Arch Linux latest git snapshot has too many issues to be a new release base

Arch Linux latest git snapshot has too many issues to be a new release base

[Tobias Powalowski via Grub-devel]

Hi Daniel,

according to my unanswered mail 2 days ago, we tried to bump grub to 
latest git snapshot.

It failed for my co-maintainer in 2 cases:

- loopback device seems to be broken

- encrypted devices is not working anymore for him

We decided to remove it from our [testing] repository again, in order to 
not break users systems.

So again I am asking how should we deal with the security flaws that 
were mentioned,

if no new release is upcoming, which ensures at least to function as the 
last point release.

Thanks for your answer.

Best regards

Tobias

-- 
Tobias Powalowski
Arch Linux Developer (tpowa)
https://www.archlinux.org
tpowa@archlinux.org

Archboot Developer
https://archboot.com

St. Martin-Apotheke
Herzog-Georg-Str. 25
89415 Lauingen
https://www.st-martin-apo.de
info@st-martin-apo.de


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: Arch Linux latest git snapshot has too many issues to be a new release base

[Glenn Washburn]

On Thu, 20 Feb 2025 12:27:12 +0100
Tobias Powalowski via Grub-devel <grub-devel@gnu.org> wrote:

> Hi Daniel,
> 
> according to my unanswered mail 2 days ago, we tried to bump grub to 
> latest git snapshot.
> 
> It failed for my co-maintainer in 2 cases:
> 
> - loopback device seems to be broken
> 
> - encrypted devices is not working anymore for him

These two issues are news to me. Were these failed tests using the
latest security patch series, specifically commit 67f70f70a36b
(disk/loopback: Reference tracking for the loopback). Other than that,
I don't think anything has changed for loopback devices in a while and
I'm not aware of issues for encrypted devices either. The information
given is too little to be of any use and I'm skeptical that these are
issues. Can you help in getting to the bottom of these issues? A start
might be to send a lot more specifics on the what and how of the issues.

Glenn

> 
> We decided to remove it from our [testing] repository again, in order to 
> not break users systems.
> 
> So again I am asking how should we deal with the security flaws that 
> were mentioned,
> 
> if no new release is upcoming, which ensures at least to function as the 
> last point release.
> 
> Thanks for your answer.
> 
> Best regards
> 
> Tobias
> 

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: Arch Linux latest git snapshot has too many issues to be a new release base

[Christian Hesse]

[-- Attachment #1.1: Type: text/plain, Size: 1185 bytes --]

Glenn Washburn <development@efficientek.com> on Fri, 2025/02/21 01:33:
> > It failed for my co-maintainer in 2 cases:
> > 
> > - loopback device seems to be broken
> > 
> > - encrypted devices is not working anymore for him  
> 
> These two issues are news to me. Were these failed tests using the
> latest security patch series, specifically commit 67f70f70a36b
> (disk/loopback: Reference tracking for the loopback). Other than that,
> I don't think anything has changed for loopback devices in a while and
> I'm not aware of issues for encrypted devices either. The information
> given is too little to be of any use and I'm skeptical that these are
> issues. Can you help in getting to the bottom of these issues? A start
> might be to send a lot more specifics on the what and how of the issues.

First one fixed, actually can not reproduce the second. See the mail from
Michael Chang and answers to that for details. Thanks!
-- 
main(a){char*c=/*    Schoene Gruesse                         */"B?IJj;MEH"
"CX:;",b;for(a/*    Best regards             my address:    */=0;b=c[a++];)
putchar(b-1/(/*    Chris            cc -ox -xc - && ./x    */b/42*2-3)*42);}

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: Arch Linux latest git snapshot has too many issues to be a new release base

[Michael Chang via Grub-devel]

On Thu, Feb 20, 2025 at 12:27:12PM +0100, Tobias Powalowski via Grub-devel wrote:
> Hi Daniel,
> 
> according to my unanswered mail 2 days ago, we tried to bump grub to latest
> git snapshot.
> 
> It failed for my co-maintainer in 2 cases:
> 
> - loopback device seems to be broken

Is the loopback file placed on an ext2/3/4 file system? If so, it might
be affected by '7e2f750f0a fs/ext2: Fix out-of-bounds read for inline
extents'. Please test if this new patch helps.

https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00115.html

> 
> - encrypted devices is not working anymore for him

I have no idea about this. Is there any error message that could help to
understand how it failed?

Thanks,
Michael

> 
> We decided to remove it from our [testing] repository again, in order to not
> break users systems.
> 
> So again I am asking how should we deal with the security flaws that were
> mentioned,
> 
> if no new release is upcoming, which ensures at least to function as the
> last point release.
> 
> Thanks for your answer.
> 
> Best regards
> 
> Tobias
> 
> -- 
> Tobias Powalowski
> Arch Linux Developer (tpowa)
> https://www.archlinux.org
> tpowa@archlinux.org
> 
> Archboot Developer
> https://archboot.com
> 
> St. Martin-Apotheke
> Herzog-Georg-Str. 25
> 89415 Lauingen
> https://www.st-martin-apo.de
> info@st-martin-apo.de
> 
> 
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: Arch Linux latest git snapshot has too many issues to be a new release base

[Christian Hesse]

[-- Attachment #1.1: Type: text/plain, Size: 1130 bytes --]

Michael Chang via Grub-devel <grub-devel@gnu.org> on Fri, 2025/02/21 15:55:
> On Thu, Feb 20, 2025 at 12:27:12PM +0100, Tobias Powalowski via Grub-devel
> wrote:
> > It failed for my co-maintainer in 2 cases:
> > 
> > - loopback device seems to be broken  
> 
> Is the loopback file placed on an ext2/3/4 file system?

It is...

> If so, it might
> be affected by '7e2f750f0a fs/ext2: Fix out-of-bounds read for inline
> extents'. Please test if this new patch helps.
> 
> https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00115.html

... and that patch fixes the loopback functionality for me.

Just for reference... Without that patch the files were read with their
correct size, but contained just null bytes:

grub> loopback loop archlinux.iso
grub> cat (loop)/arch/version
<0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
grub>

So one fixed, thanks!
-- 
main(a){char*c=/*    Schoene Gruesse                         */"B?IJj;MEH"
"CX:;",b;for(a/*    Best regards             my address:    */=0;b=c[a++];)
putchar(b-1/(/*    Chris            cc -ox -xc - && ./x    */b/42*2-3)*42);}

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: Arch Linux latest git snapshot has too many issues to be a new release base

[Michael Chang via Grub-devel]

On Fri, Feb 21, 2025 at 10:01:11AM +0100, Christian Hesse wrote:
> Michael Chang via Grub-devel <grub-devel@gnu.org> on Fri, 2025/02/21 15:55:
> > On Thu, Feb 20, 2025 at 12:27:12PM +0100, Tobias Powalowski via Grub-devel
> > wrote:
> > > It failed for my co-maintainer in 2 cases:
> > > 
> > > - loopback device seems to be broken  
> > 
> > Is the loopback file placed on an ext2/3/4 file system?
> 
> It is...
> 
> > If so, it might
> > be affected by '7e2f750f0a fs/ext2: Fix out-of-bounds read for inline
> > extents'. Please test if this new patch helps.
> > 
> > https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00115.html
> 
> ... and that patch fixes the loopback functionality for me.
> 
> Just for reference... Without that patch the files were read with their
> correct size, but contained just null bytes:
> 
> grub> loopback loop archlinux.iso
> grub> cat (loop)/arch/version
> <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
> grub>

Yes. This happens because the loopback file is fragmented and its extent
mapping cannot be fully stored in the inode's inline area. Consequently,
the filesystem promotes the extent tree to use an external block. The
previous patch mistakenly processed external extents using the inline
layout assumptions, which led to reading too few entries from the
external block.

> 
> So one fixed, thanks!

Thanks for your testing. 

Michael

> -- 
> main(a){char*c=/*    Schoene Gruesse                         */"B?IJj;MEH"
> "CX:;",b;for(a/*    Best regards             my address:    */=0;b=c[a++];)
> putchar(b-1/(/*    Chris            cc -ox -xc - && ./x    */b/42*2-3)*42);}



_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: Arch Linux latest git snapshot has too many issues to be a new release base

[Christian Hesse]

[-- Attachment #1.1: Type: text/plain, Size: 1016 bytes --]

Michael Chang via Grub-devel <grub-devel@gnu.org> on Fri, 2025/02/21 15:55:
> > - encrypted devices is not working anymore for him  
> 
> I have no idea about this. Is there any error message that could help to
> understand how it failed?

Actually I can no longer reproduce. %-p

Last time I had to recover quickly and missed to copy the output. I just
decided to try again and gather information, do so with my latest build (that
includes the fs/ext2 out-of-bounds read fix).
This time it opened the encrypted disk and booted fine, just like expected -
or actually *not* as expected, but as it is supposed to.

Wondering if I missed to run `grub-mkconfig` after `grub-install`, that
*could* be. Does the new code from git master need anything new in `grub.cfg`?
-- 
main(a){char*c=/*    Schoene Gruesse                         */"B?IJj;MEH"
"CX:;",b;for(a/*    Best regards             my address:    */=0;b=c[a++];)
putchar(b-1/(/*    Chris            cc -ox -xc - && ./x    */b/42*2-3)*42);}

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel