Coverity scan afdasdad #11

avagin · 2015-12-31T17:20:07Z

afdasds
werwqerq
bmvmnb
yuitut
TEST

It turns out we can't just test for /proc/<pid>, because the kernel appends (deleted), since the directory is actually deleted (vs. something like /proc/1/mountinfo, where the file still exists in the unlinked directory, so there is no (deleted)). See comment for details. v2: s/ret/is_dead in /proc/<pid>/xxx test, split tests to correctly test both cases Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

The descriptor for test netns-nf and netns are referencing /bin/diff. On Fedora this is a hard link to /usr/bin/diff created during the install of the package diffutils. However this hard link doesn't exist on Debian like systems. Referencing /usr/bin/diff works in both cases. Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Recent kernels allow for user to read proc pagemap file, but zero pfns in it. Support this mode for user dumps. https://github.com/xemul/criu/issues/101 Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com> Acked-by: Andrew Vagin <avagin@virtuozzo.com>

Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com> Acked-by: Andrew Vagin <avagin@virtuozzo.com> Tested-by: Adrian Reber <adrian@lisas.de>

Depending on the distribution, binaries or shared libraries a test is dependent of may not be stored at the same place. This patch introduces the ability to define option in the dependency list, by separating the optional target names by a '|' character. For instance the dependency of test may be described this way: {'flavor': 'ns', 'deps': [ '/bin/foo|/usr/bin/foo' ], 'flags': 'suid'} Note, there shouldn't be any spaces around the '|'. If none of the optional dependency is satisfied, an error is raised. Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

This test calls iptables to set a new packet filter using a shared library libxt_standard.so. Unfortunately, depending on the distribution we are running on, this shared library may be stored on a different place. This patch allows this test to be run on Debian like systems. Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

This patch introduces basic CPU feature checking for PowerPC. Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Generate random binfmt_misc entries of different types and check that they remain registered after the signal. v2: pr_perror() in cleanup, .desc file and TST_DIR in Makefile Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

It's a debug message, and it shouldn't be printed with pr_perror(). Also, we interested in debug in the both cases: magic and extensions. Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Introduce post-setup-namespaces action script It needed to have possibility to run cutom script after mount namespace is configured Signed-off-by: Igor Sukhih <igor@parallels.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

If we happen to get 0 as the fd for the mountpoint, there is an error: (00.280617) Dumping task cwd id 0x2b root id 0x2b (00.280697) mnt: Dumping mountpoints (00.280702) mnt: 132: 34:/ @ ./run/lock (00.280714) mnt: Path `/run/lock' resolved to `./run/lock' mountpoint tar: /proc/self/fd/0: Cannot open: Not a directory tar: Error is not recoverable: exiting now (00.283581) Error (util.c:666): exited, status=2 (00.283598) Error (mount.c:1220): mnt: Can't dump tmpfs content Instead, let's not ever use 0 as the mountpoint fd. Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

There's only one user of it, so better to reshuffle the arg set. Signed-off-by: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

This fixes the following test error: FAIL: binfmt_misc.c:111: mount failed (errno = 1 (Operation not permitted)) CRIU tests (./test/zdtm.py run -a) passed. Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

We need to detach from all processes before waiting the root task, because one of these processes may collect processes from a target pid namespace. The pid namespace is destroyed only when all processes have been killed and collected. https://jira.sw.ru/browse/PSBM-43089 Signed-off-by: Andrew Vagin <avagin@virtuozzo.com> Acked-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

criu detaches from tasks in freezer_detach() in this case Signed-off-by: Andrew Vagin <avagin@virtuozzo.com> Acked-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com> Acked-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

* Split into two -- full/sb comparisons * Code formatting (spaces) * Arg names Signed-off-by: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

If for some reason ptrace_poke_area return error we might left dumpee with memfd descriptor opened. Later in code we remove out injected blob making dumpee to look untouched but descriptor will hang there. lsof from container output: | systemd-u 48 root 6u REG 0,4 0 53855 /memfd:CRIUMFD (deleted) Thus lets close it immediately. https://jira.sw.ru/browse/PSBM-43199 Signed-off-by: Cyrill Gorcunov <gorcunov@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

The root mount is always external and master_id is external too. It's required to validate mounts. We already do this on restore, but we need to do this on dump too. Otherwise we will get the error: Mount %d %s (master_id: %d shared_id: %d) has unreachable sharing. Try --enable-external-masters. https://jira.sw.ru/browse/PSBM-43260 Signed-off-by: Andrew Vagin <avagin@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

These are present in every cgroup, so let's dump them. Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

When we kill a container, all processes from its pidns are killed by SIGKILL, but we don't expect that someone from the freezer cgroup will be killed too if it was not dumped. (00.468446) Error (seize.c:439): Unexpected child 79162 (00.468489) Error (seize.c:440): BUG at seize.c:440 This situation is posiable, if someone enters into pidns by setns. In this patch, we deatches from extra processes before killing dumped processes. In this case, we are not get signals if someone is killed. https://jira.sw.ru/browse/PSBM-43795 Signed-off-by: Andrey Vagin <avagin@openvz.org>

CID 157804 (#1 of 1): Missing varargs init or cleanup (VARARGS) 16. missing_va_end: va_end was not called for tmp. Reported-by: Mr Coverity

CID 157801 (#1 of 1): Argument cannot be negative (NEGATIVE_RETURNS) 19. negative_returns: fd is passed to a parameter that cannot be negative.

CID 157800 (#1 of 1): Missing break in switch (MISSING_BREAK) unterminated_case: The case for value 1071 is not terminated by a 'break' statement.

It can be dead-lokced: #0 0x00007fafbf49f6ac in __lll_lock_wait_private () from /lib64/libc.so.6 #1 0x00007fafbf44af1c in _L_lock_2460 () from /lib64/libc.so.6 #2 0x00007fafbf44ad57 in __tz_convert () from /lib64/libc.so.6 #3 0x00000000004022e2 in test_msg (format=0x404508 "Receive signal %d\n") at msg.c:51 #4 <signal handler called> #5 0x00007fafbf3f2483 in __GI__IO_vfscanf () from /lib64/libc.so.6 #6 0x00007fafbf408f27 in vsscanf () from /lib64/libc.so.6 #7 0x00007fafbf4032f7 in sscanf () from /lib64/libc.so.6 #8 0x00007fafbf449ba6 in __tzset_parse_tz () from /lib64/libc.so.6 #9 0x00007fafbf44c4cb in __tzfile_compute () from /lib64/libc.so.6 #10 0x00007fafbf44ae17 in __tz_convert () from /lib64/libc.so.6 #11 0x00000000004022e2 in test_msg (format=format@entry=0x40458c "PASS\n") at msg.c:51 #12 0x0000000000401ceb in main (argc=<optimized out>, argv=<optimized out>) at ptrace_sig.c:172 https://jira.sw.ru/browse/PSBM-47772 Signed-off-by: Andrey Vagin <avagin@openvz.org> Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>

It can be dead-lokced: #0 0x00007fafbf49f6ac in __lll_lock_wait_private () from /lib64/libc.so.6 #1 0x00007fafbf44af1c in _L_lock_2460 () from /lib64/libc.so.6 #2 0x00007fafbf44ad57 in __tz_convert () from /lib64/libc.so.6 #3 0x00000000004022e2 in test_msg (format=0x404508 "Receive signal %d\n") at msg.c:51 #4 <signal handler called> #5 0x00007fafbf3f2483 in __GI__IO_vfscanf () from /lib64/libc.so.6 #6 0x00007fafbf408f27 in vsscanf () from /lib64/libc.so.6 #7 0x00007fafbf4032f7 in sscanf () from /lib64/libc.so.6 #8 0x00007fafbf449ba6 in __tzset_parse_tz () from /lib64/libc.so.6 #9 0x00007fafbf44c4cb in __tzfile_compute () from /lib64/libc.so.6 #10 0x00007fafbf44ae17 in __tz_convert () from /lib64/libc.so.6 #11 0x00000000004022e2 in test_msg (format=format@entry=0x40458c "PASS\n") at msg.c:51 #12 0x0000000000401ceb in main (argc=<optimized out>, argv=<optimized out>) at ptrace_sig.c:172 Signed-off-by: Andrey Vagin <avagin@openvz.org> Signed-off-by: Andrew Vagin <avagin@virtuozzo.com> Tested-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

It can be dead-locked: #0 0x00007fafbf49f6ac in __lll_lock_wait_private () from /lib64/libc.so.6 #1 0x00007fafbf44af1c in _L_lock_2460 () from /lib64/libc.so.6 #2 0x00007fafbf44ad57 in __tz_convert () from /lib64/libc.so.6 #3 0x00000000004022e2 in test_msg (format=0x404508 "Receive signal %d\n") at msg.c:51 #4 <signal handler called> #5 0x00007fafbf3f2483 in __GI__IO_vfscanf () from /lib64/libc.so.6 #6 0x00007fafbf408f27 in vsscanf () from /lib64/libc.so.6 #7 0x00007fafbf4032f7 in sscanf () from /lib64/libc.so.6 #8 0x00007fafbf449ba6 in __tzset_parse_tz () from /lib64/libc.so.6 #9 0x00007fafbf44c4cb in __tzfile_compute () from /lib64/libc.so.6 #10 0x00007fafbf44ae17 in __tz_convert () from /lib64/libc.so.6 #11 0x00000000004022e2 in test_msg (format=format@entry=0x40458c "PASS\n") at msg.c:51 #12 0x0000000000401ceb in main (argc=<optimized out>, argv=<optimized out>) at ptrace_sig.c:172 https://jira.sw.ru/browse/PSBM-47772 Signed-off-by: Andrey Vagin <avagin@openvz.org> Signed-off-by: Andrew Vagin <avagin@virtuozzo.com> Signed-off-by: Cyrill Gorcunov <gorcunov@virtuozzo.com>

'info' array is off-by-one, nla_parse_nested() requires destination array (i.e. 'info') to have maxtype+1 (i.e. IFLA_INFO_MAX+1) elements: ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef823e3f8 WRITE of size 48 at 0x7ffef823e3f8 thread T0 #0 0x7f9ab7a3915b in __asan_memset (/usr/lib/gcc/x86_64-pc-linux-gnu/5.4.0/libasan.so.2+0x8d15b) #1 0x7f9ab6d4e553 in nla_parse (/usr/lib64/libnl-3.so.200+0xa553) #2 0x4acfb7 in dump_one_netdev criu/net.c:445 #3 0x4adb60 in dump_one_ethernet criu/net.c:594 #4 0x4adb60 in dump_one_link criu/net.c:665 #5 0x48af69 in nlmsg_receive criu/libnetlink.c:45 #6 0x48af69 in do_rtnl_req criu/libnetlink.c:119 #7 0x4b0e86 in dump_links criu/net.c:878 #8 0x4b0e86 in dump_net_ns criu/net.c:1651 #9 0x4a760d in do_dump_namespaces criu/namespaces.c:985 #10 0x4a760d in dump_namespaces criu/namespaces.c:1045 #11 0x451ef7 in cr_dump_tasks criu/cr-dump.c:1799 #12 0x424588 in main criu/crtools.c:736 #13 0x7f9ab67b171f in __libc_start_main (/lib64/libc.so.6+0x2071f) #14 0x4253d8 in _start (/criu/criu/criu+0x4253d8) Address 0x7ffef823e3f8 is located in stack of thread T0 at offset 264 in frame #0 0x4ac9ef in dump_one_netdev criu/net.c:364 This frame has 5 object(s): [32, 168) 'netdev' [224, 264) 'info' <== Memory access at offset 264 overflows this variable [320, 1040) 'req' [1088, 3368) 'path' [3424, 3625) 'stable_secret' Increase 'info' size to fix this. Fixes: b705dcc ("net: pass the struct nlattrs to dump() functions") travis-ci: success for net: fix stack out-of-bounds access in dump_one_netdev() Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Acked-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

This device is an API endpoint, just skip it. Also, prepare the ground for sit dump. Issue #11 Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com> Signed-off-by: Andrei Vagin <avagin@virtuozzo.com>