efibootmgr parsing errors with UTF-16 characters

Bug #2015602 reported by Julia Kreger
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ironic-python-agent
In Progress
Medium
Julia Kreger

Bug Description

A bare metal operator attempted to deploy utilizing IPA on a machine which had an unrelated, accented UTF-8/UTF-16 boundary character (In this case, 0x00FF, an accented lower case y character). This resulted IPA failing to setup the UEFI firmware boot records correctly because it could not parse nor handle the resulting characters.

This was traced down to how oslo.concurrency's processutils execute call, which when normally called, sent stderr and stdout through os.fsdecode.

But os.fsdecode is UTF-8.

It expects everything to be UTF-8.

So the issue here is basically that even then, the character would be parsed as 0xFF, which would generate an error.

Example:

DEBUG ironic_python_agent.extensions.image [-] Exception encountered while attempting to setup the EFI loader from a root filesystem. Error: 'utf-8' codec can't encode characters in position 2623-2624: surrogates not allowed _try_preserve_efi_assets /usr/lib/python3.6/site-packages/ironic_python_agent/extensions/image.py:755

While investigating this and working up a solution, it was also discovered that we can get other unrelated data from the execution of efibootmgr, because it is returning the raw data from the UEFI NVRAM which is UTF-16 encoded.

The tl;dr being that we need to accept and handle UTF-16 character payloads when running efibootmgr.

In any event, this required making the parser a little more tolerant of errors, while also parsing UTF-16.

This was reported by a Red Hat customer, additional background may be found at: https://bugzilla.redhat.com/show_bug.cgi?id=2184201

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/ironic-python-agent 9.5.0

This issue was fixed in the openstack/ironic-python-agent 9.5.0 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/ironic-python-agent 8.5.2

This issue was fixed in the openstack/ironic-python-agent 8.5.2 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.