DF-4106 / panic.txt
df4106: *** A2: DOUBLE FREE: m0=0xfffff8011eae8800 and m1=0xfffff8011eae8a00 are passed to m_freem() twice — once in the head chain, once in the RX-list loop ***
df4106: vge_stop: m_freem(head chain 0xfffff8011eae8800)
df4106: vge_stop: m_freem(rx_mbuf[0]=0xfffff8011eae8800)
df4106: vge_stop: m_freem(rx_mbuf[1]=0xfffff8011eae8a00)
df4106: vge_stop: m_freem(rx_mbuf[2]=0xfffff8011eaf0600)
df4106: vge_stop: m_freem(rx_mbuf[3]=0xfffff8011eaf0400)
df4106: A: releasing pool, alias scan
df4106: *** [A] ALIAS CONFIRMED: allocations #1244 and #1246 returned the SAME mbuf 0xfffff8011eae8a00 (cluster 0xfffff8011d64e800) — one kernel object with two live owners (double free materialized) ***
df4106: [A] 2 aliased allocation(s) found
df4106: ============ SCENARIO B: SOF failure on a completed jumbo, next-walk UAF/theft ============
df4106: B: ring initialized; m0=0xfffff8011dbf9e00 m1=0xfffff8011dbf9c00 m2=0xfffff8011dbf9a00
df4106: drained 33354 mbuf clusters — m_getcl(M_NOWAIT) now FAILS (vge_newbuf ENOBUFS path armed)
df4106: B: dispatch 1 (REAL kernel vge_rxeof)
df4106: [B-after-dispatch1] head=0 tail=0 consumed=1 prodidx=3
df4106: [B-after-dispatch1] slot 0: sts=0x07fc8200 own=0 rx_mbuf=0xfffff8011dbf9e00
df4106: [B-after-dispatch1] slot 1: sts=0x07fc8200 own=0 rx_mbuf=0xfffff8011dbf9c00
df4106: [B-after-dispatch1] slot 2: sts=0000000000 own=0 rx_mbuf=0xfffff8011dbf9a00
df4106: [B-after-dispatch1] slot 3: sts=0x80000000 own=1 rx_mbuf=0xfffff8011eae8800
df4106: *** B: the EOF branch (if_vge.c:1328-1337) m_freem()d the head chain {m0,m1} while the failed SOF newbufs left vge_rx_mbuf[0]=0xfffff8011dbf9e00 (==m0: YES) and rx_mbuf[1]=0xfffff8011dbf9c00 (==m1: YES) DANGLING in the ring ***
df4106: B: unrelated alloc 0 = 0xfffff8011e18a000
df4106: B: unrelated alloc 1 = 0xfffff8011e18a200
df4106: if_input(ifp,0xfffff8011eae8800) chain: [0xfffff8011eae8800 len=1496 fl=0xe003]
df4106: if_input(ifp,0xfffff8011eaf0600) chain: [0xfffff8011eaf0600 len=1496 fl=0xe003]
df4106: if_input(ifp,0xfffff8011eaf0400) chain: [0xfffff8011eaf0400 len=1496 fl=0xe003]
df4106: B: dispatch 2 (ring wrap over dangling entries, REAL kernel vge_rxeof)
df4106: if_input(ifp,0xfffff8011dbf9e00) chain: [0xfffff8011dbf9e00 len=2044 fl=0xe003] [0xfffff8011dbf9c00 len=2040 fl=0xe001]
df4106: [B-after-dispatch2] head=0 tail=0 consumed=3 prodidx=3
df4106: [B-after-dispatch2] slot 0: sts=0000000000 own=0 rx_mbuf=0xfffff8011eaf0400
df4106: [B-after-dispatch2] slot 1: sts=0000000000 own=0 rx_mbuf=0xfffff8011e18a600
df4106: [B-after-dispatch2] slot 2: sts=0000000000 own=0 rx_mbuf=0xfffff8011e18a800
df4106: [B-after-dispatch2] slot 3: sts=0x80000000 own=1 rx_mbuf=0xfffff8011e18a400
df4106: *** B1: unrelated alloc 0 (0xfffff8011e18a000): m_len=0 m_flags=0xe003 — the REAL handler wrote through the dangling ring entry (untouched) ***
df4106: *** B1: unrelated alloc 1 (0xfffff8011e18a200): m_len=0 m_flags=0xe003 — the REAL handler wrote through the dangling ring entry (untouched) ***
df4106: *** B2: a chain containing the freed/stolen mbufs was delivered to ifp->if_input (if_vge.c:1395) — see the if_input chain printout above ***
df4106: vge_stop: m_freem(rx_mbuf[0]=0xfffff8011eaf0400)
df4106: vge_stop: m_freem(rx_mbuf[1]=0xfffff8011e18a600)
df4106: vge_stop: m_freem(rx_mbuf[2]=0xfffff8011e18a800)
df4106: vge_stop: m_freem(rx_mbuf[3]=0xfffff8011e18a400)
df4106: *** [B] ALIAS CONFIRMED: allocations #1184 and #1246 returned the SAME mbuf 0xfffff8011dbf9c00 (cluster 0xfffff8011cbbb800) — one kernel object with two live owners (double free materialized) ***
df4106: [B] 2 aliased allocation(s) found
df4106: === PANIC phase: steer owner B's free through owner A's header ===
df4106: aliased mbuf 0xfffff8011eae8a00: owner A sets m_next := 0x4141414141414141; owner B calls m_freem()
Fatal trap 9: general protection fault while in kernel mode
cpuid = 2; lapic id = 2
instruction pointer = 0x8:0xffffffff806bdcb0
stack pointer = 0x10:0xfffff80116a7e6f8
frame pointer = 0x10:0xfffff80116a7e708
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 1144
current thread = pri 6
kernel: type 9 trap, code=0
CPU2 stopping CPUs: 0x0000003b
stopped
Stopped at m_free+0x10: movswq 0x20(%rdi),%rax
db>