Bug 369361

Summary: vmsplice syscall wrapper crashes on bad iovec
Product: [Developer tools] valgrind Reporter: Mark Wielaard <mark>
Component: generalAssignee: Julian Seward <jseward>
Status: RESOLVED FIXED    
Severity: normal    
Priority: NOR    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:
Attachments: Fix crash in vmsplice linux kernel wrapper when iovec is bad

Description Mark Wielaard 2016-09-25 22:23:54 UTC
LTP testcases/kernel/syscalls/vmsplice/vmsplice02 crashes valgrind:
==32085== Syscall param vmsplice(iov) points to unaddressable byte(s)
==32085==    at 0x4F2C173: __vmsplice_nocancel (syscall-template.S:81)
==32085==    by 0x4028BC: vmsplice_verify (vmsplice02.c:119)
==32085==    by 0x4028BC: main (vmsplice02.c:83)
==32085==  Address 0x615000 is not stack'd, malloc'd or (recently) free'd
==32085== 
==32085== Syscall param vmsplice(iov[...]) points to unaddressable byte(s)
==32085==    at 0x4F2C173: __vmsplice_nocancel (syscall-template.S:81)
==32085==    by 0x4028BC: vmsplice_verify (vmsplice02.c:119)
==32085==    by 0x4028BC: main (vmsplice02.c:83)
==32085==  Address 0x800000007 is not stack'd, malloc'd or (recently) free'd
==32085== 
--32085-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--32085-- si_code=1;  Faulting address: 0x615000;  sp: 0x80327ad70

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==32085==    at 0x380B71DC: vgSysWrap_linux_sys_vmsplice_before (syswrap-linux.c:5301)
==32085==    by 0x38092CDF: vgPlain_client_syscall (syswrap-main.c:1906)
==32085==    by 0x3808F8B2: handle_syscall (scheduler.c:1118)
==32085==    by 0x38090E76: vgPlain_scheduler (scheduler.c:1435)
==32085==    by 0x380A027A: thread_wrapper (syswrap-linux.c:103)
==32085==    by 0x380A027A: run_a_thread_NORETURN (syswrap-linux.c:156)



Reproducible: Always
Comment 1 Mark Wielaard 2016-09-25 22:25:25 UTC
Created attachment 101289 [details]
Fix crash in vmsplice linux kernel wrapper when iovec is bad
Comment 2 Mark Wielaard 2016-10-01 11:58:56 UTC
valgrind svn r15993