COMMAND

	kernel

SYSTEMS AFFECTED

	 OpenBSD 2.9

	 OpenBSD 3.0

PROBLEM

	Marco Peereboom found following : while coding in userland,  he  crashes
	down the kernel...
	

	Here is the code :
	

	

	[root@corona src]# cat crashme.c

	#include 

	#include 

	#include 

	#include 

	#include 

	#include 

	#include 

	

	/* globals */

	int fd[8]; /* temp pipe file descriptors */

	int fd_real[4]; /* real pipe\'s */

	

	static int __DEBUG__  = 0;

	static int __SYSLOG__  = 0;

	

	void enable_debug(void)

	{

	         __DEBUG__ = 1;

	}

	

	void disable_debug(void)

	{

	         __DEBUG__ = 0;

	}

	

	void enable_syslog(void)

	{

	         __SYSLOG__ = 1;

	}

	

	void disable_syslog(void)

	{

	         __SYSLOG__ = 0;

	}

	

	void s_fprintf(FILE *file, const char *fmt, ...)

	{

	         va_list ap;

	

	         if (__DEBUG__) {

	                 fflush(file);

	

	                 va_start(ap, fmt);

	                 vfprintf(file, fmt, ap);

	                 va_end(ap);

	

	                 fflush(file);

	         }

	

	         if (__SYSLOG__) {

	                 va_start(ap, fmt);

	                 vsyslog(LOG_INFO, fmt, ap);

	                 va_end(ap);

	         }

	}

	

	void *s_malloc(size_t size)

	{

	         char serr[40]; /* can not allocate more mem so lets use this

	ugly beast */

	         void *p;

	

	         if (__DEBUG__ || __SYSLOG__) {

	                 s_fprintf(stderr, \"PID=%-5i PPID=%-5i: malloc(%i)\\n\",

	getpid(), getppid(), size);

	         }

	

	         if ((p = malloc(size)) == NULL ) {

	                 sprintf(serr,\"PID=%i, Could not allocate memory\",

	getpid());

	                 perror(serr);

	                 exit(6);

	         }

	

	         return p;

	}

	

	void s_perror(const char *str)

	{

	         char *buf;

	

	         if (__DEBUG__ || __SYSLOG__) {

	                 s_fprintf(stderr, \"PID=%-5i PPID=%-5i: perror(%s)\\n\",

	getpid(), getppid(), str);

	         }

	

	         buf = s_malloc(11 + strlen(str)); /* PID=%-5i = 11 chars */

	         sprintf(buf, \"PID=%-5i %s\", getpid(), str);

	         perror(buf);

	

	         free(buf);

	}

	

	void s_pipe(int *fd)

	{

	         if (__DEBUG__ || __SYSLOG__) {

	                 s_fprintf(stderr, \"PID=%-5i PPID=%-5i: pipe(%x)\\n\",

	getpid(), getppid(), (unsigned int)fd);

	         }

	

	         if (pipe(fd) == -1)

	         {

	                 s_perror(\"Could not create pipe\");

	                 exit(3);

	         }

	}

	

	int main(int argc, char **argv)

	{

	         enable_debug();

	         enable_syslog();

	

	         fprintf(stderr, \"Before pipe\\n\");

	         s_pipe(NULL); /* test if s_pipe exits */

	         fprintf(stderr, \"Will never reach this\\n\");

	

	         return 0;

	}

	

	

	

	

SOLUTION

	Marco Peereboom explains :
	

	I tried to debug the kernel and I was partially successful  at  that.  I
	definitively need more practice at BSD kernel debugging  ;)  but  I  did
	find what was wrong. We were releasing the user mode retval  instead  of
	the *real* rval kernel mode values. And since  retval  was  pointing  at
	NULL bad things happened.
	

	Anyway here is the patch for 3.0:
	

	

	[root@corona kern]# diff -u uipc_syscalls.c.old uipc_syscalls.c

	--- uipc_syscalls.c.old Sun Dec  2 10:48:21 2001

	+++ uipc_syscalls.c     Sun Dec  2 10:48:48 2001

	@@ -903,8 +903,8 @@

	         error = copyout((caddr_t)fds, (caddr_t)SCARG(uap, fdp),

	             2 * sizeof (int));

	         if (error) {

	-               fdrelease(p, retval[0]);

	-               fdrelease(p, retval[1]);

	+               fdrelease(p, rval[0]);

	+               fdrelease(p, rval[1]);

	         }

	         return (error);

	  }

	

	

	Here is the patch for 2.9:
	

	

	[root@vuurmuur kern]# diff -u uipc_syscalls.c.old uipc_syscalls.c

	--- uipc_syscalls.c.old Sun Dec  2 11:00:51 2001

	+++ uipc_syscalls.c     Sun Dec  2 11:01:17 2001

	@@ -886,8 +886,8 @@

	         error = copyout((caddr_t)fds, (caddr_t)SCARG(uap, fdp),

	             2 * sizeof (int));

	         if (error) {

	-               fdrelease(p, retval[0]);

	-               fdrelease(p, retval[1]);

	+               fdrelease(p, rval[0]);

	+               fdrelease(p, rval[1]);

	         }

	         return (error);

	  }