syzbot


panic: timeout_add: to_ticks < 0 (2)

Status: fixed on 2019/04/04 06:46
Reported-by: syzbot+82cb4dfe6a1fc3d8b490@syzkaller.appspotmail.com
Fix commit: bf2018479c9a Reject negative and too large timeouts passed to BIOCSRTIMEOUT. Since the timeout converted to ticks is later passed timeout_add(), it could cause a panic if the timeout is negative.
First crash: 2063d, last: 2061d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: timeout_add: to_ticks < 0 C 66 2103d 2108d 3/3 fixed on 2019/02/20 21:58
openbsd panic: timeout_add: to_ticks < 0 (3) 1 2051d 2051d 3/3 fixed on 2019/04/26 02:50

Sample crash report:
login: panic: timeout_add: to_ticks (-2147483648) < 0
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*145933  85492      0           0          0    0  syz-executor.1
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
timeout_add(ffff8000ffff8300,80000000) at timeout_add+0x179 sys/kern/kern_timeout.c:190
msleep(ffff800000940b00,ffff800000940b08,11a,ffffffff81f56d13,80000000) at msleep+0x18e sleep_setup_timeout sys/kern/kern_synch.c:330 [inline]
msleep(ffff800000940b00,ffff800000940b08,11a,ffffffff81f56d13,80000000) at msleep+0x18e sys/kern/kern_synch.c:210
bpfread(21700,ffff8000149dff20,0) at bpfread+0x1ef sys/net/bpf.c:486
spec_read(ffff8000149dfd60) at spec_read+0xf5 sys/kern/spec_vnops.c:223
VOP_READ(fffffd8031b3ad38,ffff8000149dff20,0,fffffd803f7c6ae0) at VOP_READ+0x6f sys/kern/vfs_vops.c:247
vn_read(fffffd80361b0e90,ffff8000149dff20,0) at vn_read+0x1c3 sys/kern/vfs_vnops.c:365
dofilereadv(ffff8000ffff8260,3,ffff8000149dff20,0,ffff8000149e0000) at dofilereadv+0x19f sys/kern/sys_generic.c:236
sys_read(ffff8000ffff8260,ffff8000149e0018,ffff8000149e0000) at sys_read+0x92 sys/kern/sys_generic.c:156
syscall(ffff8000149e00b0) at syscall+0x541
Xsyscall(6,0,ffffffffffffffb9,0,3,98accb1c010) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff1f80, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
timeout_add: to_ticks (-2147483648) < 0
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
timeout_add(ffff8000ffff8300,80000000) at timeout_add+0x179 sys/kern/kern_timeout.c:190
msleep(ffff800000940b00,ffff800000940b08,11a,ffffffff81f56d13,80000000) at msleep+0x18e sleep_setup_timeout sys/kern/kern_synch.c:330 [inline]
msleep(ffff800000940b00,ffff800000940b08,11a,ffffffff81f56d13,80000000) at msleep+0x18e sys/kern/kern_synch.c:210
bpfread(21700,ffff8000149dff20,0) at bpfread+0x1ef sys/net/bpf.c:486
spec_read(ffff8000149dfd60) at spec_read+0xf5 sys/kern/spec_vnops.c:223
VOP_READ(fffffd8031b3ad38,ffff8000149dff20,0,fffffd803f7c6ae0) at VOP_READ+0x6f sys/kern/vfs_vops.c:247
vn_read(fffffd80361b0e90,ffff8000149dff20,0) at vn_read+0x1c3 sys/kern/vfs_vnops.c:365
dofilereadv(ffff8000ffff8260,3,ffff8000149dff20,0,ffff8000149e0000) at dofilereadv+0x19f sys/kern/sys_generic.c:236
sys_read(ffff8000ffff8260,ffff8000149e0018,ffff8000149e0000) at sys_read+0x92 sys/kern/sys_generic.c:156
syscall(ffff8000149e00b0) at syscall+0x541
Xsyscall(6,0,ffffffffffffffb9,0,3,98accb1c010) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff1f80, count: -12
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff8000149dfa80
rbx               0xffff8000149dfb30
rdx                              0x2
rcx                              0x1
rax                              0x1
r8                0xffff8000149dfa40
r9                               0x1
r10               0xe17dd9b1ff2d04bb
r11               0xe21b6eaf071c85f9
r12                     0x3000000008
r13               0xffff8000149dfa90
r14                            0x100
r15                              0x1
rip               0xffffffff8185e038    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff8000149dfa70
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor.1) pid=145933 stat=onproc
    flags process=0 proc=0
    pri=26, usrpri=53, nice=20
    forw=0x0, list=0xffff8000ffff84b8,0xffffffff822982a8
    process=0xffff8000ffff6d30 user=0xffff8000149db000, vmspace=0xfffffd803f013c60
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*85492  145933  15563      0  7           0  bpf           syz-executor.1
 15563  458508  80156      0  3        0x82  nanosleep     syz-executor.1
 21062  201854  80156      0  3         0x2  biowait       syz-executor.0
 80156  230417  46311      0  3        0x82  thrsleep      syz-execprog
 80156  328908  46311      0  3   0x4000082  thrsleep      syz-execprog
 80156  392416  46311      0  3   0x4000082  thrsleep      syz-execprog
 80156  405694  46311      0  3   0x4000082  thrsleep      syz-execprog
 80156  305530  46311      0  3   0x4000082  thrsleep      syz-execprog
 80156  165061  46311      0  3   0x4000082  kqread        syz-execprog
 80156  105356  46311      0  3   0x4000082  thrsleep      syz-execprog
 80156  419536  46311      0  3   0x4000082  thrsleep      syz-execprog
 46311  369584  66265      0  3    0x10008a  pause         ksh
 66265  408455  93462      0  3        0x92  select        sshd
 24555   97858      1      0  3    0x100083  ttyin         getty
 93462  481832      1      0  3        0x80  select        sshd
 67846  455383  62699     73  3    0x100090  kqread        syslogd
 62699   83077      1      0  3    0x100082  netio         syslogd
 44111  476025      1     77  3    0x100090  poll          dhclient
   434  218836      1      0  3        0x80  poll          dhclient
 83628  486273      0      0  2     0x14200                zerothread
 39995  333958      0      0  3     0x14200  aiodoned      aiodoned
 37215  238266      0      0  3     0x14200  syncer        update
 14694  324095      0      0  3     0x14200  cleaner       cleaner
 15553  332569      0      0  3     0x14200  reaper        reaper
 42732   48446      0      0  3     0x14200  pgdaemon      pagedaemon
 27387  152028      0      0  3     0x14200  bored         crynlk
 94543   10269      0      0  3     0x14200  bored         crypto
 54302  128649      0      0  3  0x40014200  acpi0         acpi0
 60006   65913      0      0  3     0x14200  bored         softnet
 10367  510878      0      0  3     0x14200  bored         systqmp
 69467  105511      0      0  3     0x14200  bored         systq
 77501  108010      0      0  3  0x40014200  bored         softclock
 28341  402132      0      0  3  0x40014200                idle0
 63295  257841      0      0  3     0x14200  bored         smr
     1   92372      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9439   6375K    6375K  78643K     17897        0        0
            pcb    23      9K       9K  78643K        55        0        0
         rtable    97      2K       2K  78643K       167        0        0
         ifaddr    34      9K       9K  78643K        34        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K        15        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1167     73K      73K  78643K      3627        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       1K  78643K         2        0        0
         VM map     2      0K       0K  78643K         2        0        0
            sem     2      0K       0K  78643K         2        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12537        0        0
      file desc     5     13K      25K  78643K      2474        0        0
           proc    40     30K      54K  78643K       247        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
       in_multi    33      2K       2K  78643K        33        0        0
    ether_multi     1      0K       0K  78643K         1        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    18     79K      79K  78643K        18        0        0
           exec     0      0K       1K  78643K       168        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    63     19K      20K  78643K      3251        0        0
       UVM aobj     2      2K       2K  78643K         2        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
            NDP     5      0K       0K  78643K         9        0        0
           temp    46   2342K    2406K  78643K     10209        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        4    0        0     1     0     1     1     0     8    0
inpcbpl    280       26    0       20     1     0     1     1     0     8    0
plimitpl   152       15    0        8     1     0     1     1     0     8    0
rtentry    112       41    0        1     2     0     2     2     0     8    0
syncache   264        5    0        5     2     2     0     1     0     8    0
tcpcb      544        8    0        5     1     0     1     1     0     8    0
nd6         48        4    0        0     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      184    0        0    12     0    12    12     0     8    0
art_table   32      185    0        0     2     0     2     2     0     8    0
art_node    16       40    0        6     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     3885    0     2475    46     0    46    46     0     8    0
ffsino     240     3885    0     2475    83     0    83    83     0     8    0
nchpl      144     6568    0     4946    61     0    61    61     0     8    0
uvmvnodes   72     5926    0        0   108     0   108   108     0     8    0
vnodes     200     5926    0        0   312     0   312   312     0     8    0
namei      1024   16214    0    16213     3     2     1     1     0     8    0
scxspl     192    18550    0    18549    33    32     1     6     0     8    0
sigapl     432     2648    0     2635     2     0     2     2     0     8    0
knotepl    112       45    0       28     1     0     1     1     0     8    0
kqueuepl   104        2    0        0     1     0     1     1     0     8    0
pipepl     112      142    0      123     3     2     1     1     0     8    0
fdescpl    424     2649    0     2635     2     0     2     2     0     8    0
filepl     120     5848    0     5786     2     0     2     2     0     8    0
lockfpl    104        6    0        6     1     1     0     1     0     8    0
lockfspl    32        3    0        3     1     1     0     1     0     8    0
sessionpl  112       19    0        9     1     0     1     1     0     8    0
pgrppl      48       19    0        9     1     0     1     1     0     8    0
ucredpl     96       47    0       40     1     0     1     1     0     8    0
zombiepl   144     2635    0     2635     3     2     1     1     0     8    1
processpl  840     2663    0     2635     4     0     4     4     0     8    0
procpl     600     2670    0     2635     3     0     3     3     0     8    0
sockpl     384       68    0       52     2     0     2     2     0     8    0
mcl4k      4096      10    0       10     2     2     0     1     0     8    0
mcl2k      2048    5659    0     5635     5     1     4     5     0     8    0
mtagpl      80        2    0        2     1     1     0     1     0     8    0
mbufpl     256    10178    0    10091     9     3     6     6     0     8    0
bufpl      256     7703    0     3603   257     0   257   257     0     8    0
anonpl      16    82431    0    80041    15     5    10    12     0    62    0
amapchunkpl 152    3144    0     3084     4     1     3     4     0   158    0
amappl16   192     8811    0     8721     5     0     5     5     0     8    0
amappl15   184       50    0       46     1     0     1     1     0     8    0
amappl14   176     1251    0     1247     3     2     1     1     0     8    0
amappl13   168     2496    0     2488     1     0     1     1     0     8    0
amappl12   160        7    0        6     1     0     1     1     0     8    0
amappl11   152       16    0        5     1     0     1     1     0     8    0
amappl10   144       56    0       56     3     3     0     1     0     8    0
amappl9    136      188    0      185     1     0     1     1     0     8    0
amappl8    128      118    0      106     1     0     1     1     0     8    0
amappl7    120       24    0       22     1     0     1     1     0     8    0
amappl6    112       56    0       50     1     0     1     1     0     8    0
amappl5    104      520    0      510     1     0     1     1     0     8    0
amappl4     96     2849    0     2823     2     1     1     2     0     8    0
amappl3     88     1352    0     1345     1     0     1     1     0     8    0
amappl2     80     6769    0     6725     2     1     1     2     0     8    0
amappl1     72    32214    0    31818    24    15     9    19     0     8    0
amappl      72     2885    0     2857     1     0     1     1     0    75    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24     2649    0     2635     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2649    0     2635     1     0     1     1     0     8    0
vmmpekpl   168    11012    0    10995     1     0     1     1     0     8    0
vmmpepl    168   120148    0   119236    93    53    40    71     0   357    0
vmsppl     264     2648    0     2635     2     1     1     2     0     8    0
pdppl      4096    5304    0     5270     6     1     5     6     0     8    0
pvpl        32   350319    0   345375   109    61    48    99     0   265    8
pmappl     200     2648    0     2635     1     0     1     1     0     8    0
extentpl    40       39    0       25     1     0     1     1     0     8    0
phpool     112      384    0       11    11     0    11    11     0     8    0

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/03 22:03 openbsd a99eef19e79d dfd3394d .config console log report syz ci-openbsd-main
2019/04/03 21:13 openbsd a99eef19e79d dfd3394d .config console log report syz ci-openbsd-multicore
2019/04/03 13:17 openbsd a99eef19e79d dfd3394d .config console log report syz ci-openbsd-multicore
2019/04/02 15:19 openbsd a99eef19e79d dfd3394d .config console log report syz ci-openbsd-multicore
2019/04/03 20:44 openbsd a99eef19e79d dfd3394d .config console log report ci-openbsd-multicore
2019/04/03 18:42 openbsd a99eef19e79d dfd3394d .config console log report ci-openbsd-main
2019/04/03 18:33 openbsd a99eef19e79d dfd3394d .config console log report ci-openbsd-main
2019/04/03 12:19 openbsd a99eef19e79d dfd3394d .config console log report ci-openbsd-multicore
2019/04/02 14:58 openbsd a99eef19e79d dfd3394d .config console log report ci-openbsd-multicore
2019/04/02 14:57 openbsd a99eef19e79d dfd3394d .config console log report ci-openbsd-main
2019/04/02 11:17 openbsd e8e4233962da a9ca43d4 .config console log report ci-openbsd-main
2019/04/02 10:55 openbsd e8e4233962da a9ca43d4 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.