syzbot


uvm_fault: filt_bpfrdetach

Status: fixed on 2019/10/22 13:03
Reported-by: syzbot+173a8db455144df8f505@syzkaller.appspotmail.com
Fix commit: put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
First crash: 1860d, last: 1860d

Sample crash report:
login: uvm_fault(0xfffffd803f013440, 0x8, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      filt_bpfrdetach+0x48:   movq    0x8(%r15),%r12
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xfffffd803f013440, 0x8, 0, 1) -> e
filt_bpfrdetach(fffffd80363af540) at filt_bpfrdetach+0x48 sys/net/bpf.c:1199
end trace frame: 0xffff800014942360, count: 0
ddb> trace
filt_bpfrdetach(fffffd80363af540) at filt_bpfrdetach+0x48 sys/net/bpf.c:1199
knote_fdclose(ffff8000ffff5648,8) at knote_fdclose+0x96 knote_remove sys/kern/kern_event.c:953 [inline]
knote_fdclose(ffff8000ffff5648,8) at knote_fdclose+0x96 sys/kern/kern_event.c:973
fdfree(ffff8000ffff5648) at fdfree+0xed sys/kern/kern_descrip.c:1195
exit1(ffff8000ffff5648,0,1) at exit1+0x32f sys/kern/kern_exit.c:196
sys_exit(ffff8000ffff5648,ffff800014942480,ffff8000149424d0) at sys_exit+0x17 sys/kern/kern_exit.c:94
syscall(ffff800014942550) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,1,0,1,0,7f7ffffc2754) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2720, count: -7
ddb> show registers
rdi               0xfffffd80363af540
rsi                              0x8
rbp               0xffff800014942300
rbx                              0x8
rdx                             0x20
rcx               0xfffffd80331f3a10
rax               0xffffffff824f8e98    bpfread_filtops
r8                                 0
r9                               0x5
r10               0xa8d62566123c86c5
r11               0x133931cff2816dd9
r12               0xffff800000a73b00
r13               0xfffffd8036223b60
r14               0xfffffd80363af540
r15                                0
rip               0xffffffff8210ac88    filt_bpfrdetach+0x48
cs                               0x8
rflags                       0x10207    __ALIGN_SIZE+0xf207
rsp               0xffff8000149422d0
ss                              0x10
filt_bpfrdetach+0x48:   movq    0x8(%r15),%r12
ddb> show proc
PROC (syz-executor.1) pid=10860 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    pri=32, usrpri=52, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff93c8,0xffffffff8255d430
    process=0xffff8000ffff70f0 user=0xffff80001493d000, vmspace=0xfffffd803f013440
    estcpu=2, cpticks=5, pctcpu=0.19
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 35332  284917   7707      0  2       0x482                syz-executor.1
 76467   20776   7707      0  2       0x482                syz-executor.0
  7707  195798    226      0  3        0x82  thrsleep      syz-execprog
  7707  319505    226      0  3   0x4000082  thrsleep      syz-execprog
  7707  492290    226      0  3   0x4000082  thrsleep      syz-execprog
  7707  375543    226      0  3   0x4000082  thrsleep      syz-execprog
  7707   78307    226      0  3   0x4000082  thrsleep      syz-execprog
  7707    2250    226      0  3   0x4000082  kqread        syz-execprog
  7707    6963    226      0  3   0x4000082  thrsleep      syz-execprog
   226   29519  84932      0  3    0x10008a  pause         ksh
 84932  417011  64388      0  3        0x92  select        sshd
 90876  471069      1      0  3    0x100083  ttyin         getty
 64388   39501      1      0  3        0x80  select        sshd
 12347  327039   4469     73  2    0x100090                syslogd
  4469  383775      1      0  3    0x100082  netio         syslogd
  9390  411699      1     77  3    0x100090  poll          dhclient
 85330  429855      1      0  3        0x80  poll          dhclient
 37839  301561      0      0  2     0x14200                zerothread
 87455  305127      0      0  3     0x14200  aiodoned      aiodoned
 60803   75566      0      0  3     0x14200  syncer        update
 63530  304323      0      0  3     0x14200  cleaner       cleaner
 54009  122194      0      0  3     0x14200  reaper        reaper
 75939   46059      0      0  3     0x14200  pgdaemon      pagedaemon
 74476  447156      0      0  3     0x14200  bored         crynlk
 42127  302813      0      0  3     0x14200  bored         crypto
 24341   88781      0      0  3  0x40014200  acpi0         acpi0
 87791  464846      0      0  3     0x14200  bored         softnet
 91851  359794      0      0  3     0x14200  bored         systqmp
 56306  114780      0      0  3     0x14200  bored         systq
 64599  243290      0      0  3  0x40014200  bored         softclock
 16915  426941      0      0  3  0x40014200                idle0
 24586  462229      0      0  3     0x14200  bored         smr
     1    7523      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9440   6311K    6632K  78643K     10561        0        0
            pcb    13      8K       8K  78643K        13        0        0
         rtable    65      2K       3K  78643K       203        0        0
         ifaddr    22      7K       9K  78643K        35        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K        15        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1191     75K      75K  78643K      1205        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       1K  78643K         2        0        0
         VM map     2      0K       0K  78643K         2        0        0
            sem     2      0K       0K  78643K         2        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12645        0        0
      file desc     4     12K      24K  78643K        35        0        0
           proc    47     38K      63K  78643K       347        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
       in_multi    11      0K       2K  78643K        33        0        0
    ether_multi     1      0K       0K  78643K         1        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    18     79K      79K  78643K        18        0        0
           exec     0      0K       1K  78643K       185        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    76     19K      20K  78643K       903        0        0
       UVM aobj     2      2K       2K  78643K         2        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
            NDP     3      0K       0K  78643K         9        0        0
           temp    37   3537K    3589K  78643K      3193        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        6    0        4     1     0     1     1     0     8    0
rtpcb       80       19    0       17     1     0     1     1     0     8    0
rtentry    112       45    0       21     2     0     2     2     0     8    0
unpcb      120       31    0       23     1     0     1     1     0     8    0
syncache   264        5    0        5     2     2     0     1     0     8    0
tcpcb      544        8    0        5     1     0     1     1     0     8    0
inpcb      280       30    0       24     1     0     1     1     0     8    0
nd6         48        4    0        4     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      213    0       90    14     0    14    14     0     8    4
art_table   32      214    0       90     2     0     2     2     0     8    0
art_node    16       44    0       22     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1424    0       21    46     0    46    46     0     8    0
ffsino     240     1424    0       21    83     0    83    83     0     8    0
nchpl      144     1669    0       48    61     0    61    61     0     8    0
uvmvnodes   72     1451    0        0    27     0    27    27     0     8    0
vnodes     208     1451    0        0    77     0    77    77     0     8    0
namei      1024    3983    0     3983     2     1     1     1     0     8    1
scxspl     192     4181    0     4181     9     6     3     7     0     8    3
plimitpl   152       15    0        8     1     0     1     1     0     8    0
sigapl     432      211    0      198     2     0     2     2     0     8    0
futexpl     56      135    0      135     1     0     1     1     0     8    1
knotepl    112       69    0       46     1     0     1     1     0     8    0
kqueuepl   104       26    0       14     1     0     1     1     0     8    0
pipepl     112      146    0      127     2     1     1     1     0     8    0
fdescpl    424      212    0      198     2     0     2     2     0     8    0
filepl     120     1065    0      982     4     0     4     4     0     8    0
lockfpl    104        5    0        4     1     0     1     1     0     8    0
lockfspl    48        3    0        2     1     0     1     1     0     8    0
sessionpl  112       19    0        9     1     0     1     1     0     8    0
pgrppl      48       19    0        9     1     0     1     1     0     8    0
ucredpl     96       47    0       40     1     0     1     1     0     8    0
zombiepl   144      199    0      197     2     1     1     1     0     8    0
processpl  864      226    0      197     4     0     4     4     0     8    0
procpl     632      242    0      207     4     0     4     4     0     8    1
sockpl     384       80    0       64     2     0     2     2     0     8    0
mcl4k      4096      10    0       10     2     1     1     1     0     8    1
mcl2k      2048    5496    0     5456     9     3     6     9     0     8    0
mtagpl      80        2    0        2     1     1     0     1     0     8    0
mbufpl     256     9660    0     9615    10     2     8     8     0     8    3
bufpl      256     5796    0     1327   280     0   280   280     0     8    0
anonpl      16    21959    0    19730    15     1    14    14     0    62    3
amapchunkpl 152     970    0      899     5     0     5     5     0   158    0
amappl16   192      221    0      148     6     0     6     6     0     8    0
amappl15   184        4    0        1     1     0     1     1     0     8    0
amappl14   176       31    0       27     2     1     1     1     0     8    0
amappl12   160        7    0        5     2     1     1     1     0     8    0
amappl11   152       43    0       32     1     0     1     1     0     8    0
amappl10   144        8    0        6     1     0     1     1     0     8    0
amappl9    136      430    0      424     1     0     1     1     0     8    0
amappl8    128      121    0      109     1     0     1     1     0     8    0
amappl7    120       40    0       37     1     0     1     1     0     8    0
amappl6    112       71    0       63     1     0     1     1     0     8    0
amappl5    104      135    0      126     1     0     1     1     0     8    0
amappl4     96      442    0      417     1     0     1     1     0     8    0
amappl3     88      118    0      112     1     0     1     1     0     8    0
amappl2     80      889    0      824     4     1     3     3     0     8    1
amappl1     72    14029    0    13620    25     8    17    20     0     8    8
amappl      80      457    0      424     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      212    0      198     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      212    0      198     1     0     1     1     0     8    0
vmmpekpl   168     6282    0     6264     2     0     2     2     0     8    1
vmmpepl    168    30279    0    29306    93    16    77    77     0   357   30
vmsppl     272      211    0      198     2     0     2     2     0     8    1
pdppl      4096     430    0      396     6     0     6     6     0     8    0
pvpl        32   107733    0   103178   121     7   114   114     0   265   72
pmappl     200      211    0      198     1     0     1     1     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      415    0        9    12     0    12    12     0     8    0
ddb> 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/22 06:00 openbsd 09b707593b26 c59a7cd8 .config console log report syz ci-openbsd-main
* Struck through repros no longer work on HEAD.