Bug 369361 - vmsplice syscall wrapper crashes on bad iovec
Summary: vmsplice syscall wrapper crashes on bad iovec
Status: RESOLVED FIXED
Alias: None
Product: valgrind
Classification: Developer tools
Component: general (other bugs)
Version First Reported In: unspecified
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Julian Seward
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-09-25 22:23 UTC by Mark Wielaard
Modified: 2016-10-01 11:58 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments
Fix crash in vmsplice linux kernel wrapper when iovec is bad (1.39 KB, patch)
2016-09-25 22:25 UTC, Mark Wielaard
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Wielaard 2016-09-25 22:23:54 UTC
LTP testcases/kernel/syscalls/vmsplice/vmsplice02 crashes valgrind:
==32085== Syscall param vmsplice(iov) points to unaddressable byte(s)
==32085==    at 0x4F2C173: __vmsplice_nocancel (syscall-template.S:81)
==32085==    by 0x4028BC: vmsplice_verify (vmsplice02.c:119)
==32085==    by 0x4028BC: main (vmsplice02.c:83)
==32085==  Address 0x615000 is not stack'd, malloc'd or (recently) free'd
==32085== 
==32085== Syscall param vmsplice(iov[...]) points to unaddressable byte(s)
==32085==    at 0x4F2C173: __vmsplice_nocancel (syscall-template.S:81)
==32085==    by 0x4028BC: vmsplice_verify (vmsplice02.c:119)
==32085==    by 0x4028BC: main (vmsplice02.c:83)
==32085==  Address 0x800000007 is not stack'd, malloc'd or (recently) free'd
==32085== 
--32085-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--32085-- si_code=1;  Faulting address: 0x615000;  sp: 0x80327ad70

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==32085==    at 0x380B71DC: vgSysWrap_linux_sys_vmsplice_before (syswrap-linux.c:5301)
==32085==    by 0x38092CDF: vgPlain_client_syscall (syswrap-main.c:1906)
==32085==    by 0x3808F8B2: handle_syscall (scheduler.c:1118)
==32085==    by 0x38090E76: vgPlain_scheduler (scheduler.c:1435)
==32085==    by 0x380A027A: thread_wrapper (syswrap-linux.c:103)
==32085==    by 0x380A027A: run_a_thread_NORETURN (syswrap-linux.c:156)



Reproducible: Always
Comment 1 Mark Wielaard 2016-09-25 22:25:25 UTC
Created attachment 101289 [details]
Fix crash in vmsplice linux kernel wrapper when iovec is bad
Comment 2 Mark Wielaard 2016-10-01 11:58:56 UTC
valgrind svn r15993