syzbot


assert "d->bd_in_uiomove == NUM" failed in bpf.c (4)

Status: upstream: reported on 2025/06/29 10:11
Reported-by: syzbot+53cde92f182d7250ccd7@syzkaller.appspotmail.com
First crash: 66d, last: 66d
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "d->bd_in_uiomove == NUM" failed in bpf.c -1 1 1013d 1013d 0/3 auto-obsoleted due to no activity on 2023/02/23 12:32
openbsd assert "d->bd_in_uiomove == NUM" failed in bpf.c (3) -1 1 87d 87d 3/3 fixed on 2025/06/14 15:09
openbsd assert "d->bd_in_uiomove == NUM" failed in bpf.c (2) -1 1 291d 291d 0/3 auto-obsoleted due to no activity on 2025/02/14 16:43

Sample crash report:
panic: kernel diagnostic assertion "d->bd_in_uiomove == 0" failed: file "/syzkaller/managers/main/kernel/sys/net/bpf.c", line 550
Starting stack trace...
panic(ffffffff834316bf) at panic+0x1ba sys/kern/subr_prf.c:229
__assert(ffffffff833e1ca0,ffffffff8339326d,226,ffffffff8335a8c4) at __assert+0x29 sys/kern/subr_prf.c:-1
bpfread(41700,ffff80003c997a30,0) at bpfread+0x79d sys/net/bpf.c:550
spec_read(ffff80003c997820) at spec_read+0x14c sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e6ac7e8,ffff80003c997a30,0,fffffd8007bfb7b8) at VOP_READ+0x102 sys/kern/vfs_vops.c:227
vn_read(fffffd8061ba71e8,ffff80003c997a30,0) at vn_read+0x16d sys/kern/vfs_vnops.c:369
dofilereadv(ffff80002a7e2f78,7,ffff80003c997a30,0,ffff80003c997af0) at dofilereadv+0x230 sys/kern/sys_generic.c:252
sys_readv(ffff80002a7e2f78,ffff80003c997ba0,ffff80003c997af0) at sys_readv+0xd8 sys/kern/sys_generic.c:199
syscall(ffff80003c997ba0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c997ba0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:637
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x2f8874a3f10, count: 247
End of stack trace.

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/29 10:10 openbsd 31aef2a8f397 fc9d8ee5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "d->bd_in_uiomove == NUM" failed in bpf.c
* Struck through repros no longer work on HEAD.