Thu 16 Jul 2015 02:55:21 PM UTC, original submission:
Hi,
I've had a problem when using the `grub-probe` binary to probe large LVM partitions (for example, a 1.5 TB partition).
This problem was discovered/tested in an Ubuntu 12.04.5.
When trying to probe these large LVM partitions, we get erros like:
$ grub-probe -vvv /PATH/TO/MY/LVM
[...]
grub-core/kern/disk.c:494: Read out of range: sector 0x0 (out of disk).
[...]
grub-probe: error: unknown filesystem.
This bug was reported at: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1475337
However, as I discovered that the same problematic source code exists in the upstream too, I'm creating this bug report here too.
Talking about the bug:
I debug the problem and I discovered that the problem occurs due to an inappropriate multiplication in the file grub-core/disk/lvm.c:
lv->size += seg->extent_count * vg->extent_size;
The lv->size var is an unsigned 64-bits integer. However, the next two vars are respectively an unsigned int and an int. As the result of (unsigned int) * (int) is an integer, it's very easy to get a multiplication overflow (in my case, the result of the multiplication was zero -> lv->size = 0, resulting in the "out of disk" error).
So, I'm proposing a patch for this bug (it was created over the current commit in Git, Master branch - commit ff3c20):
diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
index 7b265c7..4a39a5b 100644
--- a/grub-core/disk/lvm.c
+++ b/grub-core/disk/lvm.c
@@ -463,7 +463,8 @@ grub_lvm_detect (grub_disk_t disk,
goto lvs_segment_fail;
p += sizeof("type = \"") - 1;
- lv->size += seg->extent_count * vg->extent_size;
+ lv->size += ((grub_uint64_t) seg->extent_count
+ * (grub_uint64_t) vg->extent_size);
if (grub_memcmp (p, "striped\"",
sizeof ("striped\"") - 1) == 0)
I only tested this patch in my Ubuntu server using the Debian patched code (not the upstream code). So, I don't know if it works in the upstream code too.
I'm attaching this patch too.
|