From: Jackie Liu <liuyu...@kylinos.cn>

Some strange reasons may cause kcore to collect some strange
entries of ikconfig, such as CONFIG_SECU+[some hex data] causes
the 'val' to be NULL, and then crashes when strdup.

CONFIG_SECU+[some hex data] to be **strings that don't
contain the delimitor string '='** and then strtok_r() interprets
it as consisting of a single token, hence val resulting in having NULL.

[d.hatay...@fujitsu.com: rewrite comment]
Suggested-by: HAGIO KAZUHITO(萩尾 一仁) <k-hagio...@nec.com>
Signed-off-by: Jackie Liu <liuyu...@kylinos.cn>
---
 kernel.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/kernel.c b/kernel.c
index 9871637..c8182a6 100644
--- a/kernel.c
+++ b/kernel.c
@@ -10236,7 +10236,7 @@ static struct ikconfig_list {
        char *val;
 } *ikconfig_all;
 
-static void add_ikconfig_entry(char *line, struct ikconfig_list *ent)
+static int add_ikconfig_entry(char *line, struct ikconfig_list *ent)
 {
        char *tokptr, *name, *val;
 
@@ -10244,8 +10244,16 @@ static void add_ikconfig_entry(char *line, struct 
ikconfig_list *ent)
        sscanf(name, "CONFIG_%s", name);
        val = strtok_r(NULL, "", &tokptr);
 
+       if (!val) {
+               if (CRASHDEBUG(2))
+                       error(WARNING, "invalid ikconfig entry: %s\n", line);
+               return FALSE;
+       }
+
        ent->name = strdup(name);
        ent->val = strdup(val);
+
+       return TRUE;
 }
 
 static int setup_ikconfig(char *config)
@@ -10265,8 +10273,8 @@ static int setup_ikconfig(char *config)
                        ent++;
 
                if (STRNEQ(ent, "CONFIG_")) {
-                       add_ikconfig_entry(ent,
-                                        &ikconfig_all[kt->ikconfig_ents++]);
+                       if (add_ikconfig_entry(ent, 
&ikconfig_all[kt->ikconfig_ents]))
+                               kt->ikconfig_ents++;
                        if (kt->ikconfig_ents == IKCONFIG_MAX) {
                                error(WARNING, "ikconfig overflow.\n");
                                return 1;
-- 
2.17.1



--
Crash-utility mailing list
Crash-utility@redhat.com
https://www.redhat.com/mailman/listinfo/crash-utility

Reply via email to