syzbot


pool: free list modified: pdppl (4)

Status: upstream: reported on 2024/04/28 16:05
Reported-by: syzbot+1a3f5900c4cc24e98d1d@syzkaller.appspotmail.com
First crash: 89d, last: 71d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: pdppl (3) 1 643d 643d 0/3 auto-obsoleted due to no activity on 2023/01/20 06:59
openbsd pool: free list modified: pdppl 1 1728d 1728d 0/3 closed as invalid on 2019/11/03 08:39
openbsd pool: free list modified: pdppl (2) 1 960d 960d 0/3 auto-closed as invalid on 2022/03/09 08:14

Sample crash report:
panic: pool_do_get: pdppl free list modified: page 0xfffffd807d177000; item addr 0xfffffd807d177000; offset 0x0=0x4a10ded730a56710 != 0x4a10ded730a56750
Starting stack trace...
panic(ffffffff82889b0b) at panic+0x16f sys/kern/subr_prf.c:229
pool_do_get(ffffffff82df3ce8,1,ffff8000309e1388) at pool_do_get+0x443
pool_get(ffffffff82df3ce8,1) at pool_get+0xf0 sys/kern/subr_pool.c:582
pmap_create() at pmap_create+0x144 sys/arch/amd64/amd64/pmap.c:1369
uvmspace_fork(ffff80002a22b9f0) at uvmspace_fork+0x64 uvmspace_init sys/uvm/uvm_map.c:3302 [inline]
uvmspace_fork(ffff80002a22b9f0) at uvmspace_fork+0x64 uvmspace_alloc sys/uvm/uvm_map.c:3280 [inline]
uvmspace_fork(ffff80002a22b9f0) at uvmspace_fork+0x64 sys/uvm/uvm_map.c:3852
process_new(ffff80002dd8c578,ffff80002a22b9f0,1) at process_new+0x3dc sys/kern/kern_fork.c:278
fork1(ffff80002dd8d768,1,ffffffff81f8e6a0,0,ffff8000309e1610,0) at fork1+0x2ef sys/kern/kern_fork.c:399
syscall(ffff8000309e16c0) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff8000309e16c0) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x77750f015840, count: 248
End of stack trace.

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/17 00:38 openbsd b20edd337af0 ad5321c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: pdppl
2024/05/07 12:34 openbsd debf255c65d9 cb2dcc0e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: pdppl
2024/05/07 07:48 openbsd 21e142091427 fa7a5cf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: pdppl
2024/05/04 12:30 openbsd c604ab84837e 610f2a54 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: pdppl
2024/05/01 02:26 openbsd ab0363c32c56 3ba885bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: pdppl
2024/04/28 16:04 openbsd b98581f594cd 07b455f9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: pdppl
* Struck through repros no longer work on HEAD.