syzbot


page fault in uvm_pgflcache_alloc

Status: upstream: reported C repro on 2023/07/09 16:28
Reported-by: syzbot+0d7184ae7e8a5224d791@syzkaller.appspotmail.com
First crash: 520d, last: 520d

Sample crash report:
[  55.4764735] fatal page faultfatal page fault in supervisor mode
[  55.4854072] trap type 6 code 0 rip 0xffffffff85073c54 cs 0x8 rflags 0x10246 cr2 0xffff9a80173814c0 ilevel 0x6 rsp 0xffff9a80c7aa25b0
[  55.4854072]  in supervisor mode
[  55.5002233] curlwp 0xffff9a8013440540 pid 1246.1246 lowest kstack 0xffff9a80c7a9b2c0
[ k er55ne.l5:0 0p2a2g3e3 ] fatrualpt  ttyrpaep ,6 c cooded=e0 [
 Stopped in pid 1246.1246 (syz-executor4027) at  netbsd:uvm_pgflcache_alloc+0x154:       movq    0(%rbx),%r14
?
uvm_pgflcache_alloc() at netbsd:uvm_pgflcache_alloc+0x154 sys/uvm/uvm_pgflcache.c:220
uvm_pagealloc_pgfl() at netbsd:uvm_pagealloc_pgfl+0xe2
uvm_pagealloc_strat() at netbsd:uvm_pagealloc_strat+0x2f34
pmap_enter_ma() at netbsd:pmap_enter_ma+0x1950 pmap_get_ptp sys/arch/x86/x86/pmap.c:2561 [inline]
pmap_enter_ma() at netbsd:pmap_enter_ma+0x1950 sys/arch/x86/x86/pmap.c:5052
pmap_enter_default() at netbsd:pmap_enter_default+0x158 sys/arch/x86/x86/pmap.c:4963
uvm_fault_internal() at netbsd:uvm_fault_internal+0x61e5 uvm_fault_lower_lookup sys/uvm/uvm_fault.c:2029 [inline]
uvm_fault_internal() at netbsd:uvm_fault_internal+0x61e5 uvm_fault_lower sys/uvm/uvm_fault.c:1867 [inline]
uvm_fault_internal() at netbsd:uvm_fault_internal+0x61e5 sys/uvm/uvm_fault.c:936
trap() at netbsd:trap+0x23bd
--- trap (number 6) ---
7f7e2b80a70a:
Panic string: (null)
PID    LID S CPU     FLAGS       STRUCT LWP *               NAME WAIT
1246 >1246 7   0         0   ffff9a8013440540   syz-executor4027
1244  1244 3   0         0   ffff9a8013440100   syz-executor4027 tstile
1240  1240 3   1         0   ffff9a8012c94940   syz-executor4027 tstile
991    991 3   0         0   ffff9a8012c94500   syz-executor4027 tstile
950    950 2   0         0   ffff9a8012c940c0   syz-executor4027
1241 >1241 7   1         0   ffff9a8012bd6900   syz-executor4027
829    829 2   1       140   ffff9a8012bd64c0   syz-executor4027
930    930 3   1       180   ffff9a8012bd6080   syz-executor4027 nanoslp
449    449 3   1       180   ffff9a801251e300   syz-executor4027 nanoslp
942    942 3   0     40180   ffff9a80123922c0   syz-executor4027 nanoslp
1235  1235 3   0       180   ffff9a80123006c0               sshd select
1222  1222 3   0       180   ffff9a8012300b00              getty nanoslp
1084  1084 3   0       180   ffff9a8012300280              getty nanoslp
1224  1224 3   1       180   ffff9a80121ffac0              getty nanoslp
1216  1216 3   0       1c0   ffff9a80121fc200              getty ttyraw
1103  1103 3   0       180   ffff9a8012ba88c0               sshd select
685    685 3   1       180   ffff9a80125e6780             powerd kqueue
693    693 3   0       180   ffff9a8012ba8480            syslogd kqueue
559    559 3   0       180   ffff9a8012ba8040             dhcpcd poll
746    746 3   1       180   ffff9a801251e740             dhcpcd poll
745    745 3   1       180   ffff9a8012392700             dhcpcd poll
599    599 3   1       180   ffff9a80125e6bc0             dhcpcd poll
487    487 3   0       180   ffff9a80125e6340             dhcpcd poll
292    292 3   1       180   ffff9a8012392b40             dhcpcd poll
485    485 2   0       100   ffff9a801251eb80             dhcpcd
1        1 3   0       180   ffff9a8011ede100               init wait
0      859 3   0       200   ffff9a80121fc640            physiod physiod
0      196 3   1       200   ffff9a80121ff680          pooldrain pooldrain
0      195 3   0       200   ffff9a80121ff240            ioflush syncer
0      194 3   0  121fc920   ffff9a80121fca80           pgdaemon pgdaemon
0      167 3   0       200   ffff9a801216ca40               usb7 usbevt
0      172 3   0       200   ffff9a801216c600               usb6 usbevt
0      170 3   0       200   ffff9a801216c1c0               usb5 usbevt
0      168 3   0       200   ffff9a801213ca00               usb4 usbevt

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/07/09 16:28 netbsd b2782b14a8e5 668cb1fa .config console log report syz C [disk image] [netbsd.gdb] ci2-netbsd-kmsan page fault in uvm_pgflcache_alloc
* Struck through repros no longer work on HEAD.