syzbot


pool: free list modified: mbufpl
Status: fixed on 2019/01/06 10:35
Reported-by: syzbot+0a7c326f85a03ab26744@syzkaller.appspotmail.com
Fix commit: 54e30ac1 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
First crash: 285d, last: 271d
similar bugs (1):
Kernel Title Repro Bisected Count Last Reported Patched Status
openbsd pool: free list modified: mbufpl (2) 1 4d05h 4d05h 0/3 upstream: reported on 2019/09/11 12:57

Sample crash report:

All crashes (13):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro
ci-openbsd-main 2018/12/07 06:43 openbsd 76d787ec b6709220 .config log report syz
ci-openbsd-main 2018/12/08 10:01 openbsd 696945d5 6ae0ca72 .config log report syz
ci-openbsd-main 2018/12/18 06:21 openbsd 9257d67b 527230f1 .config log report
ci-openbsd-main 2018/12/17 19:34 openbsd 9257d67b 527230f1 .config log report
ci-openbsd-main 2018/12/04 10:37 openbsd f939acc2 03f94a45 log report
ci-openbsd-main 2018/12/17 13:20 openbsd 9257d67b 527230f1 .config log report
ci-openbsd-main 2018/12/16 20:01 openbsd 4e9c4198 1749e412 .config log report
ci-openbsd-main 2018/12/16 09:38 openbsd fc1a5002 def91db3 .config log report
ci-openbsd-main 2018/12/09 07:16 openbsd 3173a78d e699a2b9 .config log report
ci-openbsd-main 2018/12/08 23:56 openbsd 5ed42fc8 c8b26e15 .config log report
ci-openbsd-main 2018/12/08 18:05 openbsd 696945d5 6ae0ca72 .config log report
ci-openbsd-main 2018/12/08 10:02 openbsd 696945d5 6ae0ca72 .config log report
ci-openbsd-main 2018/12/08 01:59 openbsd 53ac6a98 65ed2472 .config log report