Confirmed and reproduced the exact stack buffer corruption mechanism on
Ubuntu 24.04 (`crash 8.0.4`).
In `netdump.c:proc_kcore_init_64()`, `eheader` is an automatic stack buffer
hardcoded to `MAX_KCORE_ELF_HEADER_SIZE` (32,768 bytes).
Each 64-bit program header (`Elf64_Phdr`) takes 56 bytes. Once a kernel exposes
more than 584 segments in `/proc/kcore` (common on multi-NUMA, large-RAM, or
complex direct-map systems), `pkd->header_size` exceeds 32KB.
The unpatched code then does:
`BCOPY(&eheader[0], &pkd->elf_header[0], pkd->header_size);`
Because `eheader` only contains 32KB, this copies stack frames and
return addresses into the heap buffer for all segments beyond offset
32768.
Testing with a synthetic 650-segment kcore on Noble:
- Byte offset 0..32767: valid ELF headers.
- Byte offset 32768+: `p_type` suddenly reads as stack pointers (`0xdc460340`
instead of `PT_LOAD=0x1`).
- As soon as `read_proc_kcore()` traverses past segment 583 to look up a
physical address, it dereferences garbage coordinates and terminates with SEGV.
Upstream commit `ad427b7f8ffc24c9621a1836d8027d5992c9a11a` ("fix eheader
overflow") eliminates the stack copy by seeking and reading
`pkd->header_size` directly from `fd` into the heap allocation. With the
patch applied, all 650 segments verify cleanly.
This fix is critical for Noble live sessions and directly reinforces the
SRU request in bug #2164589.
** Changed in: crash (Ubuntu)
Status: New => Confirmed
** Tags added: patch seg
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164524
Title:
Crash-utility live session fails solid with a SEGV
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/crash/+bug/2164524/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
