zdtm: fix silly goto loop in static/shm #13
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com> Signed-off-by: Andrey Vagin <avagin@gmail.com>
cyrillos
pushed a commit
that referenced
this pull request
Dec 12, 2016
Before: =[log]=> dump/zdtm/transition/shmem/142/1/dump.log ------------------------ grep Error ------------------------ pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> ------------------------ ERROR OVER ------------------------ After: =[log]=> dump/zdtm/transition/shmem/62/1/dump.log ------------------------ grep Error ------------------------ pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4 pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4 pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4 pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4 pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4 pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4 ------------------------ ERROR OVER ------------------------ Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
cyrillos
pushed a commit
that referenced
this pull request
Dec 12, 2016
Before: =[log]=> dump/zdtm/transition/shmem/142/1/dump.log ------------------------ grep Error ------------------------ pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> ------------------------ ERROR OVER ------------------------ After: =[log]=> dump/zdtm/transition/shmem/62/1/dump.log ------------------------ grep Error ------------------------ pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4 pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4 pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4 pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4 pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4 pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ> pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4 ------------------------ ERROR OVER ------------------------ Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
cyrillos
pushed a commit
that referenced
this pull request
Feb 9, 2017
'info' array is off-by-one, nla_parse_nested() requires destination array (i.e. 'info') to have maxtype+1 (i.e. IFLA_INFO_MAX+1) elements: ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef823e3f8 WRITE of size 48 at 0x7ffef823e3f8 thread T0 #0 0x7f9ab7a3915b in __asan_memset (/usr/lib/gcc/x86_64-pc-linux-gnu/5.4.0/libasan.so.2+0x8d15b) #1 0x7f9ab6d4e553 in nla_parse (/usr/lib64/libnl-3.so.200+0xa553) #2 0x4acfb7 in dump_one_netdev criu/net.c:445 #3 0x4adb60 in dump_one_ethernet criu/net.c:594 #4 0x4adb60 in dump_one_link criu/net.c:665 #5 0x48af69 in nlmsg_receive criu/libnetlink.c:45 #6 0x48af69 in do_rtnl_req criu/libnetlink.c:119 #7 0x4b0e86 in dump_links criu/net.c:878 #8 0x4b0e86 in dump_net_ns criu/net.c:1651 #9 0x4a760d in do_dump_namespaces criu/namespaces.c:985 #10 0x4a760d in dump_namespaces criu/namespaces.c:1045 #11 0x451ef7 in cr_dump_tasks criu/cr-dump.c:1799 #12 0x424588 in main criu/crtools.c:736 #13 0x7f9ab67b171f in __libc_start_main (/lib64/libc.so.6+0x2071f) #14 0x4253d8 in _start (/criu/criu/criu+0x4253d8) Address 0x7ffef823e3f8 is located in stack of thread T0 at offset 264 in frame #0 0x4ac9ef in dump_one_netdev criu/net.c:364 This frame has 5 object(s): [32, 168) 'netdev' [224, 264) 'info' <== Memory access at offset 264 overflows this variable [320, 1040) 'req' [1088, 3368) 'path' [3424, 3625) 'stable_secret' Increase 'info' size to fix this. Fixes: b705dcc ("net: pass the struct nlattrs to dump() functions") travis-ci: success for net: fix stack out-of-bounds access in dump_one_netdev() Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Acked-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
cyrillos
pushed a commit
that referenced
this pull request
Feb 14, 2017
'info' array is off-by-one, nla_parse_nested() requires destination array (i.e. 'info') to have maxtype+1 (i.e. IFLA_INFO_MAX+1) elements: ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef823e3f8 WRITE of size 48 at 0x7ffef823e3f8 thread T0 #0 0x7f9ab7a3915b in __asan_memset (/usr/lib/gcc/x86_64-pc-linux-gnu/5.4.0/libasan.so.2+0x8d15b) #1 0x7f9ab6d4e553 in nla_parse (/usr/lib64/libnl-3.so.200+0xa553) #2 0x4acfb7 in dump_one_netdev criu/net.c:445 #3 0x4adb60 in dump_one_ethernet criu/net.c:594 #4 0x4adb60 in dump_one_link criu/net.c:665 #5 0x48af69 in nlmsg_receive criu/libnetlink.c:45 #6 0x48af69 in do_rtnl_req criu/libnetlink.c:119 #7 0x4b0e86 in dump_links criu/net.c:878 #8 0x4b0e86 in dump_net_ns criu/net.c:1651 #9 0x4a760d in do_dump_namespaces criu/namespaces.c:985 #10 0x4a760d in dump_namespaces criu/namespaces.c:1045 #11 0x451ef7 in cr_dump_tasks criu/cr-dump.c:1799 #12 0x424588 in main criu/crtools.c:736 #13 0x7f9ab67b171f in __libc_start_main (/lib64/libc.so.6+0x2071f) #14 0x4253d8 in _start (/criu/criu/criu+0x4253d8) Address 0x7ffef823e3f8 is located in stack of thread T0 at offset 264 in frame #0 0x4ac9ef in dump_one_netdev criu/net.c:364 This frame has 5 object(s): [32, 168) 'netdev' [224, 264) 'info' <== Memory access at offset 264 overflows this variable [320, 1040) 'req' [1088, 3368) 'path' [3424, 3625) 'stable_secret' Increase 'info' size to fix this. Fixes: b705dcc ("net: pass the struct nlattrs to dump() functions") travis-ci: success for net: fix stack out-of-bounds access in dump_one_netdev() Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Acked-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Signed-off-by: Stanislav Kinsbursky skinsbursky@parallels.com
Signed-off-by: Andrey Vagin avagin@gmail.com