syzbot


assert failed: so->so_pcb == NULL

Status: fixed on 2019/02/25 20:33
Reported-by: syzbot+7bace612ca3cc3e124f8@syzkaller.appspotmail.com
Fix commit: fa4f0f367829 Fix the order in udp6_attach: soreserve should be called before in6_pcballoc, otherwise if it fails there is still a PCB attached, and we hit a KASSERT in socreate. In !DIAGNOSTIC this would have caused a memory leak.
First crash: 2096d, last: 2096d

Sample crash report:
login: [  26.7063438] panic: kernel diagnostic assertion "so->so_pcb == NULL" failed: file "/syzkaller/managers/netbsd/kernel/sys/kern/uipc_socket.c", line 567 
[  26.7189776] cpu1: Begin traceback...
[  26.7189776] vpanic() at netbsd:vpanic+0x214
[  26.7189776] _GLOBAL__sub_D_65535_0_cpu_configure() at netbsd:_GLOBAL__sub_D_65535_0_cpu_configure
[  26.7314576] socreate() at netbsd:socreate+0x35c
[  26.7314576] fsocreate() at netbsd:fsocreate+0x19c
[  26.7439436] sys___socket30() at netbsd:sys___socket30+0x96
[  26.7565253] sys_syscall() at netbsd:sys_syscall+0xe2
[  26.7689556] syscall() at netbsd:syscall+0x30e
[  26.7689556] --- syscall (number 0) ---
[  26.7814657] 73e23603f4ca:
[  26.7814657] cpu1: End traceback...

[  26.7814657] dumping to dev 4,1 (offset=0, size=0): not possible
[  26.7939499] rebooting...
SeaBIOS (version 1.8.2-20181029_212248-google)
Total RAM Size = 0x00000001e0000000 = 7680 MiB
CPUs found: 2     Max CPUs supported: 2
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f2a00: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Booting from Hard Disk 0...

>> NetBSD/x86 BIOS Boot, Revision 5.10 (Tue Jul 17 14:59:51 UTC 2018) (from NetBSD 8.0)
>> Memory: 639/3144640 k

     1. Boot normally
     2. Boot single user
     3. Disable ACPI
     4. Disable ACPI and SMP
     5. Drop to boot prompt

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/02/25 01:34 netbsd 11eef5b2ee47 7a06e792 console log report syz C ci2-netbsd
2019/02/25 18:34 netbsd 92d3cba1c669 a70141bf console log report ci2-netbsd
2019/02/25 13:48 netbsd 92d3cba1c669 a70141bf console log report ci2-netbsd
2019/02/25 08:32 netbsd 11eef5b2ee47 a70141bf console log report ci2-netbsd
2019/02/25 01:32 netbsd 11eef5b2ee47 7a06e792 console log report ci2-netbsd
2019/02/25 00:04 netbsd 11eef5b2ee47 7a06e792 console log report ci2-netbsd
* Struck through repros no longer work on HEAD.