Skip to content

Commit

Permalink
zdump/dfi: Fix segfault due to double free
Browse files Browse the repository at this point in the history
The problem can happen when dfi_s390mv_init_gen() returns with an error
code to dfi_init() in dfi.c.
Double free condition occurs on zg_close() call at the end of the
while loop in dfi_init() if zg_close() has already been called for the
same file handle at the end of open_dump() function in scope of
dfi_s390mv_init_gen() processing.
This global file handle is not closed during init() call for any
other dump formats. Since it is not reopened/reused after open_dump() call
during multi-volume dump initialization, we should not close it at all.

The problem can be reproduced in the following steps:

1) Install multi-volume dump tool

   # zipl -M mvdump.conf
   Dump target: 2 partitions with a total size of 4732 MB.
   Warning: All information on the following partitions will be lost!
      /dev/dasdb2
      /dev/dasdb3
   Do you want to continue creating multi-volume dump partitions (y/n)?y
   Done.

2) Run zgetdump -i using device (not partition) as a parameter without
   taking actual dump.

   # zgetdump -i /dev/dasdb
   free(): double free detected in tcache 2
   Aborted (core dumped)

Signed-off-by: Mikhail Zaslonko <[email protected]>
Reviewed-by: Alexander Egorenkov <[email protected]>
Signed-off-by: Jan Höppner <[email protected]>
  • Loading branch information
mzaslonk authored and hoeppnerj committed Apr 19, 2022
1 parent 6324f62 commit c4e4b92
Showing 1 changed file with 0 additions and 1 deletion.
1 change: 0 additions & 1 deletion zdump/dfi_s390mv.c
Original file line number Diff line number Diff line change
Expand Up @@ -556,7 +556,6 @@ static int open_dump(void)
}
if (mv_dumper_read() != 0)
return -ENODEV;
zg_close(g.fh);
return 0;
}

Expand Down

0 comments on commit c4e4b92

Please sign in to comment.