Re: fsck segfaults on rpi3 running 13-stable (and on 14-CURRENT analyzing the same file system that resulted from the 13-STABLE crash)

bob prohaska wrote this message on Tue, Feb 14, 2023 at 13:06 -0800:
> On Tue, Feb 14, 2023 at 10:38:27AM -0800, John-Mark Gurney wrote:
> > bob prohaska wrote this message on Tue, Feb 14, 2023 at 08:14 -0800:
> > > 
> > > Is this a demonstration that the fsck segfault can be reproduced 
> > > independtly of my particular corrupt filesystem? AFL is new to me. 
> > 
> > Yes, it is.  It turns out that the FS to produce this failure is a LOT
> > smaller than I expected when compresed, I have included it later in the
> > email.  The constant above was taken directly from the failing FS.
> > 
> > AFL is a very useful tool, and found this crash and apparently 50+
> > other crashes in only 5-10 minutes of running... I'll be investigating
> > a few of the other crashes as well, as fsck does ocassionally deal w/
> > untrusted fs's.
> > 
> 
> Would trying to run fsck on the corrupt filesystem from an 8GB Pi4
> (also running -current) make any difference? I.e., might more physical
> RAM cover up the bug and allow fsck to complete successfully? 

No, it will not.  It's trying to access memory address 0x4 which does
not exist, no matter how much memory.

In this case, an inode's mtime is wildly incorrect.  Here is a simple
patch that will let it get farther, BUT, it doesn't necessarily mean
that the kernel can properly handle the mtime:
diff --git a/sbin/fsck_ffs/inode.c b/sbin/fsck_ffs/inode.c
index 82338f4f8c08..d0892a822dc5 100644
--- a/sbin/fsck_ffs/inode.c
+++ b/sbin/fsck_ffs/inode.c
@@ -1311,7 +1311,10 @@ prtinode(struct inode *ip)
        printf("SIZE=%ju ", (uintmax_t)DIP(dp, di_size));
        t = DIP(dp, di_mtime);
        p = ctime(&t);
-       printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+       if (p == NULL)
+               printf("MTIME=invalid ");
+       else
+               printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
 }
 
 void


If you can get the inode number (should be in the gdb backtrace in one
of the frames), you can use fsdb to switch to the inode (inode <num>),
and then set the mtime to something reasonable (mtime 0), and then fsck
should complete as well...

> Is there a plain-English description of how AFL works? I gather it
> manipulates input read by a program to discover improperly handled
> cases, but even that is far from certain. There's no hope of me doing 
> anything useful with AFL. I'm merely curious.  

You are correct.  It insturments a program to see when it modifies
the input, which branches it takes, and uses that to make better choices
on how to mutate the input.

In another email I sent the instructions on how I ran it, but I used:
https://afl-1.readthedocs.io/en/latest/quick_start.html

to figure/remind myself how to run it.  Only difference is that instead
of running ./configure, I used make instead in the correct directory of
the FreeBSD src tree.

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."