uvm_fault: switchwrite

Status: fixed on 2019/01/06 10:35
Fix commit: 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: test akoshibe@; OK claudio@
First crash: 2049d, last: 2029d

Sample crash report:
login: uvm_fault(0xffffff003f12ca50, 0x6000100, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      switchwrite+0x98:       movq    0(%r13),%rbx
ddb> set $lines = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffff003f12ca50, 0x6000100, 0, 1) -> e
switchwrite(ffffff0037c07360,ffffff0037c07360,ffff800014ad6268) at switchwrite+0x98 sys/net/switchctl.c:234
end trace frame: 0xffff800014ad6140, count: 0
ddb> trace
switchwrite(ffffff0037c07360,ffffff0037c07360,ffff800014ad6268) at switchwrite+0x98 sys/net/switchctl.c:234
spec_write(ffffffff81e38cc0) at spec_write+0xa0 sys/kern/spec_vnops.c:310
VOP_WRITE(82,ffffff0037c07360,1,ffff800014ad6268) at VOP_WRITE+0x65 sys/kern/vfs_vops.c:268
vn_write(ffffff0037690960,ffff800014ad6268,82) at vn_write+0x127 sys/kern/vfs_vnops.c:397
dofilewritev(ffff8000ffffc710,ffff800014ad6310,82,ffff800014ad6328,806c53c9e38) at dofilewritev+0x13e sys/kern/sys_generic.c:364
sys_write(ffff800014ad63b0,ffff8000ffffc710,ffff800014a15660) at sys_write+0x6e sys/kern/sys_generic.c:283syscall(0) at syscall+0x3e4
Xsyscall(6,0,c,0,3,80490192010) at Xsyscall+0x128
end of kernel
end trace frame: 0x806c53c9ec0, count: -8
ddb> show registers
rdi               0xffffffff81e043a8    switch_ifs_lk
rsi               0xffff800014ad6268
rbp               0xffff800014ad60c0
rbx                        0x6000100    __kernel_end_phys+0x4000100
rdx                              0x1
rcx                           0x2158    __ALIGN_SIZE+0x1158
rax                              0x8
r8                0xffff800014ad6310
r9                                 0
r10                                0
r11               0xffffffff815244d0    switchwrite
r12                             0x82
r13                        0x6000100    __kernel_end_phys+0x4000100
r14               0xffff800000adc900
r15               0xffff800014ad6268
rip               0xffffffff81524568    switchwrite+0x98
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff800014ad6060
ss                              0x10
switchwrite+0x98:       movq    0(%r13),%rbx

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/27 06:40 openbsd 8ff5027431d5 82c9e677 .config console log report syz ci-openbsd-main
2018/12/07 06:25 openbsd 76d787ec3667 b6709220 .config console log report syz ci-openbsd-main
2018/12/18 04:44 openbsd 9257d67bbd0d 527230f1 .config console log report ci-openbsd-main
2018/12/15 05:01 openbsd cb84e0447e1d 7624ddd6 .config console log report ci-openbsd-main
2018/12/08 11:21 openbsd 696945d58559 6ae0ca72 .config console log report ci-openbsd-main
2018/12/08 00:01 openbsd 53ac6a98736c 65ed2472 .config console log report ci-openbsd-main
2018/12/07 12:14 openbsd 3ddf1e5e4bb5 b6709220 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.