syzbot


uvm_fault: strcmp

Status: upstream: reported on 2024/03/07 10:52
Reported-by: syzbot+3a0fb6c009b6265b07d4@syzkaller.appspotmail.com
First crash: 52d, last: 52d

Sample crash report:
uvm_fault(0xfffffd805d261030, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      strcmp+0x50:    movq    0x8(%rdi),%rax
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*  7863  43873      0           0  0x4000000    0  syz-executor.6
strcmp() at strcmp+0x50
bpfioctl(21700,8020426c,ffff80002d9230c0,1,ffff80002a63c000) at bpfioctl+0xab2 sys/net/bpf.c:956
VOP_IOCTL(fffffd807dd918a0,8020426c,ffff80002d9230c0,1,fffffd807f7d7a28,ffff80002a63c000) at VOP_IOCTL+0x91 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806cf2bd28,8020426c,ffff80002d9230c0,ffff80002a63c000) at vn_ioctl+0xbb sys/kern/vfs_vnops.c:525
sys_ioctl(ffff80002a63c000,ffff80002d9232a0,ffff80002d9231f0) at sys_ioctl+0x49e
syscall(ffff80002d9232a0) at syscall+0x751 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x261b8063740, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd805d261030, 0x0, 0, 1) -> e
ddb> trace
strcmp() at strcmp+0x50
bpfioctl(21700,8020426c,ffff80002d9230c0,1,ffff80002a63c000) at bpfioctl+0xab2 sys/net/bpf.c:956
VOP_IOCTL(fffffd807dd918a0,8020426c,ffff80002d9230c0,1,fffffd807f7d7a28,ffff80002a63c000) at VOP_IOCTL+0x91 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806cf2bd28,8020426c,ffff80002d9230c0,ffff80002a63c000) at vn_ioctl+0xbb sys/kern/vfs_vnops.c:525
sys_ioctl(ffff80002a63c000,ffff80002d9232a0,ffff80002d9231f0) at sys_ioctl+0x49e
syscall(ffff80002d9232a0) at syscall+0x751 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x261b8063740, count: -7
ddb> show registers
rdi               0xfffffffffffffff8
rsi               0xffff80002d9230b8
rbp               0xffff80002d922e60
rbx               0xffff800000df0680
rdx                                0
rcx                              0x1
rax               0xffff80002a63c000
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x829ae0964f546353
r11               0xa2f1102cdf62681c
r12                       0xfffffffc
r13                       0x8020426c    __kernel_virt_to_phys+0x20426c
r14                                0
r15               0xffff80002d9230c0
rip               0xffffffff81a1f5d0    strcmp+0x50
cs                               0x8
rflags                       0x10296    __ALIGN_SIZE+0xf296
rsp               0xffff80002d922e08
ss                              0x10
strcmp+0x50:    movq    0x8(%rdi),%rax
ddb> show proc
PROC (syz-executor.6) tid=7863 pid=43873 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=80, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0
    forw=0xffffffffffffffff, list=0xffff80002a63c550,0xffffffff82d73440
    process=0xffff8000ffff8868 user=0xffff80002d91e000, vmspace=0xfffffd805d261030
    estcpu=30, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 43873  471803  81688      0  2           0                syz-executor.6
*43873    7863  81688      0  7   0x4000000                syz-executor.6
 80166  128125  11623      0  2           0                syz-executor.7
 80166  491654  11623      0  3   0x4000080  ttyin         syz-executor.7
 80166    9541  11623      0  3   0x4000080  fsleep        syz-executor.7
 72153   13424  57921      0  3        0x80  nanoslp       syz-executor.4
 72153  162534  57921      0  3   0x4000080  fsleep        syz-executor.4
 72153  162378  57921      0  3   0x4000080  fsleep        syz-executor.4
 21446  214848  21121      0  2         0x2                syz-executor.2
 64196  268656  21121      0  2         0x2                syz-executor.3
 11623   69983  21121      0  3        0x82  nanoslp       syz-executor.7
 81688  281910  21121      0  3        0x82  nanoslp       syz-executor.6
 57921  164409  21121      0  3        0x82  nanoslp       syz-executor.4
 53714  308102  21121      0  2         0x2                syz-executor.5
  1939   43935      1      0  3    0x100083  ttyin         getty
 60998  388489      0      0  3     0x14280  nfsidl        nfsio
 60349  165600      0      0  3     0x14280  nfsidl        nfsio
 25163   34711      0      0  3     0x14280  nfsidl        nfsio
  5371  519561      0      0  3     0x14280  nfsidl        nfsio
 96598  161311      0      0  3     0x14280  nfsidl        nfsio
 35128  243153      0      0  3     0x14280  nfsidl        nfsio
 58394  386976      0      0  3     0x14280  nfsidl        nfsio
 32250   83605      0      0  3     0x14280  nfsidl        nfsio
 66325  516794      0      0  3     0x14280  nfsidl        nfsio
 34477  107107      0      0  3     0x14280  nfsidl        nfsio
 80496   14793      0      0  3     0x14280  nfsidl        nfsio
 39073   25668      0      0  3     0x14280  nfsidl        nfsio
 51747  392931      0      0  3     0x14280  nfsidl        nfsio
 48795  366102      0      0  3     0x14280  nfsidl        nfsio
 43070  491929      0      0  3     0x14280  nfsidl        nfsio
 80511  145591      0      0  3     0x14280  nfsidl        nfsio
 88882  268197      0      0  3     0x14280  nfsidl        nfsio
 95116  271279      0      0  3     0x14280  nfsidl        nfsio
 88079   74613      0      0  3     0x14280  nfsidl        nfsio
 67243  513202      0      0  3     0x14280  nfsidl        nfsio
 29056   49176  21121      0  3        0x82  nanoslp       syz-executor.1
 16107  451472  21121      0  2         0x2                syz-executor.0
  6039  139048      1      0  3        0x80  fsleep        syz-executor.1
  6039  238973      1      0  3   0x4000080  ttyin         syz-executor.1
  6039  314336      1      0  3   0x4000080  fsleep        syz-executor.1
  6039  241809      1      0  3   0x4000080  fsleep        syz-executor.1
 90824  177266      1      0  3        0x80  fsleep        syz-executor.2
 90824   35243      1      0  3   0x4000080  ttyin         syz-executor.2
 51190  220525      0      0  3     0x14200  acct          acct
 85765  329048      0      0  3     0x14200  bored         sosplice
 21121  263567  13901      0  3   0x2000082  wait          syz-fuzzer
 21121   46738  13901      0  3   0x6000082  thrsleep      syz-fuzzer
 21121  412523  13901      0  3   0x6000082  thrsleep      syz-fuzzer
 21121  444505  13901      0  3   0x6000082  wait          syz-fuzzer
 21121  296879  13901      0  3   0x6000082  kqread        syz-fuzzer
 21121  396953  13901      0  3   0x6000082  thrsleep      syz-fuzzer
 21121  354121  13901      0  3   0x6000082  wait          syz-fuzzer
 21121  134979  13901      0  3   0x6000082  wait          syz-fuzzer
 21121  306783  13901      0  3   0x6000082  thrsleep      syz-fuzzer
 21121  426299  13901      0  3   0x6000082  wait          syz-fuzzer
 21121  503284  13901      0  3   0x6000082  thrsleep      syz-fuzzer
 21121  367724  13901      0  3   0x6000082  wait          syz-fuzzer
 21121  252614  13901      0  3   0x6000082  wait          syz-fuzzer
 21121  498511  13901      0  3   0x6000082  wait          syz-fuzzer
 13901  206165  71004      0  3    0x10008a  sigsusp       ksh
 71004  458793  18004      0  3        0x9a  kqread        sshd
 18004  253534      1      0  3        0x88  kqread        sshd
 17509   79959  11078     73  3   0x1100090  kqread        syslogd
 11078  408655      1      0  3    0x100082  netio         syslogd
 93454   81097      1      0  3    0x100080  kqread        resolvd
 33432  351172  40032     77  3    0x100092  kqread        dhcpleased
 48221   45673  40032     77  3    0x100092  kqread        dhcpleased
 40032  353857      1      0  3        0x80  kqread        dhcpleased
  8677  117864      0      0  3     0x14200  bored         smr
 36327  103455      0      0  2     0x14200                zerothread
 71012  195625      0      0  3     0x14200  aiodoned      aiodoned
 50235    3549      0      0  3     0x14200  syncer        update
 16318   84568      0      0  3     0x14200  cleaner       cleaner
  7180  321327      0      0  3     0x14200  reaper        reaper
 35778  439202      0      0  3     0x14200  pgdaemon      pagedaemon
 65987  150579      0      0  3     0x14200  bored         viomb
  5361  523924      0      0  3  0x40014200  acpi0         acpi0
 16150  204822      0      0  3     0x14200  bored         softnet3
 47293  114880      0      0  3     0x14200  bored         softnet2
  2491   57979      0      0  3     0x14200  bored         softnet1
 80429   88519      0      0  3     0x14200  bored         softnet0
 10022  108531      0      0  3     0x14200  bored         systqmp
 61404  120359      0      0  3     0x14200  bored         systq
 15148  185431      0      0  2  0x40014200                softclock
  9243  331086      0      0  3  0x40014200                idle0
     1  345649      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10203   6420K    7388K 166960K     46555        0
            pcb    15     16K      18K 166960K      1032        0
         rtable   185     13K      15K 166960K      3723        0
             pf    30      9K       9K 166960K       458        0
         ifaddr    35     11K      13K 166960K       468        0
        ifgroup    51      2K       2K 166960K       757        0
         sysctl     3      0K       0K 166960K         7        0
       counters    30     17K      17K 166960K       226        0
       ioctlops     0      0K       2K 166960K       711        0
            iov     0      0K      24K 166960K      1604        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1626    102K     102K 166960K     10743        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K       179        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K      1900        0
        dirhash    12      2K       2K 166960K        99        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    15     53K      81K 166960K     14158        0
          sigio     0      0K       0K 166960K       565        0
           proc    58     59K      75K 166960K      2844        0
        subproc   130      8K       8K 166960K      1027        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       574        0
       in_multi    69      5K       7K 166960K       986        0
    ether_multi     1      0K       0K 166960K         4        0
            mrt     0      0K       0K 166960K         7        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   247   1102K    1102K 166960K       247        0
           exec     0      0K       1K 166960K      2765        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   427    303K     320K 166960K    129651        0
       UVM aobj   131      8K       8K 166960K       131        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K       366        0
            NDP    11      0K       1K 166960K       368        0
           temp    83   6764K    7118K 166960K    121278        0
         kqueue    12     18K      26K 166960K       942        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120     1011    0     1008     8     5     3     5     0     8    2
rtentry    112     1018    0      936     4     0     4     4     0     8    0
unpcb      144     8354    0     8338    30    22     8    11     0     8    7
syncache   336      118    0      118     3     2     1     1     0     8    1
tcpqe       32      154    0      154     3     2     1     1     0     8    1
tcpcb      808     4535    0     4525    30    21     9    12     0     8    7
arp         88      186    0      172     1     0     1     1     0     8    0
ipq         40       17    0       16     2     1     1     1     0     8    0
ipqe        40       53    0       52     2     1     1     1     0     8    0
inpcb      360    10381    0    10368    57    47    10    17     0     8    8
nd6        104      254    0      240     1     0     1     1     0     8    0
pkpcb       40      106    0      106     3     2     1     1     0     8    1
kcovpl      48       79    0       69     1     0     1     1     0     8    0
ppxss      1072      57    0       57     3     2     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     4015    0     3669    51    22    29    30     0     8    3
art_table   32     4016    0     3669     4     0     4     4     0     8    0
art_node    16     1013    0      937     1     0     1     1     0     8    0
sysvmsgpl   40        6    0        4     1     0     1     1     0     8    0
semapl     112     1898    0     1888     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      75    0       58     3     0     3     3     0     8    0
dino2pl    256    19187    0    17689    95     0    95    95     0     8    0
ffsino     240    19187    0    17689    89     0    89    89     0     8    0
nchpl      144    37422    0    35786    63     0    63    63     0     8    1
uvmvnodes   80     6077    0        0   125     0   125   125     0     8    0
vnodes     216     6077    0        0   338     0   338   338     0     8    0
namei      1024  126582    0   126579     8     6     2     3     0     8    1
vcpupl     2048      58    0        2     8     0     8     8     0     8    0
vmpool     664       93    0       37     5     0     5     5     0     8    0
kstatmem   264      414    0      392     2     0     2     2     0     8    0
scxspl     216   123390    0   123390    14    10     4     8     1     8    4
plimitpl   152     1477    0     1458     1     0     1     1     0     8    0
sigapl     424    14495    0    14430     8     0     8     8     0     8    0
futexpl     64   119481    0   119474     1     0     1     1     0     8    0
knotepl    120   175917    0   175835    36    25    11    18     0     8    8
kqueuepl   184     2189    0     2181    12     6     6     6     0     8    5
pipepl     288     2329    0     2299    19    12     7     7     0     8    4
fdescpl    432    14297    0    14271     4     0     4     4     0     8    0
filepl     120    76657    0    76380    39    22    17    18     0     8    6
lockfpl    104     7130    0     7127     2     0     2     2     0     8    1
lockfspl    48     3109    0     3106     1     0     1     1     0     8    0
sessionpl  144       93    0       75     1     0     1     1     0     8    0
pgrppl      48      183    0      165     1     0     1     1     0     8    0
ucredpl    104    10506    0    10492     1     0     1     1     0     8    0
zombiepl   144    14431    0    14430     2     1     1     1     0     8    0
processpl  1072   14495    0    14430     5     0     5     5     0     8    0
procpl     680    35171    0    35084    14     4    10    10     0     8    1
sosppl     168      121    0      121     3     2     1     1     0     8    1
sockpl     488    19874    0    19842   327   314    13    37     0     8    7
mcl64k     65536    559    0      559     4     3     1     1     0     8    1
mcl16k     16384    222    0      222     4     3     1     1     0     8    1
mcl12k     12288    549    0      549     4     3     1     1     0     8    1
mcl9k      9216     405    0      405     4     3     1     1     0     8    1
mcl8k      8192    1011    0     1010     7     6     1     1     0     8    0
mcl4k      4096    1403    0     1403     7     6     1     1     0     8    1
mcl2k2     2112      99    0       99     4     3     1     1     0     8    1
mcl2k      2048  100412    0   100374    39    26    13    30     0     8    7
mtagpl      96     4079    0     3767    20     0    20    20     0     8    6
mbufpl     256   282055    0   281630   530   474    56   275     0     8    8
bufpl      280    27984    0    21592   457     0   457   457     0     8    0
anonpl      24  1450067    0  1435439   168    49   119   119     0   188   12
amapchunkpl 152  409399    0   408551    66    16    50    50     0   158   10
amappl16   200    30341    0    29851   113    79    34    40     0     8    7
amappl15   192      111    0      110     1     0     1     1     0     8    0
amappl14   184      366    0      354     2     1     1     2     0     8    0
amappl13   176       43    0       43     2     1     1     1     0     8    1
amappl12   168    15987    0    15959     2     0     2     2     0     8    0
amappl11   160       51    0       41     1     0     1     1     0     8    0
amappl10   152      157    0      143     1     0     1     1     0     8    0
amappl9    144      214    0      214     1     0     1     1     0     8    1
amappl8    136      578    0      496     3     0     3     3     0     8    0
amappl7    128      398    0      373     2     0     2     2     0     8    0
amappl6    120     1336    0     1323     1     0     1     1     0     8    0
amappl5    112      357    0      348     1     0     1     1     0     8    0
amappl4    104      890    0      864     2     1     1     2     0     8    0
amappl3     96    80761    0    80665     4     0     4     4     0     8    0
amappl2     88    15504    0    15430     3     1     2     3     0     8    0
amappl1     80    63491    0    62979    22    10    12    22     0     8    0
amappl      88   128339    0   128103     7     0     7     7     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      130    0        0     3     0     3     3     0     8    0
uaddrrnd    24    14390    0    14308     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    14390    0    14308     1     0     1     1     0     8    0
vmmpekpl   168   104340    0   104264     4     0     4     4     0     8    0
vmmpepl    168   869520    0   867222   198    57   141   141     0   357   13
vmsppl     352    14389    0    14308     8     0     8     8     0     8    0
rwobjpl     24   204196    0   196404    49     0    49    49     0     8    0
pdppl      4096   28786    0    28672   955   835   120   125     0     8    6
pvpl        32  4047383    0  4026707   502   261   241   363     0   265   53
pmappl     216    14389    0    14308     5     0     5     5     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1870    0     1422    18     0    18    18     0     8    2
ddb> machine ddbcpu 0
No such command
ddb> trace
strcmp() at strcmp+0x50
bpfioctl(21700,8020426c,ffff80002d9230c0,1,ffff80002a63c000) at bpfioctl+0xab2 sys/net/bpf.c:956
VOP_IOCTL(fffffd807dd918a0,8020426c,ffff80002d9230c0,1,fffffd807f7d7a28,ffff80002a63c000) at VOP_IOCTL+0x91 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806cf2bd28,8020426c,ffff80002d9230c0,ffff80002a63c000) at vn_ioctl+0xbb sys/kern/vfs_vnops.c:525
sys_ioctl(ffff80002a63c000,ffff80002d9232a0,ffff80002d9231f0) at sys_ioctl+0x49e
syscall(ffff80002d9232a0) at syscall+0x751 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x261b8063740, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
strcmp() at strcmp+0x50
bpfioctl(21700,8020426c,ffff80002d9230c0,1,ffff80002a63c000) at bpfioctl+0xab2 sys/net/bpf.c:956
VOP_IOCTL(fffffd807dd918a0,8020426c,ffff80002d9230c0,1,fffffd807f7d7a28,ffff80002a63c000) at VOP_IOCTL+0x91 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806cf2bd28,8020426c,ffff80002d9230c0,ffff80002a63c000) at vn_ioctl+0xbb sys/kern/vfs_vnops.c:525
sys_ioctl(ffff80002a63c000,ffff80002d9232a0,ffff80002d9231f0) at sys_ioctl+0x49e
syscall(ffff80002d9232a0) at syscall+0x751 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x261b8063740, count: -7

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/07 10:52 openbsd 17449d5ce459 f39a7eed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: strcmp
* Struck through repros no longer work on HEAD.