Hi Rupesh,
Thanks for checking this.
Yes, please sponsor this fix separately. While bug #2164589 requests
upgrading the whole crash package to 9.0.2 on Noble, a full major
upgrade carries substantial regression risk for an LTS release and can
take a long time to review. In contrast, this is a minimal 5-line
backport of upstream commit ad427b7f8ffc that strictly fixes the stack
buffer overflow in proc_kcore_init_64() without touching anything else.
I have updated the bug description above with the full SRU justification
and attached crash_8.0.4-1ubuntu2.2.debdiff against crash
8.0.4-1ubuntu2.1 currently in noble-updates. The patch builds cleanly on
Noble amd64 and has been verified on the testbed.
** Description changed:
- This problem occurs with crash v8.0.4 version part of Ubuntu 24.04.4
- LTS, and only during live usage but not post-mortem.
+ [ Impact ]
+ On Ubuntu 24.04 LTS (Noble Numbat), running crash in live mode against
/proc/kcore (e.g. `crash /usr/lib/debug/boot/vmlinux-... /proc/kcore`) crashes
with SIGSEGV on systems where /proc/kcore exposes more than 584 program headers
(common on multi-NUMA, large-RAM, or fragmented direct-map memory layouts).
+
+ The root cause is in netdump.c:proc_kcore_init_64() (and
+ proc_kcore_init_32()). The ELF header was read into a fixed 32KB stack
+ buffer `char eheader[MAX_KCORE_ELF_HEADER_SIZE]`. Each 64-bit program
+ header takes 56 bytes. When pkd->header_size exceeds 32,768 bytes, the
+ unpatched code calls `BCOPY(&eheader[0], &pkd->elf_header[0],
+ pkd->header_size)`. This over-reads the 32KB stack buffer and copies
+ random stack memory into the heap allocation. When crash later traverses
+ segment descriptors past index 583 to translate physical addresses, it
+ dereferences garbage pointers and crashes with SIGSEGV.
+
+ [ Fix ]
+ Backport upstream commit ad427b7f8ffc24c9621a1836d8027d5992c9a11a ("fix
eheader overflow") by Bruno Faccini:
+ Instead of copying through a fixed 32KB stack buffer, read pkd->header_size
bytes directly from the /proc/kcore file descriptor into pkd->elf_header, which
is already dynamically allocated on the heap via calloc(pkd->header_size, 1).
+
+ [ Test Plan ]
+ 1. Reproduction:
+ - On Noble, run crash in live mode on a system with > 584 program headers in
/proc/kcore.
+ - With crash 8.0.4-1ubuntu2.1, crash terminates with a Segmentation fault
during initialization or when inspecting addresses past segment 583.
+ 2. Verification:
+ - Install crash 8.0.4-1ubuntu2.2 from noble-proposed.
+ - Run `crash /usr/lib/debug/boot/vmlinux-... /proc/kcore`.
+ - Verify that crash starts cleanly, shows the interactive prompt, and
commands like `sys`, `kmem -i`, `ps`, and `bt` complete without error.
+ - Verify that post-mortem dump analysis (`crash vmlinux vmcore`) continues to
work as expected.
+
+ [ Where problems could occur ]
+ The change is strictly isolated to proc_kcore_init_32() and
proc_kcore_init_64() in netdump.c, replacing the stack BCOPY with a direct
read() from fd. If read() fails, the existing error path prints an error and
exits cleanly via goto bailout. Regression risk is minimal and restricted to
live /proc/kcore sessions; offline vmcore analysis is unaffected.
+
+ [ Other Info ]
+ This targeted fix restores live debugging on Noble immediately and cleanly
without blocking on the major 9.0.2 version upgrade tracked in bug #2164589.
+
+ [ Original Description ]
+ This problem occurs with crash v8.0.4 version part of Ubuntu 24.04.4 LTS, and
only during live usage but not post-mortem.
The following upstream commit, part of crash-9.0.2 release describes and
fixes the issue:
fix eheader overflow
crash-utility live session fails solid with a SEGV, where it seems
that with some (new ?) Kernels and configurations /proc/kcore
- exposes a first “Note” program-header along with a big number of
+ exposes a first "Note" program-header along with a big number of
other headers (particularly when direct-map area generated from
physical memory map have a lot of entries), causing eheader[]
overflow (a stack underflow in fact since it is an automatic
variable!) because the whole size exceeds MAX_KCORE_ELF_HEADER_SIZE.
This problem still occur with latest utility version, and the
following patch has been proven to fix.
- Signed-off-by: Bruno Faccini <[email protected]>
+ Signed-off-by: Bruno Faccini <email address hidden>
Link to upstream commit:
https://github.com/crash-utility/crash/commit/ad427b7f8ffc24c9621a1836d8027d5992c9a11a
** Patch added: "crash 8.0.4-1ubuntu2.2 debdiff for noble"
https://bugs.launchpad.net/ubuntu/+source/crash/+bug/2164524/+attachment/6001449/+files/crash_8.0.4-1ubuntu2.2.debdiff
** Tags removed: seg
** Tags added: noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164524
Title:
Crash-utility live session fails solid with a SEGV
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/crash/+bug/2164524/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
