uvm_fault: sys_futimens
syzbot
syzbot found the following issue on:
HEAD commit: a536f3ad0739 Prevent read buffer overflow in verbose debug..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1500e279580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=6e70d84bb3eb0e521f97
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4f0d2f40c66a/disk-a536f3ad.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/7e716d795bb2/bsd-a536f3ad.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/359185b08762/kernel-a536f3ad.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6e70d8...@syzkaller.appspotmail.com
�j���|����E1\�: uvm_fault(0xffffee007ee64200, 0x98, 0, 1) -> e
kernel: page fault trap, code=0
--db_more-- Stopped at dovutimens+0x368: movl 0x98(%rax),%r12d
--db_more-- TID PID UID PRFLAGS PFLAGS CPU COMMAND
--db_more-- 407893 9728 0 0 0 0 syz-executor
--db_more-- *109035 9728 0 0 0x4000000 1K syz-executor
--db_more-- dovutimens(ffff80003c3e9a18,ffffee00693c3480,ffff80003b3b1b10) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691
sys_futimens(ffff80003c3e9a18,ffff80003b3b1c60,ffff80003b3b1bb0) at sys_futimens+0xb3 sys/kern/vfs_syscalls.c:2767
syscall(ffff80003b3b1c60) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003b3b1c60) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
--db_more-- Xsyscall() at Xsyscall+0x128
--db_more-- end of kernel
--db_more-- end trace frame: 0x4c0f0b39e0, count: 11
--db_more-- https://www.openbsd.org/ddb.html describes the minimum info required in bug
--db_more-- reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}> s = 0
uvm_fault(0xffffee007ee64200, 0x98, 0, 1) -> e
kernel: page fault trap, code=0
--db_more-- Stopped at dovutimens+0x368: movl 0x98(%rax),%r12d
--db_more-- dovutimens(ffff80003c3e9a18,ffffee00693c3480,ffff80003b3b1b10) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691
--db_more-- sys_futimens(ffff80003c3e9a18,ffff80003b3b1c60,ffff80003b3b1bb0) at sys_futimens+0xb3 sys/kern/vfs_syscalls.c:2767
--db_more-- syscall(ffff80003b3b1c60) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
--db_more-- syscall(ffff80003b3b1c60) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
--db_more-- end trace frame: 0x4c0f0b39e0, count: 11
ddb{1}> maxwidth = 0
No such command
ddb{1}> show panic
*cpu1: uvm_fault(0xffffee007ee64200, 0x98, 0, 1) -> e
ddb{1}> show kasan
No such command
ddb{1}> trace
dovutimens(ffff80003c3e9a18,ffffee00693c3480,ffff80003b3b1b10) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691
sys_futimens(ffff80003c3e9a18,ffff80003b3b1c60,ffff80003b3b1bb0) at sys_futimens+0xb3 sys/kern/vfs_syscalls.c:2767
--db_more--
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
syzkaller-o...@googlegroups.com.
***
Subject: duplicate of uvm_fault: dovutimens
Author: gne...@cvs.openbsd.org
#syz dup: uvm_fault: dovutimens
Same defect as https://syzkaller.appspot.com/bug?extid=5c4d0d721f4b850a14d6
dovutimens() in sys/kern/vfs_syscalls.c dereferences a NULL vp->v_mount.
Opening a D_CLONE character device (/dev/bpf) returns a vnode built by
getnewvnode(VT_NON, NULL, ...), so v_mount is NULL from birth; futimens() or
futimes() on that descriptor then reads mnt_flag off it. open("/dev/bpf")
plus futimens() is the entire trigger.
Every sampled crash report of this bug faults at dovutimens+0x368
(vfs_syscalls.c:2691), at address 0x98 on the multicore and setuid kernels
(bigger WITNESS mnt_lock) or 0x70 on main, entered from sys_futimens or
sys_futimes.
The separate titles are a titler artifact rather than separate bugs: on MP,
ddb attaches to an arbitrary CPU, and syzkaller titled these uvm_fault reports
from ddb's "Stopped at" line, which names whichever CPU ddb landed on.