[roll] Roll fuchsia [kernel][vm] Fix UAF in PagerProxy Fix a use-after-free bug in PagerProxy. Prior to this commit, PagerProxy would hold a raw const pointer to its PagerDispatcher, even after the PagerDispatcher had been destroyed. Now, PagerProxy's pointer is non-const and is cleared during on_zero_handles (via PagerProxy::OnDispatcherClose). See also https://fxbug.dev/498512247 Change pager_ to a non-const pointer. Set pager_ to null in OnDispatcherClose. Remove the now redundant pager_dispatcher_closed_ field. Add const pager_koid_ field so that PagerProxy::GetKoid continues to function after OZH. This is a partial revert of https://fxrev.dev/1337566. Update Dump to only query the PagerDispatcher name when pager_ is non-null. Add regression test. I have verified that the new test will trigger a kasan panic. ``` [00000.653] 01111:01114> *** Running standalone test directly from userboot *** [00000.836] 01111:01114> [==========] Flag Values: [00000.836] 01111:01114> --gtest_filter = Pager.ProxyUseAfterFree [00000.836] 01111:01114> --gtest_shuffle = true [00000.836] 01111:01114> --gtest_random_seed = -1 [00000.836] 01111:01114> [==========] [00000.837] 01111:01114> [==========] Running 1 test from 1 test case. [00000.837] 01111:01114> [----------] Global test environment set-up. [00000.837] 01111:01114> [----------] 1 test from Pager [00000.838] 01111:01114> [ RUN ] Pager.ProxyUseAfterFree ZIRCON KERNEL PANIC UPTIME: 846ms, CPU: 3 Zircon/x64 ELF (EM_X86_64) build ID 7b49f4c67dd7256abbc6341572e457af9f5fba56 zx_system_get_version_string: git-81df98514578575906b4a61a6ac54d7ba239d612-dirty kernel_debug_level: 2 {{{reset}}} {{{module:0:vmzircon:elf:7b49f4c67dd7256abbc6341572e457af9f5fba56}}} {{{mmap:0xffffffff00000000:0x1b3000:load:0:r:0x0}}} {{{mmap:0xffffffff001b3000:0x5fc000:load:0:rx:0x1b3000}}} {{{mmap:0xffffffff007af000:0x12000:load:0:r:0x7af000}}} {{{mmap:0xffffffff007c1000:0x25b000:load:0:rw:0x7c1000}}} stopping other cpus halting cpu 1 halting cpu 2 halting cpu 0 KASAN detected a read error: ptr={{{data:0xffffff8041f67bf8}}}, size=0x8, caller: {{{pc:0xffffffff003325c9}}} Shadow memory state around the buggy address 0xffffffe0083ecf7f: 0xffffffe0083ecf68: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xffffffe0083ecf70: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xffffffe0083ecf78: 0x00 0xfa 0xfa 0xfa 0xfa 0xfd 0xfd 0xfd ^^ 0xffffffe0083ecf80: 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xffffffe0083ecf88: 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd *** KERNEL PANIC (caller pc: 0xffffffff0042007c, stack frame: 0xffffff828000de50): *** kasan platform_halt suggested_action 0 reason 4 Halting... Zircon/x64 ELF (EM_X86_64) build ID 7b49f4c67dd7256abbc6341572e457af9f5fba56 zx_system_get_version_string: git-81df98514578575906b4a61a6ac54d7ba239d612-dirty kernel_debug_level: 2 {{{reset}}} {{{module:0:vmzircon:elf:7b49f4c67dd7256abbc6341572e457af9f5fba56}}} {{{mmap:0xffffffff00000000:0x1b3000:load:0:r:0x0}}} {{{mmap:0xffffffff001b3000:0x5fc000:load:0:rx:0x1b3000}}} {{{mmap:0xffffffff007af000:0x12000:load:0:r:0x7af000}}} {{{mmap:0xffffffff007c1000:0x25b000:load:0:rw:0x7c1000}}} {{{bt:0:0xffffffff001beff8:ra}}} {{{bt:1:0xffffffff006c7ddd:ra}}} {{{bt:2:0xffffffff001b421d:ra}}} {{{bt:3:0xffffffff0079ebcb:ra}}} {{{bt:4:0xffffffff0042007c:ra}}} {{{bt:5:0xffffffff003325c9:ra}}} {{{bt:6:0xffffffff0051ce4d:ra}}} {{{bt:7:0xffffffff002a3019:ra}}} {{{bt:8:0xffffffff002c384c:ra}}} {{{bt:9:0xffffffff007a23c3:ra}}} Halted entering panic shell loop ``` Original-Bug: 498512247 Test: fx core-tests --gtest_filter='Pager.ProxyUseAfterFree' Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1584479 Original-Revision: 6774606f2f56ae3ac8acec65670d75db9f3b1b67 GitOrigin-RevId: 3d52526545e93d1bf5551dd10fccbbe486d11390 Change-Id: Iffc954524dd0ab54b01fc82a7236f78d1c22412f
This repository contains Fuchsia's Global Integration manifest files.
All changes should be made to the internal version of this repository. Our infrastructure automatically updates this version when the internal one changes.
Currently all changes must be made by a Google employee. Non-Google employees wishing to make a change can ask for assistance in one of the communication channels documented at get involved.
First install Jiri.
Next run:
$ jiri init $ jiri import minimal https://fuchsia.googlesource.com/integration $ jiri update
Third party projects should have their own subdirectory in ./third_party.