misc/120055: kdump segfaults on freebsd6_mmap syscall

[Patrick Lamaiziere]

>Number:         120055
>Category:       misc
>Synopsis:       kdump segfaults on freebsd6_mmap syscall
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jan 27 18:50:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Patrick Lamaiziere
>Release:        RELENG_7_0
>Organization:
>Environment:
FreeBSD roxette.lamaiziere.net 7.0-RC1 FreeBSD 7.0-RC1 #0: Fri Jan 25 18:06:03 CET 2008     patrick at roxette.lamaiziere.net:/usr/obj/usr/src/sys/ROXETTE  i386

>Description:
kdump crashs with a segfault when dumping the content of the syscall freebsd6_mmap :

$ kdump
 69472 bash     CALL freebsd6_mmap(0x3,0xbfbfdeb8,<invalid>672202704,MAP_SHARED|[CUT],0,0,...
<SEGFAULT>

I've inserted some printf() in /usr/src/usr.bin/kdump/kdump.c and the problem is that ktr->narg is equal to 3 when ktrsyscall() is called for this syscall.

Line 305,/usr/src/usr.bin/kdump/kdump.c
void
ktrsyscall(struct ktr_syscall *ktr)
{
   int narg = ktr->ktr_narg;
   register_t *ip;
[CUT]
#ifdef SYS_freebsd6_mmap
   } else if (ktr->ktr_code == SYS_freebsd6_mmap) {
             print_number(ip,narg,c);
             print_number(ip,narg,c);
             (void)putchar(',');
             mmapprotname ((int)*ip);
             (void)putchar(',');
             ip++;
             narg--;
             mmapflagsname ((int)*ip);
             ip++;
             narg--;

Here narg = -1 because the macro print_number() decrements narg.
So a after, it loops until it segfaults:
[CUT]
  while (narg) {
                 print_number(ip,narg,c);
               }
 (void)putchar(')');

For a fix, a "while (narg>0)" will be safer but i don't know if this is a bug on the call, a bug on ktrace or only a bug in kdump.

Regards.
>How-To-Repeat:
The krace.out (gziped) can be found here :

http://user.lamaiziere.net/patrick/ktrace.out.gz
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: