GNU bug report logs - #35714
Parted destroys mbr_signature (Disk Identifier) when adding MBR bootcode

Previous Next

To reply to this bug, email your comments to 35714 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Matthijs Kooijman <matthijs <at> stdin.nl>
To: bug-parted <at> gnu.org
Subject: Parted destroys mbr_signature (Disk Identifier) when adding MBR
 bootcode
Date: Mon, 13 May 2019 10:52:12 +0200

[Message part 1 (text/plain, inline)]

Hi folks,

I believe I found a bug in the dos partition table writer. Let me start
with the cause. There's this bit of code:

	if (!table->boot_code[0]) {
		memset (table->boot_code, 0, 512);
		memcpy (table->boot_code, MBR_BOOT_CODE, sizeof (MBR_BOOT_CODE));
	}

When a disk has no MBR bootcode, this adds some. However, it also starts
with clearing the *entire* MBR sector. I believe this should just clear
the bootcode, e.g.

	- memset (table->boot_code, 0, 512);
	+ memset (table->boot_code, 0, sizeof(table->boot_code));

The current code clears the mbr_signature, partition table and magic at
the end. The partition table is rewritten from the table in memory, the
magic value is simply replaced with a fixed value, but the mbr_signature
is replaced by newly randomly generated value.

Effectively, this means that when modifying a partition table without
any boot code, the mbr_signature will be changed.

I've noticed this problem on a Raspberry pi. The default raspbian images
are generated using fdisk, without any boot code (which is not needed on
a pi). Modifying the partition table using parted then generates a new
mbr_signature. Since this signature (called Disk Identifier by fdisk) is
used to generate the PARTUUID for partitions [1], and the PARTUUID is used
to locate the root filesystem, this effectively makes the system
unbootable.

It seems this has been known for a while, since a workaround [2] has
been (silently, without mentioning it in the commend message) introduced
two years ago [3] in the raspberry pi resizing code (probably at the
same time they started using PARTUUID I suspect).

Also note that the disk identifier is only changes once, since then the
MBR has bootcode and parted no longer needs to clear things.

Gr.

Matthijs

[1]: https://raspberrypi.stackexchange.com/a/95436/70022
[2]: https://github.com/RPi-Distro/raspi-config/blob/master/init_resize.sh#L77-L82
[3]: https://github.com/RPi-Distro/raspi-config/commit/44a2e6188c004de50b6c25c8bace2872d672cdd1

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 35714 <at> debbugs.gnu.org (full text, mbox):

From: Matthijs Kooijman <matthijs <at> stdin.nl>
To: 35714 <at> debbugs.gnu.org
Subject: Re: Parted destroys mbr_signature (Disk Identifier) when adding MBR
 bootcode
Date: Mon, 13 May 2019 16:30:32 +0200

[Message part 1 (text/plain, inline)]

Hi folks,

one more addition: Below is an example of reproducing this problem on an
Ubuntu Disco system running parted 3.2-25. I haven't tried git master,
but looking at the code, I'm pretty sure the problem stil exists there.

Gr.

Matthijs


# Use fdisk to create an empty partition table without any boot code
matthijs <at> grubby:~$ truncate -s 8M tmp.img
matthijs <at> grubby:~$ echo -e 'o\nw' | fdisk tmp.img

Welcome to fdisk (util-linux 2.33.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Device does not contain a recognized partition table.
Created a new DOS disklabel with disk identifier 0x0298967f.

Command (m for help): Created a new DOS disklabel with disk identifier 0x94bfb6ca.

Command (m for help): The partition table has been altered.
Syncing disks.

matthijs <at> grubby:~$ fdisk -l tmp.img | grep identifier
Disk identifier: 0x94bfb6ca
matthijs <at> grubby:~$ head -c 512 tmp.img | hd
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001b0  00 00 00 00 00 00 00 00  ca b6 bf 94 00 00 00 00  |................|
000001c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200


# Then use parted to add a partition
matthijs <at> grubby:~$ parted tmp.img mkpart p fat32 4096s 8191s
/sys/firmware/dmi/tables/smbios_entry_point: Permission denied
/dev/mem: Permission denied
WARNING: You are not superuser.  Watch out for permissions.

# This has changed the disk identifier (and added bootcode)
matthijs <at> grubby:~$ fdisk -l tmp.img | grep identifier
Disk identifier: 0x5d7de418
matthijs <at> grubby:~$ head -c 512 tmp.img | hd
00000000  fa b8 00 10 8e d0 bc 00  b0 b8 00 00 8e d8 8e c0  |................|
00000010  fb be 00 7c bf 00 06 b9  00 02 f3 a4 ea 21 06 00  |...|.........!..|
00000020  00 be be 07 38 04 75 0b  83 c6 10 81 fe fe 07 75  |....8.u........u|
00000030  f3 eb 16 b4 02 b0 01 bb  00 7c b2 80 8a 74 01 8b  |.........|...t..|
00000040  4c 02 cd 13 ea 00 7c 00  00 eb fe 00 00 00 00 00  |L.....|.........|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001b0  00 00 00 00 00 00 00 00  18 e4 7d 5d 00 00 00 00  |..........}]....|
000001c0  01 20 0c 03 20 3f 00 10  00 00 00 10 00 00 00 00  |. .. ?..........|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200

[signature.asc (application/pgp-signature, inline)]

Message #11 received at 35714 <at> debbugs.gnu.org (full text, mbox):

From: Phillip Susi <phill <at> thesusis.net>
To: Matthijs Kooijman <matthijs <at> stdin.nl>
Cc: 35714 <at> debbugs.gnu.org
Subject: Re: bug#35714: Parted destroys mbr_signature (Disk Identifier) when
 adding MBR bootcode
Date: Thu, 16 May 2019 09:13:55 -0400

Matthijs Kooijman writes:

> Hi folks,
>
> I believe I found a bug in the dos partition table writer. Let me start
> with the cause. There's this bit of code:
>
> 	if (!table->boot_code[0]) {
> 		memset (table->boot_code, 0, 512);
> 		memcpy (table->boot_code, MBR_BOOT_CODE, sizeof (MBR_BOOT_CODE));
> 	}

Yikes! Clearly this should have been sizeof( table->boot_code ) rather
than 512.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.