Commit Graph

16 Commits

Author SHA1 Message Date
Mikhail Zaslonko 23e9156f43 s390_dump.h: Add DF_S390_DUMPER_MAGIC_SIZE constant
Add DF_S390_DUMPER_MAGIC_SIZE constant to s390_dump.h.
Use it instead of hardcoded length when processing dumper magics
in zgetdump code.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
2024-03-15 15:11:34 +01:00
Mikhail Zaslonko 7b68552359 zdump: Use global header s390_dump.h
Instead of using its own DF_S390_ constants and df_s390_ structs
in df_s390.h, include those from "dump/s390_dump.h" in order to minimize
duplicates. Adjust the code, where required, to use <stdint> types
instead of those defined in zt_common.h (e.g. use uint64_t instead of u64).

Adjust zdump include statements.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2023-09-27 18:29:06 +02:00
Mikhail Zaslonko c4e4b926b4 zdump/dfi: Fix segfault due to double free
The problem can happen when dfi_s390mv_init_gen() returns with an error
code to dfi_init() in dfi.c.
Double free condition occurs on zg_close() call at the end of the
while loop in dfi_init() if zg_close() has already been called for the
same file handle at the end of open_dump() function in scope of
dfi_s390mv_init_gen() processing.
This global file handle is not closed during init() call for any
other dump formats. Since it is not reopened/reused after open_dump() call
during multi-volume dump initialization, we should not close it at all.

The problem can be reproduced in the following steps:

1) Install multi-volume dump tool

   # zipl -M mvdump.conf
   Dump target: 2 partitions with a total size of 4732 MB.
   Warning: All information on the following partitions will be lost!
      /dev/dasdb2
      /dev/dasdb3
   Do you want to continue creating multi-volume dump partitions (y/n)?y
   Done.

2) Run zgetdump -i using device (not partition) as a parameter without
   taking actual dump.

   # zgetdump -i /dev/dasdb
   free(): double free detected in tcache 2
   Aborted (core dumped)

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2022-04-19 18:37:17 +02:00
Alexander Egorenkov 353c23a157 zdump: Include dfi_mem_chunk.h only if required
Don't include dfi_mem_chunk.h in dfi.h because not every module including
dfi.h needs it.

Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2021-11-10 15:12:10 +01:00
Alexander Egorenkov 1005e7be7e zdump: Don't use god-like C headers
Get rid of C headers which include everything. This is bad for testing and
maintainability. C files should include only what they need and no more.

Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2021-11-10 15:12:10 +01:00
Alexander Egorenkov f15e32cdb1 zdump/dfi: Fix illegal memory access in dfi_cpu_add_from_lc()
Check that a CPU's lowcore address falls within a valid memory region
before accessing it. This prevents potential illegal memory accesses
in case a dump contains invalid CPU lowcore addresses.

This bug was found with AFL fuzzing and ASAN.

Starting program: /root/s390-tools/zdump/zgetdump -iVVVVV /root/zgetdump-fuzzing/findings/crashes/id:000004,sig:06,src:000005,op:flip32,pos:3055
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
TRACE: DFI initialization
DEBUG: DFI trying s390tape
DEBUG: DFI s390tape returned with rc -19
DEBUG: DFI trying devmem
DEBUG: DFI devmem returned with rc -19
DEBUG: DFI trying s390mv_ext
DEBUG: DFI s390mv_ext returned with rc -19
DEBUG: DFI trying s390mv
DEBUG: DFI s390mv returned with rc -19
DEBUG: DFI trying s390_ext
DEBUG: DFI S390 extended initialization
DEBUG: DFI s390_ext returned with rc -19
DEBUG: DFI trying s390
DEBUG: DFI S390 initialization
 INFO: DFI S390 version 5
DEBUG: DFI S390 mem_size 0x00000000000dbba0
DEBUG: DFI add vol mem chunk start 0x0000000000000000 size 0x00000000000dbba0 volnr 0

[snip]

TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x0000000000000000 size 0x0000000000002000
TRACE: DFI virt mem read addr 0x00000000000000ff size 0x0000000000002000
TRACE: DFI virt mem read addr 0x00000000ffffff00 size 0x0000000000002000

Program received signal SIGSEGV, Segmentation fault.
0x000000000100fbb0 in mem_read (cnt=<optimized out>, buf=0x3ffffffc7d0, addr=4294967040, mem=0x104b218 <l+152>) at dfi.c:339
339                     size = MIN(cnt - copied, mem_chunk->end - addr + 1);
Missing separate debuginfos, use: dnf debuginfo-install fuse-libs-2.9.9-11.fc34.s390x glibc-2.33-20.1.ibm.fc34.s390x libasan-11.0.1-0.3.1.ibm.fc34.s390x libgcc-11.0.1-0.3.1.ibm.fc34.s390x libstdc++-11.0.1-0.3.1.ibm.fc34.s390x zlib-1.2.11-26.fc34.s390x
(gdb) bt

Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2021-10-01 14:59:56 +02:00
Jan Höppner d55b787d05 zgetdump: Fix device node determination via sysfs
When using zgetdump on a multi-volume device dump, the sysfs path to
determine the device node is incomplete, resulting in the following
error:

$ zgetdump -i /dev/dasdb1
zgetdump: Could not open "/sys/bus/ccw/devices/0.0.9300/dasdb/dev" (No
such file or directory)

A simple fix would be to add the missing "block" part in the sysfs path.
However, the logic still assumes sysfs links like "block:" that have
been deprecated a decade ago and are no longer present on modern
systems anyway.
Therefore, the logic can greatly be improved. Create a separate function
to determine whether a device is online, remove the logic for "block:"
entries, and use libutil functions to reduce the complexity even further.

Fixes: 70a79fab3c ("zgetdump: Avoid using PATH_MAX")
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2020-10-28 13:22:45 +01:00
Jan Höppner c2297a0a7e zgetdump: Replace strncpy() with memcpy()
We can safely replace strncpy() with memcpy() here and get rid of the
following compile warnings:

dfi_s390mv.c: In function ‘set_magic_numbers’:
dfi_s390mv.c:570:3: warning: ‘strncpy’ output truncated before
terminating nul copying 7 bytes fr om a string of the same length
[-Wstringop-truncation]
   strncpy(l.dumper_magic, DF_S390_DUMPER_MAGIC_MV_EXT, 7);
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
dfi_s390mv.c:573:3: warning: ‘strncpy’ output truncated before
terminating nul copying 7 bytes fr om a string of the same length
[-Wstringop-truncation]
   strncpy(l.dumper_magic, DF_S390_DUMPER_MAGIC_MV, 7);
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2018-11-16 15:01:42 +01:00
Jan Höppner 70a79fab3c zgetdump: Avoid using PATH_MAX
Using inappropriate sizes for snprintf() leads to the following compile
warnings:

dfi_s390mv.c: In function ‘dev_from_busid’:
dfi_s390mv.c:116:34: warning: ‘/online’ directive output may be
truncated writing 7 bytes into a region of size between 1 and 4096
[-Wformat-truncation=]
  snprintf(tmp_file, PATH_MAX, "%s/online", dev_file);
                                  ^~~~~~~
dfi_s390mv.c:116:2: note: ‘snprintf’ output between 8 and 4103 bytes
into a destination of size 4096
  snprintf(tmp_file, PATH_MAX, "%s/online", dev_file);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
dfi_s390mv.c:143:35: warning: ‘%s’ directive output may be truncated
writing up to 255 bytes into a region of size between 0 and 4095
[-Wformat-truncation=]
  snprintf(tmp_file, PATH_MAX, "%s/%s/dev", dev_file, direntp->d_name);
                                   ^~
dfi_s390mv.c:143:2: note: ‘snprintf’ output between 6 and 4356 bytes
into a destination of size 4096
  snprintf(tmp_file, PATH_MAX, "%s/%s/dev", dev_file, direntp->d_name);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A simple fix would be to use different suitable fixed sizes for tmp_file
and dev_file. However, the code can be improved here a little.

Use the libutil function util_path_sysfs() to build the sysfs path
string. This is more robust, as the function will figure out the correct
mount point of the sysfs. util_path_sysfs() will also terminate
execution, if no sysfs mount point could be found. That means, we can
get rid of check_sysfs().
Furthermore, the two variables (tmp_file, dev_file) can be combined to
one. Also, check the return value of open() and act accordingly.

Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2018-11-16 15:01:42 +01:00
Mikhail Zaslonko cf99ea019e zgetdump: Add 'Dump file size' field for zgetdump -i output
Add 'Dump file size' field for zgetdump -i output to show the actual size
of dump file in s390 extended format on disk in megabytes.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2018-05-07 13:42:03 +02:00
Mikhail Zaslonko 4a223c70f2 zgetdump: Update zgetdump to process the new dump format
Update zgetdump tool to process dumps of the new s390 extended format.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2018-05-07 13:42:03 +02:00
Mikhail Zaslonko 26d636f234 zgetdump: Update zgetdump to process the new dump tool
Update 'zgetdump -d' to process the new DASD dump tool installed (single
volume or multi-volume).

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2018-05-07 13:42:03 +02:00
Mikhail Zaslonko aade05b01d zgetdump: Update s390 dump common functions
Update df_s390_dumper structure and dumper reading functions to read
certain dumper fields instead of the entire dump tool.
Update other s390 dump common functions in preparation for the new dumper
and the new s390 extended dump format.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2018-05-07 13:42:03 +02:00
Mikhail Zaslonko a74103dba7 zgetdump: Fix overflow/truncation in part_off calculation
When calculating partition start offset during multi-volume dump processing,
the result of multiplication is truncated to 32-bits thus resulting in
invalid behavior in case the real offset is beyond 4Gig boundary.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.vnet.ibm.com>
Reviewed-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
2018-01-22 13:50:07 +01:00
Michael Holzheu 6c3c721275 zgetdump: Fix gcc 7 warning
With gcc 7 the compiler checks for sprintf() the maxium possible resulting
string based on the used datatypes.

Example:

 struct vol {
          ...
          char bus_id[9];
          ...
 }

 sprintf(vol->bus_id, "0.%x.%04x", ssid, vol_parm->devno);

The compiler can prove that "ssid" comes from "u8" and "vol_parm->devno"
from "u16". Therefore the resulting maximum string can be 0.ff.ffff which
requires 10 bytes.

This leads to the following warning:

 dfi_s390mv.c: In function 'volumes_init':
 dfi_s390mv.c:243:45: warning: '__builtin___snprintf_chk' output may be
  truncated before the last format character [-Wformat-truncation=]
  snprintf(vol->bus_id, sizeof(vol->bus_id), "0.%x.%04x", ssid,
                                             ^~~~~~~~~~~
 In file included from /usr/include/stdio.h:936:0,
                  from dfi_s390mv.c:15:
 /usr/include/bits/stdio2.h:64:10: note: '__builtin___snprintf_chk' output
    between 9 and 10 bytes into a destination of size 9
    return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         __bos (__s), __fmt, __va_arg_pack ());
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

To get rid of the warning use 10 instead of 9 bytes for the bus_id.

Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
2017-09-06 13:04:50 +02:00
Michael Holzheu b627b8d8e1 Initial s390-tools-2.0.0 import
This commit is based on the s390-tools-1.39.0 version.

Changes on top of s390-tools-1.39.0:

 - Add MIT license to all source files
 - Add LICENSE file
 - Transform REAMDE to README.md (markdown)
 - Add AUTHORS.md file
 - Add CONTRIBUTING.md file
 - Move changelog from README to CHANGELOG.md file

Reviewed-by: Stefan Haberland <sth@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
2017-08-21 10:55:40 +02:00