syzbot


uvm_fault: ffs_nodealloccg (2)

Status: upstream: reported on 2024/09/13 08:10
Reported-by: syzbot+68d04496c00d8cb6bd52@syzkaller.appspotmail.com
First crash: 60d, last: 60d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs_nodealloccg 1 1023d 1023d 0/3 auto-closed as invalid on 2022/04/24 17:10

Sample crash report:
login: uvm_fault(0xffffffff83504770, 0xffff800028582004, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs_nodealloccg+0x131:  movl    0x4(%r14),%r13d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 31212  28302      0         0x2          0    0K syz-executor
 347499  82254      0         0x2          0    1  syz-executor
ffs_nodealloccg(fffffd8074c5c330,2,ca80,41c0) at ffs_nodealloccg+0x131 ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_nodealloccg(fffffd8074c5c330,2,ca80,41c0) at ffs_nodealloccg+0x131 sys/ufs/ffs/ffs_alloc.c:1106
ffs_inode_alloc(fffffd8074c5c330,41c0,fffffd807f7d3548,ffff8000359a7098) at ffs_inode_alloc+0x20b ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:814 [inline]
ffs_inode_alloc(fffffd8074c5c330,41c0,fffffd807f7d3548,ffff8000359a7098) at ffs_inode_alloc+0x20b sys/ufs/ffs/ffs_alloc.c:390
ufs_mkdir(ffff8000359a7100) at ufs_mkdir+0x113 sys/ufs/ufs/ufs_vnops.c:1112
VOP_MKDIR(fffffd806ee2cdb0,ffff8000359a7260,ffff8000359a7290,ffff8000359a7190) at VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
domkdirat(ffff800033188a50,ffffff9c,73efcb95c2c0,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3099
syscall(ffff8000359a7410) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000359a7410) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73efcb95c280, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xffffffff83504770, 0xffff800028582004, 0, 1) -> d
ddb{0}> trace
ffs_nodealloccg(fffffd8074c5c330,2,ca80,41c0) at ffs_nodealloccg+0x131 ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_nodealloccg(fffffd8074c5c330,2,ca80,41c0) at ffs_nodealloccg+0x131 sys/ufs/ffs/ffs_alloc.c:1106
ffs_inode_alloc(fffffd8074c5c330,41c0,fffffd807f7d3548,ffff8000359a7098) at ffs_inode_alloc+0x20b ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:814 [inline]
ffs_inode_alloc(fffffd8074c5c330,41c0,fffffd807f7d3548,ffff8000359a7098) at ffs_inode_alloc+0x20b sys/ufs/ffs/ffs_alloc.c:390
ufs_mkdir(ffff8000359a7100) at ufs_mkdir+0x113 sys/ufs/ufs/ufs_vnops.c:1112
VOP_MKDIR(fffffd806ee2cdb0,ffff8000359a7260,ffff8000359a7290,ffff8000359a7190) at VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
domkdirat(ffff800033188a50,ffffff9c,73efcb95c2c0,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3099
syscall(ffff8000359a7410) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000359a7410) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73efcb95c280, count: -7
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff8000359a6ec0
rbx                              0x2
rdx                                0
rcx               0xffff800033188a50
rax               0xffffffff83466ff0    cpu_info_full_primary+0x1ff0
r8                0xffffffffffffffff
r9                0xfffffd807f7d3548
r10               0xecffec555d2b2d45
r11               0x211f05678f7d5f26
r12               0xfffffd8074c5c330
r13                                0
r14               0xffff800028582000
r15               0xfffffd807beace40
rip               0xffffffff8178b091    ffs_nodealloccg+0x131
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000359a6e10
ss                              0x10
ffs_nodealloccg+0x131:  movl    0x4(%r14),%r13d
ddb{0}> show proc
PROC (syz-executor) tid=31212 pid=28302 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=0
    runpri=50, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffff67b8,0xffff800033189990
    process=0xffff80002d774018 user=0xffff8000359a2000, vmspace=0xfffffd806ece2008
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 39865  173678  82254      0  2           0                syz-executor
  9783  213385  82254      0  2           0                syz-executor
*28302   31212  82254      0  7         0x2                syz-executor
 49224  454211      1      0  3    0x100083  ttyin         getty
  8609  231204      0      0  3     0x14200  bored         sosplice
 82254  347499   1918      0  7         0x2                syz-executor
  1918  105388  76572      0  3    0x10008a  sigsusp       ksh
 76572  107482  72904      0  3        0x98  kqread        sshd-session
 72904  168297   3223      0  3        0x92  kqread        sshd-session
  3223   28763      1      0  3        0x88  kqread        sshd
 61184   31279  70381     74  3   0x1100092  bpf           pflogd
 70381  359809      1      0  3        0x80  sbwait        pflogd
 70778  426912  86430     73  3   0x1100090  kqread        syslogd
 86430  268505      1      0  3    0x100082  sbwait        syslogd
 47226   92366      1      0  3    0x100080  kqread        resolvd
 79250  426924  63370     77  3    0x100092  kqread        dhcpleased
 87163  273604  63370     77  3    0x100092  kqread        dhcpleased
 63370  470006      1      0  3        0x80  kqread        dhcpleased
 77466  132444      0      0  3     0x14200  bored         smr
 90707  412614      0      0  3     0x14200  pgzero        zerothread
 18907  435726      0      0  3     0x14200  aiodoned      aiodoned
 66309  518140      0      0  3     0x14200  syncer        update
 67267  334268      0      0  3     0x14200  cleaner       cleaner
 97226  430198      0      0  3     0x14200  reaper        reaper
 70794  208891      0      0  3     0x14200  pgdaemon      pagedaemon
 37643  361372      0      0  3     0x14200  bored         viomb
  2324   54204      0      0  3  0x40014200  acpi0         acpi0
 26019  318496      0      0  3  0x40014200                idle1
 45253  119030      0      0  3     0x14200  bored         softnet3
 85589  312356      0      0  3     0x14200  bored         softnet2
 97535  198564      0      0  3     0x14200  bored         softnet1
 56929  287283      0      0  3     0x14200  bored         softnet0
 48522  384495      0      0  3     0x14200  bored         systqmp
 40775  400771      0      0  3     0x14200  bored         systq
 32840  458646      0      0  3     0x14200  tmoslp        softclockmp
 51232   73696      0      0  3  0x40014200  tmoslp        softclock
  3441  286151      0      0  3  0x40014200                idle0
     1   58389      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 28302 (syz-executor) thread 0xffff800033188a50 (31212)
exclusive rrwlock inode r = 0 (0xfffffd8074c5c3c8)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  domkdirat+0x8b sys/kern/vfs_syscalls.c:3084
#8  syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#8  syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#9  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83553178)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  syscall+0xad6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#1  syscall+0xad6 sys/arch/amd64/amd64/trap.c:577
#2  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10174  10083K   10466K 166960K     11756        0
            pcb    17     12K      12K 166960K       105        0
         rtable    61      2K       7K 166960K       853        0
             pf    18     15K      21K 166960K        94        0
         ifaddr    11      1K       7K 166960K       119        0
        ifgroup    22      1K       2K 166960K       129        0
         sysctl     2      0K       0K 166960K         2        0
       counters    48     34K      36K 166960K       104        0
       ioctlops     0      0K       4K 166960K      1530        0
            iov     0      0K      16K 166960K        18        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1427     90K      90K 166960K      1961        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         8        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        25        0
        dirhash    15      2K       2K 166960K        21        0
           ACPI  1690    195K     286K 166960K     12418        0
      file desc     5      4K      93K 166960K       812        0
          sigio     0      0K       0K 166960K        78        0
           proc    72     91K     140K 166960K      1032        0
        subproc     0      0K       6K 166960K       312        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        58        0
       in_multi    11      0K       7K 166960K       297        0
    ether_multi     1      0K       0K 166960K         3        0
            mrt     1      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    79    360K     360K 166960K        79        0
           exec     0      0K       1K 166960K       649        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   125      5K      91K 166960K      8160        0
       UVM aobj    14      2K       2K 166960K        16        0
     pinsyscall    30     60K     104K 166960K      2398        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        29        0
            NDP     4      0K       2K 166960K        82        0
           temp    21   6816K    6884K 166960K     35335        0
         kqueue    13     20K      28K 166960K        87        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120       90    0       87     1     0     1     1     0     8    0
rtentry    112      291    0      269     4     0     4     4     0     8    3
unpcb      144      551    0      534     6     4     2     5     0     8    1
syncache   336        6    0        6     4     3     1     1     0     8    1
tcpqe       32        2    0        2     1     1     0     1     0     8    0
tcpcb      808      212    0      206    10     2     8     8     0     8    7
arp        120       50    0       48     1     0     1     1     0     8    0
inpcb      336      634    0      625     8     1     7     7     0     8    5
nd6        136       76    0       76     1     0     1     1     0     8    1
pkpcb       40        1    0        1     1     1     0     1     0     8    0
kcovpl      48       24    0       24     1     0     1     1     0     8    1
ppxss      1168       3    0        3     2     1     1     1     0     8    1
pffrag     232        1    0        0     1     0     1     1     0   482    0
pffrnode    88        1    0        0     1     0     1     1     0     8    0
pffrent     40        2    0        1     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pftag       88        3    0        1     1     0     1     1     0     8    0
pfstitem    24       54    0       26     1     0     1     1     0     8    0
pfstkey    128       56    0       28     1     0     1     1     0     8    0
pfstate    376       55    0       27     3     0     3     3     0     8    0
pfrule     1344      28    0       21     2     0     2     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1176    0     1080    30     4    26    30     0     8   20
art_table   32     1177    0     1080     4     0     4     4     0     8    3
art_node    16      290    0      270     1     0     1     1     0     8    0
sysvmsgpl   40       75    0       71     1     0     1     1     0     8    0
semapl     112       20    0       10     1     0     1     1     0     8    0
shmpl      112       13    0        2     1     0     1     1     0     8    0
dirhash    1024      23    0        4     3     0     3     3     0     8    0
dino2pl    256     2343    0      809    97     0    97    97     0     8    0
ffsino     272     2388    0      854   103     0   103   103     0     8    0
nchpl      144     3136    0     1429    64     0    64    64     0     8    0
uvmvnodes   80     2938    0        0    60     0    60    60     0     8    0
vnodes     216     2938    0        0   164     0   164   164     0     8    0
namei      1024   11607    0    11606     2     1     1     2     0     8    0
percpumem   16       66    0       28     1     0     1     1     0     8    0
kstatmem   264       64    0       56     2     0     2     2     0     8    1
scsiplug    72        2    0        2     2     1     1     1     0     8    1
scxspl     216    19282    0    19282    10     9     1     8     1     8    1
plimitpl   152      213    0      198     1     0     1     1     0     8    0
sigapl     424     1084    0     1041     9     2     7     7     0     8    0
futexpl     64     6231    0     6231     3     2     1     1     0     8    1
knotepl    120      350    0        0    10     0    10    10     0     8    0
kqueuepl   216      131    0      122     1     0     1     1     0     8    0
pipepl     320      465    0      432    13     5     8     8     0     8    5
fdescpl    496     1063    0     1044     7     2     5     5     0     8    2
filepl     152     5512    0     5395    30    16    14    22     0     8    8
lockfpl    104      197    0      195     1     0     1     1     0     8    0
lockfspl    48       76    0       74     1     0     1     1     0     8    0
sessionpl  144       41    0       32     1     0     1     1     0     8    0
pgrppl      48      112    0       97     1     0     1     1     0     8    0
ucredpl    104      683    0      669     1     0     1     1     0     8    0
zombiepl   144     1046    0     1041     1     0     1     1     0     8    0
processpl  1160    1084    0     1041     5     1     4     5     0     8    0
procpl     648     1763    0     1720     8     2     6     7     0     8    1
srpgc       96        4    0        4     2     1     1     1     0     8    1
sosppl     168        3    0        3     1     1     0     1     0     8    0
sockpl     664     1281    0     1252    17     8     9    13     0     8    6
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       6    0        0     1     0     1     1     0     8    0
mcl4k      4096       3    0        0     1     0     1     1     0     8    0
mcl2k      2048     249    0        0    32     0    32    32     0     8    0
mtagpl      96        7    0        0     1     0     1     1     0     8    0
mbufpl     256      325    0        0    18     0    18    18     0     8    0
bufpl      280     7359    0     1185   442     0   442   442     0     8    0
anonpl      24   206271    0   203753    68    10    58    67     0   185   28
amapchunkpl 152   25675    0    25471    32     1    31    32     0   158   18
amappl16   200     4689    0     4688    35    29     6    25     0     8    5
amappl15   192        4    0        4     1     1     0     1     0     8    0
amappl14   184      152    0      140     1     0     1     1     0     8    0
amappl13   176       10    0       10     1     1     0     1     0     8    0
amappl12   168     2013    0     1994     4     2     2     3     0     8    0
amappl11   160       63    0       49     1     0     1     1     0     8    0
amappl10   152        6    0        6     1     1     0     1     0     8    0
amappl9    144      134    0      134     1     1     0     1     0     8    0
amappl8    136       27    0       25     1     0     1     1     0     8    0
amappl7    128      145    0      133     1     0     1     1     0     8    0
amappl6    120      351    0      349     1     0     1     1     0     8    0
amappl5    112      198    0      186     1     0     1     1     0     8    0
amappl4    104      361    0      342     1     0     1     1     0     8    0
amappl3     96     5066    0     5019     4     0     4     4     0     8    0
amappl2     88      914    0      847     2     0     2     2     0     8    0
amappl1     80    10916    0    10398    15     1    14    14     0     8    1
amappl      88     7624    0     7554     6     1     5     5     0    92    1
dma4096    4096       2    0        2     2     1     1     1     0     8    1
dma1024    1024       2    0        1     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       83    0       82     1     0     1     1     0     8    0
aobjpl      72       15    0        2     1     0     1     1     0     8    0
uaddrrnd    24     1063    0     1044     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1063    0     1044     1     0     1     1     0     8    0
vmmpekpl   168    11128    0    11100     4     0     4     4     0     8    1
vmmpepl    168    73203    0    71919   109    15    94   103     0   357   20
vmsppl     440     1062    0     1044     6     2     4     5     0     8    2
rwobjpl     56    26355    0    22703    59     4    55    55     0     8    0
pdppl      4096    2133    0     2088   119    72    47    85     0     8    2
pvpl        32    28245    0        0   228     0   228   228     0   265    0
pmappl     248     1062    0     1044     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      437    0       86    11     0    11    11     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
ffs_nodealloccg(fffffd8074c5c330,2,ca80,41c0) at ffs_nodealloccg+0x131 ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_nodealloccg(fffffd8074c5c330,2,ca80,41c0) at ffs_nodealloccg+0x131 sys/ufs/ffs/ffs_alloc.c:1106
ffs_inode_alloc(fffffd8074c5c330,41c0,fffffd807f7d3548,ffff8000359a7098) at ffs_inode_alloc+0x20b ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:814 [inline]
ffs_inode_alloc(fffffd8074c5c330,41c0,fffffd807f7d3548,ffff8000359a7098) at ffs_inode_alloc+0x20b sys/ufs/ffs/ffs_alloc.c:390
ufs_mkdir(ffff8000359a7100) at ufs_mkdir+0x113 sys/ufs/ufs/ufs_vnops.c:1112
VOP_MKDIR(fffffd806ee2cdb0,ffff8000359a7260,ffff8000359a7290,ffff8000359a7190) at VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
domkdirat(ffff800033188a50,ffffff9c,73efcb95c2c0,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3099
syscall(ffff8000359a7410) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000359a7410) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73efcb95c280, count: -7
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83552f70) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff83552f70) at __mp_lock+0x192 sys/kern/kern_lock.c:144
syscall(ffff80002a04ff80) at syscall+0x2cc mi_syscall sys/sys/syscall_mi.h:156 [inline]
syscall(ffff80002a04ff80) at syscall+0x2cc sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x742481d1d720, count: 9
ddb{1}> trace
x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83552f70) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff83552f70) at __mp_lock+0x192 sys/kern/kern_lock.c:144
syscall(ffff80002a04ff80) at syscall+0x2cc mi_syscall sys/sys/syscall_mi.h:156 [inline]
syscall(ffff80002a04ff80) at syscall+0x2cc sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x742481d1d720, count: -6

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/14 04:18 openbsd 3800fc3581d8 ff60e2ca .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs_nodealloccg
2024/09/13 08:10 openbsd 00475b9b7a59 73e8a465 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs_nodealloccg
* Struck through repros no longer work on HEAD.