vmx(4) driver causes kernel panic

Issue #1 closed
Takehiko NOZAKI repo owner created an issue

vmx(4) driver w/i386 kernel causes kernel panic on cvs update(maybe double m_freem() bug). patch-vmx.png

NetBSD-current has same problem. NetBSD-i386-vmx-panic.png

Comments (5)

  1. Takehiko NOZAKI reporter

    the bug was introduced due to careless about m_defrag's prototype difference between OpenBSD and NetBSD.

    • OpenBSD -- int m_defrag(struct mbuf *, int)
    • NetBSD -- struct mbuf m_defrag(struct mbuf , int)

    so, following code doesn't work as the author expected, and causes double free mbuf bug.

        case EFBIG:
            if (m_defrag(m, M_DONTWAIT) == 0 &&
                bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
                 BUS_DMA_NOWAIT) == 0)
            /* FALLTHROUGH */
            return -1;

    analyzed by me and tsutsui@, thanks.

  2. Log in to comment