syzbot


panic: assertwaitok: non-zero mutex count: NUM (3)

Status: fixed on 2025/04/16 13:42
Reported-by: syzbot+6cac839a17bc8be499d7@syzkaller.appspotmail.com
Fix commit: 42337cd26dad Release `sb_mtx' mutex(9) while doing sleeping m_copym(..., M_WAIT) in soreceive() and somove(). It is possible in both places. We copy only `len' bytes from the single mbuf(9) pointed by `m'. The `len' is always less than m->m_len. The m->m_len could only grow while `sb_mtx' is unlocked, but concurrent thread will not override our chunk of m->m_data. There is no difference with the lockless uiomove(mtod(m)).
First crash: 10d, last: 10d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: assertwaitok: non-zero mutex count: NUM C 10 492d 493d 3/3 fixed on 2023/12/19 18:40
openbsd panic: assertwaitok: non-zero mutex count: NUM (2) 178 155d 277d 0/3 auto-obsoleted due to no activity on 2025/01/09 11:25

Sample crash report:
panic: assertwaitok: non-zero mutex count: 2
Starting stack trace...
panic(ffffffff83350409) at panic+0x1ba sys/kern/subr_prf.c:229
assertwaitok() at assertwaitok+0x16f sys/kern/subr_xxx.c:163
mi_switch() at mi_switch+0x2b6 sys/kern/sched_bsd.c:412
yield() at yield+0x61 sys/kern/sched_bsd.c:320
pool_get(ffffffff8393d8c0,1) at pool_get+0x204 sys/kern/subr_pool.c:593
m_copym(fffffd806a253a00,0,3,1) at m_copym+0x1f5 m_get sys/kern/uipc_mbuf.c:-1 [inline]
m_copym(fffffd806a253a00,0,3,1) at m_copym+0x1f5 sys/kern/uipc_mbuf.c:653
somove(ffff8000015b2018,1) at somove+0xae2 sys/kern/uipc_socket.c:1695
sosplice(ffff8000015b2018,0,3,fffffd806e6cc430) at sosplice+0x88d sys/kern/uipc_socket.c:1431
sys_setsockopt(ffff80003a52e2c0,ffff80003ca3d0f0,ffff80003ca3d040) at sys_setsockopt+0x2b9 sys/kern/uipc_syscalls.c:1221
syscall(ffff80003ca3d0f0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003ca3d0f0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd3ea8e9eeb0, count: 246
End of stack trace.

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/14 18:40 openbsd c5a62f9c39e8 0bd6db41 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: assertwaitok: non-zero mutex count: NUM
* Struck through repros no longer work on HEAD.