Package: ipmitool
Version: 1.8.8-3.1
Severity: important
When using the ipmitool 'sol activate 1' command for some time, and
the sessions is terminated by the BMC, ipmitool gets hit with a SEGV.
This is reproducible on Ubuntu 8.04 HH x86-64 connecting to an Intel
S5000PAL IPMI interface:
1. establish SOL session to node, eg 'ipmitool -A MD5 -o intelplus -I
lanplus -e [ -P foo -H quad sol activate 1'
2. separately, issue 'sol deactivate 1' command
3. try to disconnect first session, or perform any activity on it, eg
'~.' or '[.'
<SEGV>
Stacktrace via valgrind:
$ valgrind ipmitool -A MD5 -o intelplus -I lanplus -e [ -P fooey -H
quorum3-mc sol activate 1
<snip>
[SOL Session operational. Use [? for help]
<separately issue 'sol disconnect 1'>
<press any key>
==14621==
==14621== Invalid read of size 1
==14621== at 0x431154: ipmi_lanplus_recv_sol (lanplus.c:2459)
==14621== by 0x42FCA7: ipmi_lanplus_send_payload (lanplus.c:2167)
==14621== by 0x4312BB: ipmi_lanplus_send_sol (lanplus.c:2298)
==14621== by 0x411482: ipmi_sol_activate (ipmi_sol.c:1259)
==14621== by 0x411B0B: ipmi_sol_main (ipmi_sol.c:1716)
==14621== by 0x428CE1: ipmi_main (ipmi_main.c:601)
==14621== by 0x40439F: main (ipmitool.c:115)
==14621== Address 0x40c is not stack'd, malloc'd or (recently) free'd
==14621==
==14621== Process terminating with default action of signal 11
(SIGSEGV): dumping core
==14621== Access not within mapped region at address 0x40C
==14621== at 0x431154: ipmi_lanplus_recv_sol (lanplus.c:2459)
==14621== by 0x42FCA7: ipmi_lanplus_send_payload (lanplus.c:2167)
==14621== by 0x4312BB: ipmi_lanplus_send_sol (lanplus.c:2298)
==14621== by 0x411482: ipmi_sol_activate (ipmi_sol.c:1259)
==14621== by 0x411B0B: ipmi_sol_main (ipmi_sol.c:1716)
==14621== by 0x428CE1: ipmi_main (ipmi_main.c:601)
==14621== by 0x40439F: main (ipmitool.c:115)
<snip>
Use the source, Luke:
/*
* ipmi_lanplus_recv_sol
*
* Receive a SOL packet and send an ACK in response.
*
*/
struct ipmi_rs *
ipmi_lanplus_recv_sol(struct ipmi_intf * intf)
{
struct ipmi_rs * rsp = ipmi_lan_poll_recv(intf);
if(rsp->session.authtype != 0) <---- SEGV
{
ack_sol_packet(intf, rsp);
/*
* Remembers the data sent, and alters the data to just
* include the new stuff.
*/
check_sol_packet_for_new_data(intf, rsp);
}
return rsp;
}
Given the SEGV is from a load at (invalid) address 0x40c, this is most
likely the offset of session.authtype from 'rsp', which is NULL.
This patch fixes the behaviour:
--- ./ipmitool-1.8.8/src/plugins/lanplus/lanplus.c 2006-04-21
17:34:30.000000000 +0100
+++ ./ipmitool-1.8.8-dan/ipmitool-1.8.8/src/plugins/lanplus/lanplus.c
2008-05-30 18:12:02.000000000 +0100
@@ -2165,6 +2165,8 @@
rsp = ipmi_lanplus_recv_sol(intf); /* Grab the next packet */
+ if (!rsp)
+ break;
if (sol_response_acks_packet(rsp, payload))
break;
@@ -2456,7 +2458,7 @@
{
struct ipmi_rs * rsp = ipmi_lan_poll_recv(intf);
- if(rsp->session.authtype != 0)
+ if(rsp && rsp->session.authtype != 0)
{
ack_sol_packet(intf, rsp);
Now, the session is terminated after it is timed out:
$ ipmitool -A MD5 -o intelplus -I lanplus -e [ -P fooey -H quorum1-mc
sol activate 1
[SOL Session operational. Use [? for help]
<terminate from other command>
Error sending SOL data: FAIL
SOL session closed by BMC
$
Can someone kick this upstream please? I'm open to testing patches and
new packages too!
Thanks,
Daniel
--
Daniel J Blueman
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
