uvm_fault: wsmux_detach

uvm_fault: wsmux_detach_sc

Status: fixed on 2019/02/19 05:10
Reported-by: syzbot+03f7377a9848d7d008c9@syzkaller.appspotmail.com
Fix commit: 0c0bf6318018 Serialize access to the list of attached child devices belonging to a wsmux. When invoking wsevsrc_* functions on a attached child device, underlying driver can sleep; this introduces a race where another thread is able to modify the list leading to all kinds of corruptions.
First crash: 2119d, last: 2108d

▶ ▼ Duplicate bugs (2)

duplicates (2):
Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
uvm_fault: wsmux_do_ioctl (3)	C			2	2106d	2114d	0/3	closed as dup on 2019/02/10 09:16
uvm_fault: wsmux_mux_close				1	2128d	2128d	0/3	closed as dup on 2019/02/08 09:54

Sample crash report:

uvm_fault(0xfffffd807f00d708, 0x9f, 0, 2) -> e
kernel: page fault trap, code=0
Stopped at      wsmux_detach_sc+0xcc:   movq    %rcx,0(%rax)
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xfffffd807f00d708, 0x9f, 0, 2) -> e
wsmux_detach_sc(ffff80000064dc00) at wsmux_detach_sc+204
end trace frame: 0xffff800020c4d440, count: 0
ddb{0}> trace
wsmux_detach_sc(ffff80000064dc00) at wsmux_detach_sc+204
wsmouseopen(4400,11,2000,ffff800020b42720) at wsmouseopen+233
spec_open(ffff800020c4d4c0) at spec_open+535
VOP_OPEN(fffffd8079f255a8,11,fffffd807f7c7c00,ffff800020b42720) at VOP_OPEN+118
vn_open(ffff800020c4d6b0,11,20) at vn_open+1222
doopenat(ffff800020b42720,ffffff9c,20000100,10,20,ffff800020c4d8f0) at doopenat+702
syscall(ffff800020c4d9a0) at syscall+1452
Xsyscall(6,0,ffffffffffffffa9,0,3,2adf008c0d8) at Xsyscall+296
end of kernel
end trace frame: 0x2b0c6b6e810, count: -8
ddb{0}> show registers
rdi                                0
rsi                                0
rbp             18446603336770966496
rbx                                0
rdx             18446744071594831341    substchar+87448
rcx             18446744073709551615
rax                              159
r8              18446744071593365349    setrunnable+149
r9                                 5
r10              4684198052002171014
r11             12183042518257316167
r12             18446603336221355448
r13                             5984    __ALIGN_SIZE+1888
r14             18446603336227806208
r15                                1
rip             18446744071589157356    wsmux_detach_sc+204
cs                                 8
rflags                         66182    __ALIGN_SIZE+62086
rsp             18446603336770966448
ss                                16
wsmux_detach_sc+204:    movq    %rcx,0(%rax)
ddb{0}> show proc
PROC (syz-executor.0) pid=384617 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=0, usrpri=79, nice=20
    forw=0xffffffffffffffff, list=0xffff800020b439e0,0xffffffff8230d660
    process=0xffff800020b44010 user=0xffff800020c48000, vmspace=0xfffffd807f00d708
    estcpu=29, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}>

Crashes (10):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	Manager
2019/02/12 19:52	openbsd	9a16e8505bdc	6ecc6d0f	.config	console log	report	syz	ci-openbsd-multicore
2019/02/10 01:14	openbsd	4071f8002cf2	d75f7686	.config	console log	report	syz	ci-openbsd-multicore
2019/02/16 16:56	openbsd	f4f0873d2d98	f42dee6d	.config	console log	report		ci-openbsd-multicore
2019/02/15 19:14	openbsd	64a70754a42c	f6f233c0	.config	console log	report		ci-openbsd-multicore
2019/02/12 19:21	openbsd	9a16e8505bdc	6ecc6d0f	.config	console log	report		ci-openbsd-multicore
2019/02/10 00:56	openbsd	4071f8002cf2	d75f7686	.config	console log	report		ci-openbsd-multicore
2019/02/09 23:20	openbsd	4071f8002cf2	d75f7686	.config	console log	report		ci-openbsd-multicore
2019/02/08 13:25	openbsd	e11291e4b0ca	aa4feb03	.config	console log	report		ci-openbsd-multicore
2019/02/05 15:22	openbsd	6e31582a5a78	d672172c	.config	console log	report		ci-openbsd-multicore
2019/02/05 07:14	openbsd	6e31582a5a78	d672172c	.config	console log	report		ci-openbsd-multicore

* ~~Struck through~~ repros no longer work on HEAD.