#335 ipmitool crash - Validating firmware image integrity...Segmentation fault

[Nicole Zhao]

Hello,

This is issue about ipmitool crash. A proper error code is expected.

$ bin/ipmitool-1.8.14 -I lan -H 192.168.10.100 -A none -t 0x9a hpm upgrade /dev/shm

PICMG HPM.1 Upgrade Agent 1.0.9:

Validating firmware image integrity...Segmentation fault

$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
3.5T 512G 2.9T 16% /
/dev/sda1 99M 18M 77M 19% /boot
tmpfs 16G 0 16G 0% /dev/shm

[Zdenek Styblik]

My guess this is caused by doing something like md5_append(16GB_of_data). Meanwhile it should be doing something like(oversimplified):

int bytes_read = 0;
while (bytes_read < image_len) {
  small_buffer = read_small_ammount_of_data();
  /* or simply shift pointer or whatever */
  md5_append(small_buffer);
  bytes_read += buff_size;
}

[Nicole Zhao]

Sorry, I'm not developper, just an end user of ipmitool. So I'm not clear on the root cause and how to fix. But the current implementation definitely is improper.

[Zdenek Styblik]

Sure, it was just a mere analysis of the problem. Although it would be great if you could fix it :)

Anyway. If you have a valid firmware image and it doesn't have like 100MB or so, please, upload it somewhere, so I can download it. I might try to fix it later, or somebody else. I don't know what kind of firmware can be upgraded via HPM nor have anything to test with. However, this is a generic programming issue, not IPMI-specific one.

Thanks.

[Nicole Zhao]

Hi,

Are you sure you are really need a valid firmware?

My issue happened when I gave a invalid firmware image to ipmitool by mistake.

$ bin/ipmitool-1.8.14 -I lan -H 192.168.10.100 -A none -t 0x9a hpm upgrade /dev/shm

tmpfs 16G 0 16G 0% /dev/shm

If you really need a valid firmware, please advice a place where I can upload. Any firmware is OK for you?

Br, Nicole

[Zdenek Styblik]

Hello,

sorry I fell ill, therefore I was unable to respond.

Are you sure you are really need a valid firmware?

Valid firmware would be great, because despite this is a general programming problem, firmware images bear MD5 inside. I want to make sure replaced code works properly and I don't want to spend time fabricating firmware image.

I also wanted to point out - ipmitool may still segfault despite the fix. If application runs out of memory, then it runs out of memory and there is nothing to do. I believe HPM upgrade could be rewriten even further, but IPMI capable platform is required to do such changes.

If you really need a valid firmware, please advice a place where I can upload. Any firmware is OK for you?

Any valid firmware which is supposed to work with HPM is ok. I don't have any IPMI capable platform nor can test beyond MD5 sum.
As where to upload it, any web/ftp will do. Even file sharing sites. If it's rather small, then sending it via e-mail would do as well.

Also, if firmware is free to download somewhere, just point me there, please. And last but not least, if firmware isn't publicly available, then it's not good idea to share it ;-)

Thanks,
Z.

[Zdenek Styblik]

I'm sorry, but fixing this means to rewrite the whole path from the ground.

[Nicole Zhao]

OK，then we ignore the problem.

发自我的 iPhone

在 2016年6月4日，下午11:05，Zdenek Styblik stybla@users.sf.net 写道：

I'm sorry, but fixing this means to rewrite the whole path from the ground.

[bugs:#335] ipmitool crash - Validating firmware image integrity...Segmentation fault

Status: open-accepted
Group: version-1.8.18
Created: Fri Jul 18, 2014 12:38 PM UTC by Nicole Zhao
Last Updated: Thu Apr 21, 2016 06:42 AM UTC
Owner: Zdenek Styblik

Hello,

This is issue about ipmitool crash. A proper error code is expected.

$ bin/ipmitool-1.8.14 -I lan -H 192.168.10.100 -A none -t 0x9a hpm upgrade /dev/shm

PICMG HPM.1 Upgrade Agent 1.0.9:

Validating firmware image integrity...Segmentation fault

$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
3.5T 512G 2.9T 16% /
/dev/sda1 99M 18M 77M 19% /boot
tmpfs 16G 0 16G 0% /dev/shm

Sent from sourceforge.net because you indicated interest in https://sourceforge.net/p/ipmitool/bugs/335/

To unsubscribe from further messages, please visit https://sourceforge.net/auth/subscriptions/

[Zdenek Styblik]

Hello,

don't get me wrong. Problem is there, but the fix is harder than expected. I'm sorry for nothing giving the description.
The problem isn't limited to MD5 checksum, but also includes the fact that given firmware image is being mapped into memory. This must be fixed, but it won't be easy.

Thanks,
Z.

[Zdenek Styblik]

Hi,

I've came up with a workaround for this specific case. Return value of fseek() needed to be checked. However, the proper fix still is to rewrite parts of HPM FW Upg module.

Z.

[Zdenek Styblik]

Sorry, I've failed and the proper fix will have to wait :(

Z.