assert "nlevel >= IPL_NONE" failed in intr.c (2)
|
|
|
|
122 |
21d |
279d
|
3/3 |
21d |
a921796a245d
make sure bpfsdetach is holding a bpf_d ref when invalidating stuff.
|
pool: double put: shmpl
|
|
|
|
12 |
33d |
107d
|
3/3 |
33d |
4a445d448ac2
Prevent a double free by unlinking the descriptor before unmaping & freeing it.
|
panic: kernel diagnostic assertion "uvm_page_owner_locked_p(pg)
|
|
|
|
70 |
47d |
51d
|
3/3 |
36d |
0535051c104d
Check if the mapping for an vm_map_entry exists while holding its lock.
|
panic: free: size too large NUM > NUM (ADDR) type sysctl
|
|
|
|
1 |
76d |
76d
|
3/3 |
75d |
dd2b8016139a
Fix sleeping race during malloc in sysctl hw.disknames.
|
assert "to_ticks >= NUM" failed in kern_timeout.c
|
|
|
|
1 |
133d |
133d
|
3/3 |
125d |
2293e68203ec
restrict the maximum wait time you can set via BIOCSWTIMEOUT to 5 minutes.
|
multicore boot error: uvm_fault (2)
|
|
|
|
12 |
352d |
352d
|
3/3 |
148d |
ef9354f58d69
sync
|
panic: lock (rwlock) solock not locked
|
C |
|
|
33 |
826d |
827d
|
3/3 |
151d |
ef9354f58d69
sync
|
witness: reversal: lock order data missing (3)
|
|
|
|
8192 |
151d |
999d
|
3/3 |
151d |
ef9354f58d69
sync
|
panic: vmxon failed
|
syz |
|
|
3 |
240d |
246d
|
3/3 |
239d |
ddfb6951b469
vmm: protect vmm activation with the vmm_softc rwlock.
|
uvm_fault: igmp_leavegroup (5)
|
C |
|
|
12 |
241d |
243d
|
3/3 |
241d |
4733ced31b52
Prevent changing interface loopback flag from userland.
|
panic: unix: lock not held
|
C |
|
|
2 |
253d |
253d
|
3/3 |
247d |
e679c1f37540
Allow listen(2) only on sockets of type SOCK_STREAM or SOCK_SEQPACKET. listen(2) man(1) page clearly prohibits sockets of other types.
|
panic: rw_enter: unix locking against myself
|
C |
|
|
2 |
271d |
271d
|
3/3 |
266d |
d1ea0a7c7de9
Do UNP_CONNECTING and UNP_BINDING flags check in uipc_listen() and return EINVAL if set. This prevents concurrent solisten() thread to make this socket listening while socket is unlocked.
|
panic: malformed IPv4 option passed to ip_optcopy (3)
|
syz |
|
|
40 |
278d |
280d
|
3/3 |
278d |
c8a0ef6cb991
Validate IPv4 packet options in divert output.
|
assert "to->to_kclock == KCLOCK_UPTIME" failed in kern_timeout.c (3)
|
|
|
|
1 |
302d |
302d
|
3/3 |
289d |
0a34672fd384
timeout: make to_kclock validation more rigorous
|
kqueue: knote !ACTIVE (3)
|
|
|
|
1 |
309d |
309d
|
3/3 |
307d |
d618cc99d763
Invert broken check of panic string in if_linkstate().
|
assert "sin6tosa(&ro->ro_dst)->sa_family == AF_INET6" failed in in6_src.c
|
C |
|
|
218 |
310d |
312d
|
3/3 |
310d |
4a2c3c9ecbcf
In in_pcbrtentry() add missing return of in6_pcbrtentry() value.
|
uvm_fault: refcnt_take
|
|
|
|
1 |
326d |
326d
|
3/3 |
325d |
470ec98d6191
Backout priterator() for walking allprocess list.
|
protection_fault: fill_file (3)
|
|
|
|
1 |
334d |
334d
|
3/3 |
328d |
d221342b6cd4
Introduce priterator(), the `ps_list' iterator. Some of `allprocess' list walkthroughs have context switch within, so make exit1() wait until the last reference released.
|
witness: reversal: solock pf_lock
|
|
|
|
2 |
332d |
339d
|
3/3 |
332d |
66bd633ef3ce
Use domain name for socket lock.
|
witness: reversal: pf_lock solock
|
syz |
|
|
23 |
332d |
339d
|
3/3 |
332d |
66bd633ef3ce
Use domain name for socket lock.
|
assert "dtlookup(unit) == NULL" failed in dt_dev.c (3)
|
|
|
|
1 |
343d |
343d
|
3/3 |
341d |
c57c5c683707
Prevent simultaneous dt(4) open.
|
assert "__mp_lock_held(&sched_lock, curcpu()) == NUM" failed in kern_lock.c (4)
|
|
|
|
1 |
356d |
356d
|
3/3 |
355d |
540e94b5c59a
soreceive() must not hold mutex when calling sblock().
|
panic: assertwaitok: non-zero mutex count: NUM
|
C |
|
|
10 |
355d |
356d
|
3/3 |
355d |
540e94b5c59a
soreceive() must not hold mutex when calling sblock().
|
uvm_fault: rtrequest (2)
|
C |
|
|
15 |
391d |
392d
|
3/3 |
391d |
a08e228de7c0
Fix rt_setgate() error handling.
|
assert "!_kernel_lock_held()" failed in kern_fork.c (3)
|
|
|
|
107 |
406d |
1055d
|
3/3 |
405d |
6d6c8141fa4d
Adjust KERNEL_ASSERT_UNLOCKED() to not assert during a panic.
|
assert "!_kernel_lock_held()" failed in uvm_map.c (2)
|
|
|
|
13 |
440d |
658d
|
3/3 |
405d |
6d6c8141fa4d
Adjust KERNEL_ASSERT_UNLOCKED() to not assert during a panic.
|
assert "((len + sizeof(long) - NUM) &~ (sizeof(long) - NUM)) <= M_SIZE(m)" failed in uipc_mbuf.c
|
C |
|
|
2 |
418d |
418d
|
3/3 |
415d |
7b4d35e0a60b
Avoid assertion failure when splitting mbuf cluster.
|
multicore boot error: witness: lock_object uninitialized: ADDR
|
|
|
|
108 |
428d |
431d
|
3/3 |
427d |
33aa5105d87e
Revert commitid: KtmyJEoS0WWxmlZ5 --- Protect interface queues with read once and mutex.
|
assert "p->p_stat == SONPROC || p->p_stat == SSLEEP || p->p_stat == SSTOP" failed in kern_synch.c
|
syz |
|
|
10 |
449d |
479d
|
3/3 |
446d |
de92f022b000
Before coredump or in pledge_fail use SINGLE_UNWIND to stop all threads.
|
assert "type != NULL" failed in subr_witness.c
|
syz |
|
|
1 |
461d |
461d
|
3/3 |
452d |
ed07db5bc17e
Revert commitid: yfAefyNWibUyjkU2, ESyyH5EKxtrXGkS6 and itscfpFvJLOj8mHB;
|
assert "nlevel >= IPL_NONE" failed in intr.c
|
C |
|
|
259 |
452d |
461d
|
3/3 |
452d |
ed07db5bc17e
Revert commitid: yfAefyNWibUyjkU2, ESyyH5EKxtrXGkS6 and itscfpFvJLOj8mHB;
|
witness: reversal: &sched_lock &pr->ps_mtx
|
syz |
|
|
170 |
456d |
458d
|
3/3 |
456d |
4ab8b759f72e
Fix SCHED_LOCK() leak in single_thread_set()
|
kernel: integer divide fault trap, code=NUM (4)
|
C |
|
|
6 |
541d |
597d
|
3/3 |
534d |
6d14abdcc245
Avoid division by 0 in m_pool_used
|
panic: rw_enter: rtlck locking against myself
|
|
|
|
5 |
681d |
681d
|
3/3 |
681d |
aa5e72b7343d
Revert the `rt_lock' rwlock(9) diff to fix the recursive rwlock(9) acquisition.
|
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (7)
|
syz |
|
|
9 |
709d |
724d
|
3/3 |
696d |
9cf4e548dcbe
Use solock() instead solock_shared() within sys_getsockopt(). Otherwise we acquiring kernel lock with mutex(9) held. This partially reverts rev 1.205 of sys/kern/uipc_syscalls.c. Shared solock() is still fine for getsockname(2) and getpeername(2).
|
pool: free list modified: semapl
|
syz |
|
|
2 |
854d |
854d
|
3/3 |
802d |
5bf1588a93fe
Fix memory corruptions with sysv semaphores due to sleeps in copyin, copyout and malloc. During a sleep another thread could delete the semaphore (and possibly allocate another one at the same location with different permissions) which would lead to an invalid access after wake up. Therefore check the semaphore pointer, the sequence, the permissions and some values in seminfo after each sleep. OK bluhm@ Reported-by: syzbot+60ba811fe2e8a6b0f975@syzkaller.appspotmail.com
|
panic: solock: lock not held
|
C |
|
|
19 |
826d |
827d
|
3/3 |
826d |
536333f5835e
Use pru_send function to check socket splicing compatibility. Only checking socket type is not sufficient as it could splice together unix and inet sockets resulting in crashes. As splicing is about sending, the same send function looks like a good criteria. Reported-by: syzbot+fc6901d63d858d5dd00a@syzkaller.appspotmail.com Reported-by: syzbot+0e026f1bf8b259c6395e@syzkaller.appspotmail.com OK gnezdo@
|
assert "uvn->u_obj.uo_refs == NUM" failed in uvm_vnode.c
|
syz |
|
|
8 |
842d |
894d
|
3/3 |
830d |
ce1ab8dd6b18
Lock vmobjlock then check u_flags & UVM_VNODE_VALID in uvn_attach
|
kernel: integer divide fault trap, code=NUM (3)
|
C |
|
|
157 |
831d |
853d
|
3/3 |
831d |
b18f9d9c6b70
Syzkaller found a missing input validation in pipex mppe keylenbits. Reported-by: syzbot+2eca95b271d07ab91b43@syzkaller.appspotmail.com tested yasuoka@; OK mvs@ yasuoka@
|
panic: tcp_output
|
C |
|
|
762 |
832d |
834d
|
3/3 |
832d |
355f588a8749
Sendmsg could crash in tcp_output due to a missing check after the introduction of tcp_send. OK mvs@, bluhm@, gnezdo@ Reported-by: syzbot+e859fd353c90eeac26f8@syzkaller.appspotmail.com
|
no output from test machine (7)
|
C |
|
|
124310 |
859d |
1482d
|
3/3 |
859d |
fa90ac5c787b
Add a pool for the allocation of the pf_anchor struct. It was possible to exhaust kernel memory by repeatedly calling pfioctl DIOCXBEGIN with different anchor names. OK bluhm@ Reported-by: syzbot+9dd98cbce69e26f0fc11@syzkaller.appspotmail.com
|
witness: userret: sendmsg
|
C |
|
|
28 |
890d |
891d
|
3/3 |
890d |
635da3731041
Unlock peer in the SOCK_STREAM and SOCK_SEQPACKET error path.
|
assert "__mp_lock_held(&sched_lock, curcpu()) == NUM" failed in kern_lock.c
|
C |
|
|
860 |
893d |
1004d
|
3/3 |
893d |
1690b19512cc
Move the deep check back into the loop. There are ways that even though we're deep the code will SSTOP and sleep and then on wakeup we need to recheck the deep conditions. Issue analyzed and OK by mpi@
|
pool: free list modified: fdescpl (2)
|
C |
|
|
6 |
901d |
946d
|
3/3 |
895d |
dc399801d5c5
kqueue: Clear task when closing kqueue
|
protection_fault: pf_anchor_global_RB_REMOVE
|
|
|
|
73 |
935d |
1022d
|
3/3 |
896d |
30d709c8a85c
Allow waiting during ktable allocation in pf_ioctl.
|
uvm_fault: pf_anchor_global_RB_INSERT_COLOR (2)
|
|
|
|
1 |
898d |
898d
|
3/3 |
896d |
30d709c8a85c
Allow waiting during ktable allocation in pf_ioctl.
|
assert "TAILQ_EMPTY(&lock->lf_blkhd)" failed in vfs_lockf.c (2)
|
C |
|
|
2 |
927d |
927d
|
3/3 |
921d |
ee8a225221fd
Fix ambiguity with lock range end
|
panic: m_copydata: null mbuf (2)
|
syz |
|
|
2 |
933d |
933d
|
3/3 |
930d |
0271abd8e494
In pf the kernel paniced if IP options in packet within ICMP payload were truncated. Drop such packets instead. Reported-by: syzbot+91abd3aa2fdfe900f9ce@syzkaller.appspotmail.com OK sashan@ claudio@
|
multicore build error (15)
|
|
|
|
6 |
949d |
949d
|
3/3 |
948d |
ba537df4ec28
Using mutex initializer for static variable does not compile with witness. Make ratecheck mutex global. Reported-by: syzbot+9864ba1338526d0e8aca@syzkaller.appspotmail.com
|
witness: reversal: pf_lock netlock (3)
|
syz |
|
|
25 |
955d |
966d
|
3/3 |
954d |
f3a753b5d089
Release PF und NET lock before calling copyout for DIOCIGETIFACES. OK sashan@ Reported-by: syzbot+b6afd166e314799e3809@syzkaller.appspotmail.com
|
protection_fault: lf_advlock
|
C |
|
|
2 |
1002d |
1047d
|
3/3 |
956d |
c30ab30fe47b
Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
|
protection_fault: lf_findoverlap
|
C |
|
|
2 |
969d |
1001d
|
3/3 |
956d |
c30ab30fe47b
Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
|
assert "TAILQ_EMPTY(&lock->lf_blkhd)" failed in vfs_lockf.c
|
|
|
|
1 |
969d |
969d
|
3/3 |
956d |
c30ab30fe47b
Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
|
protection_fault: lf_clearlock
|
C |
|
|
1 |
971d |
971d
|
3/3 |
956d |
c30ab30fe47b
Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
|
witness: reversal: pf_lock netlock (2)
|
C |
|
|
2 |
975d |
975d
|
3/3 |
974d |
2e34be423f16
Release PF und NET lock before calling copyin for DIOCXROLLBACK. OK bluhm@ Reported-by: syzbot+2945769fc3e6fd9ee413@syzkaller.appspotmail.com
|
witness: reversal: pf_lock netlock
|
C |
|
|
19 |
987d |
1039d
|
3/3 |
976d |
82d8999861ab
Release PF und NET lock before calling copyin and copyout for DIOCXBEGIN. OK bluhm@ OK sashan@ Reported-by: syzbot+b22ec16c5bf937578937@syzkaller.appspotmail.com
|
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (4)
|
C |
|
|
9 |
980d |
993d
|
3/3 |
979d |
f77c87828076
Replace KASSERT in uvm_fault_unwire_locked() with code that handles the case where not all pages are wired. The KASSERT can be triggered in multi-threaded applications when a thread calling munmap(2) races another thread that invokes sysctl(2). Properly written code shouldn't do this, but making the kernel crash in this case is a bit harsh.
|
openbsd build error (17)
|
|
|
|
2 |
987d |
987d
|
3/3 |
986d |
Put call to vmx_remote_vmclear() under #ifdef MULTIPROCESSOR to unbreak build of amd64 GENERIC
|
uvm_fault: igmp_leavegroup (3)
|
|
|
|
37 |
986d |
1078d
|
3/3 |
986d |
a134c703e536
if_detach() does if_remove(ifp); NET_LOCK(); rti_delete(). New igmp groups may join while sleeping in interface destruction. In this case if_get() in igmp_joingroup() fails and rti_fill() is not called. Then inm->inm_rti may be NULL. This is the condition when syzkaller crashes in igmp_leavegroup(). Pass the ifp the current CPU is already holding down to igmp_joingroup() and igmp_leavegroup() to avoid half constructed igmp groups. Calling if_get() in caller and callee makes no sense anyway. Reported-by: syzbot+146823a676b7bea83649@syzkaller.appspotmail.com OK denis@
|
openbsd boot error: uvm_fault
|
|
|
|
9 |
991d |
991d
|
3/3 |
991d |
475618162a2c
Revert previous. Breaks probing native IDE devices.
|
multicore boot error: uvm_fault
|
|
|
|
21 |
991d |
991d
|
3/3 |
991d |
475618162a2c
Revert previous. Breaks probing native IDE devices.
|
panic:p a anciqc:uikerrinngel dbialgocnkoastbliec a s s e r t i o n "! _k er neslle_lepo lcokc_khe l dw ( )i
|
|
|
|
1 |
992d |
992d
|
3/3 |
991d |
d25fea59a0de
For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
|
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (6)
|
C |
|
|
80 |
992d |
992d
|
3/3 |
991d |
2be5be2c1f9e
For raw IPv6 packets rip6_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw6 table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. Reported-by: syzbot+5b2679ee9be0895d26f9@syzkaller.appspotmail.com OK claudio@
|
panic: apcaqnuiicr:in g b l o kckearbnelle d isalgeneops t ic a s s leorctkio n " w!_iktehr nselp_inlolocckk_
|
|
|
|
1 |
992d |
992d
|
3/3 |
991d |
d25fea59a0de
For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
|
panic: acquiring blockable sleep lock with spinlock or critical section held (pkanerinc:e l _l o c kke)r &nkeerl ndiea
|
|
|
|
1 |
993d |
992d
|
3/3 |
991d |
d25fea59a0de
For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
|
panic: apcaquniirci: ng bkloerckneabll de i a g n o st ic a s s er ti o n " ! _ ke r n e l_ l oc k _ h sel
|
|
|
|
1 |
992d |
992d
|
3/3 |
991d |
2be5be2c1f9e
For raw IPv6 packets rip6_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw6 table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. Reported-by: syzbot+5b2679ee9be0895d26f9@syzkaller.appspotmail.com OK claudio@
|
panic: acquiring blockable sleep lock with spinlock or critical section held (kernelp_alonicck): &kkerernnelel d_ilao
|
|
|
|
1 |
992d |
992d
|
3/3 |
991d |
d25fea59a0de
For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
|
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (5)
|
C |
|
|
104 |
992d |
never
|
3/3 |
992d |
d25fea59a0de
For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
|
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (4)
|
C |
|
|
249 |
993d |
994d
|
3/3 |
993d |
63abc0ec39b5
For multicast and broadcast packets udp_input() traverses the loop of all UDP PCBs. From there it calls udp_sbappend() while holding the UDP table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. Reported-by: syzbot+7596cb96fb9f3c9d6f4f@syzkaller.appspotmail.com OK sashan@
|
witness: reversal: vmmaplk fdlock
|
syz |
|
|
22 |
1002d |
1003d
|
3/3 |
1000d |
447db83cf4f0
Revert holding a read lock on the map while copying out data during sysctl(2).
|
witness: exclusive lock of (rwlock) vmmaplk while share locked
|
C |
|
|
9 |
1002d |
1003d
|
3/3 |
1000d |
447db83cf4f0
Revert holding a read lock on the map while copying out data during sysctl(2).
|
witness: reversal: netlock vmmaplk
|
C |
|
|
166 |
1002d |
1003d
|
3/3 |
1000d |
447db83cf4f0
Revert holding a read lock on the map while copying out data during sysctl(2).
|
panic: kmmaplk: lock not shared
|
C |
|
|
15 |
1003d |
1003d
|
3/3 |
1002d |
447db83cf4f0
Revert holding a read lock on the map while copying out data during sysctl(2).
|
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (3)
|
syz |
|
|
11 |
1003d |
1019d
|
3/3 |
1003d |
5f69141a284a
Hold a read lock on the map while copying out data during a sysctl(2) call to prevent another thread from unmapping the memory and triggering an assertion or even corrupting random physical memory pages.
|
uvm_fault: socreate
|
C |
|
|
106 |
1017d |
1018d
|
3/3 |
1017d |
532245610f13
Reported-by: syzbot+1b5b209ce506db4d411d@syzkaller.appspotmail.com Revert the pr_usrreqs move: syzkaller found a NULL pointer deref and I won't be available to monitor for followup issues for a bit
|
assert "sc->sc_dev == NUM" failed in if_tun.c (2)
|
|
|
|
1 |
1023d |
1023d
|
3/3 |
1017d |
1c9104c31d3f
have another go at fixing assert "sc->sc_dev == NUM" failed.
|
assert "m->m_pkthdr.pf.prio <= IFQ_MAXPRIO" failed in ifq.c
|
syz |
|
|
2 |
1033d |
1033d
|
3/3 |
1026d |
2960c8affbaf
check pf rule "set prio" values consistently.
|
assert "sc->sc_dev == NUM" failed in if_tun.c
|
|
|
|
24 |
1028d |
1060d
|
3/3 |
1026d |
156bbf72d5e4
prevent (re)opening of tun/tap interfaces that are being destroyed.
|
assert "len >= NUM && !M_READONLY(m)" failed in uipc_mbuf.c
|
syz |
|
|
153 |
1029d |
1038d
|
3/3 |
1029d |
4be097b86868
The length value in bpf_movein() is casted to from size_t to u_int and then rounded before checking. Put the same check before the calculations to avoid overflow. Reported-by: syzbot+6f29d23eca959c5a9705@syzkaller.appspotmail.com OK claudio@
|
kernel: integer divide fault trap, code=NUM (2)
|
C |
|
|
8 |
1034d |
1037d
|
3/3 |
1033d |
43496f5abc1b
let pfattach() to also initialize pf_default_rule_new to avoid div-by-zero in pf_purge()
|
panic: unhandled af (4)
|
syz |
|
|
11 |
1051d |
1081d
|
3/3 |
1049d |
035d4f5430cb
An af-to pf rule must have an address family naf to use after translation. Make stricter sanity checks in pf ioctl to avoid later crashes during packet processing. Reported-by: syzbot+0ef9190e7d0195496d0d@syzkaller.appspotmail.com OK sashan@
|
uvm_fault: x86_ipi_db (7)
|
|
|
|
4 |
1075d |
1075d
|
3/3 |
1074d |
7945134bbda7
Use a distinct variable while iterating the list of existing devices.
|
uvm_fault: pppacopen
|
C |
|
|
92 |
1075d |
1075d
|
3/3 |
1074d |
7945134bbda7
Use a distinct variable while iterating the list of existing devices.
|
assert "TAILQ_EMPTY(&ifp->if_addrhooks)" failed in if.c (2)
|
|
|
|
1 |
1077d |
1077d
|
3/3 |
1075d |
188a0a692db5
Prevent concurrent access to incomplete or dying `sc' caused by sleep points in pppacopen() and pppacclose() paths. Use the same "sc_ready" logic we use for 'pppx_if' structure.
|
panic: free: size too small NUM <= NUM / NUM (ADDR) type devbuf
|
|
|
|
1 |
1077d |
1077d
|
3/3 |
1075d |
61c8c0f0fd3e
Prevent a double free by assigning the new keymap and corresponding size after the allocation and initialization is done. Otherwise, a race is possible if malloc ends up sleeping.
|
SYZFAIL: ioctl remote attach failed (3)
|
|
|
|
13 |
1076d |
1081d
|
3/3 |
1075d |
982627fcf222
Do not allow send/receive of kcov descriptors as the file descriptor can be kept alive longer than expected causing syzkaller to no longer being able to enable remote coverage.
|
assert "(rule != NULL) && (rule->ruleset != NULL)" failed in pf_ioctl.c
|
C |
|
|
7 |
1079d |
1622d
|
3/3 |
1078d |
5a50f165b8ad
DIOCHANGERRULE ioctl must set pointer to ruleset in rule it inserts.
|
witness: userret: ioctl (3)
|
syz |
|
|
2 |
1082d |
1082d
|
3/3 |
1081d |
41a45098bac2
Disk lock was held when returning to userland. Add a missing unlock in vnd ioctl error path. Reported-by: syzbot+6dde3fda33074a256318@syzkaller.appspotmail.com OK jsg@ anton@
|
uvm_fault: sysctl_diskinit
|
|
|
|
1 |
1088d |
1088d
|
3/3 |
1082d |
278923c07fda
While malloc sleeps, the disk list could change during sysctl. Then allocated memory could be too short for the list of disks. Retry allocating enough space until it did not change. The disk list and duid memory are protected by kernel lock. Use asserts to mark this explicitly. Reported-by: syzbot+807423f6868bbfb836bc@syzkaller.appspotmail.com OK anton@ mpi@
|
uvm_fault: pfsync_state_import
|
C |
|
|
10 |
1570d |
1639d
|
3/3 |
1082d |
d13e571b26fd
Remove ptr_array from struct pf_ruleset
|
panic: uvm_fault_unwire_locked: address not in map (3)
|
|
|
|
1 |
1085d |
1085d
|
3/3 |
1083d |
65315d4d4359
Fix a typo in mlock(2) error path triggering a double-free.
|
panic: vndioctl: null vp
|
C |
|
|
3 |
1088d |
1090d
|
3/3 |
1083d |
4d2db379fd33
Ensure that the disk has been initialized after acquiring the lock and not before as we might end up sleeping while acquiring the lock, introducing a potential race.
|
panic: malloc: allocation too large, type = NUM, size = ADDR
|
C |
|
|
3 |
1089d |
1090d
|
3/3 |
1083d |
0b7f5aec6317
Let malloc return an error as opposed of panicking when sysctl kern.shminfo.shmseg is set to something ridiculously large.
|
openbsd build error (15)
|
|
|
|
37 |
1085d |
1146d
|
3/3 |
1083d |
revert vnode: remove VLOCKSWORK and check locking when vop_islocked != nullop (both kernel and userland bits)
|
assert "suser(curproc) == NUM" failed in dt_dev.c
|
C |
|
|
7 |
1084d |
1084d
|
3/3 |
1084d |
cf997a482905
Remove useless suser assert from dt(4). The ioctl(2) path checks the user anyway and close(2) may crash after setuid(2). Reported-by: syzbot+90e094f33d329fb2c3ab@syzkaller.appspotmail.com OK deraadt@
|
uvm_fault: uvm_fault_lower
|
C |
|
|
583 |
1085d |
1089d
|
3/3 |
1084d |
f08b8e936de9
Do not try to unlock a NULL object.
|
kernel: integer divide fault trap, code=NUM
|
syz |
|
|
2 |
1097d |
1098d
|
3/3 |
1089d |
38bfd041cb0f
fix zero division found by syzkaller. The sanity checks in pf(4) ioctls are not powerful enough to detect invalid port ranges (or even invalid rules). syzkaller does not use pfctl(8), it uses ioctl(2) to pass some random chunk of memory as a rule to pf(4). Fix adds explicit check for 0 divider to pf_get_transaddr(). It should make syzkaller happy without disturbing anyone else.
|
uvm_fault: igmp_leavegroup (2)
|
|
|
|
1 |
1092d |
1092d
|
3/3 |
1089d |
5af2eee02794
Syzkaller found a dereference in igmp_leavegroup() where inm->inm_rti is NULL. It should be set in rti_fill(), but is not if malloc(9) fails. There is no rollback after malloc failure so the field stays uninitialized. The code is only called from ioctl, setsockopt or a task. Malloc should wait instead of failing, otherwise syscalls would be unreliable. While there also put an M_WAIT in the init code. During init malloc must not fail. OK mvs@ Reported-by: syzbot+e22326057ccf34908d78@syzkaller.appspotmail.com
|
uvm_fault: nd6_dad_duplicated (2)
|
|
|
|
76 |
1091d |
1097d
|
3/3 |
1091d |
ce9bd2eccc20
nd6_dad_ns_input() could trigger a NULL deref in nd6_dad_duplicated(). It checks dp in two of three places. One check got lost in revision 1.83. Do a dp == NULL once at the beginning. OK jsg@ Reported-by: syzbot+88c0ce914a0b10b7e1c8@syzkaller.appspotmail.com
|
witness: userret: ioctl (2)
|
|
|
|
1 |
1098d |
1098d
|
3/3 |
1097d |
aa5628258068
Add missing kernel unlock in error path.
|
panic: rw_enter: dklk locking against myself
|
C |
|
|
6 |
1159d |
1187d
|
3/3 |
1155d |
placing the same vnd underneath a vnd (with VNDIOCSET) is a lock violation, but other circumstances are also bad, so let's block all vnd on top of vnd. While here, fix some toctou multiple-copyin of the path, and restructure the ioctl defer all softc updates to the end. ok mpi
|
multicore test error: timed out (2)
|
|
|
|
66 |
1169d |
1171d
|
3/3 |
1169d |
11ad9ee57f54
regen
|
openbsd build error (14)
|
|
|
|
2 |
1172d |
1172d
|
3/3 |
1169d |
11ad9ee57f54
regen
|
openbsd test error: timed out (2)
|
|
|
|
33 |
1169d |
1171d
|
3/3 |
1169d |
11ad9ee57f54
regen
|
multicore build error (13)
|
|
|
|
3 |
1172d |
1172d
|
3/3 |
1169d |
11ad9ee57f54
regen
|
assert "_kernel_lock_held()" failed in uvm_vnode.c
|
|
|
|
4 |
1195d |
1195d
|
3/3 |
1188d |
8e114673a836
vmm(4): grab kernel lock before vmspace init
|
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (3)
|
C |
|
|
2 |
1190d |
1194d
|
3/3 |
1188d |
8e114673a836
vmm(4): grab kernel lock before vmspace init
|
assert "_kernel_lock_held()" failed in uvm_device.c
|
|
|
|
7 |
1194d |
1195d
|
3/3 |
1188d |
8e114673a836
vmm(4): grab kernel lock before vmspace init
|
uvm_fault: rtm_output
|
C |
|
|
14 |
1189d |
1189d
|
3/3 |
1188d |
d2084f835172
Fix NULL pointer dereference introduced by previous commit.
|
panic: vcpulock: lock not held
|
|
|
|
1 |
1195d |
1195d
|
3/3 |
1190d |
5f3d69798ad5
vmm(4): fix vcpu locking issues reported by syzbot
|
panic: lock (rwlock) vcpulock not locked
|
C |
|
|
1 |
1195d |
1195d
|
3/3 |
1190d |
5f3d69798ad5
vmm(4): fix vcpu locking issues reported by syzbot
|
panic: rw_enter: vcpulock locking against myself
|
|
|
|
1 |
1194d |
1194d
|
3/3 |
1190d |
5f3d69798ad5
vmm(4): fix vcpu locking issues reported by syzbot
|
assert "_kernel_lock_held()" failed in uvm_map.c
|
C |
|
|
11 |
1194d |
1195d
|
3/3 |
1192d |
8e114673a836
vmm(4): grab kernel lock before vmspace init
|
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (2)
|
C |
|
|
152 |
1195d |
1915d
|
3/3 |
1194d |
1be9dae600aa
Prevent lock ordering issue by raising ipl level of vcpu_pool to IPL_MPFLOOR.
|
panic: mutex ADDR not held in knote_dequeue
|
C |
|
|
24 |
1277d |
1277d
|
3/3 |
1276d |
baa47be05351
Remember to lock kqueue mutex in filt_timermodify().
|
witness: reversal: lock order data missing
|
C |
|
|
667 |
1306d |
1375d
|
3/3 |
1305d |
8b594b45f4b5
Move ktrfds() below fdpunlock(). This fixes lock order issue between vn_lock(9) and fdplock().
|
panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) solock
|
C |
|
|
4 |
1322d |
1323d
|
3/3 |
1322d |
Revert per-socket `so_lock' rwlock(9) and use it to protect routing (PF_ROUTE) sockets. There is a locking issue with timeouts that needs to be fixed. Requested by deraadt@
|
SYZFAIL: tun: can't open device
|
syz |
|
|
4 |
1376d |
1376d
|
3/3 |
1370d |
43dfcaac64e4
Issuing FIOSETOWN and TIOCSPGRP ioctl commands on a tun(4) device leaks device references causing a hang while trying to remove the same interface since the reference count will never reach zero. Instead of returning, break out of the switch in order to ensure that tun_put() gets called.
|
assert "frag->fr_firstoff[index] != NULL" failed in pf_norm.c
|
syz |
|
|
4 |
1387d |
1407d
|
3/3 |
1385d |
be7274bff2cd
When cutting of the head of an overlapping fragment during pf reassembly, reinsert the fragment into the lookup table with correct index. Reported-by: syzbot+d043455a5346f726f1c4@syzkaller.appspotmail.com OK claudio@
|
kernel: protection fault trap, code=0 (8)
|
syz |
|
|
1348 |
1398d |
1587d
|
3/3 |
1397d |
44a45654aa78
Interface group names must fit into IFNAMSIZ and be unique. But the kernel made the unique check before trunkating with strlcpy(). So there could be two interface groups with the same name. The kif is created by a name lookup. The trunkated names are equal, so there was only one kif owned by both groups. When the groups got destroyed, the single kif was removed twice from the RB tree. Check length of group name before doing the unique check. The empty group name was allowed and is now invalid. Reported-by: syzbot+f47e8296ebd559f9bbff@syzkaller.appspotmail.com OK deraadt@ gnezdo@ anton@ mvs@ claudio@
|
panic: rw_enter: pf_state_lock locking against myself
|
C |
|
|
8 |
1398d |
1398d
|
3/3 |
1398d |
d7220220b7ed
pfsync_state_import() must not be called with the pf state lock held, since the actual modification of the state table is done by a call to pf_state_insert(), which takes the pf state lock itself. Other calls to pfsync_state_import() also only have the pf lock.
|
panic: vrele: v_writecount != 0 (2)
|
C |
|
|
1955 |
1403d |
1404d
|
3/3 |
1403d |
df61468f8652
Revert previous commit. The vnode returned by ptm_vn_open() is open and can not simply be vrele()-ed on error. The code currently depends on closef() to do the cleanup.
|
assert "TAILQ_EMPTY(&kq->kq_head)" failed in kern_event.c
|
C |
|
|
2 |
1413d |
1413d
|
3/3 |
1411d |
715db9d67ba3
kqueue: Fix termination assert
|
uvm_fault: pf_addr_compare
|
C |
|
|
347 |
1418d |
1418d
|
3/3 |
1418d |
c34fe1b3cf88
An invalid packet may not have set src and dst in packet descriptor. Add a NULL check to prevent crash in pflog(4) introduced in previous commit. Reported-by: syzbot+c6d2f2ad34b822bce98a@syzkaller.appspotmail.com
|
uvm_fault: m_copyback
|
|
|
|
69 |
1436d |
1583d
|
3/3 |
1418d |
2cbebc019f52
pflog(4) tried to log the translated packet with rdr-to, nat-to, and af-to addresses and ports applied. Therefore it created a mbuf chain on the stack with a partial copy. This is too complicated for IP options, extension header, NAT46 af-to, and fragmented mbuf chains. It even caused a crash in syzkaller. Usually the length checks in pf_setup_pdesc() rejected the faked mbuf and the goto copy logged the packet unmodified. Remove the pflog_mtap() function and call bpf_mtap_hdr() directly. As the old buggy code was bypassed in most cases, tcpdump(8) output of pflog does not change. Uncondionally log the unmodified packet. Reported-by: syzbot+947e89e06ac3fec187d0@syzkaller.appspotmail.com OK sashan@
|
kernel: double fault trap, code=0 (4)
|
C |
|
|
493 |
1443d |
1700d
|
3/3 |
1429d |
c11d76984715
Syzkaller has found a stack overflow in socket splicing. Broadcast packets were resent through simplex broadcast delivery and socket splicing. Although there is an M_LOOP check in somove(9), it did not take effect. if_input_local() cleared the M_BCAST and M_MCAST flags with m_resethdr(). As if_input_local() is used for broadcast and multicast delivery, it was a mistake to delete them. Keep the M_BCAST and M_MCAST mbuf flags when packets are reinjected into the network stack. Reported-by: syzbot+a43ace363f1b663238f8@syzkaller.appspotmail.com OK anton@; discussed with claudio@
|
kernel: integer divide fault trap, code=0
|
syz |
|
|
4 |
1616d |
1645d
|
3/3 |
1453d |
39c2a1337a94
Reject rules with invalid port ranges
|
openbsd test error: uvm_fault: spllower
|
|
|
|
6 |
1467d |
1467d
|
3/3 |
1460d |
3ba77c9295b2
Revert previous extension of the SCHED_LOCK(), the state isn't passed down.
|
multicore test error: uvm_fault: spllower
|
|
|
|
12 |
1467d |
1467d
|
3/3 |
1460d |
3ba77c9295b2
Revert previous extension of the SCHED_LOCK(), the state isn't passed down.
|
uvm_fault: wsevent_fini (3)
|
C |
|
|
2 |
1466d |
1466d
|
3/3 |
1463d |
996a5b4d63fa
Fix yet another wscons race. In the same subsystem, the following properties must always hold true:
|
no output from test machine (6)
|
C |
|
|
2779 |
1482d |
1504d
|
3/3 |
1482d |
0124df67671a
Fix handling of MSG_PEEK in soreceive() for the case where an empty mbuf is encountered in a seqpacket socket.
|
no output from test machine (5)
|
C |
|
|
49467 |
1504d |
1602d
|
3/3 |
1504d |
d6d1940044d6
Fix a deadlock between uvn_io() and uvn_flush(). While faulting on a page backed by a vnode, uvn_io() will end up being called in order to populate newly allocated pages using I/O on the backing vnode. Before performing the I/O, newly allocated pages are flagged as busy by uvn_get(), that is before uvn_io() tries to lock the vnode. Such pages could then end up being flushed by uvn_flush() which already has acquired the vnode lock. Since such pages are flagged as busy, uvn_flush() will wait for them to be flagged as not busy. This will never happens as uvn_io() cannot make progress until the vnode lock is released.
|
witness: userret: ioctl
|
C |
|
|
3 |
1509d |
1509d
|
3/3 |
1508d |
610c242e11d3
- missing NET_UNLOCK() in pf_ioctl.c error path
|
panic: spl assertion failure in yield
|
C |
|
|
12 |
1637d |
1654d
|
3/3 |
1509d |
- move NET_LOCK() further down in pf_ioctl.c. Also move memory allocations outside of NET_LOCK()/PF_LOCK() scope in easy spots.
|
openbsd build error (11)
|
|
|
|
44 |
1510d |
1515d
|
3/3 |
1510d |
a524e041107f
timeout(9): fix compilation under NKCOV
|
multicore build error (8)
|
|
|
|
88 |
1510d |
1515d
|
3/3 |
1510d |
a524e041107f
timeout(9): fix compilation under NKCOV
|
panic: malloc: allocation too large, type = 98, size = ADDR
|
C |
|
|
2 |
1527d |
1527d
|
3/3 |
1526d |
Recent changes for PROT_NONE pages to not count against resource limits, failed to note this also guarded against heavy amap allocations in the MAP_SHARED case. Bring back the checks for MAP_SHARED from semarie, ok kettenis https://syzkaller.appspot.com/bug?extid=d80de26a8db6c009d060
|
openbsd build error (10)
|
|
|
|
3 |
1548d |
1548d
|
3/3 |
1546d |
Unbreak tree. Instead of passing struct process to siginit() just pass the struct sigacts since that is the only thing that is modified by siginit.
|
multicore build error (7)
|
|
|
|
5 |
1547d |
1548d
|
3/3 |
1546d |
Unbreak tree. Instead of passing struct process to siginit() just pass the struct sigacts since that is the only thing that is modified by siginit.
|
panic: syn_cache_insert: cacheoverflow: impossible (2)
|
C |
|
|
6 |
1583d |
1628d
|
3/3 |
1560d |
7c72bba2fa26
Convert tcp_sysctl to sysctl_bounded_args
|
assert "curproc->p_kd == NULL" failed in kcov.c (2)
|
|
|
|
1 |
1573d |
1573d
|
3/3 |
1560d |
ece33e2f6ca2
Before clearing the kcov descriptor associated with a thread make sure no other thread is currently within a remote section. Otherwise, the remote subsystem could end up in a broken state where it doesn't reset the necessary bits upon leaving the remote section.
|
assert "curproc->p_kd == NULL" failed in kcov.c
|
|
|
|
2 |
1577d |
1579d
|
3/3 |
1577d |
2fa3abdda1a4
When detaching common remote coverage, do not clear any fields. Instead, let kr_free() do the work. Otherwise a thread currently inside a remote section could end up not decrementing the number of ongoing sections while exiting the same remote section.
|
uvm_fault: pfi_address_add
|
syz |
|
|
1359 |
1598d |
1654d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
pool: free list modified: phpool
|
|
|
|
1 |
1628d |
1628d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
panic: sbdrop
|
syz |
|
|
183 |
1589d |
1888d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
uvm_fault: soreceive
|
syz |
|
|
240 |
1597d |
1863d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
panic: ifa_update_broadaddr does not support dynamic length (2)
|
|
|
|
13 |
1591d |
1741d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
uvm_fault: in6ifa_ifpforlinklocal
|
|
|
|
1 |
1643d |
1643d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
uvm_fault: pool_do_put (2)
|
syz |
|
|
53 |
1598d |
1842d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
kernel: protection fault trap, code=0 (7)
|
syz |
|
|
774692 |
1587d |
1831d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
uvm_fault: in_delmulti
|
syz |
|
|
375431 |
1587d |
1873d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
panic: tcp_output: template len != hdrlen - optlen
|
syz |
|
|
487 |
1589d |
1901d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
soreceive 1a
|
syz |
|
|
510 |
1589d |
1746d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
uvm_fault (2)
|
syz |
|
|
1 |
1640d |
1640d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
pool: cpu free list modified: mbufpl
|
syz |
|
|
15863 |
1587d |
1874d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
pool: free list modified: art_heap4 (2)
|
|
|
|
4 |
1629d |
1660d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
soreceive 3
|
syz |
|
|
755 |
1587d |
1746d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
uvm_fault: vio_rxeof
|
syz |
|
|
15700 |
1597d |
1908d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
uvm_fault: ifa_update_broadaddr
|
|
|
|
3275 |
1597d |
1842d
|
3/3 |
1587d |
efa3c3dd644f
Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
|
multicore build error (6)
|
|
|
|
4 |
1593d |
1606d
|
3/3 |
1590d |
Revert r1.170. dlg and jmatthew simultaneously fixed this the correct way.
|
openbsd build error (9)
|
|
|
|
1 |
1606d |
1606d
|
3/3 |
1590d |
Revert r1.170. dlg and jmatthew simultaneously fixed this the correct way.
|
uvm_fault: wsevent_fini (2)
|
|
|
|
1 |
1614d |
1614d
|
3/3 |
1593d |
25f2901d1c23
Fix yet another panic in which wsevent_fini() ends up being called with NULL. This one is a race caused by clearing the me_evp member before calling routines that could end up sleeping.
|
no output from test machine (3)
|
C |
|
|
25293 |
1608d |
1623d
|
3/3 |
1608d |
A pty write containing VDISCARD, VREPRINT, or various retyping cases of VERASE would perform (sometimes irrelevant) compute in the kernel which can be heavy (especially with our insufficient tty subsystem locking). Use tsleep_nsec for 1 tick in such circumstances to yield cpu, and also bring interruptability to ptcwrite() https://syzkaller.appspot.com/bug?extid=462539bc18fef8fc26cc ok kettenis millert, discussions with greg and anton
|
panic: unhandled af (2)
|
C |
|
|
22 |
1626d |
1651d
|
3/3 |
1625d |
38e8113e1d44
state import should accept AF_INET/AF_INET6 only
|
panic: syn_cache_insert: bucketoverflow: impossible
|
C |
|
|
5 |
1637d |
1656d
|
3/3 |
1634d |
2b10bfc1e665
Refuse to set 0 or a negative value for net.inet.tcp.synbucketlimit.
|
panic: syn_cache_insert: cacheoverflow: impossible
|
|
|
|
5 |
1634d |
1653d
|
3/3 |
1634d |
2b10bfc1e665
Refuse to set 0 or a negative value for net.inet.tcp.synbucketlimit.
|
no output from test machine
|
C |
|
|
551400 |
1676d |
2251d
|
3/3 |
1676d |
7bb4371dccb1
Do not wait indefinitely for flushing when closing a tty.
|
panic: m_copydata: null mbuf
|
C |
|
|
396 |
1680d |
1867d
|
3/3 |
1677d |
574b3a4fa98d
Do sanity checks in ip6_pullexthdr() preventing a panic in m_copydata(9).
|
assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c
|
|
|
|
1 |
1742d |
1742d
|
3/3 |
1691d |
8e6c5245c1d8
Never update the ND entry (cache) corresponding to a RTF_LOCAL route.
|
uvm_fault: pfi_dynaddr_remove
|
C |
|
|
17 |
1800d |
1805d
|
3/3 |
1693d |
3d97bff14298
fix insufficient input sanitization in pf_rulecopyin() and pf_pool_copyin()
|
uvm_fault: pfr_detach_table
|
C |
|
|
12 |
1800d |
1803d
|
3/3 |
1693d |
3d97bff14298
fix insufficient input sanitization in pf_rulecopyin() and pf_pool_copyin()
|
openbsd build error (8)
|
|
|
|
2 |
1699d |
1699d
|
3/3 |
1699d |
20c8eb7cf336
Add bse(4) device to unbreak build.
|
multicore build error (5)
|
|
|
|
4 |
1699d |
1699d
|
3/3 |
1699d |
20c8eb7cf336
Add bse(4) device to unbreak build.
|
panic: rw_enter: netlock locking against myself
|
syz |
|
|
2 |
1705d |
1705d
|
3/3 |
1701d |
27427a72e313
In sosplice(), temporarily release the socket lock before calling FRELE() as the last reference could be dropped which in turn will cause soclose() to be called where the socket lock is unconditionally acquired. Note that this is only a problem for sockets protected by the non-recursive NET_LOCK() right now.
|
assert "p == curproc" failed in vfs_vops.c
|
C |
|
|
187 |
1714d |
1714d
|
3/3 |
1711d |
fc5a743df3a9
Revert previous, syzkaller found a way to trigger the KASSERT().
|
uvm_fault: strlcpy (2)
|
|
|
|
1 |
1722d |
1722d
|
3/3 |
1715d |
9fcf6ed4d02d
Prevent out of bounds read in strlcpy due to vcp_name not being NUL-terminated.
|
panic: vputonfreelist: lock count is not zero
|
C |
|
|
2 |
1746d |
1746d
|
3/3 |
1717d |
2a9890d8c8d9
Relax the lockcount assertion in vputonfreelist(). Back when I fixed several problems with the vnode exclusive lock implementation, I overlooked the fact that a vnode can be in a state where the usecount is zero while the holdcount still being positive. There could still be threads waiting on the vnode lock in uvn_io() as long as the holdcount is positive.
|
uvm_fault: wsevent_fini
|
|
|
|
1 |
1726d |
1726d
|
3/3 |
1720d |
be78d62e13f6
Ensure that me_evp is still NULL before assignment during open of wscons devices. This condition is checked early on during open but since the same routine could end up sleeping before assigning me_evp, a race against adding the same wscons device to a wsmux could be lost. This in turn can cause a NULL deference during close.
|
kernel: double fault trap, code=0 (3)
|
C |
|
|
69 |
1733d |
1742d
|
3/3 |
1733d |
aa1987fe7ce4
Fix unlimited recursion caused by local outbound bcast/mcast packet sent via spliced socket.
|
pool: free list modified: aobjpl
|
C |
|
|
3 |
1830d |
1842d
|
3/3 |
1740d |
c5a231fb6c1e
Grab a reference for the shared memory segment before calling uvm_map() as the same function could end up putting the thread to sleep. Allowing another thread to free the shared memory segment, which in turns causes a use-after-free.
|
openbsd boot error: uvm_fault: softclock
|
|
|
|
33 |
1742d |
1743d
|
3/3 |
1741d |
previous commit accidentally aliased two unique timeouts hit by millert
|
multicore boot error: uvm_fault: softclock
|
|
|
|
66 |
1742d |
1743d
|
3/3 |
1741d |
previous commit accidentally aliased two unique timeouts hit by millert
|
kqueue: knote !QUEUED
|
syz |
|
|
8 |
1757d |
1793d
|
3/3 |
1757d |
8c4786361ce1
Raise SPL when updating kn_status. Otherwise the field can become inconsistent if knote_acquire() or knote_release() is preempted by an interrupt that modifies the same knote.
|
panic: unhandled af
|
C |
|
|
21 |
1800d |
1802d
|
3/3 |
1796d |
4804479228fb
Check address family of pf ioctl(2) DIOCNATLOOK parameter at kernel entry instead of calling panic() due to unhandled af. Reported-by: syzbot+92be143c2dd1746cf2af@syzkaller.appspotmail.com from Benjamin Baier
|
panic: attempt to execute user address
|
syz |
|
|
1539 |
1806d |
1900d
|
3/3 |
1802d |
f30ff743e528
Fix some races in kqueue_register().
|
witness: reversal: vmmaplk inode
|
C |
|
|
103124 |
1817d |
2145d
|
3/3 |
1817d |
Use separate rwlock initializations for userland ("vmspace") and kernel maps. This lets witness know that these really are different classes avoiding false positives when detecting lock order reversals.
|
kernel: protection fault trap, code=0 (6)
|
C |
|
|
55024 |
1831d |
1915d
|
3/3 |
1831d |
0f83bb56e561
Fix a bad offset calculation in uvm_share.
|
panic: uvm_mapent_clone: no space in map for entry in empty map
|
C |
|
|
12 |
1832d |
1837d
|
3/3 |
1831d |
0f83bb56e561
Fix a bad offset calculation in uvm_share.
|
panic: amap_pp_adjref: negative reference count
|
C |
|
|
98 |
1841d |
1894d
|
3/3 |
1831d |
0f83bb56e561
Fix a bad offset calculation in uvm_share.
|
uvm_fault: amap_pp_adjref
|
|
|
|
1 |
1894d |
1894d
|
3/3 |
1831d |
0f83bb56e561
Fix a bad offset calculation in uvm_share.
|
uvm_fault: uvm_unmap_remove (2)
|
C |
|
|
7836 |
1831d |
1915d
|
3/3 |
1831d |
3c82c0b2df98
Fix uvm_unmap_remove panic when tearing down VMs.
|
panic: uvmspace_fork: no space in map for entry in empty map
|
C |
|
|
450 |
1839d |
1894d
|
3/3 |
1831d |
0f83bb56e561
Fix a bad offset calculation in uvm_share.
|
assert "TAILQ_EMPTY(&ifp->if_addrhooks)" failed in if.c
|
|
|
|
2 |
1852d |
1853d
|
3/3 |
1847d |
9e254176dfa1
take care to avoid a race when creating the same interface.
|
panic: ifa_update_broadaddr does not support dynamic length
|
syz |
|
|
6780 |
1858d |
1916d
|
3/3 |
1858d |
b36fd3da6fde
Do propper kernel input validation for in_control() ioctl(2) SIOCGIFADDR, SIOCGIFNETMASK, SIOCGIFDSTADDR, SIOCGIFBRDADDR, SIOCSIFADDR, SIOCSIFNETMASK, SIOCSIFDSTADDR, and SIOCSIFBRDADDR. Name in_ioctl_set_ifaddr() consistently. Use in_sa2sin() to validate inet address. Combine if_addrlist loops and add comment. Although netmask is not a inet address, length must be valid. Reported-by: syzbot+5fc6da002fc4e8d994be@syzkaller.appspotmail.com OK visa@
|
pool: free list modified: shmpl
|
C |
|
|
22 |
2014d |
2108d
|
3/3 |
1867d |
d13730a27993
Copy in the user-supplied buffer in shmctl(2) before looking up the shared memory segment. Otherwise, if copyin ends up sleeping it allows another thread to remove the same segment leading to a use-after-free.
|
malloc: free list modified: devbuf
|
syz |
|
|
5 |
1875d |
1881d
|
3/3 |
1875d |
put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
|
uvm_fault: kqueue_scan
|
|
|
|
1 |
1897d |
1897d
|
3/3 |
1875d |
put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
|
uvm_fault: witness_checkorder
|
syz |
|
|
2 |
1877d |
1877d
|
3/3 |
1875d |
put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
|
uvm_fault: filt_bpfrdetach
|
syz |
|
|
1 |
1875d |
1875d
|
3/3 |
1875d |
put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
|
uvm_fault: bpfioctl
|
C |
|
|
14 |
1882d |
1966d
|
3/3 |
1875d |
put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
|
assert "ps->ps_uvncount == 0" failed in kern_unveil.c
|
syz |
|
|
226 |
1902d |
2169d
|
3/3 |
1895d |
a239dbafd306
Only increment the ps_uvncount counter when a path is successfully added to the corresponding red-black tree; meaning the path was not already present in the tree. This prevents an assertion to trigger in unveil_destroy() later on when the process exits.
|
assert "ln != NULL" failed in nd6.c
|
|
|
|
1 |
1921d |
1921d
|
3/3 |
1898d |
bdbfbec5cea8
Do more sanity checks when accepting socket addresses in routing messages from user land. Inspect length field early in rtm_xaddrs(). Strings must be NUL terminated. The socket address type and length depend on the routing message type. Currently checks are not super strict to avoid too much user land fallout. OK mpi@ Reported-by: syzbot+638dbf7851da8e255af5@syzkaller.appspotmail.com
|
assert "ifa == rt->rt_ifa" failed in nd6.c
|
|
|
|
9 |
1898d |
1899d
|
3/3 |
1898d |
bdbfbec5cea8
Do more sanity checks when accepting socket addresses in routing messages from user land. Inspect length field early in rtm_xaddrs(). Strings must be NUL terminated. The socket address type and length depend on the routing message type. Currently checks are not super strict to avoid too much user land fallout. OK mpi@ Reported-by: syzbot+638dbf7851da8e255af5@syzkaller.appspotmail.com
|
uvm_fault: strlcpy
|
|
|
|
18 |
1905d |
2026d
|
3/3 |
1903d |
bdbfbec5cea8
Do more sanity checks when accepting socket addresses in routing messages from user land. Inspect length field early in rtm_xaddrs(). Strings must be NUL terminated. The socket address type and length depend on the routing message type. Currently checks are not super strict to avoid too much user land fallout. OK mpi@ Reported-by: syzbot+638dbf7851da8e255af5@syzkaller.appspotmail.com
|
uvm_fault: uvm_unmap_remove
|
C |
|
|
780 |
1915d |
1934d
|
3/3 |
1915d |
00ba8250173b
vm_teardown() must be serialized since it modifies the global vmm_softc structure. Therefore grab the appropriate lock before calling the same function. This issue has been known for a while and reported before but lacking a way to easily reproduce it; until syzkaller came up with a reproducer.
|
panic: malloc: allocation too large, type = 2, size = ADDR (2)
|
C |
|
|
16842 |
1916d |
1934d
|
3/3 |
1916d |
225e50e8a961
Do not decrement the number of VMs counter twice in one of vm_create() error paths. If creation of the first VM fails, the counter will wrap around to a huge value. The same value could later be passed to malloc() through vm_get_info() causing a panic.
|
kernel: protection fault trap, code=0 (5)
|
C |
|
|
607 |
1922d |
1996d
|
3/3 |
1922d |
a42056240bd9
Fix a route use after free in IPv6 multicast route. Move the mrt6_mcast6_del() out of the rtable_walk(). This avoids recursion to prevent stack overflow. Also it allows freeing the route outside of the walk. Now mrt6_mcast_del() frees the route only when it is deleted from the routing table. If that fails, it must not be freed. After the route is returned by mf6c_find(), it is reference counted. Then we need a rtfree(), but not in the other case. Name mrt6_mcast_add() and mrt6_mcast_del() consistently. Move rt_timer_remove_all() into mrt6_mcast_del(). Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com OK mpi@
|
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock
|
|
|
|
33 |
1931d |
1935d
|
3/3 |
1930d |
d3f3cb99fa83
Do not use the flow of the first fragment to store ECN information. Handle the ECN in the fragment queue. Reported-by: syzbot+0aa80b25e9041001cac8@syzkaller.appspotmail.com fix from FreeBSD; OK claudio@
|
uvm_fault: frag6_input
|
|
|
|
24 |
1931d |
1935d
|
3/3 |
1930d |
d3f3cb99fa83
Do not use the flow of the first fragment to store ECN information. Handle the ECN in the fragment queue. Reported-by: syzbot+0aa80b25e9041001cac8@syzkaller.appspotmail.com fix from FreeBSD; OK claudio@
|
witness: userret: returning with the following locks held:
|
C |
|
|
315 |
1931d |
2141d
|
3/3 |
1931d |
b808994cf339
When a thread tries to exclusively lock a vnode, the same thread must ensure that any other thread currently trying to acquire the underlying vnode lock has observed that the same vnode is about to be exclusively locked. Such threads must then sleep until the exclusive lock has been released and then try to acquire the lock again. Otherwise, exclusive access to the vnode cannot be guaranteed.
|
panic: vput: ref cnt
|
C |
|
|
6 |
1944d |
1946d
|
3/3 |
1943d |
d627fa5cc364
Serialize access to the vnode pointers associated with acct(2) system accounting. Prevents a race where the acct thread and the acct(2) syscall both tries to close a vnode.
|
assert "timo || _kernel_lock_held()" failed in kern_synch.c
|
C |
|
|
2 |
1945d |
1945d
|
3/3 |
1945d |
93e05fce3bab
Revert unlock of lseek(2) since vn_lock() could end up calling tsleep() which is not allowed without holding the kernel lock. Otherwise, wakeups could be lost.
|
panic: vrele: v_writecount != 0
|
C |
|
|
51 |
1952d |
1958d
|
3/3 |
1952d |
3e253b4759f0
Favor vn_close() in the error path of diskmapioctl() since side-effects caused by calling vn_open() with write permissions must be reverted. Otherwise, the vfs subsystem could panic while releasing the last vnode reference if the writecount is still positive.
|
panic: vput: v_writecount != 0 (2)
|
C |
|
|
112 |
1953d |
1958d
|
3/3 |
1952d |
3e253b4759f0
Favor vn_close() in the error path of diskmapioctl() since side-effects caused by calling vn_open() with write permissions must be reverted. Otherwise, the vfs subsystem could panic while releasing the last vnode reference if the writecount is still positive.
|
assert "cpipe->pipe_buffer.cnt == 0" failed in sys_pipe.c
|
C |
|
|
8 |
1979d |
1980d
|
3/3 |
1979d |
40f8ed5eebb0
backout the unlock of pipe(2) and pipe2(2)
|
kernel: protection fault trap, code=0 (4)
|
C |
|
|
759 |
1997d |
2110d
|
3/3 |
1996d |
cf34c7c30780
Prevent recursions by not deleting entries inside rtable_walk(9).
|
uvm_fault: arp_rtrequest
|
C |
|
|
79 |
2016d |
2026d
|
3/3 |
2005d |
4cb088386ee5
In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag is set. These mpls routes use the rt_llinfo structure to store the MPLS label and would confuse the arp and nd6 code. OK bluhm@ anton@
|
assert "(rt->rt_flags & RTF_MPATH) || mrt->rt_priority != prio" failed in rtable.c
|
C |
|
|
143 |
2016d |
2030d
|
3/3 |
2005d |
ff10691ed095
Copy the user provided sockaddr into a normalized sockaddr in rtrequest() before adding it to the routing table. The rtable code is doing memcmp() of those rt_dest sockaddrs so it is important that they are stored in a canonical form. To do this struct domain is extended to include the sockaddr size for this address family. OK bluhm@ anton@
|
uvm_fault: mrt6_ioctl
|
C |
|
|
2 |
2026d |
2026d
|
3/3 |
2014d |
a8f2b5c7d3d3
Add missing NULL check for the protocol control block (pcb) pointer in mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL.
|
uvm_fault: mrt_ioctl
|
C |
|
|
2 |
2015d |
2015d
|
3/3 |
2014d |
a8f2b5c7d3d3
Add missing NULL check for the protocol control block (pcb) pointer in mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL.
|
uvm_fault: pckbc_start (2)
|
syz |
|
|
2 |
2027d |
2027d
|
3/3 |
2015d |
bc79b6e32eb3
Prevent corruption of the pckbc command queue. If multiple synchronous commands are in flight and all corresponding threads are sleeping waiting for a response, the first command to timeout will clear the command queue. The remaining threads once awake will then try to remove a dequeued command from the queue, leading to corruption. Instead, remove commands from the queue before waking up the sleeping thread. A quirk is still needed to handle the case where tsleep() returns successfully during suspend.
|
assert "_kernel_lock_held()" failed in kern_event.c
|
C |
|
|
11 |
2046d |
2048d
|
3/3 |
2016d |
1be240a95e4a
Removed all diagnostic, calling printf() here might create a recursion.
|
witness: reversal: &pr->ps_mtx &sched_lock
|
C |
|
|
141 |
2017d |
2018d
|
3/3 |
2017d |
17b25159f963
Revert to using the SCHED_LOCK() to protect time accounting.
|
uvm_fault: wsmux_do_ioctl (4)
|
C |
|
|
3 |
2030d |
2055d
|
3/3 |
2028d |
78fe050fe549
A problem fixed in wskbd is also present in wsmux. Repeating the previous commit message:
|
panic: malloc: out of space in kmem_map
|
|
|
|
97 |
2080d |
2145d
|
3/3 |
2029d |
During fuzzing, one or many fuzzing processes are often stuck waiting on memory from the subproc malloc subsystem which is exhausted. Attempt to circumvent such scenarios by allocation the kcov coverage buffer using km_alloc() instead.
|
uvm_fault: rtm_report
|
C |
|
|
2 |
2054d |
2054d
|
3/3 |
2038d |
1b18c0494f67
Make rt_mpls_set() be more strict in what it accepts. Also ensure that the RTF_MPLS can't be toggled without rt_mpls_set() being called. While RTF_MPLS is part of RTF_FMASK it should be excluded from the flags and mask when they are applied to the route since toggling it requires a call to rt_mpls_set(). OK bluhm@
|
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1
|
|
|
|
36 |
2039d |
2040d
|
3/3 |
2038d |
fbb8d265a895
Restore previous behavior of limiting deadlock detection to posix-style locks.
|
multicore build error (3)
|
|
|
|
4 |
2043d |
2043d
|
3/3 |
2042d |
always rearm completion queues as leaving them disarmed would lead to rx or tx completion stalling.
|
openbsd build error (5)
|
|
|
|
2 |
2043d |
2043d
|
3/3 |
2042d |
always rearm completion queues as leaving them disarmed would lead to rx or tx completion stalling.
|
panic: timeout_add: to_ticks < 0 (3)
|
|
|
|
1 |
2066d |
2066d
|
3/3 |
2054d |
1af424413523
Lower the accepted upper bound for bd_rtout to INT_MAX in order to prevent passing negative values to timeout_add().
|
panic: mtx ADDR: locking against myself
|
C |
|
|
3 |
2059d |
2060d
|
3/3 |
2058d |
vmm(4): remove a debug printf that was causing lock issues (it was being called from an IPI routine).
|
panic: timeout_add: to_ticks < 0 (2)
|
syz |
|
|
12 |
2076d |
2078d
|
3/3 |
2076d |
bf2018479c9a
Reject negative and too large timeouts passed to BIOCSRTIMEOUT. Since the timeout converted to ticks is later passed timeout_add(), it could cause a panic if the timeout is negative.
|
uvm_fault: rtable_satoplen (2)
|
syz |
|
|
101 |
2079d |
2088d
|
3/3 |
2076d |
575ef11475ca
Add a more strict rtm_hdrlen size check. Make sure that at least struct rt_msghdr bytes are passed in. Also return a failure from rtm_xaddrs() if rti_addrs has bad flags or run out of space. Ok bluhm@
|
uvm_fault: memcpy
|
C |
|
|
460 |
2079d |
2099d
|
3/3 |
2079d |
575ef11475ca
Add a more strict rtm_hdrlen size check. Make sure that at least struct rt_msghdr bytes are passed in. Also return a failure from rtm_xaddrs() if rti_addrs has bad flags or run out of space. Ok bluhm@
|
panic: malloc: allocation too large, type = 2, size = ADDR
|
C |
|
|
914 |
2080d |
2143d
|
3/3 |
2080d |
fd7c80607c62
Restrict the number of allowed wsmux devices, just like wskbd and wsmouse already does. Otherwise, malloc could panic if the device minor is sufficiently large.
|
openbsd build error (2)
|
|
|
|
1 |
2084d |
2084d
|
3/3 |
2084d |
6baecefef8fe
Tweak previous: include <sys/stdint.h> for INT64_MAX/INT64_MIN.
|
assert "tname->un_flags & UNVEIL_USERSET" failed in kern_unveil.c
|
C |
|
|
1447 |
2084d |
2086d
|
3/3 |
2084d |
f4c23aa848ae
Remove this assert, I can't do this here with UNVEIL_INSPECT added aggressively today. Hopefully post release a glorious flensing will remove UNVEIL_INSPECT anyway
|
uvm_fault: rtable_satoplen
|
|
|
|
158 |
2089d |
2106d
|
3/3 |
2088d |
fab4809e7ec2
Make sure pointer is within bounds before dereferencing it.
|
witness: acquiring duplicate lock of same type: "&sc->sc_lock"
|
C |
|
|
231 |
2118d |
2120d
|
3/3 |
2118d |
1f8a38b155bf
When adding a wsmux device to an existing wsmux device using ioctl(WSMUXIO_ADD_DEVICE), two distinct locks of the same type are acquired. Thus, witness will emit warning. Since acquiring two different locks of the same type is harmless in this context, relax the witness check by flagging the locks as RWL_DUPOK.
|
panic: timeout_add: to_ticks < 0
|
C |
|
|
66 |
2118d |
2123d
|
3/3 |
2118d |
3cfc9cae129c
Reject negative input from userland in spkrioctl(). One of the arguments are later passed to timeout_add() which panics if the given ticks are negative. While here, clamp arguments in pcppi_bell() in order to prevent overflow.
|
uvm_fault: pckbc_start
|
|
|
|
1 |
2120d |
2120d
|
3/3 |
2119d |
0c0bf6318018
Serialize access to the list of attached child devices belonging to a wsmux. When invoking wsevsrc_* functions on a attached child device, underlying driver can sleep; this introduces a race where another thread is able to modify the list leading to all kinds of corruptions.
|
uvm_fault: wsmux_detach_sc
|
syz |
|
|
10 |
2122d |
2134d
|
3/3 |
2120d |
0c0bf6318018
Serialize access to the list of attached child devices belonging to a wsmux. When invoking wsevsrc_* functions on a attached child device, underlying driver can sleep; this introduces a race where another thread is able to modify the list leading to all kinds of corruptions.
|
panic: vmmaplk: lock not shared
|
C |
|
|
16 |
2131d |
2143d
|
3/3 |
2131d |
Always refault if relocking maps fails after IO. This fixes a regression
|
panic: pool_p_free: semupl free list modified: page ADDR; item addr ADDR; offset 0x0=ADDR
|
C |
|
|
5 |
2131d |
2251d
|
3/3 |
2131d |
When freeing the sem_undo structure in semundo_adjust(), update the
|
pool: free list modified: semupl
|
C |
|
|
6 |
2137d |
2251d
|
3/3 |
2131d |
When freeing the sem_undo structure in semundo_adjust(), update the
|
pool: double put: mbufpl
|
|
|
|
6 |
2197d |
2198d
|
3/3 |
2131d |
Avoid an mbuf double free in the oob soreceive() path. In the
|
uvm_fault: wsmux_do_ioctl (2)
|
C |
|
|
17 |
2139d |
2143d
|
3/3 |
2137d |
In wskbdclose(), use the same logic as in wskbdopen() to determine if
|
kernel: protection fault trap, code=0 (3)
|
C |
|
|
3 |
2143d |
2143d
|
3/3 |
2142d |
Validate the user-supplied device index given to WSMUXIO_ADD_DEVICE. The same
|
uvm_fault: VOP_ACCESS
|
|
|
|
393 |
2147d |
2189d
|
3/3 |
2147d |
namei can return a null dvp on success. check this before access.
|
kernel: protection fault trap, code=0 (2)
|
syz |
|
|
109 |
2148d |
2172d
|
3/3 |
2148d |
Introduce a dedicated entry point data structure for file locks. This new data
|
panic: malformed IPv4 option passed to ip_optcopy (2)
|
C |
|
|
149 |
2153d |
2157d
|
3/3 |
2150d |
Bring back the ip_pcbopts() refactor. Pad the option buffer and therefor the mbuf to the next word length as it is required by the standard. Also use the correct offset from the input mbuf. OK visa@, input & OK bluhm@
|
panic: uvm_fault_unwire_locked: address not in map
|
C |
|
|
2 |
2175d |
2175d
|
3/3 |
2159d |
Hold a read lock on the map while doing the actual device I/O during in
|
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c
|
C |
|
|
2 |
2174d |
2174d
|
3/3 |
2159d |
Hold a read lock on the map while doing the actual device I/O during in
|
panic: malformed IPv4 option passed to ip_optcopy
|
C |
|
|
10 |
2173d |
2182d
|
3/3 |
2162d |
Validate the version, and all length fields of IP packets passed to a raw socket
|
panic: m_zero: M_READONLY
|
C |
|
|
3 |
2167d |
2168d
|
3/3 |
2162d |
It is possible to call m_zero with a read-only cluster. In that case just
|
assert "__mp_lock_held(&sched_lock, curcpu()) == 0" failed in kern_lock.c
|
C |
|
|
17 |
2164d |
2176d
|
3/3 |
2163d |
ec412da11be4
Fix unsafe use of ptsignal() in mi_switch().
|
uvm_fault: m_free
|
|
|
|
12 |
2174d |
2197d
|
3/3 |
2164d |
54e30ac1a804
Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
|
pool: free list modified: mbufpl
|
syz |
|
|
13 |
2183d |
2197d
|
3/3 |
2164d |
54e30ac1a804
Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
|
panic: pr_find_pagehead: mbufpl: incorrect page
|
|
|
|
3 |
2177d |
2193d
|
3/3 |
2164d |
54e30ac1a804
Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
|
panic: pool_cache_item_magic_check: mcl64k cpu free list modified: item addr ADDR+24 ADDR!=ADDR
|
|
|
|
1 |
2194d |
2194d
|
3/3 |
2164d |
54e30ac1a804
Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
|
uvm_fault: switchread
|
|
|
|
1 |
2192d |
2192d
|
3/3 |
2164d |
54e30ac1a804
Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
|
uvm_fault: switchwrite
|
syz |
|
|
7 |
2174d |
2194d
|
3/3 |
2164d |
54e30ac1a804
Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
|
panic: pool_cache_item_magic_check: mbufpl cpu free list modified: item addr ADDR+16 0x0!=ADDR
|
|
|
|
1 |
2184d |
2184d
|
3/3 |
2166d |
54e30ac1a804
Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
|
panic: pr_find_pagehead: mbufpl: page header missing
|
C |
|
|
10 |
2183d |
2196d
|
3/3 |
2172d |
Fix mbuf releated crashes in switch(4). They have been found by
|
pool: free list modified: mcl2k
|
C |
|
|
4 |
2181d |
2235d
|
3/3 |
2180d |
Replace a wrong poor mans m_trailingspace() with the real thing. The mbuf
|
panic: receive 3: so ADDR, so_type 1, m ADDR, m_type 6
|
C |
|
|
18 |
2183d |
2192d
|
3/3 |
2182d |
When using MSG_WAITALL, soreceive() can sleep while processing the receive buffer of a stream socket. Then a new pair of control and data mbuf can be appended to the mbuf queue. In this case, terminate the loop with a short read to prevent a panic. Userland should read the control message with the next system call. OK claudio@ deraadt@
|
panic: kernel diagnostic assertion "M_DATABUF(m) + M_SIZE(m) >= (m->m_data + m->m_len)" failed: file "/syzkaller/manager
|
C |
|
|
7 |
2192d |
2197d
|
3/3 |
2182d |
49729d6ed45f
In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees the inpcb apart from the disconnect. Just call soisdisconnected() and clear the inp->inp_faddr since the socket is still valid after a disconnect. Problem found by syzkaller via Greg Steuck OK visa@ Fixes: Reported-by: syzbot+2cd350dfe5c96f6469f2@syzkaller.appspotmail.com Reported-by: syzbot+139ac2d7d3d60162334b@syzkaller.appspotmail.com Reported-by: syzbot+02168317bd0156c13b69@syzkaller.appspotmail.com Reported-by: syzbot+de8d2459ecf4cdc576a1@syzkaller.appspotmail.com
|
pool: double put: lockfpl
|
|
|
|
1 |
2259d |
2251d
|
3/3 |
2182d |
Rework previous lockf fix; bluhm@ noticed a regress failure during consecutive runs. This is a second attempt in which the lockf structure is turned into a doubly linked list which makes it easier to ensure correctness during list insertion and deletion.
|
uvm_fault: killjobc
|
|
|
|
1 |
2187d |
2187d
|
3/3 |
2182d |
When no child devices are attached to a wsmux device, make sure to return an
|
uvm_fault: wsmux_do_ioctl
|
|
|
|
2 |
2212d |
2251d
|
3/3 |
2182d |
Utilize sigio with wscons. The old behavior of always making the process group of the process who opens the device the default recipient of sigio is removed as a side-effect of this change. Issuing ioctl(FIOSETOWN) is therefore mandatory in order to receive sigio, which is more consistent with other subsystems supporting sigio.
|
uvm_fault: sogetopt
|
C |
|
|
2 |
2199d |
2199d
|
1/3 |
2196d |
In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
|
kernel: protection fault trap, code=0
|
C |
|
|
16 |
2197d |
2201d
|
1/3 |
2196d |
In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
|
uvm_fault: ip_ctloutput
|
C |
|
|
11 |
2197d |
2200d
|
1/3 |
2196d |
In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
|
uvm_fault: ip_pcbopts
|
C |
|
|
6 |
2197d |
2200d
|
1/3 |
2196d |
In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
|