kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zdump/dfi_lkcd: Validate LKCD page address against mem_end

Browse Source 
mem_init_flex() allocates the page header index array sized for
ADDR_TO_IDX(mem_end) + 1 entries, but never checked that each
page record's address falls within [0, mem_end).
A crafted LKCD page record with addr >= mem_end writes 8 bytes
beyond the allocation.

Fix by rejecting any page record whose address is > mem_end - PAGE_SIZE
with ERR_EXIT(), immediately after the end-of-dump marker check.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Mikhail Zaslonko
2026-07-02 10:58:39 +02:00
committed by Jan Höppner
parent cdabf280ac
commit a8a87779c0
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
zdump/dfi_lkcd.c
View File

@@ -225,6 +225,9 @@ static int mem_init_flex(void)
}
if (dump_end(addr, &pg_hdr))
break;
if (pg_hdr.addr + PAGE_SIZE > l.hdr.mem_end)
ERR_EXIT("Dump file inconsistent, LKCD page address out of range (0x%llx)",
pg_hdr.addr);
if (pg_hdr.addr - addr > MEM_HOLE_SIZE_MIN) {
dfi_mem_chunk_add(mem_chunk_start,
addr + PAGE_SIZE - mem_chunk_start,