From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.71) id 1aoQ8y-0006cD-M5 for mharc-grub-devel@gnu.org; Fri, 08 Apr 2016 02:43:48 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42474) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aoQ8w-0006XY-72 for grub-devel@gnu.org; Fri, 08 Apr 2016 02:43:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aoQ8t-0001ui-0U for grub-devel@gnu.org; Fri, 08 Apr 2016 02:43:46 -0400 Received: from smtp.nue.novell.com ([195.135.221.5]:38449) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aoQ8s-0001uH-Me for grub-devel@gnu.org; Fri, 08 Apr 2016 02:43:42 -0400 Received: from nwb-ext-pat.microfocus.com ([10.120.13.103]) by smtp.nue.novell.com with ESMTP (TLS encrypted); Fri, 08 Apr 2016 08:43:40 +0200 Received: from linux-9gqx.suse (nwb-a10-snat.microfocus.com [10.120.13.201]) by nwb-ext-pat.microfocus.com with ESMTP (TLS encrypted); Fri, 08 Apr 2016 07:43:30 +0100 Date: Fri, 8 Apr 2016 14:43:23 +0800 From: Michael Chang To: grub-devel@gnu.org Subject: [PATCH] grub-file: fix segmentation fault Message-ID: <20160408064322.GA15761@linux-9gqx.suse> Mail-Followup-To: grub-devel@gnu.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 195.135.221.5 X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 06:43:47 -0000 In grub_file_open the file handle returned by file filters has no file->name set which leads to segmentation fault later referenced by grub_elf_file. We move the file->name value assignment after file filters to make sure it will be set and returned. The stack backtrace for reference. gdb --args ./grub-file --is-x86_64-xen-domu /boot/vmlinux-4.1.12-1-default.gz (gdb) bt #0 0x000000000047597e in grub_strlen (s=0x0) at ../grub-core/kern/misc.c:558 #1 0x00000000004757e2 in grub_strdup (s=0x0) at ../grub-core/kern/misc.c:463 #2 0x0000000000406418 in grub_elf_file (file=0x6dfb50, filename=0x0) at ../grub-core/kern/elf.c:89 #3 0x00000000004043b3 in grub_xen_file (file=0x6dfb50) at ../grub-core/loader/i386/xen_file.c:29 #4 0x0000000000403930 in grub_cmd_file (ctxt=0x7fffffffe120, argc=1, args=0x6dfa00) at ../grub-core/commands/file.c:425 #5 0x000000000047e178 in grub_extcmd_dispatcher (cmd=0x6df730, argc=2, args=0x6ddfb0, script=0x0) at ../grub-core/commands/extcmd.c:54 #6 0x000000000047e1d7 in grub_extcmd_dispatch (cmd=0x6df730, argc=2, args=0x6ddfb0) at ../grub-core/commands/extcmd.c:67 #7 0x0000000000402945 in main (argc=3, argv=0x7fffffffe2e8) at ../util/grub-file.c:102 (gdb) frame 3 #3 0x00000000004043b3 in grub_xen_file (file=0x6dfb50) at ../grub-core/loader/i386/xen_file.c:29 29 elf = grub_elf_file (file, file->name); --- grub-core/kern/file.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c index 668f893..44047d7 100644 --- a/grub-core/kern/file.c +++ b/grub-core/kern/file.c @@ -111,9 +111,6 @@ grub_file_open (const char *name) if ((file->fs->open) (file, file_name) != GRUB_ERR_NONE) goto fail; - file->name = grub_strdup (name); - grub_errno = GRUB_ERR_NONE; - for (filter = 0; file && filter < ARRAY_SIZE (grub_file_filters_enabled); filter++) if (grub_file_filters_enabled[filter]) @@ -123,7 +120,12 @@ grub_file_open (const char *name) } if (!file) grub_file_close (last_file); - + else + { + file->name = grub_strdup (name); + grub_errno = GRUB_ERR_NONE; + } + grub_memcpy (grub_file_filters_enabled, grub_file_filters_all, sizeof (grub_file_filters_enabled)); -- 2.6.2