Re: kern/56900: panic in uvm_map_findspace

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

The following reply was made to PR kern/56900; it has been noted by GNATS.

From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/56900: panic in uvm_map_findspace
Date: Sun, 26 Jun 2022 21:14:45 +0000

 syzbot found a reproducer for what is probably the same problem:
 
 https://syzkaller.appspot.com/bug?id=3De542bcf59b2564cca1cb38c12f076fb08dca=
 c37e
 
 The crux of the reproducer at
 
 https://syzkaller.appspot.com/text?tag=3DReproC&x=3D136e190bf00000
 
 is:
 
   syscall(SYS_compat_43_ommap, 0x20ffd000ul, 0x20ffd000ul, 0ul, 2ul, -1, 0u=
 l);
 
 Using compat_43_ommap instead of mmap is probably not particularly
 significant here; most likely there is just some edge case in the
 uvm_map_findspace logic that we're missing -- really, the whole of
 uvm_map_findspace is a twisty maze of sharp edge cases waiting to
 impale unwary passersby, and the whole thing should be reorganized
 more coherently with assertions of invariants.