bugGNU GRUB - Bugs: bug #37292, http module 'double free's, breaks...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #37292: http module 'double free's, breaks malloc and can cause SYN-ACK errors

Submitted by:  Philip Soeberg <philip007>
Submitted on:  Fri 07 Sep 2012 08:52:32 AM UTC  
 
Category: NetworkSeverity: Major
Priority: 5 - NormalItem Group: Software Error
Status: FixedPrivacy: Public
Assigned to: NoneOriginator Name: 
Open/Closed: ClosedRelease: 
Release: Bazaar - trunkReproducibility: Every Time
Planned Release: None

Fri 12 Apr 2013 06:20:13 PM UTC, comment #1:

Should be fixed now. If it persists feel free to reopen

Vladimir Serbinenko <phcoder>
Project Administrator
Fri 07 Sep 2012 08:52:32 AM UTC, original submission:

Running on grub-trunk rev 4574.
Attempting to: PXE boot Grub to boot various OS over NFS. Need load_env/save_env to access env between boots on diskless systems.
Problem: save_env can only store to disk.
Workaround: Use (http) module as workaround and script my way out of it server side.

Bug report: http module "double free's" or "alloc magic is broken" on "cat" and "load_env".

How to setup:
PXE boot blobs constructed by grub-mknetdir. No grub.cfg config file is in use. need tftp and http and working network.
How to reproduce:
PowerOn Client: will tftp core.0, some modules and *.lst files.

In client console enter:
grub> insmod http
grub> cat (http)/somefilewhichexist

3/5 times result in "Double Free at 0x1ffd8b60".
1/5 times result in "Alloc magic is broken at 0x1ffd65d0".
1/5 times result in "error: connection timeout".

cat always dumps file output (expect in last case), so I suspect the double free bug lies in the termination/closure of the http connection/module.

The last error occur because http module always use src port 21550. If httpd has not yet terminated its socket, an ACK on the sequence number from last cycle is re-sent. This cause http module to time out as no valid SYN-ACK is received. I suggest randomizing the source port number.

Attached is a pcap file with two cycles. First cycle has resulted in a "Double free", second cycle resulted in the "connection timeout" case.

Philip Soeberg <philip007>

 

Attached Files
file #26491:  50.pcap added by philip007 (459kB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by phcoder (Posted a comment)
  • -unavailable- added by philip007 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 12 Apr 2013 06:20:13 PM UTCphcoderStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Fri 07 Sep 2012 08:52:32 AM UTCphilip007Attached File-=>Added 50.pcap, #26491

    Back to the top


    Powered by Savane 3.1-cleanup