syzbot


uvm_fault: kcov_remote_enter (2)

Status: upstream: reported on 2024/03/28 06:02
Reported-by: syzbot+3662f77b0d675dc35988@syzkaller.appspotmail.com
First crash: 31d, last: 19d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: kcov_remote_enter 3 397d 515d 0/3 auto-obsoleted due to no activity on 2023/06/25 20:12

Sample crash report:
uvm_fault(0xffffffff82e5e8b0, 0xffff80002a186000, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      kcov_remote_enter+0x122:        movq    $0,0(%rcx)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*373336  50281      0   0x8000000          0    0  syz-executor.4
kcov_remote_enter(0,ffff8000fffe9d70) at kcov_remote_enter+0x122 sys/dev/kcov.c:675
timeout_run(ffff80002a678b08) at timeout_run+0x84 sys/kern/kern_timeout.c:664
softclock_process_tick_timeout(ffff80002a678b08,0) at softclock_process_tick_timeout+0x19b sys/kern/kern_timeout.c:723
softclock(0) at softclock+0x139 sys/kern/kern_timeout.c:755
softintr_dispatch(0) at softintr_dispatch+0xc1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x7d2d49688650, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff82e5e8b0, 0xffff80002a186000, 0, 2) -> e
ddb> trace
kcov_remote_enter(0,ffff8000fffe9d70) at kcov_remote_enter+0x122 sys/dev/kcov.c:675
timeout_run(ffff80002a678b08) at timeout_run+0x84 sys/kern/kern_timeout.c:664
softclock_process_tick_timeout(ffff80002a678b08,0) at softclock_process_tick_timeout+0x19b sys/kern/kern_timeout.c:723
softclock(0) at softclock+0x139 sys/kern/kern_timeout.c:755
softintr_dispatch(0) at softintr_dispatch+0xc1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x7d2d49688650, count: -6
ddb> show registers
rdi                       0xffffffff
rsi               0xffff8000006a8a00
rbp               0xffff80003438f290
rbx                       0x7ffecaea
rdx               0xffff80002a678540
rcx               0xffff80002a186000
rax               0xfffffd806c6f5e10
r8                                 0
r9                                 0
r10               0xa2ad17f68925bbe1
r11               0xd0596192e953362c
r12               0xffff80002a678a60
r13               0xffffffff82cb6ff0    cpu_info_full_primary+0x1ff0
r14               0xffff8000fffe9d70
r15                                0
rip               0xffffffff824ad1e2    kcov_remote_enter+0x122
cs                               0x8
rflags                       0x10297    __ALIGN_SIZE+0xf297
rsp               0xffff80003438f270
ss                                 0
kcov_remote_enter+0x122:        movq    $0,0(%rcx)
ddb> show proc
PROC (syz-executor.4) tid=373336 pid=50281 tcnt=2 stat=onproc
    flags process=8000000 proc=0
    runpri=82, usrpri=83, slppri=16, nice=20
    wchan=0x0, wmesg=, ps_single=0x0
    forw=0xffffffffffffffff, list=0xffff80002a6794a0,0xffff80002a678030
    process=0xffff8000fffe9510 user=0xffff80003438a000, vmspace=0xfffffd80697856c8
    estcpu=33, cpticks=1, pctcpu=0.0, user=1, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 54368  202245  93382      0  2   0x8000000                syz-executor.3
 54368   28407  93382      0  3   0xc000080  fsleep        syz-executor.3
 91981  128964  49855      0  2   0x8000000                syz-executor.5
 91981  239787  49855      0  2   0xc000000                syz-executor.5
*50281  373336  43710      0  7   0x8000000                syz-executor.4
 50281  131863  43710      0  3   0xc000080  netcon        syz-executor.4
 96273  251251  66979      0  3   0x8000080  nanoslp       syz-executor.7
 96273    5874  66979      0  3   0xc000080  sbwait        syz-executor.7
 96273   41491  66979      0  2   0xc000000                syz-executor.7
 96273  491700  66979      0  3   0xc000080  fsleep        syz-executor.7
 43710  472144  34828      0  3   0x8000082  nanoslp       syz-executor.4
 45729  410383  34828      0  3   0x8000082  nanoslp       syz-executor.1
 93382  445645  34828      0  3   0x8000082  nanoslp       syz-executor.3
 10369  359510  34828      0  3   0x8000082  nanoslp       syz-executor.6
 66979  246658  34828      0  3   0x8000082  nanoslp       syz-executor.7
 23157  490167  34828      0  3   0x8000082  nanoslp       syz-executor.0
 39691  322788      0      0  3     0x14200  bored         sosplice
 49855  400341  34828      0  3   0x8000082  nanoslp       syz-executor.5
 65670  516866  34828      0  3   0x8000082  nanoslp       syz-executor.2
 34828  395312  31911      0  3  0x1a000082  wait          syz-fuzzer
 34828  164219  31911      0  3  0x1e000082  thrsleep      syz-fuzzer
 34828  160866  31911      0  3  0x1e000082  wait          syz-fuzzer
 34828  366536  31911      0  3  0x1e000082  thrsleep      syz-fuzzer
 34828  326155  31911      0  3  0x1e000082  wait          syz-fuzzer
 34828  279601  31911      0  3  0x1e000082  thrsleep      syz-fuzzer
 34828  112458  31911      0  3  0x1e000082  thrsleep      syz-fuzzer
 34828  199403  31911      0  3  0x1e000082  wait          syz-fuzzer
 34828  385647  31911      0  3  0x1e000082  wait          syz-fuzzer
 34828  453751  31911      0  3  0x1e000082  wait          syz-fuzzer
 34828  346062  31911      0  3  0x1e000082  thrsleep      syz-fuzzer
 34828  168847  31911      0  3  0x1e000082  wait          syz-fuzzer
 34828   68221  31911      0  3  0x1e000082  kqread        syz-fuzzer
 34828    2707  31911      0  3  0x1e000082  wait          syz-fuzzer
 31911  196777   5582      0  3   0x810008a  sigsusp       ksh
  5582  377858  98757      0  3  0x1800009a  kqread        sshd
 16647  477856      1      0  3  0x18100083  ttyin         getty
 98757  196975      1      0  3  0x18000088  kqread        sshd
 44989  305124  29989     73  2  0x19100090                syslogd
 29989  447813      1      0  3  0x18100082  sbwait        syslogd
  6616  480254      1      0  3  0x18100080  kqread        resolvd
 64293   80754  96035     77  3  0x18100092  kqread        dhcpleased
 99563  478295  96035     77  3  0x18100092  kqread        dhcpleased
 96035   30354      1      0  3  0x18000080  kqread        dhcpleased
 57958   91823      0      0  3     0x14200  bored         smr
 66201  163843      0      0  2     0x14200                zerothread
 50036  396889      0      0  3     0x14200  aiodoned      aiodoned
 45185  426362      0      0  3     0x14200  syncer        update
 62390  107464      0      0  3     0x14200  cleaner       cleaner
 83745  228586      0      0  3     0x14200  reaper        reaper
 83668  466037      0      0  3     0x14200  pgdaemon      pagedaemon
 74232    6749      0      0  3     0x14200  bored         viomb
 42847  516765      0      0  3  0x40014200  acpi0         acpi0
 86990  464035      0      0  3     0x14200  bored         softnet3
 74531  207309      0      0  3     0x14200  bored         softnet2
 20475   79398      0      0  3     0x14200  bored         softnet1
 11713  130862      0      0  3     0x14200  bored         softnet0
 72717  332403      0      0  3     0x14200  bored         systqmp
 66668  413658      0      0  3     0x14200  bored         systq
 88185  142510      0      0  3  0x40014200  tmoslp        softclock
 76983  444038      0      0  3  0x40014200                idle0
     1  314351      0      0  3   0x8000082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10194   6610K    6934K 166960K     13329        0
            pcb    15     10K      10K 166960K       122        0
         rtable   188      7K       8K 166960K       831        0
             pf    27      8K       9K 166960K        91        0
         ifaddr    34      9K      11K 166960K       107        0
        ifgroup    44      1K       2K 166960K       146        0
         sysctl     3      0K       0K 166960K         3        0
       counters    29     17K      17K 166960K        58        0
       ioctlops     0      0K       2K 166960K       139        0
            iov     0      0K      24K 166960K       107        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1427     90K      90K 166960K      2397        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        32        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      1K       1K 166960K        52        0
        dirhash    12      2K       2K 166960K        30        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    14     49K      73K 166960K      1437        0
          sigio     0      0K       0K 166960K        21        0
           proc    59     59K      83K 166960K       870        0
        subproc   104      6K       6K 166960K       235        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       198        0
       in_multi    67      5K       7K 166960K       254        0
    ether_multi     1      0K       0K 166960K         5        0
            mrt     1      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    97    440K     440K 166960K        97        0
           exec     0      0K       1K 166960K       616        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   324    167K     168K 166960K     14395        0
       UVM aobj    83      7K       7K 166960K        89        0
     pinsyscall    34     68K     100K 166960K      2831        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K        86        0
            NDP    10      0K       1K 166960K        75        0
           temp    74   6804K    6880K 166960K     13751        0
         kqueue    12     18K      24K 166960K       159        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      136    0      133     1     0     1     1     0     8    0
rtentry    112      241    0      157     4     0     4     4     0     8    1
unpcb      144      852    0      832     2     0     2     2     0     8    1
syncache   336       22    0       22     1     0     1     1     0     8    1
tcpqe       32      122    0      122     1     0     1     1     0     8    1
tcpcb      808      483    0      460     8     0     8     8     0     8    5
arp         88       42    0       27     1     0     1     1     0     8    0
inpcb      360     1287    0     1260     9     0     9     9     0     8    5
nd6        104       60    0       43     1     0     1     1     0     8    0
pkpcb       40       17    0       17     1     0     1     1     0     8    1
kcovpl      48       18    0       10     1     0     1     1     0     8    0
ppxss      1072      11    0       10     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      919    0      581    30     6    24    29     0     8    1
art_table   32      920    0      581     4     0     4     4     0     8    0
art_node    16      235    0      158     1     0     1     1     0     8    0
sysvmsgpl   40       30    0       12     1     0     1     1     0     8    0
semupl     112        3    0        3     1     0     1     1     0     8    1
semapl     112       43    0       33     1     0     1     1     0     8    0
shmpl      112       86    0        6     3     0     3     3     0     8    0
dirhash    1024      29    0       12     3     0     3     3     0     8    0
dino2pl    256     3540    0     2029    96     0    96    96     0     8    0
ffsino     240     3540    0     2029    90     0    90    90     0     8    0
nchpl      144     5606    0     3867    66     0    66    66     0     8    0
uvmvnodes   80     4397    0        0    90     0    90    90     0     8    0
vnodes     216     4397    0        0   245     0   245   245     0     8    0
namei      1024   18890    0    18890     3     0     3     3     0     8    3
vcpupl     2048      16    0        1     2     0     2     2     0     8    0
vmpool     664       25    0       10     2     0     2     2     0     8    0
kstatmem   264       78    0       58     2     0     2     2     0     8    0
scxspl     216    17657    0    17657     8     0     8     8     1     8    8
plimitpl   152      164    0      147     1     0     1     1     0     8    0
sigapl     424     1736    0     1690     8     0     8     8     0     8    2
futexpl     64    21630    0    21628     1     0     1     1     0     8    0
knotepl    120    14765    0    14683    11     0    11    11     0     8    8
kqueuepl   184      268    0      259     1     0     1     1     0     8    0
pipepl     288      293    0      265     3     0     3     3     0     8    0
fdescpl    432     1698    0     1673     4     0     4     4     0     8    0
filepl     120     9410    0     9149    11     0    11    11     0     8    2
lockfpl    104      448    0      444     1     0     1     1     0     8    0
lockfspl    48      185    0      181     1     0     1     1     0     8    0
sessionpl  144       33    0       17     1     0     1     1     0     8    0
pgrppl      48       48    0       32     1     0     1     1     0     8    0
ucredpl    104     1357    0     1343     1     0     1     1     0     8    0
zombiepl   144     1694    0     1690     1     0     1     1     0     8    0
processpl  1072    1736    0     1690     5     0     5     5     0     8    1
procpl     656     3198    0     3133     8     0     8     8     0     8    1
sosppl     168       25    0       23     1     0     1     1     0     8    0
sockpl     488     2305    0     2256    15     0    15    15     0     8    7
mcl64k     65536     63    0       63     1     0     1     1     0     8    1
mcl16k     16384     59    0       59     1     0     1     1     0     8    1
mcl12k     12288     72    0       72     1     0     1     1     0     8    1
mcl9k      9216      11    0       11     1     0     1     1     0     8    1
mcl8k      8192     101    0      101     1     0     1     1     0     8    1
mcl4k      4096     221    0      221     1     0     1     1     0     8    1
mcl2k2     2112      14    0       14     1     0     1     1     0     8    1
mcl2k      2048   26200    0    26154    30    16    14    28     0     8    7
mtagpl      96      170    0       70     3     0     3     3     0     8    0
mbufpl     256    60208    0    59936    32    10    22    27     0     8    3
bufpl      280     6621    0      292   453     0   453   453     0     8    0
anonpl      24   332579    0   326849    71     0    71    71     0   188   28
amapchunkpl 152   46867    0    46245    37     0    37    37     0   158    7
amappl16   200     8345    0     8237    37    22    15    21     0     8    7
amappl15   192        9    0        9     1     0     1     1     0     8    1
amappl14   184      189    0      177     2     0     2     2     0     8    1
amappl13   176       15    0       15     1     0     1     1     0     8    1
amappl12   168     2484    0     2458     2     0     2     2     0     8    0
amappl11   160       59    0       49     1     0     1     1     0     8    0
amappl10   152       72    0       63     1     0     1     1     0     8    0
amappl9    144      141    0      139     1     0     1     1     0     8    0
amappl8    136      322    0      252     3     0     3     3     0     8    0
amappl7    128       80    0       68     1     0     1     1     0     8    0
amappl6    120      494    0      476     2     0     2     2     0     8    1
amappl5    112      248    0      236     1     0     1     1     0     8    0
amappl4    104      640    0      604     2     0     2     2     0     8    0
amappl3     96     9599    0     9529     3     0     3     3     0     8    0
amappl2     88     2224    0     2154     3     0     3     3     0     8    1
amappl1     80    14779    0    14286    22     1    21    22     0     8    8
amappl      88    13675    0    13486     6     0     6     6     0    92    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       88    0        6     2     0     2     2     0     8    0
uaddrrnd    24     1723    0     1683     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1723    0     1683     1     0     1     1     0     8    0
vmmpekpl   168    15980    0    15915     3     0     3     3     0     8    0
vmmpepl    168   123482    0   121694   110     0   110   110     0   357   18
vmsppl     344     1722    0     1683     4     0     4     4     0     8    0
rwobjpl     24    41152    0    35590    34     0    34    34     0     8    0
pdppl      4096    3452    0     3381   166    87    79    79     0     8    8
pvpl        32   792739    0   781387   356    16   340   356     0   265  232
pmappl     216     1722    0     1683     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      472    0      119    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
kcov_remote_enter(0,ffff8000fffe9d70) at kcov_remote_enter+0x122 sys/dev/kcov.c:675
timeout_run(ffff80002a678b08) at timeout_run+0x84 sys/kern/kern_timeout.c:664
softclock_process_tick_timeout(ffff80002a678b08,0) at softclock_process_tick_timeout+0x19b sys/kern/kern_timeout.c:723
softclock(0) at softclock+0x139 sys/kern/kern_timeout.c:755
softintr_dispatch(0) at softintr_dispatch+0xc1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x7d2d49688650, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
kcov_remote_enter(0,ffff8000fffe9d70) at kcov_remote_enter+0x122 sys/dev/kcov.c:675
timeout_run(ffff80002a678b08) at timeout_run+0x84 sys/kern/kern_timeout.c:664
softclock_process_tick_timeout(ffff80002a678b08,0) at softclock_process_tick_timeout+0x19b sys/kern/kern_timeout.c:723
softclock(0) at softclock+0x139 sys/kern/kern_timeout.c:755
softintr_dispatch(0) at softintr_dispatch+0xc1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x7d2d49688650, count: -6

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/09 04:33 openbsd 7e284d508f03 f3234354 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
2024/03/28 06:01 openbsd 2ee472d028ec 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
* Struck through repros no longer work on HEAD.