mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
zdump/dfi: Fix segfault due to double free
The problem can happen when dfi_s390mv_init_gen() returns with an error
code to dfi_init() in dfi.c.
Double free condition occurs on zg_close() call at the end of the
while loop in dfi_init() if zg_close() has already been called for the
same file handle at the end of open_dump() function in scope of
dfi_s390mv_init_gen() processing.
This global file handle is not closed during init() call for any
other dump formats. Since it is not reopened/reused after open_dump() call
during multi-volume dump initialization, we should not close it at all.
The problem can be reproduced in the following steps:
1) Install multi-volume dump tool
# zipl -M mvdump.conf
Dump target: 2 partitions with a total size of 4732 MB.
Warning: All information on the following partitions will be lost!
/dev/dasdb2
/dev/dasdb3
Do you want to continue creating multi-volume dump partitions (y/n)?y
Done.
2) Run zgetdump -i using device (not partition) as a parameter without
taking actual dump.
# zgetdump -i /dev/dasdb
free(): double free detected in tcache 2
Aborted (core dumped)
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
committed by
Jan Höppner
parent
6324f62da7
commit
c4e4b926b4
@@ -556,7 +556,6 @@ static int open_dump(void)
|
||||
}
|
||||
if (mv_dumper_read() != 0)
|
||||
return -ENODEV;
|
||||
zg_close(g.fh);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user