syzbot


assert "(sih->sih_state & SIS_RESTART) == NUM" failed in kern_softintr.c

Status: upstream: reported on 2025/04/30 06:21
Reported-by: syzbot+6bd1630fe810f14b57a6@syzkaller.appspotmail.com
First crash: 8d08h, last: 8d08h

Sample crash report:
syncing disks...panic: kernel diagnostic assertion "(sih->sih_state & SIS_RESTART) == 0" failed: file "/syzkaller/managers/main/kernel/sys/kern/kern_softintr.c", line 181
Starting stack trace...
panic(ffffffff834230fa) at panic+0x1ba sys/kern/subr_prf.c:229
__assert(ffffffff833cf5b3,ffffffff833f8428,b5,ffffffff8332c5d8) at __assert+0x29 sys/kern/subr_prf.c:-1
softintr_schedule(ffff80000002a040) at softintr_schedule+0x1d9
timeout_hardclock_update() at timeout_hardclock_update+0x72b sys/kern/kern_timeout.c:634
clockintr_hardclock(ffffffff83837c10,ffff80003c9951d0,0) at clockintr_hardclock+0x148 sys/kern/kern_clockintr.c:-1
clockintr_dispatch(ffff80003c9951d0) at clockintr_dispatch+0x32a sys/kern/kern_clockintr.c:-1
lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:489
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
__sanitizer_cov_trace_const_cmp4(ffffffff,d) at __sanitizer_cov_trace_const_cmp4+0x54 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_const_cmp4(ffffffff,d) at __sanitizer_cov_trace_const_cmp4+0x54 sys/dev/kcov.c:230
splraise(d) at splraise+0x37 sys/arch/amd64/amd64/intr.c:781
tsleep(ffffffff8393ae50,4,ffffffff8338a796,0) at tsleep+0x15d sys/kern/kern_synch.c:139
uvn_io(fffffd806de0de78,ffff80003c995530,1,31,1) at uvn_io+0x765 sys/uvm/uvm_vnode.c:1310
uvn_put(fffffd806de0de78,ffff80003c995530,1,31) at uvn_put+0x125 sys/uvm/uvm_vnode.c:922
uvm_pager_put(fffffd806de0de78,fffffd8007109c80,ffff80003c9955c0,ffff80003c9955ec,31,0,26944e1de5d53c8b) at uvm_pager_put+0x163 sys/uvm/uvm_pager.c:524
uvn_flush(fffffd806de0de78,0,0,31) at uvn_flush+0x6fe sys/uvm/uvm_vnode.c:723
uvm_vnp_sync(ffff800000b57800) at uvm_vnp_sync+0x1e7 sys/uvm/uvm_vnode.c:1532
sys_sync(ffff80002a8b1228,0,0) at sys_sync+0xd4 sys/kern/vfs_syscalls.c:534
vfs_syncwait(ffff80002a8b1228,1) at vfs_syncwait+0x44 sys/kern/vfs_subr.c:-1
vfs_shutdown(ffff80002a8b1228) at vfs_shutdown+0x97 sys/kern/vfs_subr.c:1808
boot(100) at boot+0x153 sys/arch/amd64/amd64/machdep.c:907
reboot(100) at reboot+0xa8
panic(ffffffff832fc0f8) at panic+0x1e3 sys/kern/subr_prf.c:231
kerntrap(ffff80003c9958d0) at kerntrap+0x28b sys/arch/amd64/amd64/trap.c:327
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
sys_msgrcv(ffff80002a8b1228,ffff80003c995b00,ffff80003c995a50) at sys_msgrcv+0x3f2 msg_copyout sys/kern/sysv_msg.c:639 [inline]
sys_msgrcv(ffff80002a8b1228,ffff80003c995b00,ffff80003c995a50) at sys_msgrcv+0x3f2 sys/kern/sysv_msg.c:349
syscall(ffff80003c995b00) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c995b00) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8fcb6f587a0, count: 230
End of stack trace.

dump to dev 4,1 not possible
rebooting...
SeaBIOS (version 1.8.2-google)
Total RAM Size = 0x0000000080000000 = 2048 MiB
CPUs found: 2     Max CPUs supported: 2
SeaBIOS (version 1.8.2-google)
Machine UUID 1498d526-897b-4d0e-28be-a262cd523d51
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f2820: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Sending Seabios boot VM event.
Booting from Hard Disk 0...
>> OpenBSD/amd64 BOOT 3.67
boot> show panic
boot: illegal argument panic
boot> trace
boot> show registers
boot> show proc
boot> ps
boot> show all locks
boot> show malloc
boot> show all pools
boot> machine ddbcpu 0
machine: syntax error
boot> trace
boot> machine ddbcpu 1
machine: syntax error
boot> trace

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/30 06:21 openbsd 3f24670b0fa3 85a5a23f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(sih->sih_state & SIS_RESTART) == NUM" failed in kern_softintr.c
* Struck through repros no longer work on HEAD.