Fix use-after-free in sk_repl_idle()'s idle-tick VM resolution (FABRIC-3.md §XIII)

Browse Source

Root-caused a heap-corruption bug that reliably failed WIREBIND identity
attach on the third attach/detach cycle in one boot. sk_console_readline()
and sk_console_getkey() captured `active_vm` once from their caller and
kept passing that same (possibly long-stale) pointer to sk_repl_idle() on
every idle tick serviced while blocked waiting for input. If the VM it
pointed at was killed (WIREBIND detach) mid-block, the existing bailout
only checked a generic "is anyone attached" boolean -- masked as soon as a
different identity attached next -- so blk_vm_flush_all() kept writing
into a freed VM struct sitting on kmalloc's own free list, corrupting the
free list's linked-list metadata itself.

Both idle branches now re-resolve the live active VM fresh from
g_repl_active_vm on every tick, matching the dispatch-side fix already
made for the sibling bug in §XII.3.

Verified: rebuilt amd64, reran the exact three-cycle repro that reliably
corrupted the heap before the fix -- free-list census stayed stable
through the same idle window that previously collapsed to zero. All three
architectures (amd64/aarch64/riscv64) boot clean to the zuse)ok> prompt.

kmalloc_debug_census()/kmalloc_debug_census_bytes() kept as permanent
diagnostic infrastructure; every other temporary probe added during the
investigation was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EXieurDfDSsDFdnSyusuWo

...

This commit is contained in:

Robert Allan James

2026-09-10 20:30:41 -04:00

co-authored by Claude Sonnet 5

parent 70421bdd43

commit 9142dda2d6

38 changed files with 236983 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

logs/20260910-180743/amd64/qemu-amd64-20260910-180743.log

+9427

File diff suppressed because it is too large Load Diff

logs/20260910-181818/amd64/qemu-amd64-20260910-181818.log

+8990

File diff suppressed because it is too large Load Diff

logs/20260910-183548/amd64/qemu-amd64-20260910-183548.log

+9065

File diff suppressed because it is too large Load Diff

logs/20260910-183851/amd64/qemu-amd64-20260910-183851.log

+9151

File diff suppressed because it is too large Load Diff

logs/20260910-184505/amd64/qemu-amd64-20260910-184505.log

+9151

File diff suppressed because it is too large Load Diff

logs/20260910-185141/amd64/qemu-amd64-20260910-185141.log

+9105

File diff suppressed because it is too large Load Diff

logs/20260910-185534/amd64/qemu-amd64-20260910-185534.log

+9213

File diff suppressed because it is too large Load Diff

logs/20260910-190420/amd64/qemu-amd64-20260910-190420.log

+9038

File diff suppressed because it is too large Load Diff

logs/20260910-190607/amd64/qemu-amd64-20260910-190607.log

+9237

File diff suppressed because it is too large Load Diff

logs/20260910-191003/amd64/qemu-amd64-20260910-191003.log

+9308

File diff suppressed because it is too large Load Diff

logs/20260910-191535/amd64/qemu-amd64-20260910-191535.log

+9204

File diff suppressed because it is too large Load Diff

logs/20260910-191816/amd64/qemu-amd64-20260910-191816.log

+9502

File diff suppressed because it is too large Load Diff

logs/20260910-192100/amd64/qemu-amd64-20260910-192100.log

+9580

File diff suppressed because it is too large Load Diff

logs/20260910-192358/amd64/qemu-amd64-20260910-192358.log

+9608

File diff suppressed because it is too large Load Diff

logs/20260910-192736/amd64/qemu-amd64-20260910-192736.log

+9777

File diff suppressed because it is too large Load Diff

logs/20260910-193124/amd64/qemu-amd64-20260910-193124.log

+10651

File diff suppressed because it is too large Load Diff

logs/20260910-193445/amd64/qemu-amd64-20260910-193445.log

+9403

File diff suppressed because it is too large Load Diff

logs/20260910-193703/amd64/qemu-amd64-20260910-193703.log

+11484

File diff suppressed because it is too large Load Diff

logs/20260910-194354/amd64/qemu-amd64-20260910-194354.log

logs/20260910-194424/amd64/qemu-amd64-20260910-194424.log

+10446

File diff suppressed because it is too large Load Diff

logs/20260910-195054/amd64/qemu-amd64-20260910-195054.log

+12205

File diff suppressed because it is too large Load Diff

logs/20260910-200009/amd64/qemu-amd64-20260910-200009.log

+14395

File diff suppressed because it is too large Load Diff

logs/20260910-200746/amd64/qemu-amd64-20260910-200746.log

+10872

File diff suppressed because it is too large Load Diff

logs/20260910-201318/aarch64/qemu-aarch64-20260910-201318.log

+8953

File diff suppressed because it is too large Load Diff

logs/20260910-202545/riscv64/qemu-riscv64-20260910-202545.log

+9022

File diff suppressed because it is too large Load Diff