syzbot


uvm_fault: arp_rtrequest (2)

Status: upstream: reported on 2024/04/16 05:05
Reported-by: syzbot+0ebeab4d14ef43dfc209@syzkaller.appspotmail.com
First crash: 219d, last: 46d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: arp_rtrequest C 79 1998d 2008d 3/3 fixed on 2019/06/14 04:59

Sample crash report:
uvm_fault(0xffffffff83507480, 0xffff800001333000, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      arp_rtrequest+0x660:    movzwl  0xc(%r15,%rbx,1),%ecx
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
  40245  42122      0           0          0    0  syz-executor
*284043  79134      0           0  0x4000000    1K syz-executor
arp_rtrequest(ffff8000012a1800,1,fffffd80796cfd90) at arp_rtrequest+0x660 arprequest sys/netinet/if_ether.c:281 [inline]
arp_rtrequest(ffff8000012a1800,1,fffffd80796cfd90) at arp_rtrequest+0x660 sys/netinet/if_ether.c:184
rtrequest(1,ffff8000371b5898,1,ffff8000371b5940,0) at rtrequest+0xbdc sys/net/route.c:1103
rt_ifa_add(ffff8000012c4f00,240004,ffff8000012c4f58,0) at rt_ifa_add+0x22e sys/net/route.c:1273
rt_ifa_addlocal(ffff8000012c4f00) at rt_ifa_addlocal+0x1d2 sys/net/route.c:1381
in_ifinit(ffff8000012a1800,ffff8000012c4f00,ffff8000371b5c00,1) at in_ifinit+0x26c sys/netinet/in.c:669
in_ioctl_change_ifaddr(8040691a,ffff8000371b5bf0,ffff8000012a1800) at in_ioctl_change_ifaddr+0x92c sys/netinet/in.c:504
ifioctl(ffff80000132dca8,8040691a,ffff8000371b5bf0,ffff8000ffffc520) at ifioctl+0x1571 pru_control sys/sys/protosw.h:355 [inline]
ifioctl(ffff80000132dca8,8040691a,ffff8000371b5bf0,ffff8000ffffc520) at ifioctl+0x1571 sys/net/if.c:2449
sys_ioctl(ffff8000ffffc520,ffff8000371b5dd0,ffff8000371b5d20) at sys_ioctl+0x67c
syscall(ffff8000371b5dd0) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000371b5dd0) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x44d71c9f1c0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xffffffff83507480, 0xffff800001333000, 0, 1) -> e
ddb{1}> trace
arp_rtrequest(ffff8000012a1800,1,fffffd80796cfd90) at arp_rtrequest+0x660 arprequest sys/netinet/if_ether.c:281 [inline]
arp_rtrequest(ffff8000012a1800,1,fffffd80796cfd90) at arp_rtrequest+0x660 sys/netinet/if_ether.c:184
rtrequest(1,ffff8000371b5898,1,ffff8000371b5940,0) at rtrequest+0xbdc sys/net/route.c:1103
rt_ifa_add(ffff8000012c4f00,240004,ffff8000012c4f58,0) at rt_ifa_add+0x22e sys/net/route.c:1273
rt_ifa_addlocal(ffff8000012c4f00) at rt_ifa_addlocal+0x1d2 sys/net/route.c:1381
in_ifinit(ffff8000012a1800,ffff8000012c4f00,ffff8000371b5c00,1) at in_ifinit+0x26c sys/netinet/in.c:669
in_ioctl_change_ifaddr(8040691a,ffff8000371b5bf0,ffff8000012a1800) at in_ioctl_change_ifaddr+0x92c sys/netinet/in.c:504
ifioctl(ffff80000132dca8,8040691a,ffff8000371b5bf0,ffff8000ffffc520) at ifioctl+0x1571 pru_control sys/sys/protosw.h:355 [inline]
ifioctl(ffff80000132dca8,8040691a,ffff8000371b5bf0,ffff8000ffffc520) at ifioctl+0x1571 sys/net/if.c:2449
sys_ioctl(ffff8000ffffc520,ffff8000371b5dd0,ffff8000371b5d20) at sys_ioctl+0x67c
syscall(ffff8000371b5dd0) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000371b5dd0) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x44d71c9f1c0, count: -10
ddb{1}> show registers
rdi               0xffff8000371e8000
rsi                            0x716
rbp               0xffff8000371b5760
rbx                             0x14
rdx               0xffff8000371e8000
rcx                0x100040600080100
rax               0xfffffd8078ffa7e0
r8                              0x10
r9                0xfffffd80796cfd90
r10               0x1b3560aeb88bee2e
r11               0x14dee3cb04ef5cae
r12                             0x4e
r13               0xfffffd8078ffa700
r14               0xfffffd80796cfd90
r15               0xffff800001332fe0
rip               0xffffffff827fbb40    arp_rtrequest+0x660
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000371b56e0
ss                              0x10
arp_rtrequest+0x660:    movzwl  0xc(%r15,%rbx,1),%ecx
ddb{1}> show proc
PROC (syz-executor) tid=284043 pid=79134 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffff27b8,0xffff8000ffffd460
    process=0xffff800029feb668 user=0xffff8000371b0000, vmspace=0xfffffd806be5d378
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 42122   40245  32158      0  7           0                syz-executor
 42122  185264  32158      0  2   0x4000080                syz-executor
 79134  348376  39707      0  2           0                syz-executor
*79134  284043  39707      0  7   0x4000000                syz-executor
 77166  343509   9077      0  2           0                syz-executor
 77166   96365   9077      0  2   0x4000000                syz-executor
 77166  156952   9077      0  3   0x4000080  fsleep        syz-executor
 12511  408299  71775      0  2           0                syz-executor
 12511  320706  71775      0  3   0x4000080  sbwait        syz-executor
 12511  440057  71775      0  3   0x4000080  fsleep        syz-executor
 36332  168075  77020      0  3        0x80  nanoslp       syz-executor
 36332  203476  77020      0  3   0x4000080  kqsel         syz-executor
 36332  508201  77020      0  3   0x4000080  kqsel         syz-executor
 36332  201640  77020      0  3   0x4000080  fsleep        syz-executor
  9522   27656  20380      0  3        0x80  nanoslp       syz-executor
  9522  367940  20380      0  3   0x4000080  rest          syz-executor
  9522  489422  20380      0  3   0x4000080  fsleep        syz-executor
  9077  360148  88291      0  3        0x82  nanoslp       syz-executor
 32158  250214  88291      0  3        0x82  nanoslp       syz-executor
 71775  411116  88291      0  3        0x82  nanoslp       syz-executor
 20380  422162  88291      0  3        0x82  nanoslp       syz-executor
 65373  499617  88291      0  3        0x82  nanoslp       syz-executor
 12282  311540  88291      0  3        0x82  nanoslp       syz-executor
 39707  485918  88291      0  3        0x82  nanoslp       syz-executor
 18421  443962      1      0  3    0x100083  ttyin         getty
 77020   22176  88291      0  3        0x82  nanoslp       syz-executor
 69096  456543      0      0  3     0x14200  bored         sosplice
 88291  388653  71205      0  3        0x82  kqread        syz-executor
 71205  208880   3339      0  3    0x10008a  sigsusp       ksh
  3339  152722  50485      0  3        0x98  kqread        sshd-session
 50485  437693  73327      0  3        0x92  kqread        sshd-session
 73327   34080      1      0  3        0x88  kqread        sshd
 31991  446558  58749     74  3   0x1100092  bpf           pflogd
 58749  425553      1      0  3        0x80  sbwait        pflogd
 57549  337905  82395     73  3   0x1100010  ffs_fsync     syslogd
 82395   95335      1      0  3    0x100082  sbwait        syslogd
 30797  185154      1      0  3    0x100080  kqread        resolvd
 49625  318888  62933     77  3    0x100092  kqread        dhcpleased
 26554  164445  62933     77  3    0x100092  kqread        dhcpleased
 62933  337574      1      0  3        0x80  kqread        dhcpleased
  7031  344822      0      0  3     0x14200  bored         smr
 16693  323586      0      0  3     0x14200  pgzero        zerothread
 80577  490798      0      0  3     0x14200  aiodoned      aiodoned
 45890  186010      0      0  3     0x14200  syncer        update
 62878  213127      0      0  3     0x14200  cleaner       cleaner
 27773  121331      0      0  3     0x14200  reaper        reaper
 59945  158613      0      0  3     0x14200  pgdaemon      pagedaemon
 74819  337610      0      0  3     0x14200  bored         viomb
 51371  413322      0      0  3  0x40014200  acpi0         acpi0
 47396  167269      0      0  3  0x40014200                idle1
 58570  104191      0      0  3     0x14200  bored         softnet3
 25238   97282      0      0  3     0x14200  bored         softnet2
 85554   70273      0      0  3     0x14200  bored         softnet1
 92294   22270      0      0  3     0x14200  bored         softnet0
 46775   66029      0      0  2     0x14200                systqmp
 89392  130898      0      0  3     0x14200  bored         systq
  1954  134169      0      0  3     0x14200  tmoslp        softclockmp
 29345  241283      0      0  3  0x40014200  tmoslp        softclock
 14311  123667      0      0  3  0x40014200                idle0
     1  257998      0      0  3     0x80082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 79134 (syz-executor) thread 0xffff8000ffffc520 (284043)
exclusive rwlock netlock r = 0 (0xffffffff8347a330)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1155
#1  in_ioctl_change_ifaddr+0xbe sys/netinet/in.c:413
#2  ifioctl+0x1571 pru_control sys/sys/protosw.h:355 [inline]
#2  ifioctl+0x1571 sys/net/if.c:2449
#3  sys_ioctl+0x67c
#4  syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#4  syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
#5  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff8358ff58)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1155
#1  ifioctl+0x47f sys/net/if.c:2096
#2  sys_ioctl+0x67c
#3  syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#3  syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
#4  Xsyscall+0x128
Process 57549 (syslogd) thread 0xffff8000ffffdbe8 (337905)
exclusive rrwlock inode r = 0 (0xfffffd806e4122c0)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1155
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  sys_fsync+0x152 sys/kern/vfs_syscalls.c:2926
#6  syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#6  syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#7  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10219  11124K   11448K 166960K     12124        0
            pcb    17     12K      12K 166960K        87        0
         rtable   172      5K       8K 166960K       864        0
             pf    31     17K      25K 166960K       148        0
         ifaddr    34      6K       7K 166960K       116        0
        ifgroup    50      2K       2K 166960K       131        0
         sysctl     2      0K       0K 166960K         2        0
       counters    60     35K      36K 166960K       104        0
       ioctlops     0      0K       4K 166960K      1541        0
            iov     1      8K      12K 166960K        99        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1481     93K      94K 166960K      2118        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        17        0
         VM map     2      1K       1K 166960K         2        0
            sem    21      3K       3K 166960K        90        0
        dirhash    12      2K       2K 166960K        24        0
           ACPI  1690    195K     286K 166960K     12418        0
      file desc    18     65K      93K 166960K       822        0
          sigio     0      0K       0K 166960K        12        0
           proc    72     91K     128K 166960K      1027        0
        subproc   104      6K       8K 166960K       299        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        68        0
       in_multi    73      5K       7K 166960K       287        0
    ether_multi     1      0K       0K 166960K         8        0
            mrt     1      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   229   1023K    1023K 166960K       229        0
           exec     0      0K       1K 166960K       704        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   263     74K      90K 166960K      8399        0
       UVM aobj    88      5K       5K 166960K        93        0
     pinsyscall    43     86K     102K 166960K      2285        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        23        0
            NDP    10      0K       2K 166960K        79        0
           temp    60   6820K    6913K 166960K     27835        0
         kqueue    13     20K      34K 166960K       107        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120       88    0       85     1     0     1     1     0     8    0
rtentry    112      287    0      210     4     1     3     4     0     8    0
unpcb      144      334    0      314     4     2     2     2     0     8    0
syncache   336        4    0        4     2     2     0     1     0     8    0
tcpcb      808      207    0      201    10     8     2     7     0     8    1
arp        120       49    0       35     1     0     1     1     0     8    0
inpcb      336      602    0      590     3     1     2     2     0     8    1
nd6        136       76    0       56     1     0     1     1     0     8    0
pkpcb       40        6    0        6     3     3     0     1     0     8    0
kcovpl      48       23    0       15     1     0     1     1     0     8    0
ppxss      1168       4    0        4     3     3     0     1     0     8    0
pffrag     232        5    0        1     1     0     1     1     0   482    0
pffrnode    88        5    0        1     1     0     1     1     0     8    0
pffrent     40       49    0       45     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       9    0        9     2     2     0     1     0     8    0
pfanchor   1288      15    0       15     2     2     0     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfstitem    24       67    0       24     1     0     1     1     0     8    0
pfstkey    128       67    0       24     2     0     2     2     0     8    0
pfstate    376       67    0       24     5     0     5     5     0     8    0
pfrule     1344      30    0       22     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1143    0      819    29     5    24    29     0     8    0
art_table   32     1144    0      819     4     0     4     4     0     8    0
art_node    16      286    0      219     1     0     1     1     0     8    0
sysvmsgpl   40       30    0       11     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       86    0       67     1     0     1     1     0     8    0
shmpl      112       90    0        5     3     0     3     3     0     8    0
dirhash    1024      25    0        8     3     0     3     3     0     8    0
dino2pl    256     2456    0      928    97     0    97    97     0     8    0
ffsino     272     2456    0      928   103     0   103   103     0     8    0
nchpl      144     3339    0     1631    64     0    64    64     0     8    0
uvmvnodes   80     3129    0        0    64     0    64    64     0     8    0
vnodes     216     3129    0        0   174     0   174   174     0     8    0
namei      1024   12703    0    12703     3     2     1     1     0     8    1
percpumem   16       66    0       22     1     0     1     1     0     8    0
pfiaddrpl  120        3    0        3     2     2     0     1     0     8    0
kstatmem   264       64    0       44     2     0     2     2     0     8    0
scxspl     216    13127    0    13126    10     9     1     8     1     8    0
plimitpl   152      274    0      255     1     0     1     1     0     8    0
sigapl     424     1092    0     1041     7     1     6     7     0     8    0
futexpl     64     7497    0     7493     1     0     1     1     0     8    0
knotepl    120      323    0        0    10     0    10    10     0     8    0
kqueuepl   216      280    0      269     3     2     1     3     0     8    0
pipepl     320      204    0      177     3     0     3     3     0     8    0
fdescpl    496     1073    0     1041     5     0     5     5     0     8    0
filepl     152     5528    0     5263    20     8    12    17     0     8    1
lockfpl    104      295    0      292     2     1     1     2     0     8    0
lockfspl    48      142    0      139     1     0     1     1     0     8    0
sessionpl  144       38    0       29     1     0     1     1     0     8    0
pgrppl      48       69    0       52     1     0     1     1     0     8    0
ucredpl    104      899    0      886     1     0     1     1     0     8    0
zombiepl   144     1043    0     1041     2     1     1     1     0     8    0
processpl  1160    1092    0     1041     5     1     4     5     0     8    0
procpl     648     1882    0     1820     6     0     6     6     0     8    0
srpgc       96        4    0        4     2     2     0     1     0     8    0
sosppl     168        3    0        3     2     2     0     1     0     8    0
sockpl     664     1038    0     1003     5     0     5     5     0     8    1
mcl64k     65536      7    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     142    0        0    18     0    18    18     0     8    0
mcl2k      2048      30    0        0     4     0     4     4     0     8    0
mtagpl      96        8    0        0     1     0     1     1     0     8    0
mbufpl     256      314    0        0    18     0    18    18     0     8    0
bufpl      280     6584    0      410   442     0   442   442     0     8    0
anonpl      24   242467    0   236638    74    13    61    68     0   185    0
amapchunkpl 152   27647    0    26979    45    16    29    37     0   158    0
amappl16   200     6398    0     6335    33    17    16    19     0     8    0
amappl15   192       17    0       16     1     0     1     1     0     8    0
amappl14   184      150    0      138     1     0     1     1     0     8    0
amappl13   176       15    0       15     1     1     0     1     0     8    0
amappl12   168     1960    0     1928     3     1     2     2     0     8    0
amappl11   160       56    0       42     1     0     1     1     0     8    0
amappl10   152       13    0       13     1     1     0     1     0     8    0
amappl9    144      138    0      138     1     1     0     1     0     8    0
amappl8    136       24    0       21     1     0     1     1     0     8    0
amappl7    128      137    0      125     1     0     1     1     0     8    0
amappl6    120      312    0      310     1     0     1     1     0     8    0
amappl5    112      189    0      177     1     0     1     1     0     8    0
amappl4    104      354    0      335     1     0     1     1     0     8    0
amappl3     96     5355    0     5232     5     1     4     4     0     8    0
amappl2     88      880    0      813     2     0     2     2     0     8    0
amappl1     80    10493    0     9920    14     1    13    14     0     8    0
amappl      88     7889    0     7687     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma512     512        1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        7    0        7     2     2     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       92    0        5     2     0     2     2     0     8    0
uaddrrnd    24     1073    0     1041     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1073    0     1041     1     0     1     1     0     8    0
vmmpekpl   168     9756    0     9707     3     0     3     3     0     8    0
vmmpepl    168    73869    0    71891   110    13    97    99     0   357    3
vmsppl     440     1072    0     1041     6     2     4     5     0     8    0
rwobjpl     56    28187    0    23970    62     0    62    62     0     8    1
pdppl      4096    2153    0     2082   117    46    71    85     0     8    0
pvpl        32    31083    0        0   251     0   251   251     0   265    0
pmappl     248     1072    0     1041     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      418    0       70    11     0    11    11     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83447ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff8358fd50) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff8358fd50) at __mp_lock+0x192 sys/kern/kern_lock.c:144
intr_handler(ffff80002cb75ff0,ffff800000079f80) at intr_handler+0xe1 sys/arch/amd64/amd64/intr.c:553
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
end of kernel
end trace frame: 0x7cc136d8acf0, count: 9
ddb{0}> trace
x86_ipi_db(ffffffff83447ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff8358fd50) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff8358fd50) at __mp_lock+0x192 sys/kern/kern_lock.c:144
intr_handler(ffff80002cb75ff0,ffff800000079f80) at intr_handler+0xe1 sys/arch/amd64/amd64/intr.c:553
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
end of kernel
end trace frame: 0x7cc136d8acf0, count: -6
ddb{0}> machine ddbcpu 1
Stopped at      arp_rtrequest+0x660:    movzwl  0xc(%r15,%rbx,1),%ecx
arp_rtrequest(ffff8000012a1800,1,fffffd80796cfd90) at arp_rtrequest+0x660 arprequest sys/netinet/if_ether.c:281 [inline]
arp_rtrequest(ffff8000012a1800,1,fffffd80796cfd90) at arp_rtrequest+0x660 sys/netinet/if_ether.c:184
rtrequest(1,ffff8000371b5898,1,ffff8000371b5940,0) at rtrequest+0xbdc sys/net/route.c:1103
rt_ifa_add(ffff8000012c4f00,240004,ffff8000012c4f58,0) at rt_ifa_add+0x22e sys/net/route.c:1273
rt_ifa_addlocal(ffff8000012c4f00) at rt_ifa_addlocal+0x1d2 sys/net/route.c:1381
in_ifinit(ffff8000012a1800,ffff8000012c4f00,ffff8000371b5c00,1) at in_ifinit+0x26c sys/netinet/in.c:669
in_ioctl_change_ifaddr(8040691a,ffff8000371b5bf0,ffff8000012a1800) at in_ioctl_change_ifaddr+0x92c sys/netinet/in.c:504
ifioctl(ffff80000132dca8,8040691a,ffff8000371b5bf0,ffff8000ffffc520) at ifioctl+0x1571 pru_control sys/sys/protosw.h:355 [inline]
ifioctl(ffff80000132dca8,8040691a,ffff8000371b5bf0,ffff8000ffffc520) at ifioctl+0x1571 sys/net/if.c:2449
sys_ioctl(ffff8000ffffc520,ffff8000371b5dd0,ffff8000371b5d20) at sys_ioctl+0x67c
syscall(ffff8000371b5dd0) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000371b5dd0) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x44d71c9f1c0, count: 5
ddb{1}> trace
arp_rtrequest(ffff8000012a1800,1,fffffd80796cfd90) at arp_rtrequest+0x660 arprequest sys/netinet/if_ether.c:281 [inline]
arp_rtrequest(ffff8000012a1800,1,fffffd80796cfd90) at arp_rtrequest+0x660 sys/netinet/if_ether.c:184
rtrequest(1,ffff8000371b5898,1,ffff8000371b5940,0) at rtrequest+0xbdc sys/net/route.c:1103
rt_ifa_add(ffff8000012c4f00,240004,ffff8000012c4f58,0) at rt_ifa_add+0x22e sys/net/route.c:1273
rt_ifa_addlocal(ffff8000012c4f00) at rt_ifa_addlocal+0x1d2 sys/net/route.c:1381
in_ifinit(ffff8000012a1800,ffff8000012c4f00,ffff8000371b5c00,1) at in_ifinit+0x26c sys/netinet/in.c:669
in_ioctl_change_ifaddr(8040691a,ffff8000371b5bf0,ffff8000012a1800) at in_ioctl_change_ifaddr+0x92c sys/netinet/in.c:504
ifioctl(ffff80000132dca8,8040691a,ffff8000371b5bf0,ffff8000ffffc520) at ifioctl+0x1571 pru_control sys/sys/protosw.h:355 [inline]
ifioctl(ffff80000132dca8,8040691a,ffff8000371b5bf0,ffff8000ffffc520) at ifioctl+0x1571 sys/net/if.c:2449
sys_ioctl(ffff8000ffffc520,ffff8000371b5dd0,ffff8000371b5d20) at sys_ioctl+0x67c
syscall(ffff8000371b5dd0) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000371b5dd0) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x44d71c9f1c0, count: -10

Crashes (18):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/06 11:41 openbsd 1b325262a2fb d7906eff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/09/26 19:24 openbsd 9119eb3a9696 9314348a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/09/26 10:03 openbsd f8f7dc1f1132 0d19f247 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/09/25 19:59 openbsd e3b2bc7ec478 0b45cac3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/09/21 19:52 openbsd e95f2867f8e8 6f888b75 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/09/20 22:54 openbsd 479c151d3429 6f888b75 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2024/09/17 09:17 openbsd 29c9965db7fc c673ca06 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/09/14 04:45 openbsd 3800fc3581d8 ff60e2ca .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/09/10 04:48 openbsd d05e5827ac65 784df80e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2024/09/10 04:34 openbsd d05e5827ac65 784df80e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2024/09/04 06:44 openbsd be4dcae9074d 9d47f20a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/08/20 10:30 openbsd c476ff4431c1 9f0ab3fb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2024/08/06 03:18 openbsd 4ad77004d94b e1bdb00a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2024/05/10 13:04 openbsd 898e5d067977 375932ce .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2024/04/30 23:06 openbsd ab0363c32c56 3ba885bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2024/04/26 19:06 openbsd 85e00e3040cd 3f914d6b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2024/04/26 15:25 openbsd 85e00e3040cd 3f914d6b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2024/04/16 05:04 openbsd 9dcb0c6dfd57 0d592ce4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
* Struck through repros no longer work on HEAD.