kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zdump/dfi: Fix illegal memory access in mem_chunk_has_addr()

Browse Source 
Verify that the mem chunk_cache pointer is valid before using it.
This prevents potential illegal memory accesses.

This problem was found with AFL fuzzing and ASAN.

./zdump/zgetdump -iVVVVV ~/zgetdump-fuzzing/findings/crashes/id\:000007\,sig\:06\,src\:000007\,op\:flip1\,pos\:37
TRACE: DFI initialization
DEBUG: DFI trying s390tape
DEBUG: DFI s390tape returned with rc -19
DEBUG: DFI trying devmem
DEBUG: DFI devmem returned with rc -19
DEBUG: DFI trying s390mv_ext
DEBUG: DFI s390mv_ext returned with rc -19
DEBUG: DFI trying s390mv
DEBUG: DFI s390mv returned with rc -19
DEBUG: DFI trying s390_ext
DEBUG: DFI S390 extended initialization
DEBUG: DFI s390_ext returned with rc -19
DEBUG: DFI trying s390
DEBUG: DFI S390 initialization
DEBUG: DFI s390 returned with rc -19
DEBUG: DFI trying lkcd
DEBUG: DFI lkcd returned with rc -19
DEBUG: DFI trying elf
DEBUG: DFI ELF initialization
DEBUG: DFI ELF e_phnum 11
DEBUG: DFI ELF p_type[0] 0x6060606
DEBUG: DFI ELF p_type[1] 0x6060606
DEBUG: DFI ELF p_type[2] 0x6060606
DEBUG: DFI ELF p_type[3] 0x6060606
DEBUG: DFI ELF p_type[4] 0x6060606
DEBUG: DFI ELF p_type[5] 0x6060606
DEBUG: DFI ELF p_type[6] 0x6060606
DEBUG: DFI ELF p_type[7] 0x6060606
DEBUG: DFI ELF p_type[8] 0x6060606
DEBUG: DFI ELF p_type[9] 0x6060606
DEBUG: DFI ELF p_type[10] 0x6060606
TRACE: DFI kdump initialization
AddressSanitizer:DEADLYSIGNAL
=================================================================
==206692==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000001016a12 bp 0x03ffcc57eae0 sp 0x03ffcc57eae0 T0)
==206692==The signal is caused by a UNKNOWN memory access.
==206692==Hint: address points to the zero page.
    #0 0x1016a12 in mem_chunk_has_addr /root/s390-tools/zdump/dfi.c:308
    #1 0x1016a12 in mem_chunk_find /root/s390-tools/zdump/dfi.c:318
    #2 0x1016a12 in dfi_mem_chunk_find /root/s390-tools/zdump/dfi.c:513
    #3 0x1016a12 in dfi_mem_range_valid /root/s390-tools/zdump/dfi.c:208
    #4 0x1016a12 in kdump_init /root/s390-tools/zdump/dfi.c:1100
    #5 0x1016a12 in dfi_init /root/s390-tools/zdump/dfi.c:1253
    #6 0x1006d3d in do_dump_info /root/s390-tools/zdump/zgetdump.c:127
    #7 0x1006d3d in main /root/s390-tools/zdump/zgetdump.c:182
    #8 0x3ff9e0abe03 in __libc_start_main (/lib64/libc.so.6+0x2be03)
    #9 0x1007d7d  (/root/s390-tools/zdump/zgetdump+0x1007d7d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/s390-tools/zdump/dfi.c:308 in mem_chunk_has_addr
==206692==ABORTING

Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Alexander Egorenkov
2021-09-03 20:49:55 +02:00
committed by Jan Höppner
parent f15e32cdb1
commit 28db3523d0
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
zdump/dfi.c
View File

@@ -315,7 +315,7 @@ static struct dfi_mem_chunk *mem_chunk_find(struct mem *mem, u64 addr)
{
struct dfi_mem_chunk *mem_chunk;
if (mem_chunk_has_addr(mem->chunk_cache, addr))
if (mem->chunk_cache && mem_chunk_has_addr(mem->chunk_cache, addr))
return mem->chunk_cache;
util_list_iterate(&mem->chunk_list, mem_chunk) {
if (mem_chunk_has_addr(mem_chunk, addr)) {