over
the years)

I was NOT aware of the 8 partition limit (I have 16 partitions
on that disk with the machine now running NetBSD).  This appears
to be a limitation of FreeBSD's disklabel, not "BSD".

As such, you should just verify the '8' limit is enforced properly
even if s/8/10/.  I.e., I would have expected a complaint when
I altered the "8" and the 'i' line to have been elided.
Comment 3 Ed Maste freebsd_committer freebsd_triage 2024-01-22 21:07:31 UTC
Actually it seems I am mistaken - GEOM_PART_BSD supports disklabels with between 8 and 20 partitions, although disklabel(8) states "The partition table can have up to 8 entries."
Comment 4 Ed Maste freebsd_committer freebsd_triage 2024-01-23 02:06:26 UTC
Yes bsdlabel is just broken when there are more than 8 partitions.

Note this, from sys/sys/disk/bsd.h:
#define BSD_NPARTS_MIN          8
#define BSD_NPARTS_MAX          20

struct disklabel {
...
        struct partition {              /* the partition table */
...
        } d_partitions[BSD_NPARTS_MIN]; /* actually may be more */
};
Comment 5 commit-hook freebsd_committer freebsd_triage 2024-01-23 02:18:37 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=3f4f82c0d7791bddf2d6f2c29d9f2f8c48c712e2

commit 3f4f82c0d7791bddf2d6f2c29d9f2f8c48c712e2
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-01-23 02:05:58 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-01-23 02:17:23 +0000

    bsdlabel: limit to 8 partitions

    bsdlabel is intended to support up to 20 partitions, but the disklabel
    struct has a d_partitions array with only BSD_NPARTS_MIN (8) entries.
    Previously, an attempt to operate on a bsdlabel with more than eight
    partitions resulted in a buffer overflow.

    As a stopgap limit bsdlabel to 8 partitions until this is fixed
    properly.

    PR:             276517

 sbin/bsdlabel/bsdlabel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 6 commit-hook freebsd_committer freebsd_triage 2024-03-22 18:44:08 UTC
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=a323dd42bcacdcd6b710fb90ba6691c6ce60cd3d

commit a323dd42bcacdcd6b710fb90ba6691c6ce60cd3d
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-01-23 02:05:58 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-03-22 18:42:59 +0000

    bsdlabel: limit to 8 partitions

    bsdlabel is intended to support up to 20 partitions, but the disklabel
    struct has a d_partitions array with only BSD_NPARTS_MIN (8) entries.
    Previously, an attempt to operate on a bsdlabel with more than eight
    partitions resulted in a buffer overflow.

    As a stopgap limit bsdlabel to 8 partitions until this is fixed
    properly.

    PR:             276517
    (cherry picked from commit 3f4f82c0d7791bddf2d6f2c29d9f2f8c48c712e2)

 sbin/bsdlabel/bsdlabel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 7 commit-hook freebsd_committer freebsd_triage 2024-03-22 18:46:09 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=a59eba2caacf82f741e8bbc334b2382c615744df

commit a59eba2caacf82f741e8bbc334b2382c615744df
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-01-23 02:05:58 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-03-22 18:45:13 +0000

    bsdlabel: limit to 8 partitions

    bsdlabel is intended to support up to 20 partitions, but the disklabel
    struct has a d_partitions array with only BSD_NPARTS_MIN (8) entries.
    Previously, an attempt to operate on a bsdlabel with more than eight
    partitions resulted in a buffer overflow.

    As a stopgap limit bsdlabel to 8 partitions until this is fixed
    properly.

    PR:             276517
    (cherry picked from commit 3f4f82c0d7791bddf2d6f2c29d9f2f8c48c712e2)
    (cherry picked from commit a323dd42bcacdcd6b710fb90ba6691c6ce60cd3d)

 sbin/bsdlabel/bsdlabel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 8 commit-hook freebsd_committer freebsd_triage 2024-03-25 22:27:11 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=7dc5c6c4120ee6d5a028a1e01cdc1bfbe9499634

commit 7dc5c6c4120ee6d5a028a1e01cdc1bfbe9499634
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-03-25 22:25:05 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-03-25 22:26:29 +0000

    bsdlabel: add BUGS section documenting 8 partition limit

    PR:             276517

 sbin/bsdlabel/bsdlabel.8 | 5 +++++
 1 file changed, 5 insertions(+)
Comment 9 commit-hook freebsd_committer freebsd_triage 2024-04-02 13:56:58 UTC
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=9f9289901c86e88c7eb357ecfe3334369356b1b0

commit 9f9289901c86e88c7eb357ecfe3334369356b1b0
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-03-25 22:25:05 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-04-02 13:56:28 +0000

    bsdlabel: add BUGS section documenting 8 partition limit

    PR:             276517
    (cherry picked from commit 7dc5c6c4120ee6d5a028a1e01cdc1bfbe9499634)

 sbin/bsdlabel/bsdlabel.8 | 5 +++++
 1 file changed, 5 insertions(+)
Comment 10 commit-hook freebsd_committer freebsd_triage 2024-04-02 13:59:06 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=51b2556ee60a503f89064152a897722a2daaa199

commit 51b2556ee60a503f89064152a897722a2daaa199
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-03-25 22:25:05 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-04-02 13:58:37 +0000

    bsdlabel: add BUGS section documenting 8 partition limit

    PR:             276517
    (cherry picked from commit 7dc5c6c4120ee6d5a028a1e01cdc1bfbe9499634)
    (cherry picked from commit 9f9289901c86e88c7eb357ecfe3334369356b1b0)

 sbin/bsdlabel/bsdlabel.8 | 5 +++++
 1 file changed, 5 insertions(+)