syzbot
uvm_fault: wsevent_fini
Status:
fixed on 2020/03/24 16:19
Reported-by: syzbot+34c3041bfd96c888c8bd@syzkaller.appspotmail.com
Fix commit:
be78d62e13f6
Ensure that me_evp is still NULL before assignment during open of wscons devices. This condition is checked early on during open but since the same routine could end up sleeping before assigning me_evp, a race against adding the same wscons device to a wsmux could be lost. This in turn can cause a NULL deference during close.
First crash: 2376d, last: 2376d
Sample crash report:
uvm_fault(0xfffffd807f0002e0, 0x28, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at wsevent_fini+0x12: movq 0x28(%r14),%r15
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
kernel page fault
uvm_fault(0xfffffd807f0002e0, 0x28, 0, 1) -> e
wsevent_fini(0) at wsevent_fini+0x12 sys/dev/wscons/wsevent.c:130
end trace frame: 0xffff800021fbd0a0, count: 0
ddb{1}> trace
wsevent_fini(0) at wsevent_fini+0x12 sys/dev/wscons/wsevent.c:130
wsmouseclose(4400,1,2000,ffff800020ac6768) at wsmouseclose+0x92 sys/dev/wscons/wsmouse.c:360
spec_close(ffff800021fbd120) at spec_close+0x311 sys/kern/spec_vnops.c:555
VOP_CLOSE(fffffd806e2f35b8,1,fffffd807f7bf7e0,ffff800020ac6768) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:174
vn_closefile(fffffd80682c4ed8,ffff800020ac6768) at vn_closefile+0xd7 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd80682c4ed8,ffff800020ac6768) at vn_closefile+0xd7 sys/kern/vfs_vnops.c:614
fdrop(fffffd80682c4ed8,ffff800020ac6768) at fdrop+0xc2 sys/kern/kern_descrip.c:1276
closef(fffffd80682c4ed8,ffff800020ac6768) at closef+0x11c sys/kern/kern_descrip.c:1260
fdfree(ffff800020ac6768) at fdfree+0x101 sys/kern/kern_descrip.c:1192
exit1(ffff800020ac6768,0,0,1) at exit1+0x32c sys/kern/kern_exit.c:197
sys_exit(ffff800020ac6768,ffff800021fbd3b0,ffff800021fbd400) at sys_exit+0x16 sys/kern/kern_exit.c:95
syscall(ffff800021fbd480) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800021fbd480) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffef7b0, count: -12
ddb{1}> show registers
rdi 0
rsi 0xffff800020ac676c
rbp 0xffff800021fbd050
rbx 0
rdx 0xffff800020ac6768
rcx 0
rax 0
r8 0xffffffff8131bee7 witness_assert+0x207
r9 0x5
r10 0x14
r11 0x11db9c8b4ff54699
r12 0x4000 __ALIGN_SIZE+0x3000
r13 0x2000 __ALIGN_SIZE+0x1000
r14 0
r15 0
rip 0xffffffff81db55e2 wsevent_fini+0x12
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff800021fbd030
ss 0x10
wsevent_fini+0x12: movq 0x28(%r14),%r15
ddb{1}> show proc
PROC (syz-executor.0) pid=493303 stat=onproc
flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
pri=0, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff800020ac64f8,0xffffffff82636ea8
process=0xffff800020a92f88 user=0xffff800021fb8000, vmspace=0xfffffd807f0002e0
estcpu=36, cpticks=6, pctcpu=0.0
user=0, sys=1, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
5955 178768 0 0 3 0x14200 bored sosplice
31499 35471 68434 0 3 0x82 nanosleep syz-executor.1
99234 117402 68434 0 3 0x82 nanosleep syz-executor.0
68434 85168 68226 0 3 0x82 thrsleep syz-fuzzer
68434 219749 68226 0 3 0x4000082 thrsleep syz-fuzzer
68434 411115 68226 0 3 0x4000082 thrsleep syz-fuzzer
68434 203200 68226 0 3 0x4000082 thrsleep syz-fuzzer
68434 267283 68226 0 3 0x4000082 thrsleep syz-fuzzer
68434 435396 68226 0 3 0x4000082 kqread syz-fuzzer
68434 207052 68226 0 3 0x4000082 thrsleep syz-fuzzer
68434 380881 68226 0 3 0x4000082 thrsleep syz-fuzzer
68434 328935 68226 0 3 0x4000082 thrsleep syz-fuzzer
68434 43767 68226 0 3 0x4000082 thrsleep syz-fuzzer
68226 518479 33926 0 3 0x10008a pause ksh
33926 366988 22993 0 3 0x92 select sshd
14007 239585 1 0 3 0x100083 ttyin getty
22993 389248 1 0 3 0x80 select sshd
51705 519979 29548 74 3 0x100092 bpf pflogd
29548 218915 1 0 3 0x80 netio pflogd
62998 304312 53723 73 3 0x100090 kqread syslogd
53723 338151 1 0 3 0x100082 netio syslogd
18925 452317 1 77 3 0x100090 poll dhclient
71600 403730 1 0 3 0x80 poll dhclient
50767 168233 0 0 3 0x14200 bored smr
365 507839 0 0 3 0x14200 pgzero zerothread
33350 338188 0 0 3 0x14200 aiodoned aiodoned
8178 357431 0 0 3 0x14200 syncer update
88228 496516 0 0 3 0x14200 cleaner cleaner
30761 320300 0 0 3 0x14200 reaper reaper
33048 319619 0 0 3 0x14200 pgdaemon pagedaemon
61837 505975 0 0 3 0x14200 bored crynlk
30008 219093 0 0 3 0x14200 bored crypto
79149 478220 0 0 3 0x40014200 acpi0 acpi0
1385 180970 0 0 3 0x40014200 idle1
93854 101158 0 0 3 0x14200 bored softnet
25316 499890 0 0 3 0x14200 bored systqmp
73447 315040 0 0 3 0x14200 bored systq
34899 262912 0 0 3 0x40014200 bored softclock
14415 122704 0 0 7 0x40014200 idle0
1 31723 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 9483 6401K 6670K 78643K 10991 0
pcb 13 8K 8K 78643K 73 0
rtable 104 3K 4K 78643K 288 0
ifaddr 53 12K 13K 78643K 100 0
counters 43 33K 34K 78643K 61 0
ioctlops 0 0K 4K 78643K 1481 0
iov 0 0K 24K 78643K 72 0
mount 1 1K 1K 78643K 1 0
vnodes 1222 77K 77K 78643K 1331 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 5K 78643K 4 0
VM map 2 1K 1K 78643K 2 0
sem 12 0K 0K 78643K 13 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1809 196K 290K 78643K 12766 0
file desc 5 13K 25K 78643K 206 0
proc 62 63K 95K 78643K 441 0
subproc 32 2K 2K 78643K 34 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 32 0
in_multi 46 2K 3K 78643K 85 0
ether_multi 1 0K 0K 78643K 9 0
mrt 0 0K 0K 78643K 4 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 49 228K 228K 78643K 49 0
exec 0 0K 1K 78643K 218 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 7 26K 26K 78643K 7 0
UVM amap 106 54K 54K 78643K 1613 0
UVM aobj 8 3K 4K 78643K 13 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 58 0
NDP 7 0K 0K 78643K 21 0
temp 86 3043K 3107K 78643K 3433 0
kqueue 3 4K 10K 78643K 31 0
SYN cache 2 16K 16K 78643K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 8 0 2 1 0 1 1 0 8 0
plcache 128 20 0 0 1 0 1 1 0 8 0
rtpcb 80 88 0 86 1 0 1 1 0 8 0
rtentry 112 56 0 14 2 0 2 2 0 8 0
unpcb 120 108 0 96 1 0 1 1 0 8 0
syncache 264 4 0 4 1 1 0 1 0 8 0
tcpqe 32 24 0 24 1 1 0 1 0 8 0
tcpcb 544 108 0 104 1 0 1 1 0 8 0
inpcb 280 297 0 290 2 0 2 2 0 8 1
nd6 48 7 0 3 1 0 1 1 0 8 0
ppxss 1128 4 0 4 1 0 1 1 0 8 1
pffrag 232 2 0 2 1 0 1 1 0 482 1
pffrnode 88 2 0 2 1 0 1 1 0 8 1
pffrent 40 4 0 4 1 0 1 1 0 8 1
pfosfp 40 846 0 423 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 25 0 3 1 0 1 1 0 8 0
pfstkey 112 25 0 3 1 0 1 1 0 8 0
pfstate 328 25 0 3 2 0 2 2 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 2 0 0 2 0 2 2 0 8 0
art_heap4 256 232 0 49 13 0 13 13 0 8 0
art_table 32 234 0 49 2 0 2 2 0 8 0
art_node 16 55 0 16 1 0 1 1 0 8 0
sysvmsgpl 40 26 0 14 1 0 1 1 0 8 0
semapl 112 11 0 1 1 0 1 1 0 8 0
shmpl 112 11 0 5 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino1pl 128 1681 0 275 46 0 46 46 0 8 0
ffsino 272 1681 0 275 94 0 94 94 0 8 0
nchpl 144 2185 0 567 61 0 61 61 0 8 0
uvmvnodes 72 1796 0 0 33 0 33 33 0 8 0
vnodes 208 1796 0 0 95 0 95 95 0 8 0
namei 1024 5810 0 5810 1 0 1 1 0 8 1
percpumem 16 41 0 9 1 0 1 1 0 8 0
vcpupl 1984 3 0 0 1 0 1 1 0 8 0
vmpool 560 5 0 2 1 0 1 1 0 8 0
scsiplug 64 1 0 1 1 1 0 1 0 8 0
scxspl 192 6541 0 6541 5 4 1 4 0 8 1
plimitpl 152 21 0 13 1 0 1 1 0 8 0
sigapl 424 422 0 390 4 0 4 4 0 8 0
futexpl 56 3147 0 3147 1 0 1 1 0 8 1
knotepl 112 90 0 71 1 0 1 1 0 8 0
kqueuepl 144 130 0 128 1 0 1 1 0 8 0
pipelkpl 48 97 0 87 1 0 1 1 0 8 0
pipepl 120 194 0 175 1 0 1 1 0 8 0
fdescpl 496 406 0 390 3 0 3 3 0 8 0
filepl 152 2558 0 2445 6 1 5 5 0 8 0
lockfpl 104 42 0 41 1 0 1 1 0 8 0
lockfspl 48 16 0 15 1 0 1 1 0 8 0
sessionpl 112 18 0 7 1 0 1 1 0 8 0
pgrppl 48 18 0 7 1 0 1 1 0 8 0
ucredpl 96 178 0 169 1 0 1 1 0 8 0
zombiepl 144 391 0 389 1 0 1 1 0 8 0
processpl 984 422 0 389 6 1 5 5 0 8 0
procpl 624 842 0 800 4 0 4 4 0 8 0
sosppl 128 3 0 3 1 1 0 1 0 8 0
sockpl 400 493 0 472 3 0 3 3 0 8 0
mcl64k 65536 7 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl12k 12288 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 4 0 0 1 0 1 1 0 8 0
mcl2k2 2112 3 0 0 1 0 1 1 0 8 0
mcl2k 2048 161 0 0 20 0 20 20 0 8 0
mtagpl 80 15 0 0 1 0 1 1 0 8 0
mbufpl 256 174 0 0 11 0 11 11 0 8 0
bufpl 280 4392 0 173 302 0 302 302 0 8 0
anonpl 16 50146 0 36737 65 6 59 64 0 124 3
amapchunkpl 152 3386 0 3243 20 3 17 20 0 158 10
amappl16 192 1620 0 882 38 0 38 38 0 8 0
amappl15 184 2 0 0 1 0 1 1 0 8 0
amappl14 176 9 0 7 2 1 1 1 0 8 0
amappl13 168 35 0 33 1 0 1 1 0 8 0
amappl12 160 9 0 8 2 1 1 1 0 8 0
amappl11 152 158 0 138 1 0 1 1 0 8 0
amappl10 144 118 0 109 1 0 1 1 0 8 0
amappl9 136 389 0 386 1 0 1 1 0 8 0
amappl8 128 301 0 288 1 0 1 1 0 8 0
amappl7 120 208 0 196 1 0 1 1 0 8 0
amappl6 112 107 0 103 1 0 1 1 0 8 0
amappl5 104 306 0 290 1 0 1 1 0 8 0
amappl4 96 510 0 478 2 1 1 2 0 8 0
amappl3 88 112 0 106 1 0 1 1 0 8 0
amappl2 80 2325 0 2256 3 1 2 3 0 8 0
amappl1 72 19065 0 18616 25 14 11 20 0 8 0
amappl 80 1102 0 1055 2 0 2 2 0 84 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 64 12 0 5 1 0 1 1 0 8 0
uaddrrnd 24 411 0 392 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 411 0 392 1 0 1 1 0 8 0
vmmpekpl 168 7066 0 7036 2 0 2 2 0 8 0
vmmpepl 168 56371 0 54481 99 11 88 94 0 357 1
vmsppl 368 410 0 392 2 0 2 2 0 8 0
pdppl 4096 830 0 787 6 0 6 6 0 8 0
pvpl 32 171430 0 154977 159 6 153 158 0 265 18
pmappl 232 410 0 392 2 0 2 2 0 8 0
extentpl 40 46 0 29 1 0 1 1 0 8 0
phpool 112 168 0 3 5 0 5 5 0 8 0
Struck through repros no longer work on HEAD.