syzbot


uvm_fault: ufs_rmdir

Status: upstream: reported on 2024/05/10 04:31
Reported-by: syzbot+1701d82d6c97830d6e81@syzkaller.appspotmail.com
First crash: 35d, last: 35d

Sample crash report:
uvm_fault(0xfffffd806924e418, 0x58, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      ufs_rmdir+0x278:        movl    0x58(%rax),%edx
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 56969  74974      0   0x8000002          0    0  syz-executor.5
ufs_rmdir(ffff8000377b6e98) at ufs_rmdir+0x278 sys/ufs/ufs/ufs_vnops.c:1270
VOP_RMDIR(fffffd80530eb1c0,fffffd806b741cb0,ffff8000377b6f78) at VOP_RMDIR+0x12a sys/kern/vfs_vops.c:407
dounlinkat(ffff80002a5d79a8,ffffff9c,71cba698f850,8) at dounlinkat+0x20e sys/kern/vfs_syscalls.c:1888
syscall(ffff8000377b70f0) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x71cba698f840, count: 10
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd806924e418, 0x58, 0, 1) -> e
ddb> trace
ufs_rmdir(ffff8000377b6e98) at ufs_rmdir+0x278 sys/ufs/ufs/ufs_vnops.c:1270
VOP_RMDIR(fffffd80530eb1c0,fffffd806b741cb0,ffff8000377b6f78) at VOP_RMDIR+0x12a sys/kern/vfs_vops.c:407
dounlinkat(ffff80002a5d79a8,ffffff9c,71cba698f850,8) at dounlinkat+0x20e sys/kern/vfs_syscalls.c:1888
syscall(ffff8000377b70f0) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x71cba698f840, count: -5
ddb> show registers
rdi                              0x1
rsi                              0x2
rbp               0xffff8000377b6e80
rbx               0xfffffd806b1fc878
rdx                                0
rcx               0xffffffff82c46ff0    cpu_info_full_primary+0x1ff0
rax                                0
r8                               0x2
r9                                 0
r10               0x63a58eae884bbdd3
r11               0xffffffff82635f70    ffs_truncate
r12               0xfffffd806e8074c0
r13                                0
r14               0xfffffd806b741cb0
r15               0xfffffd80530eb1c0
rip               0xffffffff81d494e8    ufs_rmdir+0x278
cs                               0x8
rflags                       0x10206    __ALIGN_SIZE+0xf206
rsp               0xffff8000377b6e20
ss                              0x10
ufs_rmdir+0x278:        movl    0x58(%rax),%edx
ddb> show proc
PROC (syz-executor.5) tid=56969 pid=74974 tcnt=1 stat=onproc
    flags process=8000002<EXEC> proc=0
    runpri=17, usrpri=84, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0
    forw=0xffffffffffffffff, list=0xffff80002a678a60,0xffff80002a6d2d10
    process=0xffff8000329890d8 user=0xffff8000377b2000, vmspace=0xfffffd806924e418
    estcpu=34, cpticks=0, pctcpu=0.19, user=0, sys=19, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 81792  358334  87136      0  2   0x8000000                syz-executor.0
 81792  399125  87136      0  2   0xc000000                syz-executor.0
 81792  108483  87136      0  3   0xc000080  fsleep        syz-executor.0
 74653  321407  58551      0  2   0x8000000                syz-executor.6
 74653  278307  58551      0  3   0xc000080  fsleep        syz-executor.6
  3202  210668   1291      0  2   0x8000000                syz-executor.4
  3202  323376   1291      0  3   0xc000080  fsleep        syz-executor.4
  3202  225300   1291      0  3   0xc000080  sbwait        syz-executor.4
 20257  171141  40375      0  2   0xc000000                syz-executor.2
 20257  370140  40375      0  2   0xc000000                syz-executor.2
 88770   55936  69762      0  2   0x8000002                syz-executor.1
 58551   24186  69762      0  2   0x8000482                syz-executor.6
*74974   56969  69762      0  7   0x8000002                syz-executor.5
  7504    8587  69762      0  2   0x8000482                syz-executor.3
 40375  387941  69762      0  2   0x8000482                syz-executor.2
 53830  138241  69762      0  2   0x8000482                syz-executor.7
  1291  210174  69762      0  2   0x8000482                syz-executor.4
 87136  190753  69762      0  2   0x8000482                syz-executor.0
 54905  377996  20523      0  3  0x18100082  netio         ndp
 20523  170527      1      0  3   0x810008a  sigsusp       sh
 31932  178683      1      0  2  0x18100083                getty
 23121  324242  36667      0  3  0x18100082  netio         ndp
 36667  164812      1      0  3   0x810008a  sigsusp       sh
 88815  427072  13194      0  3  0x18100082  netio         arp
 13194  228307      1      0  3   0x810008a  sigsusp       sh
 55849  203231      0      0  3     0x14280  nfsidl        nfsio
 18847   85348      0      0  3     0x14280  nfsidl        nfsio
  5539   57908      0      0  3     0x14280  nfsidl        nfsio
 19191  315412      0      0  3     0x14280  nfsidl        nfsio
 32243  192463      0      0  3     0x14280  nfsidl        nfsio
 86655  375004      0      0  3     0x14280  nfsidl        nfsio
 10991  400528      0      0  3     0x14280  nfsidl        nfsio
 77471   23078      0      0  3     0x14280  nfsidl        nfsio
 56346  485320      0      0  3     0x14280  nfsidl        nfsio
 63913  342504      0      0  3     0x14280  nfsidl        nfsio
 82054  139594      0      0  3     0x14280  nfsidl        nfsio
 66871  177399      0      0  3     0x14280  nfsidl        nfsio
 13188   64098      0      0  3     0x14280  nfsidl        nfsio
 55671  132499      0      0  3     0x14280  nfsidl        nfsio
 74861  107129      0      0  3     0x14280  nfsidl        nfsio
 80821  207670      0      0  3     0x14280  nfsidl        nfsio
 68902  505939      0      0  3     0x14280  nfsidl        nfsio
 48992  153116      0      0  3     0x14280  nfsidl        nfsio
 21767  364417      0      0  3     0x14280  nfsidl        nfsio
 88871  361133      0      0  3     0x14280  nfsidl        nfsio
 61599  297316      0      0  3     0x14200  bored         sosplice
 69762  398551  85728      0  3  0x1a000082  wait          syz-fuzzer
 69762  317914  85728      0  2  0x1e000482                syz-fuzzer
 69762   46282  85728      0  3  0x1e000082  thrsleep      syz-fuzzer
 69762  377083  85728      0  3  0x1e000082  wait          syz-fuzzer
 69762  455200  85728      0  3  0x1e000082  thrsleep      syz-fuzzer
 69762  188429  85728      0  3  0x1e000082  wait          syz-fuzzer
 69762  188023  85728      0  3  0x1e000082  wait          syz-fuzzer
 69762  362855  85728      0  3  0x1e000082  wait          syz-fuzzer
 69762  483548  85728      0  2  0x1e000482                syz-fuzzer
 69762  488936  85728      0  3  0x1e000082  wait          syz-fuzzer
 69762  123170  85728      0  3  0x1e000082  thrsleep      syz-fuzzer
 69762  274307  85728      0  3  0x1e000082  wait          syz-fuzzer
 69762  132410  85728      0  3  0x1e000082  wait          syz-fuzzer
 69762   46734  85728      0  3  0x1e000082  thrsleep      syz-fuzzer
 69762  450803  85728      0  3  0x1e000082  thrsleep      syz-fuzzer
 85728  314969  36733      0  3   0x810008a  sigsusp       ksh
 36733  204751  77151      0  3  0x1800009a  kqread        sshd
 77151  486732      1      0  3  0x18000088  kqread        sshd
 54857  289802  46334     73  2  0x19100010                syslogd
 46334  212299      1      0  3  0x18100082  sbwait        syslogd
 73623  365654      1      0  3  0x18100080  kqread        resolvd
 63330  403037  70097     77  3  0x18100092  kqread        dhcpleased
 18331  363575  70097     77  3  0x18100092  kqread        dhcpleased
 70097  318588      1      0  3  0x18000080  kqread        dhcpleased
 52440  140710      0      0  2     0x14200                smr
 49045  392950      0      0  2     0x14200                zerothread
 28232  310157      0      0  3     0x14200  aiodoned      aiodoned
 19719  154647      0      0  3     0x14200  syncer        update
 84804   67399      0      0  3     0x14200  cleaner       cleaner
 95285  451085      0      0  3     0x14200  reaper        reaper
 60469   78219      0      0  3     0x14200  pgdaemon      pagedaemon
 76719   75248      0      0  3     0x14200  bored         viomb
  9499  416942      0      0  3  0x40014200  acpi0         acpi0
 89387  202731      0      0  3     0x14200  bored         softnet3
 84164  491706      0      0  3     0x14200  bored         softnet2
 98360  276350      0      0  3     0x14200  bored         softnet1
 60030   62927      0      0  3     0x14200  bored         softnet0
  8505  358215      0      0  3     0x14200  bored         systqmp
 36617  367287      0      0  3     0x14200  bored         systq
 23195  292364      0      0  2  0x40014200                softclock
  3980  353372      0      0  3  0x40014200                idle0
     1  499767      0      0  3   0x8000082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10200   6551K   10636K 166960K     14303        0
            pcb    17     13K      14K 166960K       240        0
         rtable   217      9K       9K 166960K      2915        0
             pf    32      9K       9K 166960K       266        0
         ifaddr    41     11K      12K 166960K       410        0
        ifgroup    55      2K       2K 166960K       489        0
         sysctl     4      1K       1K 166960K        10        0
       counters    31     17K      17K 166960K       139        0
       ioctlops     0      0K       2K 166960K       188        0
            iov     1      2K      24K 166960K       155        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1540     97K      97K 166960K      3968        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2     68K      72K 166960K        54        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K       178        0
        dirhash    12      2K       3K 166960K        66        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    21     77K     113K 166960K      2653        0
          sigio     0      0K       0K 166960K        33        0
           proc    58     59K     124K 166960K      2913        0
        subproc   143      8K       8K 166960K      1329        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       214        0
       in_multi    88      6K       7K 166960K      1054        0
    ether_multi     1      0K       0K 166960K        14        0
            mrt     1      0K       0K 166960K         7        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   157    705K     705K 166960K       157        0
           exec     0      0K       1K 166960K      1563        0
     pfkey data     0      0K       4K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   308    109K     131K 166960K     21032        0
       UVM aobj   102      5K       6K 166960K       113        0
     pinsyscall    44     88K     108K 166960K      6029        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        89        0
            NDP    12      0K       2K 166960K       301        0
           temp    74   6812K    6940K 166960K     40475        0
         kqueue    12     18K      27K 166960K       235        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      379    0      373     2     0     2     2     0     8    1
rtentry    112     1038    0      941     4     0     4     4     0     8    0
unpcb      144     1176    0     1157     6     0     6     6     0     8    5
syncache   336        4    0        4     1     0     1     1     0     8    1
sackhl      24        2    0        2     1     0     1     1     0     8    1
tcpqe       32       16    0       16     1     0     1     1     0     8    1
tcpcb      808      472    0      465     5     0     5     5     0     8    4
arp         88      189    0      173     1     0     1     1     0     8    0
ipq         40        6    0        5     1     0     1     1     0     8    0
ipqe        40       97    0       96     1     0     1     1     0     8    0
inpcb      352     1933    0     1923     5     0     5     5     0     8    4
nd6        104      271    0      250     1     0     1     1     0     8    0
pkpcb       40       82    0       82     1     0     1     1     0     8    1
kcovpl      48      102    0       91     1     0     1     1     0     8    0
ppxss      1072       9    0        9     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     4193    0     3778    82    53    29    30     0     8    0
art_table   32     4194    0     3778     4     0     4     4     0     8    0
art_node    16     1035    0      947     1     0     1     1     0     8    0
sysvmsgpl   40       17    0        5     1     0     1     1     0     8    0
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl     112      175    0      165     1     0     1     1     0     8    0
shmpl      112      110    0       11     3     0     3     3     0     8    0
dirhash    1024      53    0       36     3     0     3     3     0     8    0
dino2pl    256     4064    0     2547    96     0    96    96     0     8    0
ffsino     240     4064    0     2547    90     0    90    90     0     8    0
nchpl      144     6912    0     5175    66     0    66    66     0     8    0
uvmvnodes   80     6361    0        0   130     0   130   130     0     8    0
vnodes     216     6361    0        0   354     0   354   354     0     8    0
vnodes: pool(0xffffffff82dd4c50:vnodes): page inconsistency: page 0x0; at page head addr 0xfffffd806b741f90 (p 0xfffffd806b741000)
namei      1024   32406    0    32404     3     0     3     3     0     8    2
vcpupl     3904       6    0        1     1     0     1     1     0     8    0
vmpool     664        9    0        4     1     0     1     1     0     8    0
kstatmem   264      240    0      216     2     0     2     2     0     8    0
scxspl     216    50987    0    50987     8     0     8     8     1     8    8
plimitpl   152      319    0      300     1     0     1     1     0     8    0
sigapl     424     2789    0     2719     9     0     9     9     0     8    0
futexpl     64    25356    0    25353     1     0     1     1     0     8    0
knotepl    120     8479    0     8397    11     0    11    11     0     8    6
kqueuepl   184      518    0      507     3     0     3     3     0     8    2
pipepl     288      675    0      638     3     0     3     3     0     8    0
fdescpl    432     2752    0     2720     5     0     5     5     0     8    0
filepl     120    15268    0    14953    14     0    14    14     0     8    4
lockfpl    104      461    0      459     1     0     1     1     0     8    0
lockfspl    48      204    0      202     1     0     1     1     0     8    0
sessionpl  144      112    0       93     1     0     1     1     0     8    0
pgrppl      48      132    0      113     1     0     1     1     0     8    0
ucredpl    104     2125    0     2113     1     0     1     1     0     8    0
zombiepl   144     2721    0     2719     1     0     1     1     0     8    0
processpl  1072    2789    0     2719     6     0     6     6     0     8    0
procpl     656     4471    0     4381     9     0     9     9     0     8    1
sosppl     168       16    0       16     1     0     1     1     0     8    1
sockpl     504     3624    0     3588    35    23    12    22     0     8    7
mcl64k     65536     14    0       14     1     0     1     1     0     8    1
mcl12k     12288      1    0        1     1     0     1     1     0     8    1
mcl8k      8192      38    0       37     1     0     1     1     0     8    0
mcl4k      4096      14    0       14     1     0     1     1     0     8    1
mcl2k2     2112       2    0        2     1     0     1     1     0     8    1
mcl2k      2048   29072    0    28974    37    17    20    37     0     8    5
mtagpl      96       68    0       66     1     0     1     1     0     8    0
mbufpl     256    79597    0    79393    85    59    26    71     0     8    7
bufpl      280    10627    0     2557   577     0   577   577     0     8    0
anonpl      24   482147    0   475370    97     0    97    97     0   188   43
amapchunkpl 152   69239    0    68526    49     0    49    49     0   158   15
amappl16   200     9765    0     9631    45    29    16    22     0     8    7
amappl15   192      125    0      124     1     0     1     1     0     8    0
amappl14   184      481    0      463     2     0     2     2     0     8    0
amappl13   176        9    0        9     1     0     1     1     0     8    1
amappl12   168     4638    0     4603     3     0     3     3     0     8    0
amappl11   160       68    0       58     1     0     1     1     0     8    0
amappl10   152      195    0      185     1     0     1     1     0     8    0
amappl9    144      169    0      169     1     0     1     1     0     8    1
amappl8    136      298    0      267     2     0     2     2     0     8    0
amappl7    128       62    0       46     1     0     1     1     0     8    0
amappl6    120     1407    0     1385     2     0     2     2     0     8    1
amappl5    112      506    0      494     1     0     1     1     0     8    0
amappl4    104     1096    0     1059     2     0     2     2     0     8    0
amappl3     96    12599    0    12505     3     0     3     3     0     8    0
amappl2     88     3407    0     3326     4     0     4     4     0     8    1
amappl1     80    22690    0    22109    22     2    20    22     0     8    6
amappl      88    19801    0    19593     6     0     6     6     0    92    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      112    0       11     2     0     2     2     0     8    0
uaddrrnd    24     2761    0     2724     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2761    0     2724     1     0     1     1     0     8    0
vmmpekpl   168    25159    0    25089     4     0     4     4     0     8    0
vmmpepl    168   211743    0   209702   112     0   112   112     0   357   17
vmsppl     344     2760    0     2724     5     0     5     5     0     8    0
rwobjpl     24    59900    0    52200    47     0    47    47     0     8    0
pdppl      4096    5528    0     5453   315   233    82    94     0     8    7
pvpl        32  1279923    0  1266192   367    15   352   367     0   265  226
pmappl     216     2760    0     2724     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      762    0      385    13     0    13    13     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
ufs_rmdir(ffff8000377b6e98) at ufs_rmdir+0x278 sys/ufs/ufs/ufs_vnops.c:1270
VOP_RMDIR(fffffd80530eb1c0,fffffd806b741cb0,ffff8000377b6f78) at VOP_RMDIR+0x12a sys/kern/vfs_vops.c:407
dounlinkat(ffff80002a5d79a8,ffffff9c,71cba698f850,8) at dounlinkat+0x20e sys/kern/vfs_syscalls.c:1888
syscall(ffff8000377b70f0) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x71cba698f840, count: -5
ddb> machine ddbcpu 1
No such command
ddb> trace
ufs_rmdir(ffff8000377b6e98) at ufs_rmdir+0x278 sys/ufs/ufs/ufs_vnops.c:1270
VOP_RMDIR(fffffd80530eb1c0,fffffd806b741cb0,ffff8000377b6f78) at VOP_RMDIR+0x12a sys/kern/vfs_vops.c:407
dounlinkat(ffff80002a5d79a8,ffffff9c,71cba698f850,8) at dounlinkat+0x20e sys/kern/vfs_syscalls.c:1888
syscall(ffff8000377b70f0) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x71cba698f840, count: -5

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/10 04:31 openbsd fbadb84b3757 de979bc2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_rmdir
* Struck through repros no longer work on HEAD.