SIGSEGV on OpenBSD 7.8 when using QUIC/ECH (null pointer dereference in sysctl/getrtable)
SIGSEGV on OpenBSD 7.8 when using QUIC/ECH (null pointer dereference in sysctl/getrtable)
openbsd# ktrace ./h2o -c h2o.conf [h2o.conf:22] in command listen, Warning: not enabling TLS_AES_128_GCM_SHA256 might reduce TLS1.3 interoperability, see RFC 8446 9.1 [h2o.conf:22] in command listen, Warning: not enabling TLS_AES_128_GCM_SHA256 might reduce TLS1.3 interoperability, see RFC 8446 9.1 Segmentation fault (core dumped)
Then use keydump:
1910 h2o RET read 5926/0x1726 1910 h2o CALL close(7) 1910 h2o RET close 0 1910 h2o CALL getpid() 1910 h2o RET getpid 1910/0x776 1910 h2o CALL getpid() 1910 h2o RET getpid 1910/0x776 1910 h2o CALL fcntl(4,F_GETFL) 1910 h2o RET fcntl 2 1910 h2o CALL fcntl(4,F_SETFL,0x2<O_RDWR>) 1910 h2o RET fcntl 0 1910 h2o CALL getpid() 1910 h2o RET getpid 1910/0x776 1910 h2o CALL writev(4,0x7364d7328360,2) 1910 h2o STRU struct iovec [2] { base=0x7364d7328358, len=8 } { base=0xc31f102000, len=28 } 1910 h2o GIO fd 4 wrote 8 bytes "\^\\0\0\0\0\0\0\0" 1910 h2o GIO fd 4 wrote 28 bytes "load_key\0/web/cert/cert.key\0" 1910 h2o RET writev 36/0x24 1910 h2o CALL fcntl(4,F_SETFL,0x2<O_RDWR>) 1910 h2o RET fcntl 0 1910 h2o CALL getpid() 1910 h2o RET getpid 1910/0x776 1910 h2o CALL fcntl(4,F_GETFL) 1910 h2o RET fcntl 2 1910 h2o CALL fcntl(4,F_SETFL,0x2<O_RDWR>) 1910 h2o RET fcntl 0 1910 h2o CALL getpid() 1910 h2o RET getpid 1910/0x776 1910 h2o CALL read(4,0x7364d7328368,0x8) 1910 h2o GIO fd 4 read 8 bytes "\M^A\0\0\0\0\0\0\0" 1910 h2o RET read 8 1910 h2o CALL read(4,0xc31f106000,0x81) 1910 h2o GIO fd 4 read 129 bytes "\^B\0\0\0\0\0\0\0\^A\0\0\0\0\0\0\0\M-K\^B\0\0\0\0\0\0a\0\0\0\0\0\0\0\^D\M^U\M^Sz{\M^?;\M-RD\M^D[X\M^Kjk\M-e\M^]m\^D\ c8b\M^_\M^_\M-;\^A\^St>\M^B\^Q\aM\M-v\M-M\M-d \^Vx\M-bm\M-/\M-m\M-bV\M-W\M-_4\M-rz \M-%\M^E\M-e\M-=\M-l&\M^\w\M-Bw \M-P3\M-$\M^M\M-x\M-uK\M-/\M-r\M^R\M-Ve\M-n\v/\M-=y\M^GU\^Y\M-d\M-p\M^X\M^Y\M-M\M-y\ \^Q\M^[1\M-0\M^C\M^A\M-A1\^X" 1910 h2o RET read 129/0x81 1910 h2o CALL fcntl(4,F_SETFL,0x2<O_RDWR>) 1910 h2o RET fcntl 0 1910 h2o CALL mmap(0,0x81000,0x3<PROT_READ|PROT_WRITE>,0x5002<MAP_PRIVATE|MAP_ANON|MAP_STACK>,-1,0) 1910 h2o RET mmap 838376628224/0xc333242000 1910 h2o CALL mprotect(0xc333242000,0x1000,0<PROT_NONE>) 1910 h2o RET mprotect 0 1910 h2o CALL __tfork(0x7364d7328620,24) 1910 h2o STRU struct __tfork { tcb=0xc31f128000, tid=0xc31f128030, stack=0xc3332c2ac0 } 1910 h2o RET __tfork 173209/0x2a499 1910 h2o CALL getpid() 1910 h2o RET getpid 1910/0x776 1910 h2o CALL clock_gettime(CLOCK_MONOTONIC,0x7364d73285e0) 1910 h2o STRU struct timespec { 344965.881617784 } 1910 h2o RET clock_gettime 0 1910 h2o CALL getpid() 1910 h2o RET getpid 1910/0x776 1910 h2o CALL clock_gettime(CLOCK_MONOTONIC,0x7364d73285c0) 1910 h2o STRU struct timespec { 344965.881624619 } 1910 h2o RET clock_gettime 0 1910 h2o CALL sysctl(4.17.0.0.3.0<net.route.0.0.3.0>,0,0x7364d7326c48,0,0) 1910 h2o RET sysctl 0 1910 h2o CALL sysctl(4.17.0.0.3.0<net.route.0.0.3.0>,0xc31f10f000,0x7364d7326c48,0,0) 1910 h2o RET sysctl 0 1910 h2o CALL getrtable() 1910 h2o RET getrtable 0 1910 h2o PSIG SIGSEGV SIG_DFL code=SEGV_MAPERR addr=0x0 trapno=6 1910 h2o NAMI "h2o.core"
error occurrance:
1910 h2o CALL sysctl(4.17.0.0.3.0<net.route.0.0.3.0>,0xc31f10f000,0x7364d7326c48,0,0) 1910 h2o RET sysctl 0 1910 h2o CALL getrtable() 1910 h2o RET getrtable 0 1910 h2o PSIG SIGSEGV SIG_DFL code=SEGV_MAPERR addr=0x0 trapno=6
Source: h2o/h2o