syzbot
panic: netbsd:panic+0x9e (3)
Status:
auto-obsoleted due to no activity on 2024/08/04 14:07
Reported-by: syzbot+8a2e654ca23d395ff21a@syzkaller.appspotmail.com
First crash: 809d, last: 769d
Sample crash report:
[ 434.3660131] panic: netbsd:panic+0x9e
1970/01/01 00:02:37 SYZFATAL: failed to recv *flatrpc.HostMessageRaw: EOF
[ 434.4860125] lockdebug_abort1() at netbsd:lockdebug_abort1+0x150 sys/kern/subr_lockdebug.c:388
[ 434.5260113] lockdebug_wantlock() at netbsd:lockdebug_wantlock+0x336 sys/kern/subr_lockdebug.c:489
[ 434.5560130] rw_enter() at netbsd:rw_enter+0x788 sys/kern/kern_rwlock.c:300
[ 434.5960112] genfs_lock() at netbsd:genfs_lock+0x160 sys/miscfs/genfs/genfs_vnops.c:397
[ 434.6260108] VOP_LOCK() at netbsd:VOP_LOCK+0x1e0 sys/kern/vnode_if.c:1632
[ 434.6560107] vn_lock() at netbsd:vn_lock+0x1d0 sys/kern/vfs_vnops.c:1388
[ 434.6860123] union_getattr() at netbsd:union_getattr+0x2b2 sys/fs/union/union_vnops.c:872
[ 434.7160115] VOP_GETATTR() at netbsd:VOP_GETATTR+0xe9 sys/kern/vnode_if.c:711
[ 434.7460107] vn_stat() at netbsd:vn_stat+0x9d sys/kern/vfs_vnops.c:762
[ 434.7860104] do_sys_statat() at netbsd:do_sys_statat+0x25c sys/kern/vfs_syscalls.c:3220
[ 434.8160104] sys___lstat50() at netbsd:sys___lstat50+0x94 sys/kern/vfs_syscalls.c:3260
[ 434.8460107] syscall() at netbsd:syscall+0x246 sy_call sys/sys/syscallvar.h:65 [inline]
[ 434.8460107] syscall() at netbsd:syscall+0x246 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 434.8460107] syscall() at netbsd:syscall+0x246 sys/arch/x86/x86/syscall.c:137
[ 434.8560121] --- syscall (number 441) ---
[ 434.8660102] netbsd:syscall+0x246:
[ 434.8760106] cpu1: End traceback...
[ 434.8760106] fatal breakpoint trap in supervisor mode
[ 434.8760106] trap type 1 code 0 rip 0xffffffff8023240d cs 0x8 rflags 0x286 cr2 0x71ee965e98f0 ilevel 0 rsp 0xffffc6824c450430
[ 434.8860102] curlwp 0xffffc68012c7b340 pid 7558.7558 lowest kstack 0xffffc6824c4492c0
Stopped in pid 7558.7558 (syz-executor.5) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:71
vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:288
panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1084
lockdebug_abort1() at netbsd:lockdebug_abort1+0x150 sys/kern/subr_lockdebug.c:388
lockdebug_wantlock() at netbsd:lockdebug_wantlock+0x336 sys/kern/subr_lockdebug.c:489
rw_enter() at netbsd:rw_enter+0x788 sys/kern/kern_rwlock.c:300
genfs_lock() at netbsd:genfs_lock+0x160 sys/miscfs/genfs/genfs_vnops.c:397
VOP_LOCK() at netbsd:VOP_LOCK+0x1e0 sys/kern/vnode_if.c:1632
vn_lock() at netbsd:vn_lock+0x1d0 sys/kern/vfs_vnops.c:1388
union_getattr() at netbsd:union_getattr+0x2b2 sys/fs/union/union_vnops.c:872
VOP_GETATTR() at netbsd:VOP_GETATTR+0xe9 sys/kern/vnode_if.c:711
vn_stat() at netbsd:vn_stat+0x9d sys/kern/vfs_vnops.c:762
do_sys_statat() at netbsd:do_sys_statat+0x25c sys/kern/vfs_syscalls.c:3220
sys___lstat50() at netbsd:sys___lstat50+0x94 sys/kern/vfs_syscalls.c:3260
syscall() at netbsd:syscall+0x246 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x246 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x246 sys/arch/x86/x86/syscall.c:137
--- syscall (number 441) ---
netbsd:syscall+0x246:
Panic string: LOCKDEBUG: Reader / writer lock error: rw_vector_enter,300: locking against myself
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
7871 7871 2 0 0 ffffc68012c0b680 ifconfig
9297 9297 3 1 180 ffffc68012d19700 syz-executor.2 pipe_rd
8071 8071 2 0 0 ffffc68013497180 syz-executor.1
7820 7820 3 0 180 ffffc68014597640 syz-executor.4 parked
11596 11596 3 1 0 ffffc680133a6200 syz-executor.3 vm_map
address 0x1ffff8d0491a6d7c is invalid
-2118668970 11596 3 1 0 1ffff8d0491a6d7c RmI vm_map
7558 > 7558 7 1 0 ffffc68012c7b340 syz-executor.5
8094 8094 3 1 180 ffffc6801333a980 syz-executor.0 wait
12598 12598 3 0 180 ffffc68012c8f040 init nanoslp
5616 5616 3 1 180 ffffc68012b76100 syz-executor.4 parked
11211 11211 3 1 180 ffffc68013420b40 syz-executor.2 parked
4085 4085 3 0 180 ffffc680133a6a80 syz-executor.3 parked
5076 5076 3 0 180 ffffc68012c0b240 syz-executor.3 parked
3457 6504 2 1 1140000 ffffc68013393600 syz-executor.0
3457 3457 2 1 11000040 ffffc68013e38ac0 syz-executor.0
3390 3390 3 0 180 ffffc6801335a9c0 syz-executor.1 parked
5581 2291 2 1 1140000 ffffc680143ee5c0 syz-executor.1
5581 5581 2 1 11000040 ffffc6801333a540 syz-executor.1
1859 1859 3 1 180 ffffc68012d03680 syz-executor.3 parked
658 658 3 0 180 ffffc6801426a540 syz-executor.4 parked
4800 4800 3 0 180 ffffc68012d5c340 syz-executor.3 parked
3525 3525 3 1 180 ffffc6801411a900 syz-executor.5 parked
4075 4075 3 1 180 ffffc68013f83340 syz-executor.5 parked
3560 3560 3 1 180 ffffc6801345b500 syz-executor.2 parked
3166 3166 3 1 180 ffffc68013fef040 syz-executor.4 parked
3047 3047 3 1 180 ffffc68012cb2500 syz-executor.3 parked
3149 3149 3 0 180 ffffc68012c7bbc0 syz-executor.4 parked
720 720 3 0 180 ffffc68012c8f480 syz-executor.0 parked
1200 1200 3 1 180 ffffc68012ca0080 syz-executor.5 parked
1080 1435 2 0 0 ffffc68012d0fb00 syz-fuzzer
1080 1623 3 1 0 ffffc68012cf8200 syz-fuzzer vm_map
1080 1207 3 1 180 ffffc68013e8d2c0 syz-fuzzer wait
1080 1073 3 0 180 ffffc68013e6cb00 syz-fuzzer parked
1080 1240 3 1 180 ffffc68013e6c6c0 syz-fuzzer parked
1080 989 2 1 0 ffffc68013e6c280 syz-fuzzer
1080 1247 3 0 180 ffffc68013e38680 syz-fuzzer wait
1080 1120 3 1 180 ffffc68013dd0a40 syz-fuzzer parked
1080 829 3 0 180 ffffc68013dd01c0 syz-fuzzer parked
1080 1242 3 1 180 ffffc6801343ebc0 syz-fuzzer parked
1080 449 3 0 180 ffffc6801343e780 syz-fuzzer parked
1080 1224 3 0 180 ffffc6801343e340 syz-fuzzer parked
1080 1226 3 0 180 ffffc680126d7740 syz-fuzzer wait
1080 1233 2 0 0 ffffc680126d9340 syz-fuzzer
1080 1080 3 0 180 ffffc68012a6b8c0 syz-fuzzer wait
1237 1237 3 0 180 ffffc68012a92080 sshd select
1223 1223 3 0 180 ffffc68013465100 getty nanoslp
1222 1222 3 0 180 ffffc680126db480 getty nanoslp
1195 1195 3 0 180 ffffc680134809c0 getty nanoslp
1103 1103 3 0 180 ffffc68013393a40 sshd select
1056 1056 3 0 180 ffffc68012d2a740 powerd kqueue
702 702 3 0 180 ffffc680133c9b00 syslogd kqueue
746 746 3 1 180 ffffc68012c1db00 dhcpcd poll
742 742 3 1 180 ffffc68012cb20c0 dhcpcd poll
466 466 2 0 0 ffffc68012c1d6c0 dhcpcd
598 598 3 0 180 ffffc68012c2fb40 dhcpcd poll
292 292 3 0 180 ffffc68012d94900 dhcpcd poll
485 485 3 0 180 ffffc68012d944c0 dhcpcd poll
291 > 291 7 0 0 ffffc68012d94080 dhcpcd
1 1 3 1 180 ffffc68012870180 init wait
0 11465 3 0 200 ffffc68013fef480 poolthread pooljob
0 5700 3 1 200 ffffc6801335a140 ktrace ktrwait
0 10554 3 0 200 ffffc6801333a100 ktrace ktrwait
0 8114 3 0 200 ffffc680147b8740 ktrace ktrwait
0 6094 3 0 200 ffffc680143cc580 ktrace ktrwait
0 1934 3 1 200 ffffc68012c60740 ktrace ktrwait
0 1574 3 1 200 ffffc68012b919c0 ktrace ktrwait
0 1271 3 1 200 ffffc6801411a080 acctwatch actwat
0 5558 3 1 200 ffffc6801411a4c0 ktrace ktrwait
0 673 3 0 200 ffffc680129bf6c0 physiod physiod
0 196 3 0 200 ffffc680129c1700 pooldrain pooldrain
0 195 3 1 200 ffffc680129c12c0 ioflush syncer
0 194 3 0 200 ffffc680129bfb00 pgdaemon pgdaemon
0 167 3 1 200 ffffc68012976ac0 usb7 usbevt
0 172 3 1 200 ffffc68012976680 usb6 usbevt
0 170 3 0 200 ffffc68012976240 usb5 usbevt
0 168 3 0 200 ffffc6801291ea80 usb4 usbevt
0 166 3 0 200 ffffc6801291e640 usb3 usbevt
0 165 3 0 200 ffffc6801291e200 usb2 usbevt
0 31 3 1 200 ffffc680128caa40 usb1 usbevt
0 63 3 0 200 ffffc680128ca600 usb0 usbevt
0 126 3 1 200 ffffc680128ca1c0 usbtask-dr usbtsk
0 125 3 1 200 ffffc68012870a00 usbtask-hc usbtsk
0 124 3 0 200 ffffc68010d66b00 swwreboot swwreboot
0 123 3 1 200 ffffc680128705c0 npfgc0 npfgcw
0 122 3 1 200 ffffc680128669c0 rt_free rt_free
0 121 3 1 200 ffffc68012866580 unpgc unpgc
0 120 3 1 200 ffffc68012866140 key_timehandler key_timehandler
0 119 3 1 200 ffffc68012703980 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffc68012703540 icmp6_wqinput/0 icmp6_wqinput
0 117 2 1 200 ffffc68012703100 nd6_timer
0 116 3 1 200 ffffc680126fc940 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffc680126fc500 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffc680126fc0c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffc680126ed900 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffc680126ed4c0 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffc680126ed080 icmp_wqinput/0 icmp_wqinput
0 110 3 1 200 ffffc680126d9780 rt_timer rt_timer
0 109 3 0 200 ffffc680126db8c0 vmem_rehash vmem_rehash
0 100 3 1 200 ffffc680126d7300 entbutler entropy
0 99 3 0 200 ffffc680120bdb40 viomb balloon
0 98 3 1 200 ffffc680120bd700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffc680120bd2c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 ffffc68010d666c0 scsibus0 sccomp
0 29 3 0 200 ffffc68010d66280 pms0 pmsreset
0 28 3 1 200 ffffc68010cacac0 xcall/1 xcall
0 27 1 1 200 ffffc68010cac680 softser/1
0 26 1 1 200 ffffc68010cac240 softclk/1
0 25 1 1 200 ffffc68010ca9a80 softbio/1
0 24 1 1 200 ffffc68010ca9640 softnet/1
0 23 1 1 201 ffffc68010ca9200 idle/1
0 22 3 0 200 ffffc6800fb55a40 lnxsyswq lnxsyswq
0 21 3 0 200 ffffc6800fb55600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffc6800fb551c0 lnxpwrwq lnxpwrwq
0 19 3 0 200 ffffc6800fb54a00 lnxlngwq lnxlngwq
0 18 3 0 200 ffffc6800fb545c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffffc6800fb54180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffc6800fb4d9c0 sysmon smtaskq
0 15 3 0 200 ffffc6800fb4d580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffc6800fb4d140 pmfevent pmfevent
0 13 3 0 200 ffffc6800fb4a980 sopendfree sopendfr
0 12 3 0 200 ffffc6800fb4a540 ifwdog ifwdog
0 11 3 1 200 ffffc6800fb4a100 iflnkst iflnkst
0 10 3 0 200 ffffc6800fb3b940 nfssilly nfssilly
0 9 3 0 200 ffffc6800fb3b500 pooldisp pooldisp
0 8 3 1 200 ffffc6800fb3b0c0 modunload mod_unld
0 7 3 0 200 ffffc6800fb32900 xcall/0 xcall
0 6 1 0 200 ffffc6800fb324c0 softser/0
0 5 1 0 200 ffffc6800fb32080 softclk/0
0 4 1 0 200 ffffc6800fb308c0 softbio/0
0 3 1 0 200 ffffc6800fb30480 softnet/0
0 2 1 0 201 ffffc6800fb30040 idle/0
0 0 2 1 240 ffffffff83350200 swapper
[Locks tracked through LWPs]
****** LWP 8071.8071 (syz-executor.1) @ 0xffffc68013497180, l_stat=2
*** Locks held:
* Lock 0 (initialized at netbsd:kcov_open+0x40 sys/kern/subr_kcov.c:461)
lock address : ffffc680147a54c0
type : sleep/adaptive
initialized : netbsd:kcov_open+0x40
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc68013497180 last held: 0xffffc68013497180
last locked* : netbsd:kcov_fops_ioctl+0x28
unlocked : 0
owner field : 0xffffc68013497180 wait/spin: 0/0
Turnstile: no active turnstile for this lock.
* Lock 1 (initialized at netbsd:uvm_obj_init+0x9a sys/uvm/uvm_object.c:70)
lock address : ffffc680148b5700
type : sleep/adaptive
initialized : netbsd:uvm_obj_init+0x9a
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc68013497180 last held: 0xffffc68013497180
last locked* : netbsd:uvm_fault_internal+0x1e72
unlocked : netbsd:uvm_fault_lower_enter+0x579
owner/count : 0xffffc68013497180 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.
*** Locks wanted: none
[ 434.8960127] fatal protection fault in supervisor mode
[ 434.8960127] trap type 4 code 0 rip 0xffffffff81c19d25 cs 0x8 rflags 0x10282 cr2 0x71ee965e98f0 ilevel 0x8 rsp 0xffffc6824c44fab0
[ 434.8960127] curlwp 0xffffc68012c7b340 pid 7558.7558 lowest kstack 0xffffc6824c4492c0
kernel: protection fault trap, code=0
Faulted in DDB; continuing...
Struck through repros no longer work on HEAD.