syzbot


uvm_fault: strlcpy

Status: fixed on 2019/09/24 02:15
Reported-by: syzbot+638dbf7851da8e255af5@syzkaller.appspotmail.com
Fix commit: bdbfbec5cea8 Do more sanity checks when accepting socket addresses in routing messages from user land. Inspect length field early in rtm_xaddrs(). Strings must be NUL terminated. The socket address type and length depend on the routing message type. Currently checks are not super strict to avoid too much user land fallout. OK mpi@ Reported-by: syzbot+638dbf7851da8e255af5@syzkaller.appspotmail.com
First crash: 1288d, last: 1167d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: strlcpy (2) 1 984d 984d 3/3 fixed on 2020/03/30 02:16

Sample crash report:
uvm_fault(0xffffffff825216a8, 0xffff800000ae6000, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      strlcpy+0xcf:   movzbl  0xffffffffffffffff(%rbx),%r15d
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff825216a8, 0xffff800000ae6000, 0, 1) -> e
strlcpy(ffff800000a88650,ffff800000ae5ee2,20) at strlcpy+0xcf sys/lib/libkern/strlcpy.c:44
end trace frame: 0xffff800015524920, count: 0
ddb> trace
strlcpy(ffff800000a88650,ffff800000ae5ee2,20) at strlcpy+0xcf sys/lib/libkern/strlcpy.c:44
rtlabel_name2id(ffff800000ae5ee2) at rtlabel_name2id+0x13d sys/net/route.c:1614
rtrequest(1,ffff800015524ad8,0,ffff800015524a48,0) at rtrequest+0x653 sys/net/route.c:893
rtm_output(ffff800000ae5e00,ffff800015524b80,ffff800015524ad8,0,0) at rtm_output+0x62f sys/net/rtsock.c:901
route_output(fffffd80345a7500,fffffd803c48f4b8,0,0) at route_output+0x7d9 sys/net/rtsock.c:819
route_usrreq(fffffd803c48f4b8,9,fffffd80345a7500,0,0,ffff800014914ee8) at route_usrreq+0x363 sys/net/rtsock.c:275
sosend(fffffd803c48f4b8,0,ffff800015524d80,0,0,e983c9c0) at sosend+0x63d sys/kern/uipc_socket.c:524
sendit(ffff800014914ee8,6,ffff800015524e60,e983c940,ffff800015524f40) at sendit+0x52b sys/kern/uipc_syscalls.c:662
sys_sendto(ffff800014914ee8,ffff800015524ef8,ffff800015524f40) at sys_sendto+0x80 sys/kern/uipc_syscalls.c:527
syscall(ffff800015524fc0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,ffffffffffffffd8,0,6,854940e0010) at Xsyscall+0x128
end of kernel
end trace frame: 0x85707fcc710, count: -11
ddb> show registers
rdi               0xffffffff81c15ad5    strlcpy+0xc5
rsi                            0x38a
rbp               0xffff8000155248d0
rbx               0xffff800000ae6001
rdx                            0x38b
rcx               0xffff800016940000
rax               0xffff800016940000
r8                              0x38
r9                               0x5
r10               0x3f4c667b236bc3bc
r11               0xb8630a0f3454096d
r12                                0
r13                             0xc7
r14               0xffff800000ae5ee2
r15                             0xff
rip               0xffffffff81c15adf    strlcpy+0xcf
cs                               0x8
rflags                       0x10282    __ALIGN_SIZE+0xf282
rsp               0xffff800015524880
ss                              0x10
strlcpy+0xcf:   movzbl  0xffffffffffffffff(%rbx),%r15d
ddb> show proc
PROC (syz-executor.1) pid=361808 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=79, usrpri=79, nice=20
    forw=0xffffffffffffffff, list=0xffff800014914508,0xffffffff825a1378
    process=0xffff8000ffff6a30 user=0xffff800015520000, vmspace=0xfffffd803f013bb0
    estcpu=29, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  5512  278596  55665      0  2           0                syz-executor.1
* 5512  361808  55665      0  7   0x4000000                syz-executor.1
 55665  342015   7032      0  3        0x82  nanosleep     syz-executor.1
 56577  327637   7032      0  3        0x82  nanosleep     syz-executor.0
 46017  211609      1      0  3    0x100083  ttyin         getty
 48824  201572      0      0  3     0x14200  bored         sosplice
  7032    5019   4299      0  3        0x82  thrsleep      syz-fuzzer
  7032  175668   4299      0  3   0x4000082  thrsleep      syz-fuzzer
  7032  284298   4299      0  3   0x4000082  thrsleep      syz-fuzzer
  7032  155389   4299      0  3   0x4000082  thrsleep      syz-fuzzer
  7032  106005   4299      0  3   0x4000082  thrsleep      syz-fuzzer
  7032  281025   4299      0  3   0x4000082  kqread        syz-fuzzer
  7032  310041   4299      0  3   0x4000082  thrsleep      syz-fuzzer
  7032  333706   4299      0  3   0x4000082  thrsleep      syz-fuzzer
  4299   41992  21457      0  3    0x10008a  pause         ksh
 21457   67228  54468      0  3        0x92  select        sshd
 54468  156920      1      0  3        0x80  select        sshd
 60440   63456  76571     73  2    0x100090                syslogd
 76571  294444      1      0  3    0x100082  netio         syslogd
 76461  374689      1     77  3    0x100090  poll          dhclient
 39466  154291      1      0  3        0x80  poll          dhclient
 22355   26524      0      0  2     0x14200                zerothread
 18549  221274      0      0  3     0x14200  aiodoned      aiodoned
  4162  338082      0      0  3     0x14200  syncer        update
  7281  388896      0      0  3     0x14200  cleaner       cleaner
 21155  349742      0      0  3     0x14200  reaper        reaper
 44738  303249      0      0  3     0x14200  pgdaemon      pagedaemon
 26398  430704      0      0  3     0x14200  bored         crynlk
 18003  384435      0      0  3     0x14200  bored         crypto
 56549  450719      0      0  3  0x40014200  acpi0         acpi0
 98168  516483      0      0  3     0x14200  bored         softnet
 87133  483144      0      0  3     0x14200  bored         systqmp
 37412  195215      0      0  3     0x14200  bored         systq
  3595  110597      0      0  3  0x40014200  bored         softclock
 86773  279532      0      0  3  0x40014200                idle0
 60778  416840      0      0  3     0x14200  bored         smr
     1  158513      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9539   6383K    7016K  78643K     17300        0        0
            pcb    13     10K      12K  78643K       465        0        0
         rtable   104     12K      12K  78643K      1288        0        0
         ifaddr    65     15K      16K  78643K       410        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K       123        0        0
            iov     0      0K      24K  78643K       343        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1213     76K      77K  78643K      4025        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        54        0        0
         VM map     2      0K       0K  78643K         8        0        0
            sem    12      0K       1K  78643K       447        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12645        0        0
      file desc     5     13K      25K  78643K      3208        0        0
          sigio     0      0K       0K  78643K        70        0        0
           proc    50     38K      63K  78643K      1116        0        0
        subproc    32      2K       2K  78643K       238        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     4      0K       2K  78643K      6097        0        0
       in_multi    22      1K       2K  78643K       232        0        0
    ether_multi     1      0K       0K  78643K         8        0        0
            mrt     1      0K       0K  78643K         9        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    90    397K     397K  78643K        90        0        0
           exec     0      0K       1K  78643K       582        0        0
     pfkey data     0      0K       4K  78643K         4        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   106     22K      39K  78643K      8552        0        0
       UVM aobj   130      4K       4K  78643K       143        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       441        0        0
            NDP    17      0K       0K  78643K       127        0        0
           temp   191   3540K    3667K  78643K     72364        0        0
         kqueue     0      0K       0K  78643K        18        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       37    0       33     1     0     1     1     0     8    0
rtpcb       80      189    0      185     1     0     1     1     0     8    0
rtentry    112      193    0      157     2     0     2     2     0     8    0
unpcb      120     1426    0     1411     1     0     1     1     0     8    0
syncache   264       10    0       10     4     4     0     1     0     8    0
tcpqe       32     5919    0     5919     1     1     0     1     0     8    0
tcpcb      544     1351    0     1347    31    29     2    15     0     8    1
ipq         40        5    0        5     3     2     1     1     0     8    1
ipqe        40        9    0        9     3     2     1     1     0     8    1
inpcb      280     5795    0     5785    21    19     2     9     0     8    1
rttmr       72        1    0        1     1     1     0     1     0     8    0
nd6         48       28    0       26     2     1     1     1     0     8    0
pkpcb       40       20    0       20     7     7     0     1     0     8    0
ppxss      1128      54    0       54    13    12     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      798    0      626    21     9    12    15     0     8    1
art_table   32      799    0      626     2     0     2     2     0     8    0
art_node    16      181    0      150     1     0     1     1     0     8    0
sysvmsgpl   40       30    0       15     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      445    0      435     1     0     1     1     0     8    0
shmpl      112      141    0       13     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     6256    0     4869    46     0    46    46     0     8    0
ffsino     240     6256    0     4869    83     0    83    83     0     8    0
nchpl      144    11985    0    10360    61     0    61    61     0     8    0
uvmvnodes   72     6217    0        0   114     0   114   114     0     8    0
vnodes     208     6217    0        0   328     0   328   328     0     8    0
namei      1024   38106    0    38106     3     2     1     1     0     8    1
vmpool     520        6    0        6     3     3     0     1     0     8    0
scsiplug    64        9    0        9     7     7     0     1     0     8    0
scxspl     192    32114    0    32114    27    25     2     7     0     8    2
plimitpl   152      263    0      256     1     0     1     1     0     8    0
sigapl     432     3344    0     3331     2     0     2     2     0     8    0
futexpl     56    73844    0    73844     2     1     1     1     0     8    1
knotepl    112      862    0      843     5     4     1     3     0     8    0
kqueuepl   104     1135    0     1133     7     6     1     4     0     8    0
pipepl     112     1888    0     1869    11     9     2     2     0     8    1
fdescpl    424     3345    0     3331     2     0     2     2     0     8    0
filepl     120    27900    0    27801    26    22     4    11     0     8    1
lockfpl    104     1118    0     1117     1     0     1     1     0     8    0
lockfspl    48      369    0      368     1     0     1     1     0     8    0
sessionpl  112       30    0       20     1     0     1     1     0     8    0
pgrppl      48       68    0       58     1     0     1     1     0     8    0
ucredpl     96     4638    0     4631     1     0     1     1     0     8    0
zombiepl   144     3332    0     3331     4     3     1     1     0     8    0
processpl  864     3361    0     3331     4     0     4     4     0     8    0
procpl     632     7297    0     7259     5     1     4     5     0     8    0
sosppl     128       39    0       39     9     8     1     1     0     8    1
sockpl     384     7512    0     7484    39    34     5    15     0     8    1
mcl64k     65536    613    0      613    41    41     0    33     0     8    0
mcl16k     16384     21    0       21    13    12     1     1     0     8    1
mcl12k     12288     58    0       58    10     9     1     1     0     8    1
mcl9k      9216      35    0       35    11    11     0     1     0     8    0
mcl8k      8192      69    0       69    11    10     1     1     0     8    1
mcl4k      4096     231    0      231     3     2     1     1     0     8    1
mcl2k2     2112      38    0       38    15    14     1     1     0     8    1
mcl2k      2048   62280    0    62237    23    17     6    14     0     8    0
mtagpl      80      154    0      154     4     3     1     1     0     8    1
mbufpl     256   124705    0   124590    39    29    10    23     0     8    0
bufpl      256    16952    0    10732   389     0   389   389     0     8    0
anonpl      16   309637    0   298120   149    85    64    81     0    62    0
amapchunkpl 152   15421    0    15304    46    40     6    15     0   158    0
amappl16   192    15687    0    14810   121    76    45    57     0     8    0
amappl15   184      270    0      270     2     2     0     1     0     8    0
amappl14   176      594    0      589     2     1     1     1     0     8    0
amappl13   168     1172    0     1171     1     0     1     1     0     8    0
amappl12   160      641    0      639     1     0     1     1     0     8    0
amappl11   152      505    0      493     1     0     1     1     0     8    0
amappl10   144       26    0       26     4     4     0     1     0     8    0
amappl9    136      967    0      961     1     0     1     1     0     8    0
amappl8    128      509    0      480     2     0     2     2     0     8    0
amappl7    120       88    0       81     1     0     1     1     0     8    0
amappl6    112      505    0      493     1     0     1     1     0     8    0
amappl5    104      883    0      873     1     0     1     1     0     8    0
amappl4     96     4047    0     4018     1     0     1     1     0     8    0
amappl3     88      436    0      431     1     0     1     1     0     8    0
amappl2     80    25842    0    25774     4     2     2     3     0     8    0
amappl1     72    69484    0    69076    28    19     9    20     0     8    0
amappl      80     7690    0     7651     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      142    0       13     3     0     3     3     0     8    0
uaddrrnd    24     3351    0     3331     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3351    0     3331     1     0     1     1     0     8    0
vmmpekpl   168    22231    0    22203     2     0     2     2     0     8    0
vmmpepl    168   396290    0   394361   281   163   118   118     0   357   29
vmsppl     272     3344    0     3331     2     1     1     2     0     8    0
pdppl      4096    6708    0     6674     6     1     5     6     0     8    0
pvpl        32   935626    0   921031   383   185   198   226     0   265   47
pmappl     200     3350    0     3337     1     0     1     1     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      671    0      155    16     0    16    16     0     8    0

Crashes (18):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2019/09/22 01:54 openbsd 50de75e56cac d96e88f3 .config log report
ci-openbsd-multicore 2019/09/21 02:50 openbsd ea5e035f4d57 d96e88f3 .config log report
ci-openbsd-multicore 2019/09/20 16:32 openbsd 015b970d3247 d96e88f3 .config log report
ci-openbsd-multicore 2019/09/19 21:14 openbsd dd7527c89705 eb940044 .config log report
ci-openbsd-multicore 2019/09/13 15:45 openbsd 33d1bf81aaf6 32d59357 .config log report
ci-openbsd-multicore 2019/09/08 14:15 openbsd aed271771839 a60cb4cd .config log report
ci-openbsd-multicore 2019/08/13 12:50 openbsd 723403cbe800 74d61399 .config log report
ci-openbsd-main 2019/08/05 01:15 openbsd 864b814f529e 6affd8e8 .config log report
ci-openbsd-multicore 2019/07/27 21:24 openbsd 6181cd3477c2 c85e1c5b .config log report
ci-openbsd-multicore 2019/07/19 08:16 openbsd 966bc0c5a553 8304907d .config log report
ci-openbsd-multicore 2019/07/18 01:47 openbsd efd5e74bbf29 f613a7c4 .config log report
ci-openbsd-main 2019/06/23 09:40 openbsd e9959c3eed29 34bf9440 .config log report
ci-openbsd-multicore 2019/06/23 03:13 openbsd f1eb72fadbac 34bf9440 .config log report
ci-openbsd-main 2019/06/14 10:11 openbsd 77d2abb04e7b 998ccc76 .config log report
ci-openbsd-multicore 2019/06/03 04:38 openbsd 5d24dd80fef3 53c81ea5 .config log report
ci-openbsd-main 2019/06/02 23:10 openbsd 5d24dd80fef3 53c81ea5 .config log report
ci-openbsd-multicore 2019/05/25 22:16 openbsd a6afde387ed7 85c57315 .config log report
ci-openbsd-main 2019/05/24 14:44 openbsd b21d7bd479d1 0dadcd9d .config log report
* Struck through repros no longer work on HEAD.