syzbot


protection_fault: reaper

Status: upstream: reported on 2024/08/13 05:13
Reported-by: syzbot+1be774028d4a6ca2c5c7@syzkaller.appspotmail.com
First crash: 34d, last: 11d

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      reaper+0x322:   movq    0x8(%rax),%rdi
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> trace
reaper(ffff800029fd8cb0) at reaper+0x322 sys/kern/kern_exit.c:492
end trace frame: 0x0, count: -1
ddb{1}> show registers
rdi                                0
rsi                          0x40000    acpi_pdirpa+0x2be71
rbp               0xffff800029fe5620
rbx                                0
rdx                                0
rcx               0xffff800029fd8cb0
rax               0xdeaf4152deaf4152
r8                              0x65
r9                               0x1
r10               0xf1cb1db4ca414aa3
r11               0x8f435fd7746de330
r12                          0x40000    acpi_pdirpa+0x2be71
r13               0xffffffff8347cff0    cpu_info_full_primary+0x1ff0
r14               0xffff8000309a7af8
r15                          0x41018    acpi_pdirpa+0x2ce89
rip               0xffffffff81f36d72    reaper+0x322
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800029fe55f0
ss                              0x10
reaper+0x322:   movq    0x8(%rax),%rdi
ddb{1}> show proc
PROC (reaper) tid=482552 pid=91790 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=32, usrpri=52, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800029fd8f38,0xffff800029fd8a38
    process=0xffff800029feb1e0 user=0xffff800029fe0000, vmspace=0xffffffff834fc920
    estcpu=2, cpticks=9, pctcpu=3.13, user=0, sys=75067, intr=5833
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 37718  175851     58  32767  2        0x10                syz-executor
 37718  134466     58  32767  3   0x4000090  fsleep        syz-executor
 27068  150041  72729  32767  2        0x10                syz-executor
 27068  472603  72729  32767  3   0x4000090  ttyout        syz-executor
 65497  385375    549  32767  7        0x10                syz-executor
 65497  496184    549  32767  2   0x4000010                syz-executor
 34146  517057  79251  32767  2        0x10                syz-executor
 34146  245238  79251  32767  3   0x4000090  ttyretype     syz-executor
 34146  276886  79251  32767  3   0x4000090  fsleep        syz-executor
 82774  375113  56602  32767  3        0x90  nanoslp       syz-executor
 82774   15398  56602  32767  3   0x4000090  fsleep        syz-executor
 82774  175819  56602  32767  3   0x4000090  sbwait        syz-executor
 86148  509376  41020  32767  3        0x90  nanoslp       syz-executor
 86148  152827  41020  32767  3   0x4000090  sbwait        syz-executor
 86148  199211  41020  32767  3   0x4000090  fsleep        syz-executor
 11385  383829  85665  32767  3        0x90  nanoslp       syz-executor
 11385  469317  85665  32767  3   0x4000090  kqsel         syz-executor
 11385  394280  85665  32767  3   0x4000090  netacc        syz-executor
 11385  325057  85665  32767  3   0x4000090  fsleep        syz-executor
 41020  369991  71029  32767  3        0x90  nanoslp       syz-executor
 71029  237187  56971      0  3        0x82  wait          syz-executor
    58  279580   3606  32767  3        0x90  nanoslp       syz-executor
  3606  198893  56971      0  3        0x82  wait          syz-executor
 56602  141952  26664  32767  3        0x90  nanoslp       syz-executor
 26664  192953  56971      0  3        0x82  wait          syz-executor
 74474  248297  86132  32767  2        0x10                syz-executor
 86132  150236  56971      0  3        0x82  wait          syz-executor
   549  178868  56000  32767  3        0x90  nanoslp       syz-executor
 56000  518696  56971      0  3        0x82  wait          syz-executor
 79251  303368  27897  32767  2        0x10                syz-executor
 27897  243979  56971      0  3        0x82  wait          syz-executor
 85665  428087  95315  32767  3        0x90  nanoslp       syz-executor
 95315  254249  56971      0  3        0x82  wait          syz-executor
 72729  314300  63113  32767  3        0x90  nanoslp       syz-executor
 63113  282476  56971      0  3        0x82  wait          syz-executor
 66509  264723  34686      0  3    0x100082  sbwait        arp
 34686   32315  38034      0  3    0x10008a  sigsusp       sh
 38034   32250      1      0  3        0x80  wait          syz-executor
 37267  235526  16458      0  3    0x100082  sbwait        arp
 16458   83604  37616      0  3    0x10008a  sigsusp       sh
 37616  154817      1      0  3        0x80  wait          syz-executor
 63424  213673      0      0  3     0x14200  bored         sosplice
 32603   39126   5255      0  3    0x100082  sbwait        arp
  5255  475566  50862      0  3    0x10008a  sigsusp       sh
 50862  461468      1      0  3        0x80  wait          syz-executor
 56971  421652  21781      0  3        0x82  kqread        syz-executor
 21781  204946  58462      0  3    0x10008a  sigsusp       ksh
 58462   60721  66381      0  3        0x98  kqread        sshd-session
 66381  236500  86645      0  3        0x92  kqread        sshd-session
 11759  241192      1      0  3    0x100083  ttyin         getty
 86645  516689      1      0  3        0x88  kqread        sshd
 90537  237095  17256     73  3   0x1100090  kqread        syslogd
 17256  344383      1      0  3    0x100082  sbwait        syslogd
 63848   84375      1      0  3    0x100080  kqread        resolvd
 21959  515255  88632     77  3    0x100092  kqread        dhcpleased
 15142  442319  88632     77  3    0x100092  kqread        dhcpleased
 88632  115143      1      0  3        0x80  kqread        dhcpleased
 67717  267675      0      0  3     0x14200  bored         smr
  7412    5126      0      0  2     0x14200                zerothread
 28276  150422      0      0  3     0x14200  aiodoned      aiodoned
 14900  488819      0      0  3     0x14200  syncer        update
 62646  482451      0      0  3     0x14200  cleaner       cleaner
*91790  482552      0      0  7     0x14200                reaper
 12386  172019      0      0  3     0x14200  pgdaemon      pagedaemon
 51553  305968      0      0  3     0x14200  bored         viomb
 40109  179464      0      0  3  0x40014200  acpi0         acpi0
 15444  289605      0      0  3  0x40014200                idle1
 13795  136465      0      0  3     0x14200  bored         softnet3
 35665  240463      0      0  3     0x14200  bored         softnet2
 51401  443188      0      0  3     0x14200  bored         softnet1
 91135  271302      0      0  3     0x14200  bored         softnet0
 26165  368992      0      0  3     0x14200  bored         systqmp
  1485   74575      0      0  3     0x14200  bored         systq
 11817  163149      0      0  3     0x14200  tmoslp        softclockmp
 90717  416195      0      0  3  0x40014200  tmoslp        softclock
 55613  366314      0      0  3  0x40014200                idle0
     1  365757      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 91790 (reaper) thread 0xffff800029fd8cb0 (482552)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83592528)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  __mp_acquire_count+0x58
#2  mi_switch+0x658 sys/kern/sched_bsd.c:460
#3  sleep_finish+0x219 sys/kern/kern_synch.c:416
#4  rw_enter+0x348 sys/kern/kern_rwlock.c:285
#5  knote_processexit+0x2b sys/kern/kern_event.c:2063
#6  reaper+0x2ad sys/kern/kern_exit.c:490
#7  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10222  10028K   10035K 166960K     12700        0
            pcb    17     18K      20K 166960K        23        0
         rtable   242      6K       7K 166960K     15122        0
             pf    31     16K      16K 166960K       976        0
         ifaddr    42     11K      11K 166960K      1906        0
        ifgroup    50      2K       2K 166960K      1927        0
         sysctl     4      1K       5K 166960K         9        0
       counters    64     36K      36K 166960K       996        0
       ioctlops     0      0K       2K 166960K       662        0
            iov     1      2K      18K 166960K      1340        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1508     95K      95K 166960K     12088        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K       232        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K       749        0
        dirhash    15      2K       3K 166960K       396        0
           ACPI  1690    195K     286K 166960K     12418        0
      file desc    34    129K     197K 166960K     19346        0
          sigio     0      0K       0K 166960K       341        0
           proc    56     78K     176K 166960K     14730        0
        subproc   143      8K      15K 166960K      8333        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K      3471        0
       in_multi    99      7K       8K 166960K      5804        0
    ether_multi     1      0K       0K 166960K       108        0
            mrt     2      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   271   1208K    1208K 166960K       271        0
           exec     0      0K       1K 166960K      8790        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   327    101K     165K 166960K    150681        0
       UVM aobj   131      4K       6K 166960K       136        0
     pinsyscall    58    116K     152K 166960K     32763        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       1K 166960K      1028        0
            NDP    11      0K       2K 166960K      1413        0
           temp    87   6824K    6952K 166960K    147919        0
         kqueue    15     22K      37K 166960K      2244        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120     2885    0     2879    20    19     1     4     0     8    0
rtentry    112     5356    0     5242    18    14     4     4     0     8    0
unpcb      144    15033    0    15012   101   100     1    11     0     8    0
syncache   336      153    0      153    35    35     0     1     0     8    0
tcpqe       32       46    0       46    21    21     0     1     0     8    0
tcpcb      808     9535    0     9524   238   236     2    18     0     8    0
arp        120      956    0      938     1     0     1     1     0     8    0
ipq         40       72    0       70     5     4     1     1     0     8    0
ipqe        40      641    0      639     5     4     1     1     0     8    0
inpcb      336    23707    0    23689   280   275     5    21     0     8    3
ip6q        72       39    0       39     5     5     0     1     0     8    0
ip6af       40       78    0       78     5     5     0     1     0     8    0
nd6        136     1559    0     1531     7     5     2     2     0     8    0
kcovpl      48      641    0      630     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256    21737    0    21267   213   181    32    32     0     8    0
art_table   32    21738    0    21267    10     5     5     5     0     8    0
art_node    16     5355    0     5251     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        2     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      747    0      737     1     0     1     1     0     8    0
shmpl      112      133    0        5     4     0     4     4     0     8    0
dirhash    1024     280    0      257    18    14     4     4     0     8    1
dino2pl    256    21082    0    18122   188     2   186   186     0     8    0
ffsino     272    21082    0    18122   200     2   198   198     0     8    0
nchpl      144    37366    0    34583   104     0   104   104     0     8    0
uvmvnodes   80    10098    0        0   207     0   207   207     0     8    0
vnodes     216    10098    0        0   561     0   561   561     0     8    0
namei      1024  180597    0   180597    31    30     1     2     0     8    1
percpumem   16      512    0      466     1     0     1     1     0     8    0
kstatmem   264      954    0      932     3     1     2     2     0     8    0
scxspl     216   266165    0   266165    72    69     3     8     1     8    3
plimitpl   152     5084    0     5054     3     1     2     2     0     8    0
sigapl     424    18435    0    18370    18     9     9    10     0     8    0
futexpl     64   172208    0   172203    31    30     1     1     0     8    0
knotepl    120     1572    0        0    19     1    18    18     0     8    0
kqueuepl   216     5012    0     4999    62    61     1    12     0     8    0
pipepl     320     4220    0     4184    45    39     6     9     0     8    1
fdescpl    496    18416    0    18370    18    11     7     8     0     8    0
filepl     152   118248    0   117930   104    87    17    23     0     8    0
lockfpl    104     4373    0     4371     4     3     1     2     0     8    0
lockfspl    48     1171    0     1169     1     0     1     1     0     8    0
sessionpl  144      556    0      537     2     0     2     2     0     8    0
pgrppl      48     1476    0     1449     1     0     1     1     0     8    0
ucredpl    104    21819    0    21800     1     0     1     1     0     8    0
zombiepl   144    18370    0    18370     1     0     1     1     0     8    1
processpl  1160   18435    0    18370     8     2     6     6     0     8    0
procpl     648    37982    0    37905    16     8     8     8     0     8    0
srpgc       96       47    0       47    18    18     0     1     0     8    0
sosppl     168      227    0      227    41    40     1     1     0     8    1
sockpl     664    41987    0    41942   393   386     7    26     0     8    3
mcl64k     65536     26    0        0     3     0     3     3     0     8    0
mcl16k     16384      9    0        0     2     0     2     2     0     8    0
mcl12k     12288      8    0        0     1     0     1     1     0     8    0
mcl9k      9216       4    0        0     1     0     1     1     0     8    0
mcl8k      8192      17    0        0     3     0     3     3     0     8    0
mcl4k      4096       9    0        0     2     0     2     2     0     8    0
mcl2k2     2112       3    0        0     1     0     1     1     0     8    0
mcl2k      2048     738    0        0    28     8    20    27     0     8    0
mtagpl      96        4    0        0     1     0     1     1     0     8    0
mbufpl     256     2533    0        0   136     0   136   136     0     8    0
bufpl      280    28642    0    18536   722     0   722   722     0     8    0
anonpl      24  2328569    0  2318403   345   253    92   112     0   185    2
amapchunkpl 152  478689    0   477770   224   180    44    53     0   158    4
amappl16   200    48898    0    48691   387   362    25    36     0     8    7
amappl15   192       11    0       10     1     0     1     1     0     8    0
amappl14   184     1180    0     1167     1     0     1     1     0     8    0
amappl13   176       41    0       41     6     6     0     1     0     8    0
amappl12   168    26611    0    26561     6     3     3     3     0     8    0
amappl11   160       60    0       50     1     0     1     1     0     8    0
amappl10   152        8    0        7     2     1     1     1     0     8    0
amappl9    144      160    0      158     1     0     1     1     0     8    0
amappl8    136       21    0       18     1     0     1     1     0     8    0
amappl7    128     1160    0     1146     1     0     1     1     0     8    0
amappl6    120     4792    0     4787     1     0     1     1     0     8    0
amappl5    112     2053    0     2044     1     0     1     1     0     8    0
amappl4    104     2059    0     2038     1     0     1     1     0     8    0
amappl3     96    84828    0    84690     4     0     4     4     0     8    0
amappl2     88    20280    0    20184     3     0     3     3     0     8    0
amappl1     80   112068    0   111421    18     1    17    17     0     8    0
amappl      88   145636    0   145375     8     1     7     7     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      135    0        5     3     0     3     3     0     8    0
uaddrrnd    24    18416    0    18370     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    18416    0    18370     1     0     1     1     0     8    0
vmmpekpl   168   169273    0   169202     8     4     4     5     0     8    0
vmmpepl    168  1156835    0  1154230   349   219   130   138     0   357    2
vmsppl     440    18415    0    18370    12     5     7     7     0     8    0
rwobjpl     56   307070    0   295551   197    29   168   169     0     8    1
pdppl      4096   36839    0    36740  1509  1406   103   133     0     8    4
pvpl        32    52209    0        0   408     0   408   408     0   265    0
pmappl     248    18415    0    18370     5     1     4     4     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     2890    0     2191    22     1    21    21     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff8347cff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x785c3cd56540, count: -3
ddb{0}> machine ddbcpu 1
Stopped at      reaper+0x322:   movq    0x8(%rax),%rdi
ddb{1}> trace
reaper(ffff800029fd8cb0) at reaper+0x322 sys/kern/kern_exit.c:492
end trace frame: 0x0, count: -1

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/05 05:16 openbsd ebe65f64a6a1 dfbe2ed4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid protection_fault: reaper
2024/09/04 08:15 openbsd be4dcae9074d 9d47f20a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid protection_fault: reaper
2024/08/17 22:39 openbsd ef61d0404a18 dbc93b08 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid protection_fault: reaper
2024/08/13 05:12 openbsd 6fd6d0214b92 7b0f4b46 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: reaper
* Struck through repros no longer work on HEAD.