[roll] Roll fuchsia [kernel][vm] Fix UAF in PagerProxy

Fix a use-after-free bug in PagerProxy.  Prior to this commit,
PagerProxy would hold a raw const pointer to its PagerDispatcher, even
after the PagerDispatcher had been destroyed.  Now, PagerProxy's
pointer is non-const and is cleared during on_zero_handles (via
PagerProxy::OnDispatcherClose).  See also https://fxbug.dev/498512247

Change pager_ to a non-const pointer.

Set pager_ to null in OnDispatcherClose.

Remove the now redundant pager_dispatcher_closed_ field.

Add const pager_koid_ field so that PagerProxy::GetKoid continues to
function after OZH.  This is a partial revert of
https://fxrev.dev/1337566.

Update Dump to only query the PagerDispatcher name when pager_ is
non-null.

Add regression test.

I have verified that the new test will trigger a kasan panic.

```
[00000.653] 01111:01114> *** Running standalone test directly from userboot ***
[00000.836] 01111:01114> [==========] Flag Values:
[00000.836] 01111:01114>              --gtest_filter = Pager.ProxyUseAfterFree
[00000.836] 01111:01114>              --gtest_shuffle = true
[00000.836] 01111:01114>              --gtest_random_seed = -1
[00000.836] 01111:01114> [==========]
[00000.837] 01111:01114> [==========] Running 1 test from 1 test case.
[00000.837] 01111:01114> [----------] Global test environment set-up.
[00000.837] 01111:01114> [----------] 1 test from Pager
[00000.838] 01111:01114> [ RUN      ] Pager.ProxyUseAfterFree

ZIRCON KERNEL PANIC

UPTIME: 846ms, CPU: 3
Zircon/x64 ELF (EM_X86_64) build ID 7b49f4c67dd7256abbc6341572e457af9f5fba56
zx_system_get_version_string: git-81df98514578575906b4a61a6ac54d7ba239d612-dirty
kernel_debug_level: 2
{{{reset}}}
{{{module:0:vmzircon:elf:7b49f4c67dd7256abbc6341572e457af9f5fba56}}}
{{{mmap:0xffffffff00000000:0x1b3000:load:0:r:0x0}}}
{{{mmap:0xffffffff001b3000:0x5fc000:load:0:rx:0x1b3000}}}
{{{mmap:0xffffffff007af000:0x12000:load:0:r:0x7af000}}}
{{{mmap:0xffffffff007c1000:0x25b000:load:0:rw:0x7c1000}}}
stopping other cpus
halting cpu 1
halting cpu 2
halting cpu 0

KASAN detected a read error: ptr={{{data:0xffffff8041f67bf8}}}, size=0x8, caller: {{{pc:0xffffffff003325c9}}}
Shadow memory state around the buggy address 0xffffffe0083ecf7f:
0xffffffe0083ecf68: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0xffffffe0083ecf70: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0xffffffe0083ecf78: 0x00 0xfa 0xfa 0xfa 0xfa 0xfd 0xfd 0xfd
                                                        ^^
0xffffffe0083ecf80: 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd
0xffffffe0083ecf88: 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd

*** KERNEL PANIC (caller pc: 0xffffffff0042007c, stack frame: 0xffffff828000de50):
*** kasan

platform_halt suggested_action 0 reason 4
Halting...
Zircon/x64 ELF (EM_X86_64) build ID 7b49f4c67dd7256abbc6341572e457af9f5fba56
zx_system_get_version_string: git-81df98514578575906b4a61a6ac54d7ba239d612-dirty
kernel_debug_level: 2
{{{reset}}}
{{{module:0:vmzircon:elf:7b49f4c67dd7256abbc6341572e457af9f5fba56}}}
{{{mmap:0xffffffff00000000:0x1b3000:load:0:r:0x0}}}
{{{mmap:0xffffffff001b3000:0x5fc000:load:0:rx:0x1b3000}}}
{{{mmap:0xffffffff007af000:0x12000:load:0:r:0x7af000}}}
{{{mmap:0xffffffff007c1000:0x25b000:load:0:rw:0x7c1000}}}
{{{bt:0:0xffffffff001beff8:ra}}}
{{{bt:1:0xffffffff006c7ddd:ra}}}
{{{bt:2:0xffffffff001b421d:ra}}}
{{{bt:3:0xffffffff0079ebcb:ra}}}
{{{bt:4:0xffffffff0042007c:ra}}}
{{{bt:5:0xffffffff003325c9:ra}}}
{{{bt:6:0xffffffff0051ce4d:ra}}}
{{{bt:7:0xffffffff002a3019:ra}}}
{{{bt:8:0xffffffff002c384c:ra}}}
{{{bt:9:0xffffffff007a23c3:ra}}}
Halted
entering panic shell loop
```

Original-Bug: 498512247
Test: fx core-tests --gtest_filter='Pager.ProxyUseAfterFree'
Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1584479
Original-Revision: 6774606f2f56ae3ac8acec65670d75db9f3b1b67
GitOrigin-RevId: 3d52526545e93d1bf5551dd10fccbbe486d11390
Change-Id: Iffc954524dd0ab54b01fc82a7236f78d1c22412f
1 file changed
tree: 0321825d95310037cf2f06d5176b540d4801fcb0
  1. ctf/
  2. git-hooks/
  3. infra/
  4. third_party/
  5. cobalt
  6. flower
  7. jiri.lock
  8. MILESTONE
  9. minimal
  10. prebuilts
  11. README.md
  12. stem
  13. test_durations
README.md

Integration

This repository contains Fuchsia's Global Integration manifest files.

Making changes

All changes should be made to the internal version of this repository. Our infrastructure automatically updates this version when the internal one changes.

Currently all changes must be made by a Google employee. Non-Google employees wishing to make a change can ask for assistance in one of the communication channels documented at get involved.

Obtaining the source

First install Jiri.

Next run:

$ jiri init
$ jiri import minimal https://fuchsia.googlesource.com/integration
$ jiri update

Third party

Third party projects should have their own subdirectory in ./third_party.