Issue #3049 has been reported by open.sou...@ribose.com. ---------------------------------------- Bug #3049: panic DragonFly v4.8.1-RELEASE by mounting a malformed msdosfs image [12.128] http://bugs.dragonflybsd.org/issues/3049
* Author: open.sou...@ribose.com * Status: New * Priority: Normal * Assignee: * Category: Kernel * Target version: Latest stable ---------------------------------------- It is possible to panic DragonFly v4.8.1-RELEASE by mounting a malformed msdosfs image. The malformed msdosfs is attached to this issue and the image can also be found at the github URL at the bottom of this message. # kgdb kern.1 vmcore.1 GNU gdb (GDB) 7.6.1 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-dragonfly". For bug reporting instructions, please see: <http://bugs.dragonflybsd.org/>... Reading symbols from /var/crash/kern.1...done. Unread portion of the kernel message buffer: Copyright (c) 2003-2017 The DragonFly Project. Copyright (c) 1992-2003 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. DragonFly v4.8.1-RELEASE #5: Tue Aug 1 23:19:38 EDT 2017 r...@www.shiningsilence.com:/usr/obj/home/justin/release/4_8/sys/X86_64_GENERIC i8254 clock: 1193197 Hz TSC invariant clock: 2294696856 Hz CPU: Intel(R) Core(TM) i7-4850HQ CPU @ 2.30GHz (2294.70-MHz K8-class CPU) Origin = "GenuineIntel" Id = 0x40661 Stepping = 1 Features=0x783fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2> Features2=0x56d8220b<SSE3,PCLMULQDQ,MON,SSSE3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AESNI,XSAVE,AVX,RDRND> AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM> AMD Features2=0x21<LAHF,ABM> Structured Extended Features=0x2000 real memory = 132709376 (126 MB) avail memory = 81620992 (77 MB) lapic: divisor index 0, frequency 500004517 Hz srat_probe: can't locate SRAT SMI Frequency (worst case): 22727 Hz (44 us) Initialize MI interrupts TSC: cputimer freq 71709276, shift 5 VMM: VMX is not supported by this Intel CPU wdog: In-kernel automatic watchdog reset enabled kbd1 at kbdmux0 md0: Malloc disk interrupt uses mplock: swi_taskq ACPI: RSDP 0x00000000000E0000 000024 (v02 VBOX ) ACPI: XSDT 0x0000000007FF0030 00003C (v01 VBOX VBOXXSDT 00000001 ASL 00000061) ACPI: FACP 0x0000000007FF00F0 0000F4 (v04 VBOX VBOXFACP 00000001 ASL 00000061) ACPI: DSDT 0x0000000007FF0470 0021C8 (v02 VBOX VBOXBIOS 00000002 INTL 20100528) ACPI: FACS 0x0000000007FF0200 000040 ACPI: FACS 0x0000000007FF0200 000040 ACPI: APIC 0x0000000007FF0240 000054 (v02 VBOX VBOXAPIC 00000001 ASL 00000061) ACPI: SSDT 0x0000000007FF02A0 0001CC (v01 VBOX VBOXCPUT 00000002 INTL 20100528) cryptosoft0: <software crypto> on motherboard aesni0: <AES-CBC,AES-XTS> on motherboard padlock0: No ACE support. rdrand0: <RdRand RNG> on motherboard acpi0: <VBOX VBOXXSDT> on motherboard ACPI: Executed 1 blocks of module-level executable AML code ACPI: 2 ACPI AML tables successfully acquired and loaded ACPI FADT: SCI testing interrupt mode ... ACPI FADT: SCI select level/high acpi0: Power Button (fixed) acpi0: Sleep Button (fixed) acpi_timer0 on acpi0 pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0 pci0: <ACPI PCI bus> on pcib0 isab0: <PCI-ISA bridge> at device 1.0 on pci0 isa0: <ISA bus> on isab0 atapci0: <Intel PIIX4 UDMA33 controller> port 0xd000-0xd00f,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0 ata0: <ATA channel 0> on atapci0 interrupt uses mplock: ata0 ad0: 16384MB <VBOX HARDDISK 1.0> at ata0-master UDMA33 ata1: <ATA channel 1> on atapci0 interrupt uses mplock: ata1 acd0: DVDROM <VBOX CD-ROM/1.0> at ata1-master UDMA33 vgapci0: <VGA-compatible display> mem 0xe0000000-0xe0ffffff irq 18 at device 2.0 on pci0 vgapci0: Boot video device em0: <Intel(R) PRO/1000 Network Connection 82540EM 7.4.2> port 0xd010-0xd017 mem 0xf0000000-0xf001ffff irq 19 at device 3.0 on pci0 em0: MAC address: 08:00:27:b2:31:f4 pci0: <base peripheral> (vendor 0x80ee, dev 0xcafe) at device 4.0 irq 20 ohci0: <Apple KeyLargo/Intrepid USB controller> mem 0xf0804000-0xf0804fff irq 22 at device 6.0 on pci0 usbus0 on ohci0 pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 7.0 irq 23 usbus0: 12Mbps Full Speed USB v1.0 ehci0: <Intel 82801FB (ICH6) USB 2.0 controller> mem 0xf0805000-0xf0805fff irq 19 at device 11.0 on pci0 usbus1: EHCI version 1.0 ugen0.1: <Apple> at usbus0 uhub0: <Apple OHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus0 usbus1 on ehci0 battery0: <ACPI Control Method Battery> on acpi0 acpi_acad0: <AC Adapter> on acpi0 atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0 atkbd0: <AT Keyboard> irq 1 on atkbdc0 kbd0 at atkbd0 usbus1: 480Mbps High Speed USB v2.0 ugen1.1: <Intel> at usbus1 uhub1: <Intel EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus1 psm0: <PS/2 Mouse> irq 12 on atkbdc0 interrupt uses mplock: psm0 psm0: model IntelliMouse Explorer, device ID 4 cpu0: <ACPI CPU> on acpi0 cpu_cst0: <ACPI CPU C-State> on cpu0 ACPI: Enabled 2 GPEs in block 00 to 07 orm0: <ISA Option ROMs> at iomem 0xc0000-0xc7fff,0xe2000-0xe2fff on isa0 pmtimer0 on isa0 vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0 sc0: <System console> at flags 0x500 on isa0 sc0: VGA <16 virtual consoles, flags=0x300> sio0: can't drain, serial port might not exist, disabling sio1: can't drain, serial port might not exist, disabling hpt27xx: no controller detected. CAM: Configuring 2 busses uhub0: 12 ports with 12 removable, self powered CAM: finished configuring all busses cd0 at ata1 bus 0 target 0 lun 0 cd0: <VBOX CD-ROM 1.0> Removable CD-ROM SCSI-0 device cd0: 33.000MB/s transfers cd0: Attempt to query device size failed: NOT READY, Medium not present uhub1: 12 ports with 12 removable, self powered no B_DEVMAGIC (bootdev=0) Mounting root from ufs:serno/VB72453a18-bfd99f8c.s1d DMA space used: 160k, remaining available: 1248k Mounting devfs <118>Loading configuration files. <118>Loading devfs rules: <118> /etc/defaults/devfs.conf <118>. <118>Initializing random seed: <118>done. <118>dumpon: crash dumps to /dev/ad0s1b (21, 0x20001) <118>Starting file system checks: <118>/dev/serno/VB72453a18-bfd99f8c.s1d: <118>FILESYSTEM CLEAN; SKIPPING CHECKS <118>/dev/serno/VB72453a18-bfd99f8c.s1d: <118>clean, 11946365 free <118>(2773 frags, 1492949 blocks, 0.0% fragmentation) <118>/dev/serno/VB72453a18-bfd99f8c.s1a: <118>FILESYSTEM CLEAN; SKIPPING CHECKS <118>/dev/serno/VB72453a18-bfd99f8c.s1a: <118>clean, 438163 free <118>(155 frags, 54751 blocks, 0.0% fragmentation) <118>Setting hostname: foobar.localdomain. <118>starting dhclient on em0 <118>lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 <118> options=43<RXCSUM,TXCSUM,RSS> <118> inet 127.0.0.1 netmask 0xff000000 <118> inet6 ::1 prefixlen 128 <118> inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 <118>em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 <118> options=1b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING> <118> inet6 fe80::a00:27ff:feb2:31f4%em0 prefixlen 64 tentative scopeid 0x1 <118> ether 08:00:27:b2:31:f4 <118> media: Ethernet autoselect <rxpause> (none) <118> status: no carrier <118>Additional routing options: <118>. <118>Starting devd. <118>Mounting NFS file systems: <118>. <118>Building databases... <118>Starting syslogd. <118>Aug 14 21:04:14 foobar syslogd: kernel boot file is /boot/kernel/kernel <118>No core dumps found. swap low/high-water marks set to 16760/25140 <118>swapon: adding /dev/serno/VB72453a18-bfd99f8c.s1b as swap device <118>ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/perl5 <118>Id Refs Name <118>208 1 nfs <118>NFS CLIENT: <118> access_cache_timeout=5 <118> neg_cache_timeout=3 <118>. <118>Starting local daemons: <118>. <118>Updating motd. <118>Configuring syscons: <118> blanktime <118>. <118>Starting sshd. <118>sendmail_submit: /etc/mail/aliases.db not present, generating <118>newaliases: no recipients <118>sendmail_clientmqueue: /etc/mail/aliases.db not present, generating <118>newaliases: no recipients <118>Starting cron. <118>Local package initialization: <118>. <118>Additional TCP options: <118>. <118>Mon Aug 14 21:04:15 HKT 2017 panic: getblk: size(98304) > MAXBSIZE(65536) cpuid = 0 Trace beginning at frame 0xffffff8051d782b8 panic() at panic+0x236 0xffffffff805e5e66 panic() at panic+0x236 0xffffffff805e5e66 getblk() at getblk+0x519 0xffffffff80651e39 breadnx() at breadnx+0x266 0xffffffff80652156 fillinusemap() at fillinusemap+0x1b4 0xffffffff80687cd4 msdosfs_mount() at msdosfs_mount+0xc39 0xffffffff8068a829 Debugger("panic") CPU0 stopping CPUs: 0x00000000 stopped Physical memory: 87 MB Dumping 1106 MB: 1091 1075 1059 1043 1027 1011 995 979 963 947 931 915 899 883 867 851 835 819 803 787 771 755 739 723 707 691 675 659 643 627 611 595 579 563 547 531 515 499 483 467 451 435 419 403 387 371 355 339 323 307 291 275 259 243 227 211 195 179 163 147 131 115 99 83 67 51 35 19 3 [New kernel syncer14] [New pid 966/0, mount_msdos] [New pid 965/0, mount] [New pid 957/0, csh] [New pid 951/0, sshd] [New pid 512/0, syslogd] [New pid 411/0, dhclient] [New pid 944/0, getty] [New pid 943/0, getty] [New pid 942/0, getty] [New pid 941/0, getty] [New pid 940/0, getty] [New pid 938/0, getty] [New pid 939/0, getty] [New pid 937/0, getty] [New kernel syscons7] [New kernel syscons6] [New kernel syscons5] [New kernel syscons4] [New kernel syscons3] [New kernel syscons2] [New kernel syscons1] [New pid 841/0, cron] [New pid 818/0, sshd] [New pid 436/0, devd] [New pid 289/0, dhclient] [New pid 288/0, dhclient] [New kernel syncer13] [New kernel syncer12] [New kernel syncer5] [New kernel syscons255] [New kernel syncer4] [New pid 1/0, init] [New kernel consttyd] [New kernel vnlru] [New kernel bufdaemon_hw] [New kernel bufdaemon] [New kernel vmdaemon] [New kernel swapcached] [New kernel pagedaemon] [New kernel syncer3] [New kernel unp taskq] [New kernel random] [New kernel syncer2] [New kernel syncer1] [New kernel ithread12 0] [New kernel ithread1 0] [New kernel usbus1] [New kernel usbus1] [New kernel usbus1] [New kernel usbus1] [New kernel usbus0] [New kernel usbus0] [New kernel usbus0] [New kernel usbus0] [New kernel ithread22 0] [New kernel ithread19 0] [New kernel ithread15 0] [New kernel ithread14 0] [New kernel ithread9 0] [New kernel acpi_task] [New kernel ithread197 0] [New kernel ithread195 0] [New kernel xpt_thrd] [New kernel crypto returns] [New kernel crypto 0] [New kernel firmware taskq] [New kernel sensors 0] [New kernel taskq_cpu 0] [New kernel ifnet 0] [New kernel disk_msg_core] [New kernel netisr_cpu 0] [New kernel devfs_msg_core] [New kernel dsched 0] [New kernel usched 0] [New kernel usched 0] [New kernel ithread196 0] [New kernel ithreadE 0] [New kernel softclock 0] [New pid 0/0, swapper] [New kernel idle_0] Reading symbols from /boot/kernel/acpi.ko...(no debugging symbols found)...done. Loaded symbols for /boot/kernel/acpi.ko Reading symbols from /boot/kernel/ehci.ko...(no debugging symbols found)...done. Loaded symbols for /boot/kernel/ehci.ko Reading symbols from /boot/kernel/xhci.ko...(no debugging symbols found)...done. Loaded symbols for /boot/kernel/xhci.ko _get_mycpu () at ./machine/thread.h:69 69 ./machine/thread.h: No such file or directory. (kgdb) bt #0 _get_mycpu () at ./machine/thread.h:69 #1 panic (fmt=fmt@entry=0xffffffff80b2f300 "getblk: size(%d) > MAXBSIZE(%d)") at /home/justin/release/4_8/sys/kern/kern_shutdown.c:833 #2 0xffffffff80651e39 in getblk (vp=<optimized out>, loffset=32768, size=98304, blkflags=0, slptimeo=<optimized out>) at /home/justin/release/4_8/sys/kern/vfs_bio.c:2803 #3 0xffffffff80652156 in breadnx (vp=0xffffff8051aa0e60, loffset=<optimized out>, size=<optimized out>, raoffset=raoffset@entry=0x0, rabsize=rabsize@entry=0x0, cnt=cnt@entry=0, bpp=0xffffff8051d78450) at /home/justin/release/4_8/sys/kern/vfs_bio.c:938 #4 0xffffffff80687cd4 in bread (bpp=0xffffff8051d78450, size=<optimized out>, loffset=<optimized out>, vp=<optimized out>) at /home/justin/release/4_8/sys/sys/buf2.h:356 #5 fillinusemap (pmp=pmp@entry=0xffffff80493e9740) at /home/justin/release/4_8/sys/vfs/msdosfs/msdosfs_fat.c:904 #6 0xffffffff8068a829 in mountmsdosfs (argp=0xffffff8051d78580, mp=0xffffff804eb1ddc0, devvp=0xffffff8051aa0e60) at /home/justin/release/4_8/sys/vfs/msdosfs/msdosfs_vfsops.c:590 #7 msdosfs_mount (mp=0xffffff804eb1ddc0, path=<optimized out>, data=<optimized out>, cred=0xffffff8040749d48) at /home/justin/release/4_8/sys/vfs/msdosfs/msdosfs_vfsops.c:280 #8 0xffffffff8067cefa in vfs_mount (mp=0xffffff804eb1ddc0, path=0x7fffffffe210 <Address 0x7fffffffe210 out of bounds>, data=0x7fffffffe6a0 <Address 0x7fffffffe6a0 out of bounds>, cred=0xffffff8040749d48) at /home/justin/release/4_8/sys/kern/vfs_vfsops.c:93 #9 0xffffffff806729fd in sys_mount (uap=<optimized out>) at /home/justin/release/4_8/sys/kern/vfs_syscalls.c:380 #10 0xffffffff80a5c786 in syscall2 (frame=0xffffff8051d789f8) at /home/justin/release/4_8/sys/platform/pc64/x86_64/trap.c:1228 #11 0xffffffff80a4428b in Xfast_syscall () at /home/justin/release/4_8/sys/platform/pc64/x86_64/exception.S:323 #12 0x000000000000002b in ?? () Backtrace stopped: previous frame inner to this frame (corrupt stack?) (kgdb) A copy of the malformed msdosfs image + the above kgdb output can be found here: https://github.com/riboseinc/fuzzbsd/tree/master/results/dragonflybsd_4.8.1/msdos/12 This submission is in response to the Ribose Retrace Challenge. The Bug Challenge encourages finding bugs (any bug AND security vulnerabilities) in well-known software (OSS / proprietary) using retrace (https://github.com/riboseinc/retrace). ---Files-------------------------------- image-fuzzbsd-msdos-12.128 (1.41 MB) kgdb.txt (12.7 KB) -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account