syzbot


pool: free list modified: pmappl

Status: upstream: reported on 2024/05/27 09:56
Reported-by: syzbot+0e8460c6d18de4b2bcf2@syzkaller.appspotmail.com
First crash: 103d, last: 17d

Sample crash report:
panic: pool_do_get: pmappl free list modified: page 0xfffffd806aadc000; item addr 0xfffffd806aadc4e8; offset 0x4c=0xdeadbef0
Starting stack trace...
panic(ffffffff830608fe) at panic+0x1d0 sys/kern/subr_prf.c:229
pool_do_get(ffffffff8353dd18,1,ffff8000357af238) at pool_do_get+0x5e6
pool_get(ffffffff8353dd18,1) at pool_get+0x141
pmap_create() at pmap_create+0x41 sys/arch/amd64/amd64/pmap.c:1352
uvmspace_fork(ffff80002d565228) at uvmspace_fork+0x7f uvmspace_alloc sys/uvm/uvm_map.c:3242 [inline]
uvmspace_fork(ffff80002d565228) at uvmspace_fork+0x7f sys/uvm/uvm_map.c:3813
process_new(ffff80002d56f990,ffff80002d565228,1) at process_new+0x553 sys/kern/kern_fork.c:279
fork1(ffff80002d56ece8,1,ffffffff82c89120,0,ffff8000357af4c0,0) at fork1+0x3ea sys/kern/kern_fork.c:405
syscall(ffff8000357af570) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000357af570) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x77d40dafd660, count: 248
End of stack trace.
syncing disks...
set $lines = 0
set $maxwidth = 0
show panic
trace
show registers
show proc
ps
show all locks
show malloc
show all pools
machine ddbcpu 0
trace
machine ddbcpu 1
trace

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/21 14:52 openbsd 39cd50f5fe5d db5852f9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: pmappl
2024/06/25 21:37 openbsd 00aa7573f64b 34889ee3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: pmappl
2024/05/27 09:56 openbsd bc2c23e056db 761766e6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: pmappl
* Struck through repros no longer work on HEAD.