Extra filters: [With Repro]
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Closed Patch
kasan test error: no output from test machine -1 5 97d 100d 1/4 never kasan/kcov: don't let the two runtimes instrument each other
KASAN: invalid memory access in sysvipc_infoout -1 syz, C 10 83d 84d 1/4 never sysv: fold the three SysV IPC info sysctls into one helper
KASAN: invalid memory access in sysctl_sysvipc -1 syz, C 163 11d 87d 1/4 never sysv: fold the three SysV IPC info sysctls into one helper
panic: Caught invalid memory access at ADDR size NUM op 2 1 12d 12d 1/4 never sysctl_sysvipc: size the SEM and SHM info buffers correctly
KASAN: invalid memory access in doktrace -1 1 87d 87d 1/4 never ktrace: pin walked processes with ps_refcnt across sleeping vrele
KASAN: invalid memory access in knote_processfork -1 29 24d 57d 1/4 never kqueue: don't use the knote after knote_processfork() releases ps_mtx
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (7) -1 syz, C 3 7d11h 40d 1/4 never Reapply 1.129 so uvm_fault_unwire_locked can handle racey holes
KASAN: invalid memory access in kprintf -1 2 28d 30d 1/4 never Merge remote-tracking branch 'origin/master' into tick-merge
KASAN: invalid memory access in bioioctl -1 8 91d 91d 1/4 never Merge remote-tracking branch 'origin/master' into tick-merge
uvm_fault: dovutimens -1 323266 55d 199d 2/4 never 63d30f6f93ff Consistently guard against NULL vp->v_mount in vfs_syscalls.c
KASAN: invalid memory access in mrt6_ioctl -1 2 20d 42d 4/4 6d07h d11e486715c5 Make IPv6 multicast router global variable MP safe.
KASAN: invalid memory access in pf_remove_if_empty_ruleset -1 12 22d 59d 4/4 16d e0a25791f40f pf: do not free the caller's ruleset when attaching a table fails
protection_fault: in_ifdetach -1 39 19d 24d 4/4 16d dfebb840a0e1 Revert "Unlink multicast records when their interface is detached"
panic: free: non-malloced addr ADDR type ip_moptions 2 6 26d 88d 4/4 20d e7ea118a97a3 Unlink multicast records when their interface is detached
uvm_fault: ip6_freemoptions -1 9 27d 85d 4/4 20d e7ea118a97a3 Unlink multicast records when their interface is detached
uvm_fault: mld6_fasttimo -1 1 68d 68d 4/4 20d e7ea118a97a3 Unlink multicast records when their interface is detached
KASAN: invalid memory access in mtx_leave -1 1 41d 41d 4/4 36d 53d74301dd9a Close mtx_wantipl race in mtx_leave
uvm_fault: memset -1 syz, C 1180 62d 1889d 4/4 60d d98ad52af95c Reject d_secsize exceeding MAXPHYS in (init|set)disklabel
KASAN: invalid memory access in setdisklabel -1 3 62d 65d 4/4 61d 68da56e7e9ff Fix for KASAN: invalid memory access in setdisklabel
KASAN: invalid memory access in shm_delete_mapping -1 10 69d 78d 4/4 68d dfd87cc9ab8c Eliminate holding raw shmseg over sleep-window in uvm_unmap
KASAN: invalid memory access in igmp_leavegroup -1 2 69d 74d 4/4 69d 229406285b56 Do not use dangling pointer in igmp multicast.
KASAN: invalid memory access in tagname2tag -1 syz, C 2 77d 77d 4/4 74d 02abc4651138 Null-terminate strings in DIOCADDQUEUE
protection_fault: sys_msgrcv (2) -1 syz, C 168 138d 1458d 4/4 92d fa811effdbdb Make concurrent sys_msgrcv() wait until we finish message delivery. We left acquired message in the queue while we are sleeping in msg_copyout(). Concurrent sys_msgrcv() could acquire and delete this message.
panic: ip6_getpcbopt: unexpected option 2 45 107d 108d 3/4 106d 1086699a8b28 Put back IPV6_RTHDR to ip6_getpcbopt() as no operation.
protection_fault: done_flush (4) -1 1601 199d 328d 3/4 182d 54f7a0c00ad4 vmm: Handle reserved bits in debug registers
uvm_fault: dt_ioctl_record_stop (2) -1 4591 200d 435d 3/4 200d 7348976a6ac6 dt: Deny enabling probes after recording starts
assert "flags & (PR_WAITOK | PR_NOWAIT)" failed in subr_pool.c -1 2 243d 243d 3/4 241d eab2e406eb7b pfr_attach_table() needs wait flag.
panic: maddr rwlock ADDR: enter read deadlock 2 2529 279d 280d 3/4 279d 2b6fc957b059 Backout: Protect IGMP and MLD6 fast timer with rwlock.
witness: shared lock of (rwlock) maddr while exclusively locked -1 1910 279d 280d 3/4 279d 2b6fc957b059 Backout: Protect IGMP and MLD6 fast timer with rwlock.
panic: excl->share 2 98 279d 280d 3/4 279d 2b6fc957b059 Backout: Protect IGMP and MLD6 fast timer with rwlock.
protection_fault: in6_addmulti (5) -1 1 309d 309d 3/4 280d 80bc9799356e Protect IGMP and MLD6 fast timer with rwlock.
kernel: privileged instruction fault trap, code=NUM (2) -1 1 306d 306d 3/4 293d dca1e142a338 Fix race in vmm(4) where
uvm_fault: vm_terminate (2) -1 2 304d 322d 3/4 296d 10e7775f0707 Fix race in vmm(4) vm termination path.
assert "part >= NUM && part < MAXPARTITIONS" failed in subr_disk.c -1 117 329d 330d 3/4 326d b5bf9d3d0aeb bogus asserts; ok krw gnezdo
panic: mtx ADDR: locking against myself (2) 2 338 422d 578d 3/4 421d 5e82fd317c62 Prevent lock recursion in error path.
panic: malloc: allocation too large, type = NUM, size = ADDR (5) 2 1 443d 443d 3/4 435d 753a922a6fb4 Set the upper boundary of 'kern.seminfo.semopm' variable to "(MALLOC_MAX / sizeof(struct sembuf))". Otherwise the greater value could exceed the MALLOC_MAX limit and cause panic.
uvm_fault: dt_ioctl_record_stop -1 1306 435d 552d 3/4 435d 5b6ddc98dee7 Fix sleeping race in dt(4) ioctl(2).
assert "nlevel >= IPL_NONE" failed in intr.c (3) -1 1 488d 488d 3/4 483d b64faffc3616 run ifq_barrier against all ifqs in if_detach, not just if_snd.
assert "d->bd_in_uiomove == NUM" failed in bpf.c (3) -1 1 489d 489d 3/4 483d b64faffc3616 run ifq_barrier against all ifqs in if_detach, not just if_snd.
assert "(TAILQ_NEXT(inp, inp_queue) == NULL) || (TAILQ_NEXT(inp, inp_queue) == _Q_INVALID)" failed in in_pcb.c -1 16 484d 485d 3/4 484d 6bb594b93bf9 Fix use-after-free of inpcb.
protection_fault: in_pcb_iterator -1 4 484d 485d 3/4 484d 6bb594b93bf9 Fix use-after-free of inpcb.
witness: userret: sysctl -1 4 491d 492d 3/4 490d d8a43137eb27 Add forgotten NET_UNLOCK_SHARED() in FILLINPTABLE().
witness: thread exiting with locks held (3) -1 3 490d 491d 3/4 490d d8a43137eb27 Add forgotten NET_UNLOCK_SHARED() in FILLINPTABLE().
panic: mutex ADDR not held in in_pcb_iterator 2 5 493d 493d 3/4 492d b9215d49b9b3 Add forgotten mtx_enter() in FILLINPTABLE().
uvm_fault: ether_frm_ctloutput -1 3 525d 526d 3/4 525d 7d4a6d53c3d0 handle NULL for the option data mbufs in the ethernet setsockopt handling
panic: assertwaitok: non-zero mutex count: NUM (3) 2 1 544d 544d 3/4 542d 42337cd26dad Release `sb_mtx' mutex(9) while doing sleeping m_copym(..., M_WAIT) in soreceive() and somove(). It is possible in both places. We copy only `len' bytes from the single mbuf(9) pointed by `m'. The `len' is always less than m->m_len. The m->m_len could only grow while `sb_mtx' is unlocked, but concurrent thread will not override our chunk of m->m_data. There is no difference with the lockless uiomove(mtod(m)).
assert "va >= entry->start" failed in uvm_fault.c (2) -1 171 573d 614d 3/4 558d 818e6b572963 Make vslock(9) similar to mlock(2): silently ignore non-mapped ranges.
panic: uvm_fault_unwire_locked: address not in map (4) 2 syz, C 638 574d 1650d 3/4 558d 818e6b572963 Make vslock(9) similar to mlock(2): silently ignore non-mapped ranges.
uvm_fault: rtrequest (4) -1 1 602d 602d 3/4 595d 45a541306066 Move kassert from resolve to add case in rtrequest().
panic: malloc: allocation too large, type = NUM, size = ADDR (3) 2 58 611d 614d 3/4 611d 910ed27a3d72 Limit net.bpf.maxbufsize sysctl(8) to a value that malloc(9) can handle. Introduce MALLOC_MAX definition to keep this value in sync and use it system wide.
openbsd test error: SYZFATAL: image testing failed w/o kernel bug -1 47 614d 621d 3/4 613d db5d28f093d6 Bump kcov buffer size limit
assert "nlevel >= IPL_NONE" failed in intr.c (2) -1 122 691d 949d 3/4 691d a921796a245d make sure bpfsdetach is holding a bpf_d ref when invalidating stuff.
pool: double put: shmpl -1 12 704d 777d 3/4 703d 4a445d448ac2 Prevent a double free by unlinking the descriptor before unmaping & freeing it.
panic: kernel diagnostic assertion "uvm_page_owner_locked_p(pg) 2 70 717d 721d 3/4 707d 0535051c104d Check if the mapping for an vm_map_entry exists while holding its lock.
panic: free: size too large NUM > NUM (ADDR) type sysctl 2 1 746d 746d 3/4 745d dd2b8016139a Fix sleeping race during malloc in sysctl hw.disknames.
assert "to_ticks >= NUM" failed in kern_timeout.c -1 1 803d 803d 3/4 795d 2293e68203ec restrict the maximum wait time you can set via BIOCSWTIMEOUT to 5 minutes.
multicore boot error: uvm_fault (2) -1 12 1022d 1022d 3/4 819d ef9354f58d69 sync
panic: lock (rwlock) solock not locked 2 syz, C 33 1497d 1497d 3/4 821d ef9354f58d69 sync
witness: reversal: lock order data missing (3) -1 8192 821d 1669d 3/4 821d ef9354f58d69 sync
panic: vmxon failed 2 syz 3 910d 916d 3/4 909d ddfb6951b469 vmm: protect vmm activation with the vmm_softc rwlock.
uvm_fault: igmp_leavegroup (5) -1 syz, C 12 911d 913d 3/4 911d 4733ced31b52 Prevent changing interface loopback flag from userland.
panic: unix: lock not held 2 syz, C 2 923d 923d 3/4 918d e679c1f37540 Allow listen(2) only on sockets of type SOCK_STREAM or SOCK_SEQPACKET. listen(2) man(1) page clearly prohibits sockets of other types.
panic: rw_enter: unix locking against myself 2 syz, C 2 941d 941d 3/4 936d d1ea0a7c7de9 Do UNP_CONNECTING and UNP_BINDING flags check in uipc_listen() and return EINVAL if set. This prevents concurrent solisten() thread to make this socket listening while socket is unlocked.
panic: malformed IPv4 option passed to ip_optcopy (3) 2 syz 40 948d 950d 3/4 948d c8a0ef6cb991 Validate IPv4 packet options in divert output.
assert "to->to_kclock == KCLOCK_UPTIME" failed in kern_timeout.c (3) -1 1 972d 972d 3/4 959d 0a34672fd384 timeout: make to_kclock validation more rigorous
kqueue: knote !ACTIVE (3) -1 1 979d 979d 3/4 977d d618cc99d763 Invert broken check of panic string in if_linkstate().
assert "sin6tosa(&ro->ro_dst)->sa_family == AF_INET6" failed in in6_src.c -1 syz, C 218 980d 982d 3/4 980d 4a2c3c9ecbcf In in_pcbrtentry() add missing return of in6_pcbrtentry() value.
uvm_fault: refcnt_take -1 1 996d 996d 3/4 995d 470ec98d6191 Backout priterator() for walking allprocess list.
protection_fault: fill_file (3) -1 1 1005d 1005d 3/4 998d d221342b6cd4 Introduce priterator(), the `ps_list' iterator. Some of `allprocess' list walkthroughs have context switch within, so make exit1() wait until the last reference released.
witness: reversal: solock pf_lock -1 2 1003d 1009d 3/4 1002d 66bd633ef3ce Use domain name for socket lock.
witness: reversal: pf_lock solock -1 syz 23 1002d 1009d 3/4 1002d 66bd633ef3ce Use domain name for socket lock.
assert "dtlookup(unit) == NULL" failed in dt_dev.c (3) -1 1 1013d 1013d 3/4 1011d c57c5c683707 Prevent simultaneous dt(4) open.
assert "__mp_lock_held(&sched_lock, curcpu()) == NUM" failed in kern_lock.c (4) -1 1 1026d 1026d 3/4 1026d 540e94b5c59a soreceive() must not hold mutex when calling sblock().
panic: assertwaitok: non-zero mutex count: NUM 2 syz, C 10 1026d 1026d 3/4 1026d 540e94b5c59a soreceive() must not hold mutex when calling sblock().
uvm_fault: rtrequest (2) -1 syz, C 15 1062d 1062d 3/4 1061d a08e228de7c0 Fix rt_setgate() error handling.
assert "!_kernel_lock_held()" failed in kern_fork.c (3) -1 107 1076d 1726d 3/4 1075d 6d6c8141fa4d Adjust KERNEL_ASSERT_UNLOCKED() to not assert during a panic.
assert "!_kernel_lock_held()" failed in uvm_map.c (2) -1 13 1110d 1328d 3/4 1075d 6d6c8141fa4d Adjust KERNEL_ASSERT_UNLOCKED() to not assert during a panic.
assert "((len + sizeof(long) - NUM) &~ (sizeof(long) - NUM)) <= M_SIZE(m)" failed in uipc_mbuf.c -1 syz, C 2 1088d 1088d 3/4 1085d 7b4d35e0a60b Avoid assertion failure when splitting mbuf cluster.
multicore boot error: witness: lock_object uninitialized: ADDR -1 108 1098d 1101d 3/4 1098d 33aa5105d87e Revert commitid: KtmyJEoS0WWxmlZ5 --- Protect interface queues with read once and mutex.
assert "p->p_stat == SONPROC || p->p_stat == SSLEEP || p->p_stat == SSTOP" failed in kern_synch.c -1 syz 10 1119d 1149d 3/4 1116d de92f022b000 Before coredump or in pledge_fail use SINGLE_UNWIND to stop all threads.
assert "type != NULL" failed in subr_witness.c -1 syz 1 1131d 1131d 3/4 1122d ed07db5bc17e Revert commitid: yfAefyNWibUyjkU2, ESyyH5EKxtrXGkS6 and itscfpFvJLOj8mHB;
assert "nlevel >= IPL_NONE" failed in intr.c -1 syz, C 259 1122d 1131d 3/4 1122d ed07db5bc17e Revert commitid: yfAefyNWibUyjkU2, ESyyH5EKxtrXGkS6 and itscfpFvJLOj8mHB;
witness: reversal: &sched_lock &pr->ps_mtx -1 syz 170 1126d 1128d 3/4 1126d 4ab8b759f72e Fix SCHED_LOCK() leak in single_thread_set()
kernel: integer divide fault trap, code=NUM (4) -1 syz, C 6 1211d 1267d 3/4 1204d 6d14abdcc245 Avoid division by 0 in m_pool_used
panic: rw_enter: rtlck locking against myself 2 5 1351d 1352d 3/4 1351d aa5e72b7343d Revert the `rt_lock' rwlock(9) diff to fix the recursive rwlock(9) acquisition.
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (7) 2 syz 9 1379d 1394d 3/4 1366d 9cf4e548dcbe Use solock() instead solock_shared() within sys_getsockopt(). Otherwise we acquiring kernel lock with mutex(9) held. This partially reverts rev 1.205 of sys/kern/uipc_syscalls.c. Shared solock() is still fine for getsockname(2) and getpeername(2).
pool: free list modified: semapl -1 syz 2 1524d 1524d 3/4 1472d 5bf1588a93fe Fix memory corruptions with sysv semaphores due to sleeps in copyin, copyout and malloc. During a sleep another thread could delete the semaphore (and possibly allocate another one at the same location with different permissions) which would lead to an invalid access after wake up. Therefore check the semaphore pointer, the sequence, the permissions and some values in seminfo after each sleep. OK bluhm@ Reported-by: syzbot+60ba811fe2e8a6b0f975@syzkaller.appspotmail.com
panic: solock: lock not held 2 syz, C 19 1497d 1497d 3/4 1497d 536333f5835e Use pru_send function to check socket splicing compatibility. Only checking socket type is not sufficient as it could splice together unix and inet sockets resulting in crashes. As splicing is about sending, the same send function looks like a good criteria. Reported-by: syzbot+fc6901d63d858d5dd00a@syzkaller.appspotmail.com Reported-by: syzbot+0e026f1bf8b259c6395e@syzkaller.appspotmail.com OK gnezdo@
assert "uvn->u_obj.uo_refs == NUM" failed in uvm_vnode.c -1 syz 8 1512d 1564d 3/4 1500d ce1ab8dd6b18 Lock vmobjlock then check u_flags & UVM_VNODE_VALID in uvn_attach
kernel: integer divide fault trap, code=NUM (3) -1 syz, C 157 1501d 1523d 3/4 1501d b18f9d9c6b70 Syzkaller found a missing input validation in pipex mppe keylenbits. Reported-by: syzbot+2eca95b271d07ab91b43@syzkaller.appspotmail.com tested yasuoka@; OK mvs@ yasuoka@
panic: tcp_output 2 syz, C 762 1502d 1504d 3/4 1502d 355f588a8749 Sendmsg could crash in tcp_output due to a missing check after the introduction of tcp_send. OK mvs@, bluhm@, gnezdo@ Reported-by: syzbot+e859fd353c90eeac26f8@syzkaller.appspotmail.com
no output from test machine (7) -1 syz, C 124310 1530d 2152d 3/4 1530d fa90ac5c787b Add a pool for the allocation of the pf_anchor struct. It was possible to exhaust kernel memory by repeatedly calling pfioctl DIOCXBEGIN with different anchor names. OK bluhm@ Reported-by: syzbot+9dd98cbce69e26f0fc11@syzkaller.appspotmail.com
witness: userret: sendmsg -1 syz, C 28 1561d 1561d 3/4 1561d 635da3731041 Unlock peer in the SOCK_STREAM and SOCK_SEQPACKET error path.
assert "__mp_lock_held(&sched_lock, curcpu()) == NUM" failed in kern_lock.c -1 syz, C 860 1563d 1674d 3/4 1563d 1690b19512cc Move the deep check back into the loop. There are ways that even though we're deep the code will SSTOP and sleep and then on wakeup we need to recheck the deep conditions. Issue analyzed and OK by mpi@
pool: free list modified: fdescpl (2) -1 syz, C 6 1572d 1617d 3/4 1566d dc399801d5c5 kqueue: Clear task when closing kqueue
protection_fault: pf_anchor_global_RB_REMOVE -1 73 1605d 1692d 3/4 1566d 30d709c8a85c Allow waiting during ktable allocation in pf_ioctl.
uvm_fault: pf_anchor_global_RB_INSERT_COLOR (2) -1 1 1568d 1568d 3/4 1566d 30d709c8a85c Allow waiting during ktable allocation in pf_ioctl.
assert "TAILQ_EMPTY(&lock->lf_blkhd)" failed in vfs_lockf.c (2) -1 syz, C 2 1597d 1597d 3/4 1591d ee8a225221fd Fix ambiguity with lock range end
panic: m_copydata: null mbuf (2) 2 syz 2 1603d 1603d 3/4 1600d 0271abd8e494 In pf the kernel paniced if IP options in packet within ICMP payload were truncated. Drop such packets instead. Reported-by: syzbot+91abd3aa2fdfe900f9ce@syzkaller.appspotmail.com OK sashan@ claudio@
multicore build error (15) -1 6 1619d 1619d 3/4 1618d ba537df4ec28 Using mutex initializer for static variable does not compile with witness. Make ratecheck mutex global. Reported-by: syzbot+9864ba1338526d0e8aca@syzkaller.appspotmail.com
witness: reversal: pf_lock netlock (3) -1 syz 25 1625d 1637d 3/4 1625d f3a753b5d089 Release PF und NET lock before calling copyout for DIOCIGETIFACES. OK sashan@ Reported-by: syzbot+b6afd166e314799e3809@syzkaller.appspotmail.com
protection_fault: lf_advlock -1 syz, C 2 1672d 1717d 3/4 1626d c30ab30fe47b Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
protection_fault: lf_findoverlap -1 syz, C 2 1639d 1671d 3/4 1626d c30ab30fe47b Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
assert "TAILQ_EMPTY(&lock->lf_blkhd)" failed in vfs_lockf.c -1 1 1639d 1639d 3/4 1626d c30ab30fe47b Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
protection_fault: lf_clearlock -1 syz, C 1 1642d 1642d 3/4 1626d c30ab30fe47b Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
witness: reversal: pf_lock netlock (2) -1 syz, C 2 1645d 1645d 3/4 1644d 2e34be423f16 Release PF und NET lock before calling copyin for DIOCXROLLBACK. OK bluhm@ Reported-by: syzbot+2945769fc3e6fd9ee413@syzkaller.appspotmail.com
witness: reversal: pf_lock netlock -1 syz, C 19 1657d 1709d 3/4 1646d 82d8999861ab Release PF und NET lock before calling copyin and copyout for DIOCXBEGIN. OK bluhm@ OK sashan@ Reported-by: syzbot+b22ec16c5bf937578937@syzkaller.appspotmail.com
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (4) -1 syz, C 9 1650d 1664d 3/4 1649d f77c87828076 Replace KASSERT in uvm_fault_unwire_locked() with code that handles the case where not all pages are wired. The KASSERT can be triggered in multi-threaded applications when a thread calling munmap(2) races another thread that invokes sysctl(2). Properly written code shouldn't do this, but making the kernel crash in this case is a bit harsh.
openbsd build error (17) -1 2 1657d 1657d 3/4 1656d Put call to vmx_remote_vmclear() under #ifdef MULTIPROCESSOR to unbreak build of amd64 GENERIC
uvm_fault: igmp_leavegroup (3) -1 37 1656d 1748d 3/4 1656d a134c703e536 if_detach() does if_remove(ifp); NET_LOCK(); rti_delete(). New igmp groups may join while sleeping in interface destruction. In this case if_get() in igmp_joingroup() fails and rti_fill() is not called. Then inm->inm_rti may be NULL. This is the condition when syzkaller crashes in igmp_leavegroup(). Pass the ifp the current CPU is already holding down to igmp_joingroup() and igmp_leavegroup() to avoid half constructed igmp groups. Calling if_get() in caller and callee makes no sense anyway. Reported-by: syzbot+146823a676b7bea83649@syzkaller.appspotmail.com OK denis@
openbsd boot error: uvm_fault -1 9 1661d 1661d 3/4 1661d 475618162a2c Revert previous. Breaks probing native IDE devices.
multicore boot error: uvm_fault -1 21 1661d 1661d 3/4 1661d 475618162a2c Revert previous. Breaks probing native IDE devices.
panic:p a anciqc:uikerrinngel dbialgocnkoastbliec a s s e r t i o n "! _k er neslle_lepo lcokc_khe l dw ( )i 2 1 1663d 1662d 3/4 1661d d25fea59a0de For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (6) 2 syz, C 80 1662d 1662d 3/4 1661d 2be5be2c1f9e For raw IPv6 packets rip6_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw6 table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. Reported-by: syzbot+5b2679ee9be0895d26f9@syzkaller.appspotmail.com OK claudio@
panic: apcaqnuiicr:in g b l o kckearbnelle d isalgeneops t ic a s s leorctkio n " w!_iktehr nselp_inlolocckk_ 2 1 1662d 1662d 3/4 1661d d25fea59a0de For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
panic: acquiring blockable sleep lock with spinlock or critical section held (pkanerinc:e l _l o c kke)r &nkeerl ndiea 2 1 1663d 1662d 3/4 1661d d25fea59a0de For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
panic: apcaquniirci: ng bkloerckneabll de i a g n o st ic a s s er ti o n " ! _ ke r n e l_ l oc k _ h sel 2 1 1662d 1662d 3/4 1661d 2be5be2c1f9e For raw IPv6 packets rip6_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw6 table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. Reported-by: syzbot+5b2679ee9be0895d26f9@syzkaller.appspotmail.com OK claudio@
panic: acquiring blockable sleep lock with spinlock or critical section held (kernelp_alonicck): &kkerernnelel d_ilao 2 1 1663d 1662d 3/4 1661d d25fea59a0de For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (5) 2 syz, C 104 1662d never 3/4 1662d d25fea59a0de For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (4) 2 syz, C 249 1663d 1664d 3/4 1663d 63abc0ec39b5 For multicast and broadcast packets udp_input() traverses the loop of all UDP PCBs. From there it calls udp_sbappend() while holding the UDP table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. Reported-by: syzbot+7596cb96fb9f3c9d6f4f@syzkaller.appspotmail.com OK sashan@
witness: reversal: vmmaplk fdlock -1 syz 22 1672d 1673d 3/4 1670d 447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
witness: exclusive lock of (rwlock) vmmaplk while share locked -1 syz, C 9 1673d 1673d 3/4 1670d 447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
witness: reversal: netlock vmmaplk -1 syz, C 166 1672d 1673d 3/4 1670d 447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
panic: kmmaplk: lock not shared 2 syz, C 15 1673d 1673d 3/4 1672d 447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (3) -1 syz 11 1673d 1689d 3/4 1673d 5f69141a284a Hold a read lock on the map while copying out data during a sysctl(2) call to prevent another thread from unmapping the memory and triggering an assertion or even corrupting random physical memory pages.
uvm_fault: socreate -1 syz, C 106 1687d 1688d 3/4 1687d 532245610f13 Reported-by: syzbot+1b5b209ce506db4d411d@syzkaller.appspotmail.com Revert the pr_usrreqs move: syzkaller found a NULL pointer deref and I won't be available to monitor for followup issues for a bit
assert "sc->sc_dev == NUM" failed in if_tun.c (2) -1 1 1694d 1694d 3/4 1687d 1c9104c31d3f have another go at fixing assert "sc->sc_dev == NUM" failed.
assert "m->m_pkthdr.pf.prio <= IFQ_MAXPRIO" failed in ifq.c -1 syz 2 1703d 1703d 3/4 1697d 2960c8affbaf check pf rule "set prio" values consistently.
assert "sc->sc_dev == NUM" failed in if_tun.c -1 24 1698d 1730d 3/4 1697d 156bbf72d5e4 prevent (re)opening of tun/tap interfaces that are being destroyed.
assert "len >= NUM && !M_READONLY(m)" failed in uipc_mbuf.c -1 syz 153 1699d 1708d 3/4 1699d 4be097b86868 The length value in bpf_movein() is casted to from size_t to u_int and then rounded before checking. Put the same check before the calculations to avoid overflow. Reported-by: syzbot+6f29d23eca959c5a9705@syzkaller.appspotmail.com OK claudio@
kernel: integer divide fault trap, code=NUM (2) -1 syz, C 8 1704d 1707d 3/4 1703d 43496f5abc1b let pfattach() to also initialize pf_default_rule_new to avoid div-by-zero in pf_purge()
panic: unhandled af (4) 2 syz 11 1722d 1751d 3/4 1719d 035d4f5430cb An af-to pf rule must have an address family naf to use after translation. Make stricter sanity checks in pf ioctl to avoid later crashes during packet processing. Reported-by: syzbot+0ef9190e7d0195496d0d@syzkaller.appspotmail.com OK sashan@
uvm_fault: x86_ipi_db (7) -1 4 1745d 1745d 3/4 1744d 7945134bbda7 Use a distinct variable while iterating the list of existing devices.
uvm_fault: pppacopen -1 syz, C 92 1745d 1745d 3/4 1744d 7945134bbda7 Use a distinct variable while iterating the list of existing devices.
assert "TAILQ_EMPTY(&ifp->if_addrhooks)" failed in if.c (2) -1 1 1747d 1747d 3/4 1745d 188a0a692db5 Prevent concurrent access to incomplete or dying `sc' caused by sleep points in pppacopen() and pppacclose() paths. Use the same "sc_ready" logic we use for 'pppx_if' structure.
panic: free: size too small NUM <= NUM / NUM (ADDR) type devbuf 2 1 1748d 1748d 3/4 1745d 61c8c0f0fd3e Prevent a double free by assigning the new keymap and corresponding size after the allocation and initialization is done. Otherwise, a race is possible if malloc ends up sleeping.
SYZFAIL: ioctl remote attach failed (3) -1 13 1746d 1751d 3/4 1745d 982627fcf222 Do not allow send/receive of kcov descriptors as the file descriptor can be kept alive longer than expected causing syzkaller to no longer being able to enable remote coverage.
assert "(rule != NULL) && (rule->ruleset != NULL)" failed in pf_ioctl.c -1 syz, C 7 1749d 2292d 3/4 1748d 5a50f165b8ad DIOCHANGERRULE ioctl must set pointer to ruleset in rule it inserts.
witness: userret: ioctl (3) -1 syz 2 1752d 1752d 3/4 1752d 41a45098bac2 Disk lock was held when returning to userland. Add a missing unlock in vnd ioctl error path. Reported-by: syzbot+6dde3fda33074a256318@syzkaller.appspotmail.com OK jsg@ anton@
uvm_fault: sysctl_diskinit -1 1 1758d 1758d 3/4 1752d 278923c07fda While malloc sleeps, the disk list could change during sysctl. Then allocated memory could be too short for the list of disks. Retry allocating enough space until it did not change. The disk list and duid memory are protected by kernel lock. Use asserts to mark this explicitly. Reported-by: syzbot+807423f6868bbfb836bc@syzkaller.appspotmail.com OK anton@ mpi@
uvm_fault: pfsync_state_import -1 syz, C 10 2240d 2309d 3/4 1753d d13e571b26fd Remove ptr_array from struct pf_ruleset
panic: uvm_fault_unwire_locked: address not in map (3) 2 1 1755d 1755d 3/4 1753d 65315d4d4359 Fix a typo in mlock(2) error path triggering a double-free.
panic: vndioctl: null vp 2 syz, C 3 1758d 1760d 3/4 1754d 4d2db379fd33 Ensure that the disk has been initialized after acquiring the lock and not before as we might end up sleeping while acquiring the lock, introducing a potential race.
panic: malloc: allocation too large, type = NUM, size = ADDR 2 syz, C 3 1759d 1761d 3/4 1754d 0b7f5aec6317 Let malloc return an error as opposed of panicking when sysctl kern.shminfo.shmseg is set to something ridiculously large.
openbsd build error (15) -1 37 1755d 1817d 3/4 1754d revert vnode: remove VLOCKSWORK and check locking when vop_islocked != nullop (both kernel and userland bits)
assert "suser(curproc) == NUM" failed in dt_dev.c -1 syz, C 7 1754d 1755d 3/4 1754d cf997a482905 Remove useless suser assert from dt(4). The ioctl(2) path checks the user anyway and close(2) may crash after setuid(2). Reported-by: syzbot+90e094f33d329fb2c3ab@syzkaller.appspotmail.com OK deraadt@
uvm_fault: uvm_fault_lower -1 syz, C 583 1755d 1759d 3/4 1755d f08b8e936de9 Do not try to unlock a NULL object.
kernel: integer divide fault trap, code=NUM -1 syz 2 1768d 1768d 3/4 1759d 38bfd041cb0f fix zero division found by syzkaller. The sanity checks in pf(4) ioctls are not powerful enough to detect invalid port ranges (or even invalid rules). syzkaller does not use pfctl(8), it uses ioctl(2) to pass some random chunk of memory as a rule to pf(4). Fix adds explicit check for 0 divider to pf_get_transaddr(). It should make syzkaller happy without disturbing anyone else.
uvm_fault: igmp_leavegroup (2) -1 1 1762d 1762d 3/4 1759d 5af2eee02794 Syzkaller found a dereference in igmp_leavegroup() where inm->inm_rti is NULL. It should be set in rti_fill(), but is not if malloc(9) fails. There is no rollback after malloc failure so the field stays uninitialized. The code is only called from ioctl, setsockopt or a task. Malloc should wait instead of failing, otherwise syscalls would be unreliable. While there also put an M_WAIT in the init code. During init malloc must not fail. OK mvs@ Reported-by: syzbot+e22326057ccf34908d78@syzkaller.appspotmail.com
uvm_fault: nd6_dad_duplicated (2) -1 76 1761d 1767d 3/4 1761d ce9bd2eccc20 nd6_dad_ns_input() could trigger a NULL deref in nd6_dad_duplicated(). It checks dp in two of three places. One check got lost in revision 1.83. Do a dp == NULL once at the beginning. OK jsg@ Reported-by: syzbot+88c0ce914a0b10b7e1c8@syzkaller.appspotmail.com
witness: userret: ioctl (2) -1 1 1768d 1768d 3/4 1767d aa5628258068 Add missing kernel unlock in error path.
panic: rw_enter: dklk locking against myself 2 syz, C 6 1830d 1858d 3/4 1826d placing the same vnd underneath a vnd (with VNDIOCSET) is a lock violation, but other circumstances are also bad, so let's block all vnd on top of vnd. While here, fix some toctou multiple-copyin of the path, and restructure the ioctl defer all softc updates to the end. ok mpi
multicore test error: timed out (2) -1 66 1839d 1842d 3/4 1839d 11ad9ee57f54 regen
openbsd build error (14) -1 2 1842d 1842d 3/4 1839d 11ad9ee57f54 regen
openbsd test error: timed out (2) -1 33 1839d 1842d 3/4 1839d 11ad9ee57f54 regen
multicore build error (13) -1 3 1842d 1842d 3/4 1839d 11ad9ee57f54 regen
assert "_kernel_lock_held()" failed in uvm_vnode.c -1 4 1865d 1865d 3/4 1858d 8e114673a836 vmm(4): grab kernel lock before vmspace init
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (3) 2 syz, C 2 1861d 1864d 3/4 1858d 8e114673a836 vmm(4): grab kernel lock before vmspace init
assert "_kernel_lock_held()" failed in uvm_device.c -1 7 1864d 1865d 3/4 1858d 8e114673a836 vmm(4): grab kernel lock before vmspace init
uvm_fault: rtm_output -1 syz, C 14 1859d 1859d 3/4 1858d d2084f835172 Fix NULL pointer dereference introduced by previous commit.
panic: vcpulock: lock not held 2 1 1865d 1865d 3/4 1860d 5f3d69798ad5 vmm(4): fix vcpu locking issues reported by syzbot
panic: lock (rwlock) vcpulock not locked 2 syz, C 1 1865d 1865d 3/4 1860d 5f3d69798ad5 vmm(4): fix vcpu locking issues reported by syzbot
panic: rw_enter: vcpulock locking against myself 2 1 1864d 1864d 3/4 1860d 5f3d69798ad5 vmm(4): fix vcpu locking issues reported by syzbot
assert "_kernel_lock_held()" failed in uvm_map.c -1 syz, C 11 1864d 1865d 3/4 1862d 8e114673a836 vmm(4): grab kernel lock before vmspace init
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (2) 2 syz, C 152 1865d 2586d 3/4 1865d 1be9dae600aa Prevent lock ordering issue by raising ipl level of vcpu_pool to IPL_MPFLOOR.
panic: mutex ADDR not held in knote_dequeue 2 syz, C 24 1947d 1947d 3/4 1947d baa47be05351 Remember to lock kqueue mutex in filt_timermodify().
witness: reversal: lock order data missing -1 syz, C 667 1976d 2046d 3/4 1975d 8b594b45f4b5 Move ktrfds() below fdpunlock(). This fixes lock order issue between vn_lock(9) and fdplock().
panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) solock 2 syz, C 4 1992d 1993d 3/4 1992d Revert per-socket `so_lock' rwlock(9) and use it to protect routing (PF_ROUTE) sockets. There is a locking issue with timeouts that needs to be fixed. Requested by deraadt@
SYZFAIL: tun: can't open device -1 syz 4 2046d 2046d 3/4 2040d 43dfcaac64e4 Issuing FIOSETOWN and TIOCSPGRP ioctl commands on a tun(4) device leaks device references causing a hang while trying to remove the same interface since the reference count will never reach zero. Instead of returning, break out of the switch in order to ensure that tun_put() gets called.
assert "frag->fr_firstoff[index] != NULL" failed in pf_norm.c -1 syz 4 2058d 2077d 3/4 2055d be7274bff2cd When cutting of the head of an overlapping fragment during pf reassembly, reinsert the fragment into the lookup table with correct index. Reported-by: syzbot+d043455a5346f726f1c4@syzkaller.appspotmail.com OK claudio@
kernel: protection fault trap, code=0 (8) -1 syz 1348 2068d 2257d 3/4 2067d 44a45654aa78 Interface group names must fit into IFNAMSIZ and be unique. But the kernel made the unique check before trunkating with strlcpy(). So there could be two interface groups with the same name. The kif is created by a name lookup. The trunkated names are equal, so there was only one kif owned by both groups. When the groups got destroyed, the single kif was removed twice from the RB tree. Check length of group name before doing the unique check. The empty group name was allowed and is now invalid. Reported-by: syzbot+f47e8296ebd559f9bbff@syzkaller.appspotmail.com OK deraadt@ gnezdo@ anton@ mvs@ claudio@
panic: rw_enter: pf_state_lock locking against myself 2 syz, C 8 2068d 2068d 3/4 2068d d7220220b7ed pfsync_state_import() must not be called with the pf state lock held, since the actual modification of the state table is done by a call to pf_state_insert(), which takes the pf state lock itself. Other calls to pfsync_state_import() also only have the pf lock.
panic: vrele: v_writecount != 0 (2) 2 syz, C 1955 2073d 2074d 3/4 2073d df61468f8652 Revert previous commit. The vnode returned by ptm_vn_open() is open and can not simply be vrele()-ed on error. The code currently depends on closef() to do the cleanup.
assert "TAILQ_EMPTY(&kq->kq_head)" failed in kern_event.c -1 syz, C 2 2083d 2083d 3/4 2082d 715db9d67ba3 kqueue: Fix termination assert
uvm_fault: pf_addr_compare -1 syz, C 347 2088d 2088d 3/4 2088d c34fe1b3cf88 An invalid packet may not have set src and dst in packet descriptor. Add a NULL check to prevent crash in pflog(4) introduced in previous commit. Reported-by: syzbot+c6d2f2ad34b822bce98a@syzkaller.appspotmail.com
uvm_fault: m_copyback -1 69 2106d 2254d 3/4 2088d 2cbebc019f52 pflog(4) tried to log the translated packet with rdr-to, nat-to, and af-to addresses and ports applied. Therefore it created a mbuf chain on the stack with a partial copy. This is too complicated for IP options, extension header, NAT46 af-to, and fragmented mbuf chains. It even caused a crash in syzkaller. Usually the length checks in pf_setup_pdesc() rejected the faked mbuf and the goto copy logged the packet unmodified. Remove the pflog_mtap() function and call bpf_mtap_hdr() directly. As the old buggy code was bypassed in most cases, tcpdump(8) output of pflog does not change. Uncondionally log the unmodified packet. Reported-by: syzbot+947e89e06ac3fec187d0@syzkaller.appspotmail.com OK sashan@
kernel: double fault trap, code=0 (4) -1 syz, C 493 2113d 2370d 3/4 2099d c11d76984715 Syzkaller has found a stack overflow in socket splicing. Broadcast packets were resent through simplex broadcast delivery and socket splicing. Although there is an M_LOOP check in somove(9), it did not take effect. if_input_local() cleared the M_BCAST and M_MCAST flags with m_resethdr(). As if_input_local() is used for broadcast and multicast delivery, it was a mistake to delete them. Keep the M_BCAST and M_MCAST mbuf flags when packets are reinjected into the network stack. Reported-by: syzbot+a43ace363f1b663238f8@syzkaller.appspotmail.com OK anton@; discussed with claudio@
kernel: integer divide fault trap, code=0 -1 syz 4 2286d 2315d 3/4 2123d 39c2a1337a94 Reject rules with invalid port ranges
openbsd test error: uvm_fault: spllower -1 6 2137d 2137d 3/4 2130d 3ba77c9295b2 Revert previous extension of the SCHED_LOCK(), the state isn't passed down.
multicore test error: uvm_fault: spllower -1 12 2137d 2137d 3/4 2130d 3ba77c9295b2 Revert previous extension of the SCHED_LOCK(), the state isn't passed down.
uvm_fault: wsevent_fini (3) -1 syz, C 2 2136d 2136d 3/4 2133d 996a5b4d63fa Fix yet another wscons race. In the same subsystem, the following properties must always hold true:
no output from test machine (6) -1 syz, C 2779 2152d 2174d 3/4 2152d 0124df67671a Fix handling of MSG_PEEK in soreceive() for the case where an empty mbuf is encountered in a seqpacket socket.
no output from test machine (5) -1 syz, C 49467 2174d 2272d 3/4 2174d d6d1940044d6 Fix a deadlock between uvn_io() and uvn_flush(). While faulting on a page backed by a vnode, uvn_io() will end up being called in order to populate newly allocated pages using I/O on the backing vnode. Before performing the I/O, newly allocated pages are flagged as busy by uvn_get(), that is before uvn_io() tries to lock the vnode. Such pages could then end up being flushed by uvn_flush() which already has acquired the vnode lock. Since such pages are flagged as busy, uvn_flush() will wait for them to be flagged as not busy. This will never happens as uvn_io() cannot make progress until the vnode lock is released.
witness: userret: ioctl -1 syz, C 3 2179d 2179d 3/4 2178d 610c242e11d3 - missing NET_UNLOCK() in pf_ioctl.c error path
panic: spl assertion failure in yield 2 syz, C 12 2307d 2324d 3/4 2179d - move NET_LOCK() further down in pf_ioctl.c. Also move memory allocations outside of NET_LOCK()/PF_LOCK() scope in easy spots.
openbsd build error (11) -1 44 2180d 2185d 3/4 2180d a524e041107f timeout(9): fix compilation under NKCOV
multicore build error (8) -1 88 2180d 2185d 3/4 2180d a524e041107f timeout(9): fix compilation under NKCOV
panic: malloc: allocation too large, type = 98, size = ADDR 2 syz, C 2 2197d 2197d 3/4 2196d Recent changes for PROT_NONE pages to not count against resource limits, failed to note this also guarded against heavy amap allocations in the MAP_SHARED case. Bring back the checks for MAP_SHARED from semarie, ok kettenis https://syzkaller.appspot.com/bug?extid=d80de26a8db6c009d060
openbsd build error (10) -1 3 2218d 2218d 3/4 2216d Unbreak tree. Instead of passing struct process to siginit() just pass the struct sigacts since that is the only thing that is modified by siginit.
multicore build error (7) -1 5 2218d 2218d 3/4 2216d Unbreak tree. Instead of passing struct process to siginit() just pass the struct sigacts since that is the only thing that is modified by siginit.
panic: syn_cache_insert: cacheoverflow: impossible (2) 2 syz, C 6 2253d 2298d 3/4 2230d 7c72bba2fa26 Convert tcp_sysctl to sysctl_bounded_args
assert "curproc->p_kd == NULL" failed in kcov.c (2) -1 1 2243d 2243d 3/4 2230d ece33e2f6ca2 Before clearing the kcov descriptor associated with a thread make sure no other thread is currently within a remote section. Otherwise, the remote subsystem could end up in a broken state where it doesn't reset the necessary bits upon leaving the remote section.
assert "curproc->p_kd == NULL" failed in kcov.c -1 2 2247d 2249d 3/4 2247d 2fa3abdda1a4 When detaching common remote coverage, do not clear any fields. Instead, let kr_free() do the work. Otherwise a thread currently inside a remote section could end up not decrementing the number of ongoing sections while exiting the same remote section.
uvm_fault: pfi_address_add -1 syz 1359 2268d 2324d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
pool: free list modified: phpool -1 1 2299d 2299d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
panic: sbdrop 2 syz 183 2259d 2558d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: soreceive -1 syz 240 2267d 2533d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
panic: ifa_update_broadaddr does not support dynamic length (2) 2 13 2262d 2411d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: in6ifa_ifpforlinklocal -1 1 2313d 2313d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: pool_do_put (2) -1 syz 53 2269d 2512d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
kernel: protection fault trap, code=0 (7) -1 syz 774692 2257d 2501d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: in_delmulti -1 syz 375431 2257d 2544d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
panic: tcp_output: template len != hdrlen - optlen 2 syz 487 2259d 2571d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
soreceive 1a -1 syz 510 2259d 2416d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault (2) -1 syz 1 2310d 2310d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
pool: cpu free list modified: mbufpl -1 syz 15863 2257d 2544d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
pool: free list modified: art_heap4 (2) -1 4 2299d 2330d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
soreceive 3 -1 syz 755 2257d 2416d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: vio_rxeof -1 syz 15700 2267d 2579d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: ifa_update_broadaddr -1 3275 2267d 2512d 3/4 2257d efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
multicore build error (6) -1 4 2263d 2276d 3/4 2260d Revert r1.170. dlg and jmatthew simultaneously fixed this the correct way.
openbsd build error (9) -1 1 2276d 2276d 3/4 2260d Revert r1.170. dlg and jmatthew simultaneously fixed this the correct way.
uvm_fault: wsevent_fini (2) -1 1 2284d 2284d 3/4 2263d 25f2901d1c23 Fix yet another panic in which wsevent_fini() ends up being called with NULL. This one is a race caused by clearing the me_evp member before calling routines that could end up sleeping.
no output from test machine (3) -1 syz, C 25293 2278d 2293d 3/4 2278d A pty write containing VDISCARD, VREPRINT, or various retyping cases of VERASE would perform (sometimes irrelevant) compute in the kernel which can be heavy (especially with our insufficient tty subsystem locking). Use tsleep_nsec for 1 tick in such circumstances to yield cpu, and also bring interruptability to ptcwrite() https://syzkaller.appspot.com/bug?extid=462539bc18fef8fc26cc ok kettenis millert, discussions with greg and anton
panic: unhandled af (2) 2 syz, C 22 2296d 2322d 3/4 2295d 38e8113e1d44 state import should accept AF_INET/AF_INET6 only
panic: syn_cache_insert: bucketoverflow: impossible 2 syz, C 5 2307d 2326d 3/4 2304d 2b10bfc1e665 Refuse to set 0 or a negative value for net.inet.tcp.synbucketlimit.
panic: syn_cache_insert: cacheoverflow: impossible 2 5 2304d 2323d 3/4 2304d 2b10bfc1e665 Refuse to set 0 or a negative value for net.inet.tcp.synbucketlimit.
no output from test machine -1 syz, C 551400 2346d 2921d 3/4 2346d 7bb4371dccb1 Do not wait indefinitely for flushing when closing a tty.
panic: m_copydata: null mbuf 2 syz, C 396 2350d 2537d 3/4 2347d 574b3a4fa98d Do sanity checks in ip6_pullexthdr() preventing a panic in m_copydata(9).
assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c -1 1 2413d 2413d 3/4 2361d 8e6c5245c1d8 Never update the ND entry (cache) corresponding to a RTF_LOCAL route.
uvm_fault: pfi_dynaddr_remove -1 syz, C 17 2470d 2475d 3/4 2363d 3d97bff14298 fix insufficient input sanitization in pf_rulecopyin() and pf_pool_copyin()
uvm_fault: pfr_detach_table -1 syz, C 12 2470d 2473d 3/4 2363d 3d97bff14298 fix insufficient input sanitization in pf_rulecopyin() and pf_pool_copyin()
openbsd build error (8) -1 2 2369d 2369d 3/4 2369d 20c8eb7cf336 Add bse(4) device to unbreak build.
multicore build error (5) -1 4 2369d 2369d 3/4 2369d 20c8eb7cf336 Add bse(4) device to unbreak build.
panic: rw_enter: netlock locking against myself 2 syz 2 2375d 2375d 3/4 2371d 27427a72e313 In sosplice(), temporarily release the socket lock before calling FRELE() as the last reference could be dropped which in turn will cause soclose() to be called where the socket lock is unconditionally acquired. Note that this is only a problem for sockets protected by the non-recursive NET_LOCK() right now.
assert "p == curproc" failed in vfs_vops.c -1 syz, C 187 2384d 2384d 3/4 2381d fc5a743df3a9 Revert previous, syzkaller found a way to trigger the KASSERT().
uvm_fault: strlcpy (2) -1 1 2392d 2392d 3/4 2385d 9fcf6ed4d02d Prevent out of bounds read in strlcpy due to vcp_name not being NUL-terminated.
panic: vputonfreelist: lock count is not zero 2 syz, C 2 2416d 2416d 3/4 2388d 2a9890d8c8d9 Relax the lockcount assertion in vputonfreelist(). Back when I fixed several problems with the vnode exclusive lock implementation, I overlooked the fact that a vnode can be in a state where the usecount is zero while the holdcount still being positive. There could still be threads waiting on the vnode lock in uvn_io() as long as the holdcount is positive.
uvm_fault: wsevent_fini -1 1 2396d 2396d 3/4 2391d be78d62e13f6 Ensure that me_evp is still NULL before assignment during open of wscons devices. This condition is checked early on during open but since the same routine could end up sleeping before assigning me_evp, a race against adding the same wscons device to a wsmux could be lost. This in turn can cause a NULL deference during close.
kernel: double fault trap, code=0 (3) -1 syz, C 69 2403d 2412d 3/4 2403d aa1987fe7ce4 Fix unlimited recursion caused by local outbound bcast/mcast packet sent via spliced socket.
pool: free list modified: aobjpl -1 syz, C 3 2500d 2513d 3/4 2410d c5a231fb6c1e Grab a reference for the shared memory segment before calling uvm_map() as the same function could end up putting the thread to sleep. Allowing another thread to free the shared memory segment, which in turns causes a use-after-free.
openbsd boot error: uvm_fault: softclock -1 33 2412d 2413d 3/4 2411d previous commit accidentally aliased two unique timeouts hit by millert
multicore boot error: uvm_fault: softclock -1 66 2412d 2413d 3/4 2411d previous commit accidentally aliased two unique timeouts hit by millert
kqueue: knote !QUEUED -1 syz 8 2427d 2463d 3/4 2427d 8c4786361ce1 Raise SPL when updating kn_status. Otherwise the field can become inconsistent if knote_acquire() or knote_release() is preempted by an interrupt that modifies the same knote.
panic: unhandled af 2 syz, C 21 2470d 2472d 3/4 2466d 4804479228fb Check address family of pf ioctl(2) DIOCNATLOOK parameter at kernel entry instead of calling panic() due to unhandled af. Reported-by: syzbot+92be143c2dd1746cf2af@syzkaller.appspotmail.com from Benjamin Baier
panic: attempt to execute user address 2 syz 1539 2476d 2570d 3/4 2472d f30ff743e528 Fix some races in kqueue_register().
witness: reversal: vmmaplk inode -1 syz, C 103124 2488d 2815d 3/4 2487d Use separate rwlock initializations for userland ("vmspace") and kernel maps. This lets witness know that these really are different classes avoiding false positives when detecting lock order reversals.
kernel: protection fault trap, code=0 (6) -1 syz, C 55024 2501d 2586d 3/4 2501d 0f83bb56e561 Fix a bad offset calculation in uvm_share.
panic: uvm_mapent_clone: no space in map for entry in empty map 2 syz, C 12 2502d 2508d 3/4 2502d 0f83bb56e561 Fix a bad offset calculation in uvm_share.
panic: amap_pp_adjref: negative reference count 2 syz, C 98 2512d 2564d 3/4 2502d 0f83bb56e561 Fix a bad offset calculation in uvm_share.
uvm_fault: amap_pp_adjref -1 1 2564d 2564d 3/4 2502d 0f83bb56e561 Fix a bad offset calculation in uvm_share.
uvm_fault: uvm_unmap_remove (2) -1 syz, C 7836 2502d 2585d 3/4 2502d 3c82c0b2df98 Fix uvm_unmap_remove panic when tearing down VMs.
panic: uvmspace_fork: no space in map for entry in empty map 2 syz, C 450 2510d 2564d 3/4 2502d 0f83bb56e561 Fix a bad offset calculation in uvm_share.
assert "TAILQ_EMPTY(&ifp->if_addrhooks)" failed in if.c -1 2 2522d 2524d 3/4 2517d 9e254176dfa1 take care to avoid a race when creating the same interface.
panic: ifa_update_broadaddr does not support dynamic length 2 syz 6780 2528d 2586d 3/4 2528d b36fd3da6fde Do propper kernel input validation for in_control() ioctl(2) SIOCGIFADDR, SIOCGIFNETMASK, SIOCGIFDSTADDR, SIOCGIFBRDADDR, SIOCSIFADDR, SIOCSIFNETMASK, SIOCSIFDSTADDR, and SIOCSIFBRDADDR. Name in_ioctl_set_ifaddr() consistently. Use in_sa2sin() to validate inet address. Combine if_addrlist loops and add comment. Although netmask is not a inet address, length must be valid. Reported-by: syzbot+5fc6da002fc4e8d994be@syzkaller.appspotmail.com OK visa@
pool: free list modified: shmpl -1 syz, C 22 2684d 2779d 3/4 2538d d13730a27993 Copy in the user-supplied buffer in shmctl(2) before looking up the shared memory segment. Otherwise, if copyin ends up sleeping it allows another thread to remove the same segment leading to a use-after-free.
malloc: free list modified: devbuf -1 syz 5 2545d 2551d 3/4 2545d put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
uvm_fault: kqueue_scan -1 1 2567d 2567d 3/4 2545d put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
uvm_fault: witness_checkorder -1 syz 2 2547d 2547d 3/4 2545d put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
uvm_fault: filt_bpfrdetach -1 syz 1 2545d 2545d 3/4 2545d put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
uvm_fault: bpfioctl -1 syz, C 14 2553d 2636d 3/4 2545d put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
assert "ps->ps_uvncount == 0" failed in kern_unveil.c -1 syz 226 2572d 2840d 3/4 2565d a239dbafd306 Only increment the ps_uvncount counter when a path is successfully added to the corresponding red-black tree; meaning the path was not already present in the tree. This prevents an assertion to trigger in unveil_destroy() later on when the process exits.
assert "ln != NULL" failed in nd6.c -1 1 2591d 2591d 3/4 2568d bdbfbec5cea8 Do more sanity checks when accepting socket addresses in routing messages from user land. Inspect length field early in rtm_xaddrs(). Strings must be NUL terminated. The socket address type and length depend on the routing message type. Currently checks are not super strict to avoid too much user land fallout. OK mpi@ Reported-by: syzbot+638dbf7851da8e255af5@syzkaller.appspotmail.com
assert "ifa == rt->rt_ifa" failed in nd6.c -1 9 2568d 2569d 3/4 2568d bdbfbec5cea8 Do more sanity checks when accepting socket addresses in routing messages from user land. Inspect length field early in rtm_xaddrs(). Strings must be NUL terminated. The socket address type and length depend on the routing message type. Currently checks are not super strict to avoid too much user land fallout. OK mpi@ Reported-by: syzbot+638dbf7851da8e255af5@syzkaller.appspotmail.com
uvm_fault: strlcpy -1 18 2575d 2696d 3/4 2573d bdbfbec5cea8 Do more sanity checks when accepting socket addresses in routing messages from user land. Inspect length field early in rtm_xaddrs(). Strings must be NUL terminated. The socket address type and length depend on the routing message type. Currently checks are not super strict to avoid too much user land fallout. OK mpi@ Reported-by: syzbot+638dbf7851da8e255af5@syzkaller.appspotmail.com
uvm_fault: uvm_unmap_remove -1 syz, C 780 2585d 2604d 3/4 2585d 00ba8250173b vm_teardown() must be serialized since it modifies the global vmm_softc structure. Therefore grab the appropriate lock before calling the same function. This issue has been known for a while and reported before but lacking a way to easily reproduce it; until syzkaller came up with a reproducer.
panic: malloc: allocation too large, type = 2, size = ADDR (2) 2 syz, C 16842 2586d 2604d 3/4 2586d 225e50e8a961 Do not decrement the number of VMs counter twice in one of vm_create() error paths. If creation of the first VM fails, the counter will wrap around to a huge value. The same value could later be passed to malloc() through vm_get_info() causing a panic.
kernel: protection fault trap, code=0 (5) -1 syz, C 607 2592d 2666d 3/4 2592d a42056240bd9 Fix a route use after free in IPv6 multicast route. Move the mrt6_mcast6_del() out of the rtable_walk(). This avoids recursion to prevent stack overflow. Also it allows freeing the route outside of the walk. Now mrt6_mcast_del() frees the route only when it is deleted from the routing table. If that fails, it must not be freed. After the route is returned by mf6c_find(), it is reference counted. Then we need a rtfree(), but not in the other case. Name mrt6_mcast_add() and mrt6_mcast_del() consistently. Move rt_timer_remove_all() into mrt6_mcast_del(). Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com OK mpi@
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock 2 33 2601d 2605d 3/4 2600d d3f3cb99fa83 Do not use the flow of the first fragment to store ECN information. Handle the ECN in the fragment queue. Reported-by: syzbot+0aa80b25e9041001cac8@syzkaller.appspotmail.com fix from FreeBSD; OK claudio@
uvm_fault: frag6_input -1 24 2601d 2605d 3/4 2600d d3f3cb99fa83 Do not use the flow of the first fragment to store ECN information. Handle the ECN in the fragment queue. Reported-by: syzbot+0aa80b25e9041001cac8@syzkaller.appspotmail.com fix from FreeBSD; OK claudio@
witness: userret: returning with the following locks held: -1 syz, C 315 2601d 2811d 3/4 2601d b808994cf339 When a thread tries to exclusively lock a vnode, the same thread must ensure that any other thread currently trying to acquire the underlying vnode lock has observed that the same vnode is about to be exclusively locked. Such threads must then sleep until the exclusive lock has been released and then try to acquire the lock again. Otherwise, exclusive access to the vnode cannot be guaranteed.
panic: vput: ref cnt 2 syz, C 6 2614d 2616d 3/4 2613d d627fa5cc364 Serialize access to the vnode pointers associated with acct(2) system accounting. Prevents a race where the acct thread and the acct(2) syscall both tries to close a vnode.
assert "timo || _kernel_lock_held()" failed in kern_synch.c -1 syz, C 2 2615d 2615d 3/4 2615d 93e05fce3bab Revert unlock of lseek(2) since vn_lock() could end up calling tsleep() which is not allowed without holding the kernel lock. Otherwise, wakeups could be lost.
panic: vrele: v_writecount != 0 2 syz, C 51 2622d 2628d 3/4 2622d 3e253b4759f0 Favor vn_close() in the error path of diskmapioctl() since side-effects caused by calling vn_open() with write permissions must be reverted. Otherwise, the vfs subsystem could panic while releasing the last vnode reference if the writecount is still positive.
panic: vput: v_writecount != 0 (2) 2 syz, C 112 2623d 2628d 3/4 2622d 3e253b4759f0 Favor vn_close() in the error path of diskmapioctl() since side-effects caused by calling vn_open() with write permissions must be reverted. Otherwise, the vfs subsystem could panic while releasing the last vnode reference if the writecount is still positive.
assert "cpipe->pipe_buffer.cnt == 0" failed in sys_pipe.c -1 syz, C 8 2649d 2650d 3/4 2649d 40f8ed5eebb0 backout the unlock of pipe(2) and pipe2(2)
kernel: protection fault trap, code=0 (4) -1 syz, C 759 2668d 2780d 3/4 2667d cf34c7c30780 Prevent recursions by not deleting entries inside rtable_walk(9).
uvm_fault: arp_rtrequest -1 syz, C 79 2686d 2696d 3/4 2675d 4cb088386ee5 In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag is set. These mpls routes use the rt_llinfo structure to store the MPLS label and would confuse the arp and nd6 code. OK bluhm@ anton@
assert "(rt->rt_flags & RTF_MPATH) || mrt->rt_priority != prio" failed in rtable.c -1 syz, C 143 2686d 2700d 3/4 2675d ff10691ed095 Copy the user provided sockaddr into a normalized sockaddr in rtrequest() before adding it to the routing table. The rtable code is doing memcmp() of those rt_dest sockaddrs so it is important that they are stored in a canonical form. To do this struct domain is extended to include the sockaddr size for this address family. OK bluhm@ anton@
uvm_fault: mrt6_ioctl -1 syz, C 2 2696d 2696d 3/4 2684d a8f2b5c7d3d3 Add missing NULL check for the protocol control block (pcb) pointer in mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL.
uvm_fault: mrt_ioctl -1 syz, C 2 2685d 2685d 3/4 2684d a8f2b5c7d3d3 Add missing NULL check for the protocol control block (pcb) pointer in mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL.
uvm_fault: pckbc_start (2) -1 syz 2 2697d 2698d 3/4 2685d bc79b6e32eb3 Prevent corruption of the pckbc command queue. If multiple synchronous commands are in flight and all corresponding threads are sleeping waiting for a response, the first command to timeout will clear the command queue. The remaining threads once awake will then try to remove a dequeued command from the queue, leading to corruption. Instead, remove commands from the queue before waking up the sleeping thread. A quirk is still needed to handle the case where tsleep() returns successfully during suspend.
assert "_kernel_lock_held()" failed in kern_event.c -1 syz, C 11 2716d 2718d 3/4 2686d 1be240a95e4a Removed all diagnostic, calling printf() here might create a recursion.
witness: reversal: &pr->ps_mtx &sched_lock -1 syz, C 141 2687d 2688d 3/4 2687d 17b25159f963 Revert to using the SCHED_LOCK() to protect time accounting.
uvm_fault: wsmux_do_ioctl (4) -1 syz, C 3 2700d 2725d 3/4 2698d 78fe050fe549 A problem fixed in wskbd is also present in wsmux. Repeating the previous commit message:
panic: malloc: out of space in kmem_map 2 97 2751d 2815d 3/4 2699d During fuzzing, one or many fuzzing processes are often stuck waiting on memory from the subproc malloc subsystem which is exhausted. Attempt to circumvent such scenarios by allocation the kcov coverage buffer using km_alloc() instead.
uvm_fault: rtm_report -1 syz, C 2 2724d 2724d 3/4 2708d 1b18c0494f67 Make rt_mpls_set() be more strict in what it accepts. Also ensure that the RTF_MPLS can't be toggled without rt_mpls_set() being called. While RTF_MPLS is part of RTF_FMASK it should be excluded from the flags and mask when they are applied to the route since toggling it requires a call to rt_mpls_set(). OK bluhm@
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 -1 36 2709d 2711d 3/4 2709d fbb8d265a895 Restore previous behavior of limiting deadlock detection to posix-style locks.
multicore build error (3) -1 4 2713d 2713d 3/4 2712d always rearm completion queues as leaving them disarmed would lead to rx or tx completion stalling.
openbsd build error (5) -1 2 2713d 2713d 3/4 2712d always rearm completion queues as leaving them disarmed would lead to rx or tx completion stalling.
panic: timeout_add: to_ticks < 0 (3) 2 1 2736d 2736d 3/4 2724d 1af424413523 Lower the accepted upper bound for bd_rtout to INT_MAX in order to prevent passing negative values to timeout_add().
panic: mtx ADDR: locking against myself 2 syz, C 3 2729d 2730d 3/4 2728d vmm(4): remove a debug printf that was causing lock issues (it was being called from an IPI routine).
panic: timeout_add: to_ticks < 0 (2) 2 syz 12 2746d 2748d 3/4 2746d bf2018479c9a Reject negative and too large timeouts passed to BIOCSRTIMEOUT. Since the timeout converted to ticks is later passed timeout_add(), it could cause a panic if the timeout is negative.
uvm_fault: rtable_satoplen (2) -1 syz 101 2749d 2758d 3/4 2746d 575ef11475ca Add a more strict rtm_hdrlen size check. Make sure that at least struct rt_msghdr bytes are passed in. Also return a failure from rtm_xaddrs() if rti_addrs has bad flags or run out of space. Ok bluhm@
uvm_fault: memcpy -1 syz, C 460 2749d 2769d 3/4 2749d 575ef11475ca Add a more strict rtm_hdrlen size check. Make sure that at least struct rt_msghdr bytes are passed in. Also return a failure from rtm_xaddrs() if rti_addrs has bad flags or run out of space. Ok bluhm@
panic: malloc: allocation too large, type = 2, size = ADDR 2 syz, C 914 2751d 2813d 3/4 2750d fd7c80607c62 Restrict the number of allowed wsmux devices, just like wskbd and wsmouse already does. Otherwise, malloc could panic if the device minor is sufficiently large.
openbsd build error (2) -1 1 2755d 2755d 3/4 2754d 6baecefef8fe Tweak previous: include <sys/stdint.h> for INT64_MAX/INT64_MIN.
assert "tname->un_flags & UNVEIL_USERSET" failed in kern_unveil.c -1 syz, C 1447 2754d 2756d 3/4 2754d f4c23aa848ae Remove this assert, I can't do this here with UNVEIL_INSPECT added aggressively today. Hopefully post release a glorious flensing will remove UNVEIL_INSPECT anyway
uvm_fault: rtable_satoplen -1 158 2759d 2776d 3/4 2759d fab4809e7ec2 Make sure pointer is within bounds before dereferencing it.
witness: acquiring duplicate lock of same type: "&sc->sc_lock" -1 syz, C 231 2788d 2790d 3/4 2788d 1f8a38b155bf When adding a wsmux device to an existing wsmux device using ioctl(WSMUXIO_ADD_DEVICE), two distinct locks of the same type are acquired. Thus, witness will emit warning. Since acquiring two different locks of the same type is harmless in this context, relax the witness check by flagging the locks as RWL_DUPOK.
panic: timeout_add: to_ticks < 0 2 syz, C 66 2788d 2793d 3/4 2788d 3cfc9cae129c Reject negative input from userland in spkrioctl(). One of the arguments are later passed to timeout_add() which panics if the given ticks are negative. While here, clamp arguments in pcppi_bell() in order to prevent overflow.
uvm_fault: pckbc_start -1 1 2790d 2790d 3/4 2790d 0c0bf6318018 Serialize access to the list of attached child devices belonging to a wsmux. When invoking wsevsrc_* functions on a attached child device, underlying driver can sleep; this introduces a race where another thread is able to modify the list leading to all kinds of corruptions.
uvm_fault: wsmux_detach_sc -1 syz 10 2793d 2804d 3/4 2790d 0c0bf6318018 Serialize access to the list of attached child devices belonging to a wsmux. When invoking wsevsrc_* functions on a attached child device, underlying driver can sleep; this introduces a race where another thread is able to modify the list leading to all kinds of corruptions.
panic: vmmaplk: lock not shared 2 syz, C 16 2801d 2813d 3/4 2801d Always refault if relocking maps fails after IO. This fixes a regression
panic: pool_p_free: semupl free list modified: page ADDR; item addr ADDR; offset 0x0=ADDR 2 syz, C 5 2801d 2921d 3/4 2801d When freeing the sem_undo structure in semundo_adjust(), update the
pool: free list modified: semupl -1 syz, C 6 2807d 2921d 3/4 2801d When freeing the sem_undo structure in semundo_adjust(), update the
pool: double put: mbufpl -1 6 2867d 2868d 3/4 2801d Avoid an mbuf double free in the oob soreceive() path. In the
uvm_fault: wsmux_do_ioctl (2) -1 syz, C 17 2809d 2813d 3/4 2808d In wskbdclose(), use the same logic as in wskbdopen() to determine if
kernel: protection fault trap, code=0 (3) -1 syz, C 3 2813d 2813d 3/4 2812d Validate the user-supplied device index given to WSMUXIO_ADD_DEVICE. The same
uvm_fault: VOP_ACCESS -1 393 2817d 2860d 3/4 2817d namei can return a null dvp on success. check this before access.
kernel: protection fault trap, code=0 (2) -1 syz 109 2818d 2842d 3/4 2818d Introduce a dedicated entry point data structure for file locks. This new data
panic: malformed IPv4 option passed to ip_optcopy (2) 2 syz, C 149 2823d 2827d 3/4 2820d Bring back the ip_pcbopts() refactor. Pad the option buffer and therefor the mbuf to the next word length as it is required by the standard. Also use the correct offset from the input mbuf. OK visa@, input & OK bluhm@
panic: uvm_fault_unwire_locked: address not in map 2 syz, C 2 2846d 2846d 3/4 2829d Hold a read lock on the map while doing the actual device I/O during in
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c -1 syz, C 2 2844d 2844d 3/4 2829d Hold a read lock on the map while doing the actual device I/O during in
panic: malformed IPv4 option passed to ip_optcopy 2 syz, C 10 2843d 2852d 3/4 2832d Validate the version, and all length fields of IP packets passed to a raw socket
panic: m_zero: M_READONLY 2 syz, C 3 2838d 2838d 3/4 2832d It is possible to call m_zero with a read-only cluster. In that case just
assert "__mp_lock_held(&sched_lock, curcpu()) == 0" failed in kern_lock.c -1 syz, C 17 2834d 2846d 3/4 2833d ec412da11be4 Fix unsafe use of ptsignal() in mi_switch().
uvm_fault: m_free -1 12 2844d 2867d 3/4 2834d 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
pool: free list modified: mbufpl -1 syz 13 2853d 2867d 3/4 2834d 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
panic: pr_find_pagehead: mbufpl: incorrect page 2 3 2847d 2863d 3/4 2834d 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
panic: pool_cache_item_magic_check: mcl64k cpu free list modified: item addr ADDR+24 ADDR!=ADDR 2 1 2864d 2864d 3/4 2834d 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
uvm_fault: switchread -1 1 2862d 2862d 3/4 2834d 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
uvm_fault: switchwrite -1 syz 7 2844d 2864d 3/4 2834d 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
panic: pool_cache_item_magic_check: mbufpl cpu free list modified: item addr ADDR+16 0x0!=ADDR 2 1 2855d 2855d 3/4 2836d 54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
panic: pr_find_pagehead: mbufpl: page header missing 2 syz, C 10 2854d 2867d 3/4 2842d Fix mbuf releated crashes in switch(4). They have been found by
pool: free list modified: mcl2k -1 syz, C 4 2851d 2905d 3/4 2850d Replace a wrong poor mans m_trailingspace() with the real thing. The mbuf
panic: receive 3: so ADDR, so_type 1, m ADDR, m_type 6 2 syz, C 18 2853d 2862d 3/4 2852d When using MSG_WAITALL, soreceive() can sleep while processing the receive buffer of a stream socket. Then a new pair of control and data mbuf can be appended to the mbuf queue. In this case, terminate the loop with a short read to prevent a panic. Userland should read the control message with the next system call. OK claudio@ deraadt@
panic: kernel diagnostic assertion "M_DATABUF(m) + M_SIZE(m) >= (m->m_data + m->m_len)" failed: file "/syzkaller/manager 2 syz, C 7 2862d 2868d 3/4 2852d 49729d6ed45f In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees the inpcb apart from the disconnect. Just call soisdisconnected() and clear the inp->inp_faddr since the socket is still valid after a disconnect. Problem found by syzkaller via Greg Steuck OK visa@ Fixes: Reported-by: syzbot+2cd350dfe5c96f6469f2@syzkaller.appspotmail.com Reported-by: syzbot+139ac2d7d3d60162334b@syzkaller.appspotmail.com Reported-by: syzbot+02168317bd0156c13b69@syzkaller.appspotmail.com Reported-by: syzbot+de8d2459ecf4cdc576a1@syzkaller.appspotmail.com
pool: double put: lockfpl -1 1 2929d 2921d 3/4 2852d Rework previous lockf fix; bluhm@ noticed a regress failure during consecutive runs. This is a second attempt in which the lockf structure is turned into a doubly linked list which makes it easier to ensure correctness during list insertion and deletion.
uvm_fault: killjobc -1 1 2857d 2857d 3/4 2852d When no child devices are attached to a wsmux device, make sure to return an
uvm_fault: wsmux_do_ioctl -1 2 2882d 2921d 3/4 2852d Utilize sigio with wscons. The old behavior of always making the process group of the process who opens the device the default recipient of sigio is removed as a side-effect of this change. Issuing ioctl(FIOSETOWN) is therefore mandatory in order to receive sigio, which is more consistent with other subsystems supporting sigio.
uvm_fault: sogetopt -1 syz, C 2 2870d 2870d 1/4 2867d In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
kernel: protection fault trap, code=0 -1 syz, C 16 2867d 2871d 1/4 2867d In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
uvm_fault: ip_ctloutput -1 syz, C 11 2867d 2871d 1/4 2867d In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
uvm_fault: ip_pcbopts -1 syz, C 6 2867d 2870d 1/4 2867d In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees