Re: [Crash-utility] [PATCH] netdump: bugfix for read elf header
Hi,
Am 30.11.20 um 11:56 schrieb Qianli Zhao:
From: Qianli Zhao <zhaoqianli(a)xiaomi.com>
Without the patch,errors may occur in reading the ELF header,
causing the parsing to fail.
Signed-off-by: Qianli Zhao <zhaoqianli(a)xiaomi.com>
---
When i use crash to parsing a kdump,i got below error.
This error occurs because of the read header less then SAFE_NETDUMP_ELF_HEADER_SIZE,
But can read MIN_NETDUMP_ELF_HEADER_SIZE bytes from the file correctly.
this issue is introduced due to commit:f42db6a33f0e0652df7cce8506352745b4794287
crash 7.2.9
Copyright (C) 2002-2020 Red Hat, Inc.
Copyright (C) 2004, 2005, 2006, 2010 IBM Corporation
Copyright (C) 1999-2006 Hewlett-Packard Co
Copyright (C) 2005, 2006, 2011, 2012 Fujitsu Limited
Copyright (C) 2006, 2007 VA Linux Systems Japan K.K.
Copyright (C) 2005, 2011 NEC Corporation
Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc.
Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc.
This program is free software, covered by the GNU General Public License,
and you are welcome to change it and/or distribute copies of it under
certain conditions. Enter "help copying" to see the conditions.
This program has absolutely no warranty. Enter "help warranty" for details.
/var/tmp/ramdump_elf_B2R4cQ: ELF header read: No such file or
directory
crash: malformed ELF file: /var/tmp/ramdump_elf_B2R4cQ
This looks like an error to me. According to the above errno value, you
tried to read a file that's not there? But maybe it's just a stall errno
value as we don't reset it prior to calling read(). To clarify, can you
please provide the output of running 'strace crash ....'?
Usage:
crash [OPTION]... NAMELIST MEMORY-IMAGE[@ADDRESS] (dumpfile form)
crash [OPTION]... [NAMELIST] (live system form)
Enter "crash -h" for details.
---
netdump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/netdump.c b/netdump.c
index c76d9dd..cb0af41 100644
--- a/netdump.c
+++ b/netdump.c
@@ -142,7 +142,7 @@ is_netdump(char *file, ulong source_query)
if (!read_flattened_format(fd, 0, eheader, size))
goto bailout;
} else {
- if (read(fd, eheader, size) != size) {
+ if (read(fd, eheader, size) < MIN_NETDUMP_ELF_HEADER_SIZE) {
size -- which is set to SAFE_NETDUMP_ELF_HEADER_SIZE here -- is only 128
bytes more than MIN_NETDUMP_ELF_HEADER_SIZE. This means, if the above
change really fixes your issue, you're trying to open a very small file
that barely carries any useful information beside its header. Anyhow,
this change introduces a regression to the code that's following, which
assumes the full 'size' was read, like the sanity checks for finding the
PT_NOTE program header. So you should either update 'size' so it mirrors
the actual bytes read or double-check that the kdump file you're trying
to analyze is actually a real one.
Thanks,
Mathias
sprintf(buf, "%s: ELF header read", file);
perror(buf);
goto bailout;