syzbot


protection_fault: in_pcbhash_lookup

Status: upstream: reported on 2025/06/12 21:19
Reported-by: syzbot+7459bc68bb82aef152b6@syzkaller.appspotmail.com
First crash: 33d, last: 33d

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      in_pcbhash_lookup+0xc0: movl    0xc0(%r14),%r12d
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
in_pcbhash_lookup(ffffffff839cdd98,4a4d31bc623022b7,0,ffffffff83701c78,0,ffffffff83701c78,cebdc36e922c73a0) at in_pcbhash_lookup+0xc0 sys/netinet/in_pcb.c:1115
in_pcblookup_listen(ffffffff839cdd98,100007f,1600,fffffd8069452000,0) at in_pcblookup_listen+0x294 sys/netinet/in_pcb.c:-1
tcp_input_solocked(ffff80002a74b800,ffff80002a74b80c,0,2,ffff80002a74b7f8) at tcp_input_solocked+0xa97 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839cae60,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff800000b11800,ffff80002a74b8d8,0) at if_input_process+0x229 sys/net/if.c:1015
ifiq_process(ffff800000b11c18) at ifiq_process+0xcd sys/net/ifq.c:874
taskq_thread(ffff80000002c000) at taskq_thread+0xd4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -7
ddb> show registers
rdi                       0xdeaf4152
rsi                                0
rbp               0xffff80002a74b540
rbx                                0
rdx                                0
rcx                           0x1600    __ALIGN_SIZE+0x600
rax               0xffff80002a72c290
r8                                 0
r9                0xffffffff83701c78    zeroin_addr
r10               0x21031a5a13d69032
r11                0x46ae97dc9ee8b78
r12                                0
r13                       0xdeaf4152
r14               0xdeaf4152deaf4152
r15                           0x1600    __ALIGN_SIZE+0x600
rip               0xffffffff82c47ee0    in_pcbhash_lookup+0xc0
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a74b4c0
ss                              0x10
in_pcbhash_lookup+0xc0: movl    0xc0(%r14),%r12d
ddb> show proc
PROC (softnet0) tid=233416 pid=86154 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a72ca40,0xffff80002a72c010
    process=0xffff8000ffffc488 user=0xffff80002a746000, vmspace=0xffffffff838e16a0
    estcpu=0, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 63152  340560  73971      0  2           0                syz-executor
 63152  362090  73971      0  3   0x4000080  fsleep        syz-executor
 61776  374714   2467      0  2           0                syz-executor
 61776   58443   2467      0  3   0x4000080  netcon        syz-executor
 93299  323075  51785      0  2           0                syz-executor
 98299  138281  30302      0  2           0                syz-executor
 98299  150756  30302      0  3   0x4000080  fsleep        syz-executor
 31780  195523  58911      0  2           0                syz-executor
 31780   80620  58911      0  3   0x4000080  fsleep        syz-executor
  3464  313477  67261      0  3        0x80  nanoslp       syz-executor
  3464  452968  67261      0  3   0x4000080  kqsel         syz-executor
  3464  102830  67261      0  3   0x4000080  fsleep        syz-executor
 81532  296141      0      0  3     0x14200  acct          acct
 58142  155333    308      0  3        0x82  wait          syz-executor
  2467  439578    308      0  3        0x82  nanoslp       syz-executor
 15471  332473    308      0  3        0x82  wait          syz-executor
 72261  207491      0      0  3     0x14200  bored         sosplice
 51785  391348    308      0  3        0x82  nanoslp       syz-executor
 30302   96346    308      0  3        0x82  nanoslp       syz-executor
 73971  476425    308      0  3        0x82  nanoslp       syz-executor
 58911  490637    308      0  3        0x82  nanoslp       syz-executor
 67261  371682    308      0  3        0x82  nanoslp       syz-executor
   308   17576   6126      0  3        0x82  kqread        syz-executor
  6126  152579  34224      0  3    0x10008a  sigsusp       ksh
 34224   88336  48597      0  3        0x98  kqread        sshd-session
 48597  275867  42051      0  3        0x92  kqread        sshd-session
 46667  279715      1      0  3    0x100083  ttyopn        getty
 42051  182091      1      0  3        0x88  kqread        sshd
 72489  367125  86528     73  3   0x1100090  kqread        syslogd
 86528  508330      1      0  3    0x100082  sbwait        syslogd
 35494  283009      1      0  3    0x100080  kqread        resolvd
 82322  172446  52320     77  3    0x100092  kqread        dhcpleased
 83965  495797  52320     77  3    0x100092  kqread        dhcpleased
 52320  211742      1      0  3        0x80  kqread        dhcpleased
  6386  277930      0      0  3     0x14200  bored         smr
 61397   91975      0      0  2     0x14200                zerothread
 36783  355113      0      0  3     0x14200  aiodoned      aiodoned
 19517  362509      0      0  3     0x14200  syncer        update
  2014  338482      0      0  3     0x14200  cleaner       cleaner
 43924  516810      0      0  3     0x14200  reaper        reaper
 99131   91886      0      0  3     0x14200  pgdaemon      pagedaemon
 94876  136584      0      0  3     0x14200  bored         viomb
  4492  289455      0      0  3  0x40014200  acpi0         acpi0
 61955  430471      0      0  3     0x14200  bored         softnet3
 93717  148307      0      0  3     0x14200  bored         softnet2
 10078    4629      0      0  3     0x14200  bored         softnet1
*86154  233416      0      0  7     0x14200                softnet0
 99713  163122      0      0  3     0x14200  bored         systqmp
  6685  207309      0      0  3     0x14200  bored         systq
 37637  108232      0      0  3  0x40014200  tmoslp        softclock
 59621  102742      0      0  3  0x40014200                idle0
     1  231512      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10215  11183K   12183K 166960K     14317        0
            pcb    17     18K      21K 166960K       574        0
         rtable   222      8K      10K 166960K       594        0
             pf    32     13K      17K 166960K       152        0
         ifaddr    40      7K       8K 166960K       113        0
        ifgroup    54      2K       2K 166960K       198        0
         sysctl     4      1K       9K 166960K        16        0
       counters    33     17K      18K 166960K        99        0
       ioctlops     0      0K       4K 166960K       239        0
            iov     0      0K      16K 166960K       122        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1495     94K      94K 166960K      2805        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        26        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       178        0
        dirhash    12      2K       2K 166960K        27        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K      97K 166960K      1500        0
          sigio     0      0K       0K 166960K        23        0
           proc    60     59K      91K 166960K       714        0
        subproc    72      4K       4K 166960K       100        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       180        0
       in_multi    86      6K       7K 166960K       196        0
    ether_multi     1      0K       0K 166960K         7        0
            mrt     0      0K       0K 166960K         9        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   223    996K     996K 166960K       223        0
           exec     0      0K       1K 166960K       609        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   247    161K     177K 166960K     14646        0
       UVM aobj    52      5K       5K 166960K        58        0
     pinsyscall    39     78K      96K 166960K      2630        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        93        0
            NDP    12      0K       2K 166960K        77        0
           temp    76   8687K    8755K 166960K     83640        0
         kqueue    14     22K      30K 166960K       288        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      129    0      126     1     0     1     1     0     8    0
rtentry    136      184    0       86     5     0     5     5     0     8    0
unpcb      144     1019    0     1004     4     0     4     4     0     8    3
syncache   336        8    0        8     1     0     1     1     0     8    1
tcpqe       32        3    0        3     1     0     1     1     0     8    1
tcpcb      736      325    0      317     2     0     2     2     0     8    0
arp         88       29    0       11     1     0     1     1     0     8    0
ipq         40        2    0        0     1     0     1     1     0     8    0
ipqe        40        2    0        0     1     0     1     1     0     8    0
inpcb      328     1648    0     1635    15     6     9    15     0     8    7
ip6q        72        4    0        2     1     0     1     1     0     8    0
ip6af       40        7    0        4     1     0     1     1     0     8    0
nd6        104       41    0       17     1     0     1     1     0     8    0
pkpcb       40       10    0       10     1     0     1     1     0     8    1
kcovpl      48       11    0        3     1     0     1     1     0     8    0
mppekey    1024       2    0        2     1     0     1     1     0     8    1
ppxss      1072      44    0       44     1     0     1     1     0     8    1
pppxif     1384      10    0       10     1     0     1     1     0     8    1
pfrktable  1344       1    0        1     1     0     1     1     0     8    1
pfanchor   1288       2    0        0     1     0     1     1     0     8    0
pftag       88        1    0        1     1     0     1     1     0     8    1
pfrule     1344       7    0        5     1     0     1     1     0     8    0
rttmr      136        2    0        2     1     0     1     1     0     8    1
art_heap8  4096       4    0        0     4     0     4     4     0     8    0
art_heap4  256      762    0      370    31     0    31    31     0     8    5
art_table   32      766    0      370     4     0     4     4     0     8    0
art_node    16      179    0       92     1     0     1     1     0     8    0
sysvmsgpl   40       31    0       13     1     0     1     1     0     8    0
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl     112      166    0      156     1     0     1     1     0     8    0
shmpl      112       55    0        6     2     0     2     2     0     8    0
dirhash    1024      27    0       10     3     0     3     3     0     8    0
dino2pl    256     4054    0     2555    95     0    95    95     0     8    0
ffsino     248     4054    0     2555    95     0    95    95     0     8    0
nchpl      144     6203    0     4518    63     0    63    63     0     8    0
rtmask      32        3    0        3     1     0     1     1     0     8    1
uvmvnodes   80     5144    0        0   105     0   105   105     0     8    0
vnodes     216     5144    0        0   286     0   286   286     0     8    0
namei      1024   22208    0    22208     2     0     2     2     0     8    2
kstatmem   264      110    0       86     3     0     3     3     0     8    1
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        7    0        7     1     0     1     1     0     8    1
scxspl     216    18449    0    18449     8     0     8     8     1     8    8
plimitpl   152      279    0      263     1     0     1     1     0     8    0
sigapl     424     1782    0     1734     7     0     7     7     0     8    1
knotepl    120   634458    0   634411    28    17    11    17     0     8    8
kqueuepl   184      558    0      547     3     0     3     3     0     8    2
pipepl     296      344    0      317     8     0     8     8     0     8    5
fdescpl    440     1762    0     1732     5     0     5     5     0     8    1
filepl     120    11631    0    11415    12     0    12    12     0     8    3
lockfpl    104      745    0      743     2     0     2     2     0     8    1
lockfspl    48      295    0      293     1     0     1     1     0     8    0
sessionpl  144       28    0       20     1     0     1     1     0     8    0
pgrppl      48       53    0       37     1     0     1     1     0     8    0
ucredpl    104     1510    0     1499     1     0     1     1     0     8    0
zombiepl   144     1736    0     1734     1     0     1     1     0     8    0
processpl  1160    1782    0     1734     4     0     4     4     0     8    0
procpl     656     3701    0     3647     6     0     6     6     0     8    0
sosppl     168       10    0       10     1     0     1     1     0     8    1
sockpl     528     2843    0     2811    14     4    10    14     0     8    7
mcl64k     65536     16    0       16     1     0     1     1     0     8    1
mcl12k     12288      2    0        2     1     0     1     1     0     8    1
mcl9k      9216       2    0        2     1     0     1     1     0     8    1
mcl8k      8192      20    0       20     1     0     1     1     0     8    1
mcl4k      4096    4236    0     4180    15     0    15    15     0     8    7
mcl2k2     2112       1    0        1     1     0     1     1     0     8    1
mcl2k      2048    1500    0     1493     3     0     3     3     0     8    2
mtagpl      96      191    0       90     3     0     3     3     0     8    0
mbufpl     256    19125    0    18838    22     0    22    22     0     8    3
bufpl      280     5940    0      125   416     0   416   416     0     8    0
anonpl      24   251667    0   239094   101     0   101   101     0   187    0
amapchunkpl 152   49288    0    48651    37     0    37    37     0   158   11
amappl16   200     4620    0     4131    39     0    39    39     0     8    0
amappl15   192        7    0        7     1     0     1     1     0     8    1
amappl14   184      115    0      105     1     0     1     1     0     8    0
amappl13   176        7    0        6     1     0     1     1     0     8    0
amappl12   168     2418    0     2388     2     0     2     2     0     8    0
amappl11   160       43    0       33     1     0     1     1     0     8    0
amappl10   152        6    0        6     1     0     1     1     0     8    1
amappl9    144      292    0      292     1     0     1     1     0     8    1
amappl8    136       22    0       20     1     0     1     1     0     8    0
amappl7    128      115    0      105     1     0     1     1     0     8    0
amappl6    120      214    0      210     1     0     1     1     0     8    0
amappl5    112      121    0      114     1     0     1     1     0     8    0
amappl4    104      306    0      289     1     0     1     1     0     8    0
amappl3     96     9988    0     9872     4     0     4     4     0     8    0
amappl2     88      682    0      623     2     0     2     2     0     8    0
amappl1     80    14036    0    13492    13     0    13    13     0     8    0
amappl      88    13654    0    13472     5     0     5     5     0    92    0
dma32768   32768      1    0        1     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma2048    2048       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma512     512        2    0        2     1     0     1     1     0     8    1
dma256     256        8    0        8     1     0     1     1     0     8    1
dma128     128      256    0      256     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        9    0        9     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       57    0        6     1     0     1     1     0     8    0
uaddrrnd    24     1762    0     1732     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1762    0     1732     1     0     1     1     0     8    0
vmmpekpl   168    13950    0    13914     3     0     3     3     0     8    0
vmmpepl    168   113181    0   110805   115     0   115   115     0   357    0
vmsppl     360     1761    0     1732     4     0     4     4     0     8    1
rwobjpl     32    33595    0    27073    55     0    55    55     0     8    0
pdppl      4096    3530    0     3464   112    46    66    82     0     8    0
pvpl        32   745617    0   727274   183     0   183   183     0   265    2
pmappl     216     1761    0     1732     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      299    0       46     8     0     8     8     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
in_pcbhash_lookup(ffffffff839cdd98,4a4d31bc623022b7,0,ffffffff83701c78,0,ffffffff83701c78,cebdc36e922c73a0) at in_pcbhash_lookup+0xc0 sys/netinet/in_pcb.c:1115
in_pcblookup_listen(ffffffff839cdd98,100007f,1600,fffffd8069452000,0) at in_pcblookup_listen+0x294 sys/netinet/in_pcb.c:-1
tcp_input_solocked(ffff80002a74b800,ffff80002a74b80c,0,2,ffff80002a74b7f8) at tcp_input_solocked+0xa97 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839cae60,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff800000b11800,ffff80002a74b8d8,0) at if_input_process+0x229 sys/net/if.c:1015
ifiq_process(ffff800000b11c18) at ifiq_process+0xcd sys/net/ifq.c:874
taskq_thread(ffff80000002c000) at taskq_thread+0xd4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
in_pcbhash_lookup(ffffffff839cdd98,4a4d31bc623022b7,0,ffffffff83701c78,0,ffffffff83701c78,cebdc36e922c73a0) at in_pcbhash_lookup+0xc0 sys/netinet/in_pcb.c:1115
in_pcblookup_listen(ffffffff839cdd98,100007f,1600,fffffd8069452000,0) at in_pcblookup_listen+0x294 sys/netinet/in_pcb.c:-1
tcp_input_solocked(ffff80002a74b800,ffff80002a74b80c,0,2,ffff80002a74b7f8) at tcp_input_solocked+0xa97 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839cae60,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff800000b11800,ffff80002a74b8d8,0) at if_input_process+0x229 sys/net/if.c:1015
ifiq_process(ffff800000b11c18) at ifiq_process+0xcd sys/net/ifq.c:874
taskq_thread(ffff80000002c000) at taskq_thread+0xd4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -7

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/12 22:58 openbsd 97ee8abe534f 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: in_pcbhash_lookup
2025/06/12 22:55 openbsd 97ee8abe534f 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: in_pcbhash_lookup
2025/06/12 21:18 openbsd 97ee8abe534f 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: in_pcbhash_lookup
* Struck through repros no longer work on HEAD.