Skip to content

util-linux: restrict libblkid partition probers to gpt/dos - #1006

Open
qianxjcraig wants to merge 1 commit into
bottlerocket-os:developfrom
qianxjcraig:libblkid-strip-atari-prober
Open

util-linux: restrict libblkid partition probers to gpt/dos#1006
qianxjcraig wants to merge 1 commit into
bottlerocket-os:developfrom
qianxjcraig:libblkid-strip-atari-prober

Conversation

@qianxjcraig

Copy link
Copy Markdown
Contributor

Issue number:

Closes bottlerocket-os/bottlerocket#4855

Description of changes:
EKS worker nodes intermittently fail to boot (~1/1800 launches, more frequent on large ~1 TB volumes) because mkfs.xfs refuses to format the BOTTLEROCKET-DATA partition, wrongly reporting that it already contains an Atari filesystem.

The root cause is in libblkid. Unlike every other partition-table prober, the Atari prober has no magic number — it identifies a partition table purely from loose structural heuristics. On a freshly-encrypted EBS volume, the pseudorandom bytes that back never-written blocks can coincidentally satisfy those heuristics, so libblkid reports a phantom atari partition table on BOTTLEROCKET-DATA. mkfs.xfs then sees an "existing filesystem" and refuses to format, and prepare-local-fs.service fails, blocking boot. (See also util-linux#1116 and rook#7940.)

Bottlerocket only ever creates and consumes GPT partition tables (plus the DOS/pMBR protective MBR that GPT requires). This patch restricts libblkid's partition-prober set to gpt, dos, and pmbr, and stops compiling the now-unreferenced legacy prober sources (aix, atari, mac, sgi, sun, ultrix) from both the automake and meson builds. This removes the Atari false positive at the source and reduces libblkid's attack surface by not building parsers Bottlerocket never uses.

bsd, unixware, solaris_x86, and minix are dropped from the top-level prober array but intentionally kept in the build, because dos.c's dos_nested[] table invokes them as MBR sub-probes; aix.h is likewise retained because dos.c includes it for the AIX magic-number check.

This adds Patch1: to util-linux.spec; %autosetup -p1 applies it automatically.

Testing done:

  • Verified the patch applies cleanly to util-linux 2.42.2 (git apply --check and patch -p1 --dry-run).
  • Built libblkid locally and confirmed via nm that atari_pt_idinfo (and the other removed probers) are absent from the resulting libblkid.so, while dos/gpt/pmbr remain — with no undefined-reference/link errors, confirming the retained sub-probe sources still link.
  • Built the core-kit with the patch (x86_64 and aarch64).
  • Built an aws-k8s-1.36 AMI and launched it on a deterministically "poisoned" EBS volume (a BOTTLEROCKET-DATA partition seeded with a valid Atari signature that reliably reproduces the failure on stock AMIs). Confirmed the node boots cleanly: no mkfs.xfs ... (atari) error, prepare-local-fs.service succeeds, /local mounts, and the system reaches multi-user.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

@qianxjcraig
qianxjcraig marked this pull request as ready for review August 11, 2026 17:22
Comment on lines +6 to +16
Bottlerocket only creates and consumes GPT partition tables (plus the
DOS/pMBR protective MBR that GPT requires). The Atari prober has no magic
number and matches purely on structural heuristics, so the pseudorandom
bytes of a freshly-encrypted EBS volume can produce a phantom "atari"
partition table. mkfs.xfs then refuses to format BOTTLEROCKET-DATA and
the node fails to boot (~1/1800 launches on ~1 TB volumes).

Restrict the top-level prober array to gpt/dos/pmbr and drop the sources
for the now-unreferenced probers (aix, atari, mac, sgi, sun, ultrix).
bsd, unixware, solaris_x86 and minix stay compiled because dos.c invokes
them as MBR sub-probes; aix.h stays because dos.c includes it.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Bottlerocket only creates and consumes GPT partition tables (plus the
DOS/pMBR protective MBR that GPT requires). The Atari prober has no magic
number and matches purely on structural heuristics, so the pseudorandom
bytes of a freshly-encrypted EBS volume can produce a phantom "atari"
partition table. mkfs.xfs then refuses to format BOTTLEROCKET-DATA and
the node fails to boot (~1/1800 launches on ~1 TB volumes).
Restrict the top-level prober array to gpt/dos/pmbr and drop the sources
for the now-unreferenced probers (aix, atari, mac, sgi, sun, ultrix).
bsd, unixware, solaris_x86 and minix stay compiled because dos.c invokes
them as MBR sub-probes; aix.h stays because dos.c includes it.
Restrict the top-level prober array to gpt/dos/pmbr and drop the sources
for the now-unreferenced probers (aix, atari, mac, sgi, sun, ultrix). Bottlerocket
only creates and consumes GPT partition tables (plus the DOS/pMBR
protective MBR that GPT requires).
bsd, unixware, solaris_x86 and minix stay compiled because dos.c invokes
them as MBR sub-probes; aix.h stays because dos.c includes it.

I think we can be more specific about the comment/commit message since we're removing unsupported partitions. The Atari error was just the impetus for this investigation.

@qianxjcraig
qianxjcraig force-pushed the libblkid-strip-atari-prober branch from 868ab47 to 68f5738 Compare August 17, 2026 17:59
Restrict the top-level prober array to gpt/dos/pmbr and drop the
sources for the now-unreferenced probers (aix, atari, mac, sgi, sun,
ultrix). Bottlerocket only creates and consumes GPT partition tables
(plus the DOS/pMBR protective MBR that GPT requires).

bsd, unixware, solaris_x86 and minix stay compiled because dos.c
invokes them as MBR sub-probes; aix.h stays because dos.c includes it.

See bottlerocket-os/bottlerocket#4855

Signed-off-by: Craig Qian <qianxj@amazon.com>
@qianxjcraig
qianxjcraig force-pushed the libblkid-strip-atari-prober branch from 68f5738 to cfdbd35 Compare August 17, 2026 18:10
@qianxjcraig

Copy link
Copy Markdown
Contributor Author

Resolve commitlint failure

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

prepare-local-fs.service fails intermittently on encrypted EBS volumes due to mkfs.xfs false-positive signature detection

2 participants