syzbot


pool: double put: mbufpl

Status: fixed on 2019/02/08 08:15
Reported-by: syzbot+8e7997d4036ae523c79c@syzkaller.appspotmail.com
Fix commit: Avoid an mbuf double free in the oob soreceive() path. In the
First crash: 1465d, last: 1463d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: double put: mbufpl (2) 2 1101d 1133d 0/3 auto-closed as invalid on 2020/02/29 20:17

Sample crash report:
panic: pool_do_put: mbufpl: double pool_put: 0xffffff0071454300
Stopped at      db_enter+0xa:   popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*209936  85149      0           0  0x4000000    0  syz-executor1
db_enter() at db_enter+0xa
panic() at panic+0x147
pool_do_put(ffffff0071454300,ffffffff81ecbc58) at pool_do_put+0x2e2
pool_put(b5879742ae4ca728,ffffff0071454300) at pool_put+0x37
m_free(ffffff0071454300) at m_free+0x12c
m_freem(16) at m_freem+0x2d
soreceive(0,ffffff006f2eba80,ffff800021138110,465,ffff8000211381a0,ffff8000211380b0) at soreceive+0x1131
recvit(ffff8000211381d0,ffff8000211382d8,ffff8000211382c0,ffff8000ffff72d8,0) at recvit+0x28c
sys_recvmsg(ffff800021138360,ffff8000ffff72d8,ffff80002105f330) at sys_recvmsg+0x120
syscall(0) at syscall+0x3e4
Xsyscall(6,0,ffffffffffffffbf,0,3,4d569c8b010) at Xsyscall+0x128
end of kernel
end trace frame: 0x4d7d25b1080, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> show panic
pool_do_put: mbufpl: double pool_put: 0xffffff0071454300
ddb> trace
db_enter() at db_enter+0xa
panic() at panic+0x147
pool_do_put(ffffff0071454300,ffffffff81ecbc58) at pool_do_put+0x2e2
pool_put(b5879742ae4ca728,ffffff0071454300) at pool_put+0x37
m_free(ffffff0071454300) at m_free+0x12c
m_freem(16) at m_freem+0x2d
soreceive(0,ffffff006f2eba80,ffff800021138110,465,ffff8000211381a0,ffff8000211380b0) at soreceive+0x1131
recvit(ffff8000211381d0,ffff8000211382d8,ffff8000211382c0,ffff8000ffff72d8,0) at recvit+0x28c
sys_recvmsg(ffff800021138360,ffff8000ffff72d8,ffff80002105f330) at sys_recvmsg+0x120
syscall(0) at syscall+0x3e4
Xsyscall(6,0,ffffffffffffffbf,0,3,4d569c8b010) at Xsyscall+0x128
end of kernel
end trace frame: 0x4d7d25b1080, count: -11
ddb> show registers
rdi               0xffffffff81e10dd8    kprintf_mutex
rsi               0xffffffff81679b89    db_enter+0x9
rbp               0xffff800021137e30
rbx               0xffff800021137ed0
rdx               0xffff800001ccf000
rcx                           0x1d99    __ALIGN_SIZE+0xd99
rax               0xffff800001ccf000
r8                0xffff800021137e00
r9                0x8080808080808080
r10               0xb5879742ae4ca728
r11               0xffffffff8174f9a0    x86_bus_space_io_read_1
r12                     0x3000000008
r13               0xffff800021137e40
r14                            0x100
r15               0xffffffff81c3c06c    cy_pio_rec+0x4090
rip               0xffffffff81679b8a    db_enter+0xa
cs                               0x8
rflags                         0x206
rsp               0xffff800021137e30
ss                              0x10
db_enter+0xa:   popq    %rbp
ddb> show proc
PROC (syz-executor1) pid=209936 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=82, usrpri=82, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff7530,0xffffffff81eafaa0
    process=0xffff80002105f330 user=0xffff800021133000, vmspace=0xffffff007f12ba50
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 85149  381860   6110      0  2           0                syz-executor1
*85149  209936   6110      0  7   0x4000000                syz-executor1
 50409  456716  73839      0  2           0                syz-executor0
 50409  277522  73839      0  3   0x4000080  ttyout        syz-executor0
 50409    7149  73839      0  3   0x4000080  fsleep        syz-executor0
 68891  291675      1      0  3    0x100083  ttyin         getty
 70646  114759      0      0  3     0x14200  bored         sosplice
 73839  478944  40031      0  3        0x82  nanosleep     syz-executor0
  6110  395805  40031      0  3        0x82  nanosleep     syz-executor1
 40031  198781  49716      0  3        0x82  thrsleep      syz-fuzzer
 40031  329813  49716      0  3   0x4000082  thrsleep      syz-fuzzer
 40031  170632  49716      0  3   0x4000082  thrsleep      syz-fuzzer
 40031   98965  49716      0  3   0x4000082  thrsleep      syz-fuzzer
 40031  101748  49716      0  3   0x4000082  kqread        syz-fuzzer
 40031  212649  49716      0  3   0x4000082  thrsleep      syz-fuzzer
 40031  475432  49716      0  3   0x4000082  thrsleep      syz-fuzzer
 49716  350810  73936      0  3    0x10008a  pause         ksh
 73936  278858  58343      0  3        0x92  select        sshd
 58343  429682      1      0  3        0x80  select        sshd
 32320   49679  13208     73  3    0x100090  kqread        syslogd
 13208   49599      1      0  3    0x100082  netio         syslogd
 56410   18858      1     77  3    0x100090  poll          dhclient
 87700  345552      1      0  3        0x80  poll          dhclient
 85141   23883      0      0  2     0x14200                zerothread
 33277  209903      0      0  3     0x14200  aiodoned      aiodoned
 42922   15850      0      0  3     0x14200  syncer        update
 70097  385470      0      0  3     0x14200  cleaner       cleaner
 24820  464015      0      0  3     0x14200  reaper        reaper
 29558  221422      0      0  3     0x14200  pgdaemon      pagedaemon
 96048   16202      0      0  3     0x14200  bored         crynlk
 73491  480118      0      0  3     0x14200  bored         crypto
 24999  191370      0      0  3  0x40014200  acpi0         acpi0
 35409  357770      0      0  3     0x14200  bored         softnet
 47509  492519      0      0  3     0x14200  bored         systqmp
 51323  300057      0      0  3     0x14200  bored         systq
 54697  215453      0      0  3  0x40014200  bored         softclock
 52412  416270      0      0  3  0x40014200                idle0
     1  243624      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper

Crashes (6):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2018/12/04 06:44 openbsd f939acc2595a 03f94a45 log report
ci-openbsd-main 2018/12/04 03:55 openbsd f939acc2595a 03f94a45 log report
ci-openbsd-main 2018/12/04 02:41 openbsd f939acc2595a 03f94a45 log report
ci-openbsd-main 2018/12/04 00:23 openbsd f939acc2595a 03f94a45 log report
ci-openbsd-main 2018/12/03 21:23 openbsd f939acc2595a 03f94a45 log report
ci-openbsd-main 2018/12/03 00:24 openbsd 87d30890b5c0 28e157f1 log report
* Struck through repros no longer work on HEAD.