syzbot


protection_fault: __x86_indirect_thunk_r11 (3)

Status: upstream: reported on 2024/08/18 10:02
Reported-by: syzbot+637aaf75b9531ece3d17@syzkaller.appspotmail.com
First crash: 29d, last: 29d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: __x86_indirect_thunk_r11 (2) 15 111d 194d 0/3 auto-obsoleted due to no activity on 2024/08/17 10:13
openbsd protection_fault: __x86_indirect_thunk_r11 1 322d 322d 0/3 auto-obsoleted due to no activity on 2024/01/28 10:43

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      __x86_indirect_thunk_r11+0x14:  ret
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
softclock_thread(ffff80002a40cca8) at softclock_thread+0xe3 sys/kern/kern_timeout.c:811
end trace frame: 0x0, count: -2
ddb> show registers
rdi               0xdead4110dead4110
rsi                                0
rbp               0xffff80002a419440
rbx                                0
rdx                                0
rcx               0xffffffff83473ff0    cpu_info_full_primary+0x1ff0
rax                              0x9
r8                                 0
r9                                 0
r10               0xf181c016eb9ed989
r11               0xdead4110dead4110
r12               0xdead4110dead4110
r13               0xffffffff83473ff0    cpu_info_full_primary+0x1ff0
r14               0xffff8000ffffddf8
r15               0xdead4110dead4110
rip               0xffffffff82531304    __x86_indirect_thunk_r11+0x14
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a419400
ss                              0x10
__x86_indirect_thunk_r11+0x14:  ret
ddb> show proc
PROC (softclock) tid=184034 pid=44084 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
    runpri=50, usrpri=50, slppri=0, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a40cf30,0xffff80002a40c7a8
    process=0xffff8000ffffddf8 user=0xffff80002a414000, vmspace=0xffffffff8356dbd8
    estcpu=0, cpticks=0, pctcpu=0.0, user=0, sys=9, intr=1
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  2511  264507  40914  60928  2   0xc081010                syz-executor
  2511   68451  40914  60928  3   0xc003010  suspend       syz-executor
 81028  297285  52129  60929  3   0x8003010  suspend       syz-executor
 81028  184753  52129  60929  2   0xc081010                syz-executor
 81028  504170  52129  60929  3   0xc081010  inode         syz-executor
  3990  447820  68505      0  3   0x8000082  wait          syz-executor
 18943   30565  68505      0  3   0x8000082  wait          syz-executor
 52129  205252  68505      0  3   0x8000082  wait          syz-executor
 97419  417260  68505      0  3   0x8000082  wait          syz-executor
 39039  345052  68505      0  3   0x8000082  wait          syz-executor
 40914   30572  68505      0  3   0x8000082  wait          syz-executor
  6696   51755  68505      0  3   0x8000082  wait          syz-executor
  6936  258844      0      0  3     0x14200  bored         sosplice
 48472   14918      1      0  3  0x18100083  ttyin         getty
 68505  130604  82229      0  3   0x8000082  wait          syz-executor
 82229  390847   9351      0  3   0x810008a  sigsusp       ksh
  9351    2646  47593      0  3  0x18000098  kqread        sshd-session
 47593  483387  83573      0  3  0x18000092  kqread        sshd-session
 83573  259458      1      0  3  0x18000088  kqread        sshd
 13163   37316  92333     73  3  0x19100010  biowait       syslogd
 92333  185943      1      0  3  0x18100082  sbwait        syslogd
 97007   16227      1      0  3  0x18100080  kqread        resolvd
 31809   78268  27601     77  3  0x18100092  kqread        dhcpleased
 16918  520049  27601     77  3  0x18100092  kqread        dhcpleased
 27601  107089      1      0  3  0x18000080  kqread        dhcpleased
 12132  179520      0      0  3     0x14200  bored         smr
 81610  382170      0      0  2     0x14200                zerothread
 17592  453544      0      0  3     0x14200  aiodoned      aiodoned
 12908  473103      0      0  3     0x14200  syncer        update
  7548   43487      0      0  3     0x14200  cleaner       cleaner
 21197  359094      0      0  2     0x14200                reaper
 98104  513261      0      0  3     0x14200  pgdaemon      pagedaemon
 87151  439012      0      0  3     0x14200  bored         viomb
 39381  509899      0      0  3  0x40014200  acpi0         acpi0
  2744    1485      0      0  3     0x14200  bored         softnet3
 19587  116763      0      0  3     0x14200  bored         softnet2
 20624   33004      0      0  3     0x14200  bored         softnet1
 76930  408094      0      0  2     0x14200                softnet0
 79123   58778      0      0  3     0x14200  bored         systqmp
 99198  277495      0      0  3     0x14200  bored         systq
*44084  184034      0      0  7  0x40014200                softclock
 65173  482657      0      0  3  0x40014200                idle0
     1  243747      0      0  3   0x8000082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10213  10108K   14308K 166960K     17546        0
            pcb    17     18K      20K 166960K      1340        0
         rtable   191      7K       8K 166960K      7050        0
             pf    40     15K      21K 166960K       653        0
         ifaddr    40     10K      12K 166960K       988        0
        ifgroup    54      2K       2K 166960K      1093        0
         sysctl     4      1K       1K 166960K        14        0
       counters    31     17K      17K 166960K       298        0
       ioctlops     0      0K       4K 166960K       794        0
            iov     0      0K      24K 166960K       412        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1548     97K      98K 166960K      8236        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3     72K      72K 166960K        89        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       201        0
        dirhash    15      2K       3K 166960K       114        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    12     41K      97K 166960K      6506        0
          sigio     1      0K       0K 166960K       128        0
           proc    59     59K     124K 166960K      6591        0
        subproc   104      6K      10K 166960K      2890        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       496        0
       in_multi    85      6K       7K 166960K      2441        0
    ether_multi     1      0K       0K 166960K        14        0
            mrt     1      0K       0K 166960K        12        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   259   1155K    1155K 166960K       259        0
           exec     0      0K       1K 166960K      4424        0
     pfkey data     0      0K       0K 166960K         4        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   257    121K     133K 166960K     51070        0
       UVM aobj    57      2K       2K 166960K        63        0
     pinsyscall    35     70K      96K 166960K     12915        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K       209        0
            NDP    12      0K       2K 166960K       709        0
           temp    78   6816K    6956K 166960K    209593        0
         kqueue    13     20K      30K 166960K       568        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      955    0      952     6     3     3     3     0     8    2
rtentry    112     2546    0     2461     4     1     3     4     0     8    0
unpcb      144     5858    0     5837    16    10     6     6     0     8    5
syncache   336        5    0        5     2     2     0     1     0     8    0
tcpcb      808     1654    0     1650    28    20     8    14     0     8    7
arp         88      462    0      445     1     0     1     1     0     8    0
ipq         40       18    0       16     1     0     1     1     0     8    0
ipqe        40       70    0       68     1     0     1     1     0     8    0
inpcb      336     7219    0     7204    34    24    10    13     0     8    7
nd6        104      674    0      653     1     0     1     1     0     8    0
pkpcb       40       25    0       25     3     2     1     1     0     8    1
kcovpl      48      217    0      209     1     0     1     1     0     8    0
ppxss      1072      29    0       29     3     2     1     1     0     8    1
pfstscr     40       10    0       10     3     2     1     1     0     8    1
pfosfp      40       75    0       72     1     0     1     1     0     8    0
pfosfpen   112       75    0       70     1     0     1     1     0     8    0
pfanchor   1288       1    0        0     1     0     1     1     0     8    0
pftag       88        4    0        0     1     0     1     1     0     8    0
pfqueue    264        2    0        1     2     1     1     1     0     8    0
pfstitem    24       14    0       10     1     0     1     1     0     8    0
pfstkey    128       64    0       50     1     0     1     1     0     8    0
pfstate    344       33    0       31     1     0     1     1     0     8    0
pfrule     1344      29    0       25     1     0     1     1     0     8    0
rttmr      136        2    0        2     2     1     1     1     0     8    1
pool(rttmr): free list modified: page 0xfffffd807ac4a000; item ordinal 0; addr 0xfffffd807ac4aee8 (p 0xfffffd807ac4a000); offset 0x10=0xffffffff
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256     9892    0     9517    59    31    28    30     0     8    1
art_table   32     9894    0     9517     5     1     4     4     0     8    0
art_node    16     2504    0     2431     1     0     1     1     0     8    0
sysvmsgpl   40       15    0       11     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      199    0      189     1     0     1     1     0     8    0
shmpl      112       60    0        6     2     0     2     2     0     8    0
dirhash    1024      86    0       66     3     0     3     3     0     8    0
dino2pl    256     8716    0     6810   120     0   120   120     0     8    0
ffsino     240     8716    0     6810   113     0   113   113     0     8    0
nchpl      144    13970    0    12012    73     0    73    73     0     8    0
uvmvnodes   80     9000    0        0   184     0   184   184     0     8    0
vnodes     216     9000    0        0   500     0   500   500     0     8    0
namei      1024   76637    0    76635     4     2     2     2     0     8    1
vcpupl     3904      15    0        2     2     0     2     2     0     8    0
vmpool     664       23    0       10     2     0     2     2     0     8    0
kstatmem   264      558    0      534     2     0     2     2     0     8    0
scsiplug    72        4    0        4     2     1     1     1     0     8    1
scxspl     216   130675    0   130674    11     8     3     8     1     8    2
plimitpl   152     1754    0     1736     1     0     1     1     0     8    0
sigapl     424     6393    0     6346     9     0     9     9     0     8    3
futexpl     64    63298    0    63298     1     0     1     1     0     8    1
knotepl    120   142120    0   142073    33    23    10    17     0     8    5
kqueuepl   184     1632    0     1623    13    10     3     6     0     8    2
pipepl     288     1563    0     1536    17    10     7     9     0     8    4
fdescpl    432     6353    0     6327     5     1     4     5     0     8    0
filepl     120    45144    0    44897    30    15    15    16     0     8    6
lockfpl    104     1620    0     1617     3     1     2     2     0     8    1
lockfspl    48      666    0      663     1     0     1     1     0     8    0
sessionpl  144      229    0      221     1     0     1     1     0     8    0
pgrppl      48      484    0      468     1     0     1     1     0     8    0
ucredpl    104     6446    0     6432     1     0     1     1     0     8    0
zombiepl   144     7348    0     7340     2     1     1     1     0     8    0
processpl  1096    6393    0     6346     6     0     6     6     0     8    1
procpl     648    12426    0    12369    10     2     8     9     0     8    2
sosppl     168        6    0        6     3     2     1     1     0     8    1
sockpl     504    14167    0    14128   224   210    14    30     0     8    6
mcl64k     65536    108    0      108     2     1     1     1     0     8    1
mcl16k     16384     11    0       11     3     2     1     1     0     8    1
mcl12k     12288      9    0        9     3     2     1     1     0     8    1
mcl9k      9216       5    0        5     2     1     1     1     0     8    1
mcl8k      8192     149    0      149     3     2     1     1     0     8    1
mcl4k      4096      32    0       32     3     2     1     1     0     8    1
mcl2k2     2112       3    0        3     1     0     1     1     0     8    1
mcl2k      2048   19685    0    19585    27    11    16    23     0     8    2
mtagpl      96      261    0      259     4     3     1     3     0     8    0
mbufpl     256    70814    0    70621   140   119    21    68     0     8    3
bufpl      280    18110    0     9057   647     0   647   647     0     8    0
anonpl      24   829085    0   820532   164   112    52   108     0   187    0
amapchunkpl 152  165606    0   164560   101    60    41    54     0   158    0
amappl16   200    12217    0    12177   110    98    12    26     0     8    8
amappl15   192       10    0       10     2     2     0     1     0     8    0
amappl14   184      531    0      521     1     0     1     1     0     8    0
amappl13   176        5    0        5     1     1     0     1     0     8    0
amappl12   168    10257    0    10227     3     1     2     3     0     8    0
amappl11   160       72    0       62     1     0     1     1     0     8    0
amappl10   152       23    0       22     1     0     1     1     0     8    0
amappl9    144      132    0      132     1     1     0     1     0     8    0
amappl8    136       22    0       20     1     0     1     1     0     8    0
amappl7    128      541    0      529     1     0     1     1     0     8    0
amappl6    120     2267    0     2265     1     0     1     1     0     8    0
amappl5    112      963    0      954     1     0     1     1     0     8    0
amappl4    104      928    0      911     1     0     1     1     0     8    0
amappl3     96    31729    0    31601     5     1     4     4     0     8    0
amappl2     88     3559    0     3501     2     0     2     2     0     8    0
amappl1     80    39180    0    38635    15     2    13    14     0     8    0
amappl      88    48932    0    48742     5     0     5     5     0    92    0
dma65536   65536      1    0        1     1     1     0     1     0     8    0
dma4096    4096       2    0        2     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma512     512        1    0        1     1     0     1     1     0     8    1
dma256     256        7    0        7     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       62    0        6     2     0     2     2     0     8    0
uaddrrnd    24     6376    0     6334     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     6376    0     6334     1     0     1     1     0     8    0
vmmpekpl   168    52833    0    52780     4     0     4     4     0     8    0
vmmpepl    168   384932    0   383087   139    48    91   102     0   357   10
vmsppl     344     6375    0     6333     5     0     5     5     0     8    1
rwobjpl     24   111654    0   101687    62     0    62    62     0     8    0
pdppl      4096   12758    0    12679   471   392    79    84     0     8    0
pvpl        32  3073107    0  3054979   834   602   232   450     0   265   73
pmappl     216     6375    0     6333     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1260    0      831    14     0    14    14     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
softclock_thread(ffff80002a40cca8) at softclock_thread+0xe3 sys/kern/kern_timeout.c:811
end trace frame: 0x0, count: -2
ddb> machine ddbcpu 1
No such command
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
softclock_thread(ffff80002a40cca8) at softclock_thread+0xe3 sys/kern/kern_timeout.c:811
end trace frame: 0x0, count: -2

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/18 10:01 openbsd 076a4f8b5857 dbc93b08 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
* Struck through repros no longer work on HEAD.