Bug 245741

Summary:	sys-boot/grub-0.97-r6 segfaults with ext2-REV0 Filesystems
Product:	Gentoo Linux	Reporter:	Antoine Kaufmann <toni.kaufmann>
Component:	[OLD] Core system	Assignee:	Gentoo's Team for Core System packages <base-system>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Antoine Kaufmann 2008-11-05 19:45:20 UTC

While working on a hobby OS i remarked that my grub is segfaulting when I try to generate HD-Images. After some debugging I found that the patch 810_all_grub-0.97-ext3_256byte_inode.patch in grub-0.97-patches-1.7.tar.bz2 causes this. The problem is in those two lines:

 66 +#define EXT2_INODE_SIZE(s)             (SUPERBLOCK->s_inode_size)
 67 +#define EXT2_INODES_PER_BLOCK(s)       (EXT2_BLOCK_SIZE(s)/EXT2_INODE_SIZE(s))

This is because the field s_inode_size is only valid if s_rev_level is EXT2_DYNAMIC_REV (1). So on it may happen, that the value is zero and EXT2_INODES_PER_BLOCK will cause a division by zero. I would suggest to change the INODE_SIZE macro to:
  #define EXT2_INODE_SIZE(s)      (SUPERBLOCK->s_rev_level == 1 ? SUPERBLOCK->s_inode_size : 128)


Reproducible: Always

Steps to Reproduce:
1. Create some hd image: dd if=/dev/zero of=hd.img bs=1024 count=10240
2. Create a primary partition on the image (you cannot install grub on a non partitioned image): /sbin/fdisk hd.img (you have to go to the expertsmenu[x] and then set the cylinder count[c] to 325)
3. Format the image with ext2-REV0. There are two possibilities, either you use kpartx or you use some dd-magic. I'll show the 2nd possibility: dd if=hd.img of=part bs=512 skip=63; /sbin/mkfs.ext2 -r0 part -F; dd if=part of=hd.img bs=512 seek=63
4. Now mount the partition and copy grub on it: mount -o loop,offset=$((63*512)) hd.img /tmp; cp /path/to/stage/1/and/2 /tmp; umount /tmp
5. Install grub on the image: /sbin/grub;
   grub> device (hd0) hd.img
   grub> root (hd0,0)
   grub> setup (hd0)

Actual Results:  
Segfault

Expected Results:  
There should have been no segfault ;-)

Comment 1 Antoine Kaufmann 2008-11-05 21:40:27 UTC

Hum, with the newest e2fsprogs-Version this problem cannot be reproduced, because the inode-size will be set, even if you specify -r0. I used e2fsprogs-1.40.9 to reproduce this bug.

Comment 2 Robin Johnson archtester

2008-11-05 22:34:05 UTC

Please test 0.97-r8 that is in package.mask very carefully (aka have a livecd handy), but this should now be fixed.