syzbot


uvm_fault: sbdrop

Status: auto-closed as invalid on 2020/10/10 16:05
Reported-by: syzbot+37e5882854377187f93e@syzkaller.appspotmail.com
First crash: 1604d, last: 1384d

Sample crash report:
login: uvm_fault(0xffffffff827b2830, 0xfffffd0000000018, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      sbdrop+0x219:   movl    0x18(%r15),%r13d
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xffffffff827b2830, 0xfffffd0000000018, 0, 1) -> e
sbdrop(ffff800020ed8478,ffff800020ed8500,441) at sbdrop+0x219 sys/kern/uipc_socket2.c:965
end trace frame: 0xffff800020ed8420, count: 0
ddb{0}> trace
sbdrop(ffff800020ed8478,ffff800020ed8500,441) at sbdrop+0x219 sys/kern/uipc_socket2.c:965
sbflush(ffff800020ed8478,ffff800020ed8500) at sbflush+0x93 sys/kern/uipc_socket2.c:934
sbrelease(ffff800020ed8478,ffff800020ed8500) at sbrelease+0x2e sys/kern/uipc_socket2.c:525
sorflush(fffffd806f683190) at sorflush+0x14b sys/kern/uipc_socket.c:1137
sofree(fffffd806f683190,42) at sofree+0x147 sys/kern/uipc_socket.c:263
soclose(fffffd806f683190,80) at soclose+0x270 sys/kern/uipc_socket.c:344
soo_close(fffffd8066634d28,ffff800020e38878) at soo_close+0x40
fdrop(fffffd8066634d28,ffff800020e38878) at fdrop+0xc2 sys/kern/kern_descrip.c:1279
closef(fffffd8066634d28,ffff800020e38878) at closef+0x11c sys/kern/kern_descrip.c:1263
fdfree(ffff800020e38878) at fdfree+0x101 sys/kern/kern_descrip.c:1195
exit1(ffff800020e38878,0,0,1) at exit1+0x32c sys/kern/kern_exit.c:197
sys_exit(ffff800020e38878,ffff800020ed88d0,ffff800020ed8920) at sys_exit+0x16 sys/kern/kern_exit.c:95
syscall(ffff800020ed89a0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020ed89a0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbf350, count: -14
ddb{0}> show registers
rdi                                0
rsi                            0x3af
rbp               0xffff800020ed83d0
rbx               0xfffffd806c997800
rdx                          0x5d478    acpi_pdirpa+0x492e0
rcx                                0
rax                                0
r8                0xffffffff820d7818    sbdrop+0x248
r9                               0x3
r10               0x4e943c8d34a16c80
r11               0x7450b007fb06c8b5
r12                            0x3af
r13                            0xb00
r14               0xffff800020ed8500
r15               0xfffffd0000000000
rip               0xffffffff820d77e9    sbdrop+0x219
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800020ed8370
ss                              0x10
sbdrop+0x219:   movl    0x18(%r15),%r13d
ddb{0}> show proc
PROC (syz-executor.0) pid=399099 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    pri=32, usrpri=51, nice=20
    forw=0xffffffffffffffff, list=0xffff800020e38ae8,0xffffffff828b7760
    process=0xffff800020eb5b40 user=0xffff800020ed3000, vmspace=0xfffffd806e8f8178
    estcpu=36, cpticks=3, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 35280  381820      0      0  3     0x14200  bored         sosplice
 95731  251229  31644      0  3        0x82  nanosleep     syz-executor.1
 12246   74092  31644      0  3        0x82  nanosleep     syz-executor.0
 31644  194239  16824      0  3        0x82  thrsleep      syz-fuzzer
 31644  222883  16824      0  3   0x4000082  nanosleep     syz-fuzzer
 31644   84588  16824      0  3   0x4000082  thrsleep      syz-fuzzer
 31644   45235  16824      0  3   0x4000082  thrsleep      syz-fuzzer
 31644    8238  16824      0  3   0x4000082  thrsleep      syz-fuzzer
 31644  321041  16824      0  3   0x4000082  thrsleep      syz-fuzzer
 31644  187047  16824      0  3   0x4000082  thrsleep      syz-fuzzer
 31644  196090  16824      0  3   0x4000082  thrsleep      syz-fuzzer
 31644  438355  16824      0  3   0x4000082  kqread        syz-fuzzer
 31644  193745  16824      0  3   0x4000082  thrsleep      syz-fuzzer
 16824  380727  31787      0  3    0x10008a  pause         ksh
 31787  484306  81703      0  3        0x92  select        sshd
 88123   40671      1      0  3    0x100083  ttyin         getty
 81703  232972      1      0  3        0x80  select        sshd
 30143  472584  26933     74  3    0x100092  bpf           pflogd
 26933  184574      1      0  3        0x80  netio         pflogd
 44757  312332  21029     73  3    0x100090  kqread        syslogd
 21029  506201      1      0  3    0x100082  netio         syslogd
  1946  214471      1     77  3    0x100090  poll          dhclient
 68057  142576      1      0  3        0x80  poll          dhclient
 79006  450688      0      0  3     0x14200  bored         smr
 39036  278241      0      0  2     0x14200                zerothread
 46365   31185      0      0  3     0x14200  aiodoned      aiodoned
 33356  468718      0      0  3     0x14200  syncer        update
 19803  304637      0      0  3     0x14200  cleaner       cleaner
 83629  133121      0      0  7     0x14200                reaper
 39383  214361      0      0  3     0x14200  pgdaemon      pagedaemon
 98587   56974      0      0  3     0x14200  bored         crynlk
 47183  128106      0      0  3     0x14200  bored         crypto
 49685  235672      0      0  3  0x40014200  acpi0         acpi0
 68485  316808      0      0  3  0x40014200                idle1
 82927   76193      0      0  3     0x14200  bored         softnet
 35418  391076      0      0  3     0x14200  bored         systqmp
 50873    5363      0      0  3     0x14200  bored         systq
 77300  135231      0      0  2  0x40014200                softclock
 56669  438508      0      0  3  0x40014200                idle0
     1    2784      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9505   6532K    6789K  78643K     10752        0
            pcb    13      8K       8K  78643K        39        0
         rtable   101      3K       3K  78643K       226        0
         ifaddr    58     12K      12K  78643K        72        0
       counters    43     33K      34K  78643K        45        0
       ioctlops     0      0K       4K  78643K      1478        0
            iov     0      0K      16K  78643K        16        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1216     76K      77K  78643K      1263        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       1K  78643K        22        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1824    197K     290K  78643K     13058        0
      file desc     5     13K      25K  78643K       152        0
          sigio     0      0K       0K  78643K         2        0
           proc    61     63K      95K  78643K       462        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        10        0
       in_multi    36      2K       2K  78643K        57        0
    ether_multi     1      0K       0K  78643K         4        0
            mrt     0      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    31    148K     148K  78643K        31        0
           exec     0      0K       1K  78643K       223        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   122     55K      55K  78643K      1415        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        14        0
            NDP     9      0K       0K  78643K        16        0
           temp    90   3862K    3926K  78643K      2335        0
         kqueue     3      4K       8K  78643K         8        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        7    0        0     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       31    0       28     1     0     1     1     0     8    0
rtentry    112       50    0        8     2     0     2     2     0     8    0
unpcb      120      119    0      109     1     0     1     1     0     8    0
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpqe       32      147    0      147     2     2     0     1     0     8    0
tcpcb      544       48    0       42     1     0     1     1     0     8    0
inpcb      296      165    0      158     2     0     2     2     0     8    1
nd6         48        8    0        4     1     0     1     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       21    0        0     1     0     1     1     0     8    0
pfstkey    112       21    0        0     1     0     1     1     0     8    0
pfstate    328       21    0        0     2     0     2     2     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      195    0       16    12     0    12    12     0     8    0
art_table   32      196    0       16     2     0     2     2     0     8    0
art_node    16       49    0       10     1     0     1     1     0     8    0
sysvmsgpl   40       20    0       10     1     0     1     1     0     8    0
semupl     112        3    0        3     1     0     1     1     0     8    1
semapl     112       15    0        5     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1578    0      174    89     0    89    89     0     8    1
ffsino     272     1578    0      174    94     0    94    94     0     8    0
nchpl      144     1970    0      360    60     0    60    60     0     8    0
uvmvnodes   72     1656    0        0    31     0    31    31     0     8    0
vnodes     208     1656    0        0    88     0    88    88     0     8    0
namei      1024    5196    0     5196     1     0     1     1     0     8    1
percpumem   16       33    0        1     1     0     1     1     0     8    0
vcpupl     1984       4    0        0     1     0     1     1     0     8    0
vmpool     560        4    0        0     1     0     1     1     0     8    0
scxspl     192     5862    0     5862     8     1     7     7     0     8    7
plimitpl   152       19    0       11     1     0     1     1     0     8    0
sigapl     424      368    0      336     4     0     4     4     0     8    0
futexpl     56     1845    0     1845     1     0     1     1     0     8    1
knotepl    112       67    0       48     1     0     1     1     0     8    0
kqueuepl   144       18    0       15     1     0     1     1     0     8    0
pipepl     304      287    0      277     2     0     2     2     0     8    1
fdescpl    496      352    0      336     3     0     3     3     0     8    0
filepl     152     2106    0     2004     5     0     5     5     0     8    0
lockfpl    104       26    0       25     1     0     1     1     0     8    0
lockfspl    48       10    0        9     1     0     1     1     0     8    0
sessionpl  112       18    0        7     1     0     1     1     0     8    0
pgrppl      48       28    0       17     1     0     1     1     0     8    0
ucredpl     96      105    0       96     1     0     1     1     0     8    0
zombiepl   144      337    0      335     1     0     1     1     0     8    0
processpl  992      368    0      335     5     0     5     5     0     8    0
procpl     624      653    0      610     4     0     4     4     0     8    0
sosppl     128        4    0        4     1     0     1     1     0     8    1
sockpl     400      319    0      298     4     0     4     4     0     8    1
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      3    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       1    0        0     1     0     1     1     0     8    0
mcl4k      4096       5    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     207    0        0    25     0    25    25     0     8    0
mtagpl      96        9    0        0     1     0     1     1     0     8    0
mbufpl     256      203    0        0    13     0    13    13     0     8    0
bufpl      280     3565    0      133   246     0   246   246     0     8    0
anonpl      16    51223    0    34702    75     1    74    74     0   124    6
amapchunkpl 152    2033    0     1873    12     0    12    12     0   158    4
amappl16   192     1536    0      648    46     0    46    46     0     8    1
amappl15   184       61    0       58     1     0     1     1     0     8    0
amappl14   176       23    0       19     1     0     1     1     0     8    0
amappl13   168       29    0       26     1     0     1     1     0     8    0
amappl12   160       11    0        9     1     0     1     1     0     8    0
amappl11   152       55    0       40     1     0     1     1     0     8    0
amappl10   144       77    0       71     1     0     1     1     0     8    0
amappl9    136      388    0      387     1     0     1     1     0     8    0
amappl8    128      341    0      311     2     0     2     2     0     8    0
amappl7    120      184    0      169     1     0     1     1     0     8    0
amappl6    112       21    0       18     2     1     1     1     0     8    0
amappl5    104      250    0      231     1     0     1     1     0     8    0
amappl4     96      490    0      458     1     0     1     1     0     8    0
amappl3     88      107    0      102     1     0     1     1     0     8    0
amappl2     80     1869    0     1792     2     0     2     2     0     8    0
amappl1     72    17748    0    17287    23    12    11    18     0     8    1
amappl      80      909    0      858     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      356    0      336     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      356    0      336     1     0     1     1     0     8    0
vmmpekpl   168     7666    0     7626     2     0     2     2     0     8    0
vmmpepl    168    50545    0    48400   123     4   119   119     0   357   24
vmsppl     368      355    0      335     2     0     2     2     0     8    0
pdppl      4096     719    0      674     6     0     6     6     0     8    0
pvpl        32   167400    0   147801   179     0   179   179     0   265   19
pmappl     232      355    0      335     2     0     2     2     0     8    0
extentpl    40       53    0       36     1     0     1     1     0     8    0
phpool     112      262    0        3     8     0     8     8     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
sbdrop(ffff800020ed8478,ffff800020ed8500,441) at sbdrop+0x219 sys/kern/uipc_socket2.c:965
sbflush(ffff800020ed8478,ffff800020ed8500) at sbflush+0x93 sys/kern/uipc_socket2.c:934
sbrelease(ffff800020ed8478,ffff800020ed8500) at sbrelease+0x2e sys/kern/uipc_socket2.c:525
sorflush(fffffd806f683190) at sorflush+0x14b sys/kern/uipc_socket.c:1137
sofree(fffffd806f683190,42) at sofree+0x147 sys/kern/uipc_socket.c:263
soclose(fffffd806f683190,80) at soclose+0x270 sys/kern/uipc_socket.c:344
soo_close(fffffd8066634d28,ffff800020e38878) at soo_close+0x40
fdrop(fffffd8066634d28,ffff800020e38878) at fdrop+0xc2 sys/kern/kern_descrip.c:1279
closef(fffffd8066634d28,ffff800020e38878) at closef+0x11c sys/kern/kern_descrip.c:1263
fdfree(ffff800020e38878) at fdfree+0x101 sys/kern/kern_descrip.c:1195
exit1(ffff800020e38878,0,0,1) at exit1+0x32c sys/kern/kern_exit.c:197
sys_exit(ffff800020e38878,ffff800020ed88d0,ffff800020ed8920) at sys_exit+0x16 sys/kern/kern_exit.c:95
syscall(ffff800020ed89a0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020ed89a0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbf350, count: -14
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff800020d70ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff829011d8) at __mp_lock+0x12e __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff829011d8) at __mp_lock+0x12e sys/kern/kern_lock.c:147
uvm_unmap_detach(ffff800020dcf940,1) at uvm_unmap_detach+0xe7 sys/uvm/uvm_map.c:1581
uvm_map_teardown(fffffd806e8f8e68) at uvm_map_teardown+0x25c sys/uvm/uvm_map.c:2757
uvmspace_free(fffffd806e8f8e68) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3646
uvm_exit(ffff800020eb5380) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297
reaper(ffff800020d895f0) at reaper+0x189 sys/kern/kern_exit.c:456
end trace frame: 0x0, count: -9

Crashes (44):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/12 16:04 openbsd 1d70c39ec0a2 115e1930 .config console log report ci-openbsd-multicore
2020/06/24 08:56 openbsd 95d22deeeb03 bbad15ae .config console log report ci-openbsd-multicore
2020/06/23 07:38 openbsd 4d943fd61ab7 1afe1535 .config console log report ci-openbsd-multicore
2020/06/18 07:26 openbsd ae375af6dd72 d45a4d69 .config console log report ci-openbsd-multicore
2020/06/13 03:14 openbsd 50f19d1942a4 d1c1c849 .config console log report ci-openbsd-multicore
2020/06/11 04:00 openbsd 470a8ce0996f 3ab7a05a .config console log report ci-openbsd-multicore
2020/06/09 11:58 openbsd 324b9c791e90 0d60b78a .config console log report ci-openbsd-multicore
2020/06/05 14:35 openbsd d21ef8e00906 d36418e9 .config console log report ci-openbsd-multicore
2020/05/28 23:44 openbsd d2236770fb31 c7192a2f .config console log report ci-openbsd-multicore
2020/04/23 03:26 openbsd 7e0422b28c5a 2e44d63e .config console log report ci-openbsd-multicore
2020/03/31 16:20 openbsd 95fa874077b3 46105100 .config console log report ci-openbsd-multicore
2020/03/16 07:44 openbsd 8399ad734b90 749688d2 .config console log report ci-openbsd-multicore
2020/03/10 19:42 openbsd bfe2257568b6 35f53e45 .config console log report ci-openbsd-multicore
2020/03/10 12:18 openbsd be43c06a7fc3 35f53e45 .config console log report ci-openbsd-multicore
2020/03/10 04:23 openbsd be43c06a7fc3 35f53e45 .config console log report ci-openbsd-multicore
2020/03/07 23:38 openbsd 306edf26fe54 2e9971bb .config console log report ci-openbsd-multicore
2020/03/07 01:47 openbsd 40cca5d50a54 fd2a5f28 .config console log report ci-openbsd-multicore
2020/02/28 19:08 openbsd b0694f62b628 c88c7b75 .config console log report ci-openbsd-multicore
2020/02/26 15:47 openbsd 7a60b4b8ea4c 251aabb7 .config console log report ci-openbsd-multicore
2020/02/23 11:54 openbsd 49c609622354 2c36e7a7 .config console log report ci-openbsd-multicore
2020/02/20 00:00 openbsd 7e8f63e027b5 47fae6e9 .config console log report ci-openbsd-multicore
2020/02/18 06:42 openbsd 1cf3f1c7ac53 1ce142dc .config console log report ci-openbsd-multicore
2020/02/03 11:15 openbsd 43304138eba1 93e5e335 .config console log report ci-openbsd-multicore
2020/01/30 18:04 openbsd b0727cb75553 5ed23f9a .config console log report ci-openbsd-multicore
2020/01/30 03:31 openbsd c9ac349a8ef5 5ed23f9a .config console log report ci-openbsd-multicore
2020/01/24 20:21 openbsd c4318b7540a1 2e95ab33 .config console log report ci-openbsd-multicore
2020/01/22 12:49 openbsd 09e8f7802c96 8eda0b95 .config console log report ci-openbsd-multicore
2020/01/19 18:21 openbsd 41fdd898cae2 0342f8c7 .config console log report ci-openbsd-multicore
2020/01/18 08:04 openbsd e59323290a94 3de7aabb .config console log report ci-openbsd-multicore
2020/01/16 22:45 openbsd 70e790579e67 3de7aabb .config console log report ci-openbsd-multicore
2020/01/16 06:41 openbsd 2a9551c7a233 f9b69507 .config console log report ci-openbsd-multicore
2020/01/15 09:41 openbsd cc9e5af14082 fa12bd3c .config console log report ci-openbsd-multicore
2020/01/15 00:21 openbsd efb735b0778c fa12bd3c .config console log report ci-openbsd-multicore
2020/01/13 04:53 openbsd be3ccdcb25df 53faa9fe .config console log report ci-openbsd-multicore
2020/01/11 14:31 openbsd a769387c40b6 4c04afaa .config console log report ci-openbsd-multicore
2020/01/11 09:27 openbsd a769387c40b6 4c04afaa .config console log report ci-openbsd-multicore
2020/01/09 23:11 openbsd caf70d67be30 4de4e9f0 .config console log report ci-openbsd-multicore
2020/01/09 16:34 openbsd caf70d67be30 4de4e9f0 .config console log report ci-openbsd-multicore
2019/12/28 06:52 openbsd f142a2fe4ac8 be5c2c81 .config console log report ci-openbsd-multicore
2019/12/26 15:35 openbsd 4b157101db52 be5c2c81 .config console log report ci-openbsd-multicore
2019/12/26 09:58 openbsd 4b157101db52 be5c2c81 .config console log report ci-openbsd-multicore
2019/12/15 19:03 openbsd e749f6f89611 eef6e580 .config console log report ci-openbsd-multicore
2019/12/09 08:18 openbsd 6577a79c0f80 1508f453 .config console log report ci-openbsd-main
2019/12/06 06:27 openbsd ce2d25888d00 98b4ef2d .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.