lshw can crash arm64 systems

[dann frazier]

lshw's smbios parsing code pokes at bad places in /dev/mem and can crash the system (oops) when running with sufficient privileges.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "aarch64-disable-smbios-check.patch" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiff!

It looks good, but please tag the patch with the proper DEP-3 headers.

See the following for more information:
http://dep.debian.net/deps/dep3/

Thanks!

[CTS Cisco Builder Bot (cts-cisco-builder-bot)]

Updated the changelog for UNRELEASED to trusty, and sponsored this bugfix for trusty. Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package lshw - 02.16-2ubuntu1

---------------
lshw (02.16-2ubuntu1) trusty; urgency=medium

  * Disable /dev/mem access for SMBIOS on aarch64 systems (LP: #1284406)
 -- dann frazier <email address hidden> Mon, 10 Mar 2014 10:04:28 -0500

[Leif Lindholm (leif-lindholm)]

While I realise this is considered fixed, the attached patch fixes the random poking around in /dev/mem instead of just bailing out. Making lshw functional on arm/arm64 UEFI platforms with SMBIOS.

[dann frazier (dannf)]

On Fri, Oct 31, 2014 at 11:29 AM, Leif Lindholm
<email address hidden> wrote:
> While I realise this is considered fixed, the attached patch fixes the
> random poking around in /dev/mem instead of just bailing out. Making
> lshw functional on arm/arm64 UEFI platforms with SMBIOS.

Thanks Lief! Has this been submitted upstream?

I'd suggest opening a separate bug in LP to enable this class of
systems. This bug is at the end of it's lifecycle, and reopening it
would cause confusion. Would you mind doing that or should I?

  -dann

[Leif Lindholm (leif-lindholm)]

Hi Dann,

On Fri, Oct 31, 2014 at 05:57:36PM -0000, dann frazier wrote:
> On Fri, Oct 31, 2014 at 11:29 AM, Leif Lindholm
> <email address hidden> wrote:
> > While I realise this is considered fixed, the attached patch fixes the
> > random poking around in /dev/mem instead of just bailing out. Making
> > lshw functional on arm/arm64 UEFI platforms with SMBIOS.
>
> Thanks Lief! Has this been submitted upstream?

Yeah, I logged a bug in the lshw tracking system (which is moderated,
so it's not publicly visible yet). I also intend to raise it on
bugs.debian.org (Jessie can still crash the Mustang boards, and I'm
thinking the powerpc port will also be potentially risky).

> I'd suggest opening a separate bug in LP to enable this class of
> systems. This bug is at the end of it's lifecycle, and reopening it
> would cause confusion. Would you mind doing that or should I?

I don't mind, but as always I am slightly unsure of what level of
severity I should raise it at.

/
    Leif

[dann frazier (dannf)]

On Fri, Oct 31, 2014 at 2:23 PM, Leif Lindholm
<email address hidden> wrote:
> Hi Dann,
>
> On Fri, Oct 31, 2014 at 05:57:36PM -0000, dann frazier wrote:
>> On Fri, Oct 31, 2014 at 11:29 AM, Leif Lindholm
>> <email address hidden> wrote:
>> > While I realise this is considered fixed, the attached patch fixes the
>> > random poking around in /dev/mem instead of just bailing out. Making
>> > lshw functional on arm/arm64 UEFI platforms with SMBIOS.
>>
>> Thanks Lief! Has this been submitted upstream?
>
> Yeah, I logged a bug in the lshw tracking system (which is moderated,
> so it's not publicly visible yet). I also intend to raise it on
> bugs.debian.org (Jessie can still crash the Mustang boards, and I'm
> thinking the powerpc port will also be potentially risky).

Yeah, I've got a bug open in Debian (#740034), I certainly don't mind
if you add your patch there since it is still open. Actually, I need
to increase the severity now since arm64 is part of the archive.

>> I'd suggest opening a separate bug in LP to enable this class of
>> systems. This bug is at the end of it's lifecycle, and reopening it
>> would cause confusion. Would you mind doing that or should I?
>
> I don't mind, but as always I am slightly unsure of what level of
> severity I should raise it at.

Well, if it is negatively impacting shipping hardware (i.e. lshw is
unable to report certain things because of the lack of smbios
support), I'd say "High" since I consider that a hardware enablement
issue. If it's just a correctness thing at this point, my opinion
would be wishlist. That's just my opinion though, feel free to use
your own judgment.

  -dann

> /
> Leif
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1284406
>
> Title:
> lshw can crash arm64 systems
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/lshw/+bug/1284406/+subscriptions

[Leif Lindholm (leif-lindholm)]

On Fri, Oct 31, 2014 at 09:32:58PM -0000, dann frazier wrote:
> > Yeah, I logged a bug in the lshw tracking system (which is moderated,
> > so it's not publicly visible yet). I also intend to raise it on
> > bugs.debian.org (Jessie can still crash the Mustang boards, and I'm
> > thinking the powerpc port will also be potentially risky).
>
> Yeah, I've got a bug open in Debian (#740034), I certainly don't mind
> if you add your patch there since it is still open. Actually, I need
> to increase the severity now since arm64 is part of the archive.

Added.

> >> I'd suggest opening a separate bug in LP to enable this class of
> >> systems. This bug is at the end of it's lifecycle, and reopening it
> >> would cause confusion. Would you mind doing that or should I?
> >
> > I don't mind, but as always I am slightly unsure of what level of
> > severity I should raise it at.
>
> Well, if it is negatively impacting shipping hardware (i.e. lshw is
> unable to report certain things because of the lack of smbios
> support), I'd say "High" since I consider that a hardware enablement
> issue. If it's just a correctness thing at this point, my opinion
> would be wishlist. That's just my opinion though, feel free to use
> your own judgment.

https://bugs.launchpad.net/ubuntu/+source/lshw/+bug/1388262 raised.
And I don't have access to set severity anyway, so I'll leave that up
to you :)

Consider this ticket closed.

/
    Leif