Date: Sun, 27 Jan 2008 18:41:36 GMT From: Patrick Lamaiziere <patpr@davenulle.org> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/120055: kdump segfaults on freebsd6_mmap syscall Message-ID: <200801271841.m0RIfaO2065209@www.freebsd.org> Resent-Message-ID: <200801271850.m0RIo0tQ030617@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 120055
>Category: misc
>Synopsis: kdump segfaults on freebsd6_mmap syscall
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Jan 27 18:50:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Patrick Lamaiziere
>Release: RELENG_7_0
>Organization:
>Environment:
FreeBSD roxette.lamaiziere.net 7.0-RC1 FreeBSD 7.0-RC1 #0: Fri Jan 25 18:06:03 CET 2008 patrick@roxette.lamaiziere.net:/usr/obj/usr/src/sys/ROXETTE i386
>Description:
kdump crashs with a segfault when dumping the content of the syscall freebsd6_mmap :
$ kdump
69472 bash CALL freebsd6_mmap(0x3,0xbfbfdeb8,<invalid>672202704,MAP_SHARED|[CUT],0,0,...
<SEGFAULT>
I've inserted some printf() in /usr/src/usr.bin/kdump/kdump.c and the problem is that ktr->narg is equal to 3 when ktrsyscall() is called for this syscall.
Line 305,/usr/src/usr.bin/kdump/kdump.c
void
ktrsyscall(struct ktr_syscall *ktr)
{
int narg = ktr->ktr_narg;
register_t *ip;
[CUT]
#ifdef SYS_freebsd6_mmap
} else if (ktr->ktr_code == SYS_freebsd6_mmap) {
print_number(ip,narg,c);
print_number(ip,narg,c);
(void)putchar(',');
mmapprotname ((int)*ip);
(void)putchar(',');
ip++;
narg--;
mmapflagsname ((int)*ip);
ip++;
narg--;
Here narg = -1 because the macro print_number() decrements narg.
So a after, it loops until it segfaults:
[CUT]
while (narg) {
print_number(ip,narg,c);
}
(void)putchar(')');
For a fix, a "while (narg>0)" will be safer but i don't know if this is a bug on the call, a bug on ktrace or only a bug in kdump.
Regards.
>How-To-Repeat:
The krace.out (gziped) can be found here :
http://user.lamaiziere.net/patrick/ktrace.out.gz
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200801271841.m0RIfaO2065209>