syzbot


UBSan: Undefined Behavior in db_nextframe (4)

Status: upstream: reported on 2024/05/22 17:54
Reported-by: syzbot+869d83d98ee7b072f5cd@syzkaller.appspotmail.com
First crash: 24d, last: 15d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
netbsd UBSan: Undefined Behavior in db_nextframe (2) 1 662d 662d 0/3 auto-obsoleted due to no activity on 2022/11/20 23:49
netbsd UBSan: Undefined Behavior in db_nextframe (3) 1 187d 187d 0/3 auto-obsoleted due to no activity on 2024/03/10 18:16
netbsd UBSan: Undefined Behavior in db_nextframe 2 849d 857d 0/3 auto-closed as invalid on 2022/05/18 00:37

Sample crash report:
[  55.0032251] panic: cpu0: softints stuck for 16 seconds
[  55.0032251] cpu0: Begin traceback...
[  55.0032251] __sanitizer_cov_trace_pc() at netbsd:__sanitizer_cov_trace_pc+0x88 sys/kern/subr_kcov.c:596
[  55.0032251] vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288
[  55.0032251] ttwrite() at netbsd:ttwrite+0xad1 ttstart sys/kern/tty.c:1854 [inline]
[  55.0032251] ttwrite() at netbsd:ttwrite+0xad1 sys/kern/tty.c:2368
[  55.0032251] panic() at comwrite() at netbsd:panic+0x49 sys/kern/subr_prf.c:1116
[  55.0032251] netbsd:comwrite+0x135
[  55.0032251] heartbeat() at cdev_write() at netbsd:heartbeat+0x7c3 select_patient sys/kern/kern_heartbeat.c:549 [inline]
[  55.0032251] heartbeat() at cdev_write() at netbsd:heartbeat+0x7c3 sys/kern/kern_heartbeat.c:706
[  55.0032251] netbsd:cdev_write+0x14c
[  55.0032251] hardclock() at cnwrite() at netbsd:hardclock+0x1d9 sys/kern/kern_clock.c:348
[  55.0032251] netbsd:cnwrite+0xcb
[  55.0032251] Xresume_lapic_ltimer() at cdev_write() at netbsd:Xresume_lapic_ltimer+0x1e
[  55.0032251] --- interrupt ---
[  55.0032251] netbsd:cdev_write+0x14c
[  55.0032251] ipi_wait() at spec_write() at netbsd:ipi_wait+0x10b sys/kern/subr_ipi.c:451
[  55.0032251] netbsd:spec_write+0x278
[  55.0032251] _kernel_lock() at VOP_WRITE() at netbsd:_kernel_lock+0x53b sys/kern/kern_lock.c:278
[  55.0032251] netbsd:VOP_WRITE+0x2ab
[  55.0032251] intr_biglock_wrapper() at vn_write() at netbsd:intr_biglock_wrapper+0x23 x86_curcpu sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:64 [inline]
[  55.0032251] intr_biglock_wrapper() at vn_write() at netbsd:intr_biglock_wrapper+0x23 sys/arch/x86/x86/intr.c:676
[  55.0032251] netbsd:vn_write+0x309
[  55.0032251] Xhandle_ioapic_edge19() at netbsd:Xhandle_ioapic_edge19+0x75
[  55.0032251] --- interrupt ---
[  55.0032251] do_filewritev.part.0() at netbsd:do_filewritev.part.0+0x56d
[  55.0032251] __sanitizer_cov_trace_pc() at netbsd:__sanitizer_cov_trace_pc+0x16 sys/kern/subr_kcov.c:581
[  55.0032251] sys_writev() at netbsd:sys_writev+0x5e do_filewritev sys/kern/sys_generic.c:383 [inline]
[  55.0032251] sys_writev() at netbsd:sys_writev+0x5e sys/kern/sys_generic.c:383
[  55.0032251] _kernel_lock() at netbsd:_kernel_lock+0x491 sys/kern/kern_lock.c:270
[  55.0032251] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[  55.0032251] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
[  55.0032251] softint_dispatch() at netbsd:softint_dispatch+0xada softint_execute sys/kern/kern_softint.c:602 [inline]
[  55.0032251] softint_dispatch() at netbsd:softint_dispatch+0xada sys/kern/kern_softint.c:848
[  55.0032251] Skipping crash dump on recursive panic
[  55.0032251] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/arch/amd64/amd64/db_machdep.c:125:24, member access within misaligned address 0x98fe for type 'struct x86_64_frame' which requires 8 byte alignment

[  55.0032251] Faulted in mid-traceback; aborting...
[  55.0032251] syscall() at fatal breakpoint trap in supervisor mode
[  55.0032251] trap type 1 code 0 rip 0xffffffff80235475 cs 0x8 rflags 0x202 cr2 0x7e0ee12f6f68 ilevel 0x7 rsp 0xffffa4022fa37c30
[  55.0032251] curlwp 0xffffd7caacfc24c0 pid 0.6 lowest kstack 0xffffa4022fa342c0
Stopped in pid 0.6 (system) at  netbsd:breakpoint+0x5:  leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:71
vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0xfc sys/../common/lib/libc/misc/ubsan.c:432
db_nextframe() at netbsd:db_nextframe+0x790 sys/arch/amd64/amd64/db_machdep.c:125
db_stack_trace_print() at netbsd:db_stack_trace_print+0x281 sys/arch/x86/x86/db_trace.c:278
db_panic() at netbsd:db_panic+0x9d x86_curcpu sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:64 [inline]
db_panic() at netbsd:db_panic+0x9d sys/ddb/db_panic.c:61
vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288
panic() at netbsd:panic+0x49 sys/kern/subr_prf.c:1116
heartbeat() at netbsd:heartbeat+0x7c3 select_patient sys/kern/kern_heartbeat.c:549 [inline]
heartbeat() at netbsd:heartbeat+0x7c3 sys/kern/kern_heartbeat.c:706
hardclock() at netbsd:hardclock+0x1d9 sys/kern/kern_clock.c:348
Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
--- interrupt ---
ipi_wait() at netbsd:ipi_wait+0x10b sys/kern/subr_ipi.c:451
_kernel_lock() at netbsd:_kernel_lock+0x53b sys/kern/kern_lock.c:278
intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x23 x86_curcpu sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:64 [inline]
intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x23 sys/arch/x86/x86/intr.c:676
Xhandle_ioapic_edge19() at netbsd:Xhandle_ioapic_edge19+0x75
--- interrupt ---
__sanitizer_cov_trace_pc() at netbsd:__sanitizer_cov_trace_pc+0x16 sys/kern/subr_kcov.c:581
_kernel_lock() at netbsd:_kernel_lock+0x491 sys/kern/kern_lock.c:270
softint_dispatch() at netbsd:softint_dispatch+0xada softint_execute sys/kern/kern_softint.c:602 [inline]
softint_dispatch() at netbsd:softint_dispatch+0xada sys/kern/kern_softint.c:848

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/31 21:18 netbsd 2864ddb2e91d 0c378259 .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kubsan UBSan: Undefined Behavior in db_nextframe
2024/05/22 17:54 netbsd f5ffeae836a2 4d098039 .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kubsan UBSan: Undefined Behavior in db_nextframe
* Struck through repros no longer work on HEAD.