grub-setup crashed with SEGV in grub_util_biosdisk_is_floppy()

[Tuomas Heino]

Attempted to install Precise daily; installer said it failed to install grub (on /dev/md_d0).
Reproduced in rescue mode using "grub-install /dev/md127" as command line.

Basically prevents making a bootable Precise installation for me. Hope this can be retraced...

ProblemType: Crash
DistroRelease: Ubuntu 12.04
Package: grub-pc-bin 1.99-14ubuntu2
ProcVersionSignature: Ubuntu 3.2.0-8.14-generic 3.2.0
Uname: Linux 3.2.0-8-generic x86_64
ApportVersion: 1.90-0ubuntu2
Architecture: amd64
CrashCounter: 1
Date: Sat Jan 14 12:40:19 2012
ExecutablePath: /usr/lib/grub/i386-pc/grub-setup
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha amd64 (20120112)
ProcCmdline: /usr/sbin/grub-setup --directory=/boot/grub --device-map=/boot/grub/device.map /dev/md127
ProcEnviron:
 LANGUAGE=en_IE:en
 PATH=(custom, no user)
 LANG=C.UTF-8
 SHELL=/bin/sh
SegvAnalysis:
 Segfault happened at: 0x436364: mov 0x685bc8(%rax),%rdi
 PC (0x00436364) ok
 source "0x685bc8(%rax)" (0x400685bc8) not located in a known VMA region (needed readable region)!
 destination "%rdi" ok
SegvReason: reading unknown VMA
Signal: 11
SourcePackage: grub2
StacktraceTop:
 ?? ()
 ?? ()
 ?? ()
 __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6
 ?? ()
Title: grub-setup crashed with SIGSEGV in __libc_start_main()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

[Apport retracing service (apport)]

StacktraceTop:
 ?? ()
 ?? ()
 ?? ()
 __libc_start_main (main=0x403ef0, argc=4, ubp_av=0x7fff1cad8b38, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff1cad8b28) at libc-start.c:226
 ?? ()

[Tuomas Heino (iheino+ub)]

Compiled manually with -g and it crashed on line
1948 fd = open (map[disk->id].device, O_RDONLY);

disk->id is 0x40000000 while sizeof(map) is 4096.

Further details missing since install disk rescue mode does not load installer network-console component for sshd and virt-manager's VNC displays do not support copy-paste.

[Tuomas Heino (iheino+ub)]

Adding range-check before the offending code in grub-core/kern/emu/hostdisk.c fixes this symptom for me. Underlying cause may be deeper though.

int
grub_util_biosdisk_is_floppy (grub_disk_t disk)
{
  struct stat st;
  int fd;

  /* Shouldn't happen. See LP#916435. */
  if (disk->id > sizeof(map) / sizeof(*map))
    return 0;

  fd = open (map[disk->id].device, O_RDONLY);
  /* Shouldn't happen. */
  if (fd == -1)
    return 0;

  /* Shouldn't happen either. */
  if (fstat (fd, &st) < 0)
    return 0;

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Marcus Tomlinson (marcustomlinson)]

This release of Ubuntu is no longer receiving maintenance updates. If this is still an issue on a maintained version of Ubuntu please let us know.

[Marcus Tomlinson (marcustomlinson)]

This issue has sat incomplete for more than 60 days now. I'm going to close it as invalid. Please feel free re-open if this is still an issue for you. Thank you.