panic: pr_find_pagehead: mbufpl: incorrect page
Status: fixed on 2019/01/06 10:35
Fix commit: 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: test akoshibe@; OK claudio@
First crash: 1096d, last: 1080d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: pr_find_pagehead: mbufpl: incorrect page (2) 20 506d 773d 0/3 auto-closed as invalid on 2020/10/17 23:59

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2018/12/23 23:36 openbsd 7d0170de3bc3 e3bd7ab8 .config log report
ci-openbsd-main 2018/12/19 14:51 openbsd f26abd72fe13 cda92f77 .config log report
ci-openbsd-main 2018/12/08 02:23 openbsd 53ac6a98736c 65ed2472 .config log report