duplicate of uvm_fault: dovutimens

[Greg Steuck]

#syz dup: uvm_fault: dovutimens

Same defect as https://syzkaller.appspot.com/bug?extid=5c4d0d721f4b850a14d6

dovutimens() in sys/kern/vfs_syscalls.c dereferences a NULL vp->v_mount.
Opening a D_CLONE character device (/dev/bpf) returns a vnode built by
getnewvnode(VT_NON, NULL, ...), so v_mount is NULL from birth; futimens() or
futimes() on that descriptor then reads mnt_flag off it. open("/dev/bpf")
plus futimens() is the entire trigger.

Every sampled crash report of this bug faults at dovutimens+0x368
(vfs_syscalls.c:2691), at address 0x98 on the multicore and setuid kernels
(bigger WITNESS mnt_lock) or 0x70 on main, entered from sys_futimens or
sys_futimes.

The separate titles are a titler artifact rather than separate bugs: on MP,
ddb attaches to an arbitrary CPU, and syzkaller titled these uvm_fault reports
from ddb's "Stopped at" line, which names whichever CPU ddb landed on.

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]

[Greg Steuck]