zdump/dfi: Fix segfault due to double free

The problem can happen when dfi_s390mv_init_gen() returns with an error
code to dfi_init() in dfi.c.
Double free condition occurs on zg_close() call at the end of the
while loop in dfi_init() if zg_close() has already been called for the
same file handle at the end of open_dump() function in scope of
dfi_s390mv_init_gen() processing.
This global file handle is not closed during init() call for any
other dump formats. Since it is not reopened/reused after open_dump() call
during multi-volume dump initialization, we should not close it at all.

The problem can be reproduced in the following steps:

1) Install multi-volume dump tool

   # zipl -M mvdump.conf
   Dump target: 2 partitions with a total size of 4732 MB.
   Warning: All information on the following partitions will be lost!
      /dev/dasdb2
      /dev/dasdb3
   Do you want to continue creating multi-volume dump partitions (y/n)?y
   Done.

2) Run zgetdump -i using device (not partition) as a parameter without
   taking actual dump.

   # zgetdump -i /dev/dasdb
   free(): double free detected in tcache 2
   Aborted (core dumped)

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Mikhail Zaslonko
2022-03-23 16:41:29 +01:00
committed by Jan Höppner
parent 6324f62da7
commit c4e4b926b4

View File

@@ -556,7 +556,6 @@ static int open_dump(void)
}
if (mv_dumper_read() != 0)
return -ENODEV;
zg_close(g.fh);
return 0;
}