[Panicsel-developers] RE: Segment fault happened when run fruconfig.

[Cress, A. R <and...@in...>]

Again, this is from bad FRU/SDR information put into the system.
However, I will add some bounds checking to make sure the value doesn't go
beyond the buffer.

Andy

-----Original Message-----
From: Guo, Min 
Sent: Monday, March 10, 2003 1:37 AM
To: Cress, Andrew R
Cc: pan...@li...
Subject: Segment fault happened when run fruconfig.


Hi

	Here I encounter one issue  when run fruconfig on langley.
Can you tell me whether it is a bug of fruconfig?
	
	We can get the fru header, but can not access the corresponding 
board information address.

Thanks
Guo Min	

----------------------------------------------------------------------------
-------------------------------------------------
./fruconfig
fruconfig: version 1.1
-- BMC version 0.48, IPMI version 1.5
Mainboard FRU Size  : 256
Segmentation fault
./fruconfig -x
fruconfig: version 1.1
-- BMC version 0.48, IPMI version 1.5
ipmi_cmd_ia: request (len=13): 10 20 00 0a 00 d0 fc ff bf 01 00 00 00
  req.data=0xbffffcd0, dlen=1: 00
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=3): 00 01 00
load_fru: inv ret = 0, cc = 0
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 00 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed
ee ef
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 10 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 01 04 17 c6 54 53 52 4c 54 32 cb 41 44 4c
41 32
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 20 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 33 30 30 30 34 35 c0 c1 00 00 00 00 00 00
00 97
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 30 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 01 06 00 66 6c 33 c5 49 6e 74 65 6c c4 53
43 42
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 40 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 32 cc 4b 52 43 32 32 32 31 30 31 39 38 31
ca 41
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 50 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 34 36 30 34 34 2d 36 30 39 c0 c0 c1 00 00
00 d5
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 60 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 01 0a 00 c5 49 6e 74 65 6c c7 4c 41 4e 47
4c 45
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 70 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 59 c0 c0 c0 c0 c0 c6 54 53 52 4c 54 32 c1
00 00
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 80 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 90 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 a0 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 4f
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 b0 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 c0 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 d0 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 e0 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff
ipmi_cmd_ia: request (len=13): 11 20 00 0a 00 d0 fc ff bf 04 00 00 00
  req.data=0xbffffcd0, dlen=4: 00 f0 00 10
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=17): 10 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff
ipmi_cmd_ia: request (len=13): 37 20 00 06 00 d0 fc ff bf 00 00 00 00
  req.data=0xbffffcd0, dlen=0:
ipmi_cmd_ia: sendImbRequest status=0, ccode=0
ipmi_cmd_ia: response (len=16): cc 45 d0 38 54 72 d6 11 00 80 de b4 d5 47 03
00
system_guid: ret = 0, cc = 0
system guid (16): cc 45 d0 38 54 72 d6 11 00 80 de b4 d5 47 03 00 00
Mainboard FRU Size  : 256
FRU Header: e0 e1 e2 e3 e4 e5 e6 e7
FRU Body (size=9088/256):
  0000: e0 e1 e2 e3 e4 e5 e6 e7
  0008: e8 e9 ea eb ec ed ee ef
  0016: 01 04 17 c6 54 53 52 4c
  0024: 54 32 cb 41 44 4c 41 32
  0032: 33 30 30 30 34 35 c0 c1
  0040: 00 00 00 00 00 00 00 97
  0048: 01 06 00 66 6c 33 c5 49
  0056: 6e 74 65 6c c4 53 43 42
  0064: 32 cc 4b 52 43 32 32 32
  0072: 31 30 31 39 38 31 ca 41
  0080: 34 36 30 34 34 2d 36 30
  0088: 39 c0 c0 c1 00 00 00 d5
  0096: 01 0a 00 c5 49 6e 74 65
  0104: 6c c7 4c 41 4e 47 4c 45
  0112: 59 c0 c0 c0 c0 c0 c6 54
  0120: 53 52 4c 54 32 c1 00 00
  0128: 00 00 00 00 00 00 00 00
  0136: 00 00 00 00 00 00 00 00
  0144: 00 00 00 00 00 00 00 00
  0152: 00 00 00 00 00 00 00 00
  0160: 00 00 00 00 00 00 00 00
  0168: 00 00 00 00 00 00 00 4f
  0176: ff ff ff ff ff ff ff ff
  0184: ff ff ff ff ff ff ff ff
  0192: ff ff ff ff ff ff ff ff
  0200: ff ff ff ff ff ff ff ff
  0208: ff ff ff ff ff ff ff ff
  0216: ff ff ff ff ff ff ff ff
  0224: ff ff ff ff ff ff ff ff
  0232: ff ff ff ff ff ff ff ff
  0240: ff ff ff ff ff ff ff ff
  0248: ff ff ff ff ff ff ff ff
Segmentation fault
----------------------------------------------------------------------------
---------------
When I check the source , I found the error happens in the following code.
Show_fru()
/* show board fields */
   pfru = &frubuf[(frubuf[3] * 8)]; //here frubuf[3] is 227 '?', and address
fru[1816] can not be acessed.
   lang = pfru[2];
   pfru += 6;  /* skip board header */
----------------------------------------------------------------------------
---------------------------------------