Userland Heap Garbage in Kernel Heap Page
|Reported by:||bonefish||Owned by:||bonefish|
Cf. attached KDL session. Kernel page fault occurred while running the perl test suite. As can be seen in the attachment, there's a complete page of garbage in the entry array of a hash table. The contents looks like it stems from the heap of one of the perl tests (t/TEST or one of its children). The corresponding page looks good though -- it's in the right cache and has no bogus area mappings.
My suspicion would be that e.g. on an exec() a userland heap page has been freed, but not correctly unmapped, so that writes to that virtual address (likely the heap of the exec()ed program) would not cause a page fault and continue to modify that page. At some point the kernel heap would reuse the page and hand out an chunk of memory backed by it. Subsequent writes to the userland heap would then overwrite the contents of this allocation.
Needless to say that I've looked through the involved code and didn't spot a problem. There's still a TODO regarding removing page mappings in delete_cache(), but that looks obsolete to me (mappings and wired_count of the page have been checked a few lines before). There's another TODO in vm_soft_fault() talking about the possibility of mapping a page twice, but that seems unrelated.
I saved the virtual machine state, so if there're any hints what more to examine, I can do that.
Might be related to #1900.
Change History (10)
by , 13 years ago