From 28db3523d0d41490bb2cbbb8d83ab1fe48baf935 Mon Sep 17 00:00:00 2001 From: Alexander Egorenkov Date: Fri, 3 Sep 2021 20:49:55 +0200 Subject: [PATCH] zdump/dfi: Fix illegal memory access in mem_chunk_has_addr() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verify that the mem chunk_cache pointer is valid before using it. This prevents potential illegal memory accesses. This problem was found with AFL fuzzing and ASAN. ./zdump/zgetdump -iVVVVV ~/zgetdump-fuzzing/findings/crashes/id\:000007\,sig\:06\,src\:000007\,op\:flip1\,pos\:37 TRACE: DFI initialization DEBUG: DFI trying s390tape DEBUG: DFI s390tape returned with rc -19 DEBUG: DFI trying devmem DEBUG: DFI devmem returned with rc -19 DEBUG: DFI trying s390mv_ext DEBUG: DFI s390mv_ext returned with rc -19 DEBUG: DFI trying s390mv DEBUG: DFI s390mv returned with rc -19 DEBUG: DFI trying s390_ext DEBUG: DFI S390 extended initialization DEBUG: DFI s390_ext returned with rc -19 DEBUG: DFI trying s390 DEBUG: DFI S390 initialization DEBUG: DFI s390 returned with rc -19 DEBUG: DFI trying lkcd DEBUG: DFI lkcd returned with rc -19 DEBUG: DFI trying elf DEBUG: DFI ELF initialization DEBUG: DFI ELF e_phnum 11 DEBUG: DFI ELF p_type[0] 0x6060606 DEBUG: DFI ELF p_type[1] 0x6060606 DEBUG: DFI ELF p_type[2] 0x6060606 DEBUG: DFI ELF p_type[3] 0x6060606 DEBUG: DFI ELF p_type[4] 0x6060606 DEBUG: DFI ELF p_type[5] 0x6060606 DEBUG: DFI ELF p_type[6] 0x6060606 DEBUG: DFI ELF p_type[7] 0x6060606 DEBUG: DFI ELF p_type[8] 0x6060606 DEBUG: DFI ELF p_type[9] 0x6060606 DEBUG: DFI ELF p_type[10] 0x6060606 TRACE: DFI kdump initialization AddressSanitizer:DEADLYSIGNAL ================================================================= ==206692==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000001016a12 bp 0x03ffcc57eae0 sp 0x03ffcc57eae0 T0) ==206692==The signal is caused by a UNKNOWN memory access. ==206692==Hint: address points to the zero page. #0 0x1016a12 in mem_chunk_has_addr /root/s390-tools/zdump/dfi.c:308 #1 0x1016a12 in mem_chunk_find /root/s390-tools/zdump/dfi.c:318 #2 0x1016a12 in dfi_mem_chunk_find /root/s390-tools/zdump/dfi.c:513 #3 0x1016a12 in dfi_mem_range_valid /root/s390-tools/zdump/dfi.c:208 #4 0x1016a12 in kdump_init /root/s390-tools/zdump/dfi.c:1100 #5 0x1016a12 in dfi_init /root/s390-tools/zdump/dfi.c:1253 #6 0x1006d3d in do_dump_info /root/s390-tools/zdump/zgetdump.c:127 #7 0x1006d3d in main /root/s390-tools/zdump/zgetdump.c:182 #8 0x3ff9e0abe03 in __libc_start_main (/lib64/libc.so.6+0x2be03) #9 0x1007d7d (/root/s390-tools/zdump/zgetdump+0x1007d7d) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /root/s390-tools/zdump/dfi.c:308 in mem_chunk_has_addr ==206692==ABORTING Signed-off-by: Alexander Egorenkov Signed-off-by: Jan Höppner --- zdump/dfi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zdump/dfi.c b/zdump/dfi.c index 433a58cd..9a38b51e 100644 --- a/zdump/dfi.c +++ b/zdump/dfi.c @@ -315,7 +315,7 @@ static struct dfi_mem_chunk *mem_chunk_find(struct mem *mem, u64 addr) { struct dfi_mem_chunk *mem_chunk; - if (mem_chunk_has_addr(mem->chunk_cache, addr)) + if (mem->chunk_cache && mem_chunk_has_addr(mem->chunk_cache, addr)) return mem->chunk_cache; util_list_iterate(&mem->chunk_list, mem_chunk) { if (mem_chunk_has_addr(mem_chunk, addr)) {