syzbot


protection_fault: copyout

Status: upstream: reported on 2025/02/05 03:58
Reported-by: syzbot+8ae7bb4e6771ee01e83e@syzkaller.appspotmail.com
First crash: 15h16m, last: 15h16m

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      copyout+0x57:   repe movsq      (%rsi),%es:(%rdi)
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003ca27af0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd21883208b0, count: -3
ddb> show registers
rdi                   0x200000001208
rsi               0xdeafbeaddeafbead
rbp               0xffff80003ca27a10
rbx                                0
rdx               0xffff80003ca22000
rcx                       0x1bd5f7d5
rax                       0xdeafbead
r8                    0x7f7fffffc000
r9                                 0
r10               0x1a8c141a656db6a6
r11               0xffffffff8142b710    copy_fault
r12               0xfffffd806e04ef08
r13               0xfffffd80663f9100
r14               0xffff8000012c9700
r15                   0x200000001208
rip               0xffffffff8142b637    copyout+0x57
cs                               0x8
rflags                       0x50203    acpi_pdirpa+0x3c074
rsp               0xffff80003ca27960
ss                              0x10
copyout+0x57:   repe movsq      (%rsi),%es:(%rdi)
ddb> show proc
PROC (syz-executor) tid=498575 pid=28126 tcnt=4 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=36, usrpri=83, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a8ac020,0xffff80002a8696e8
    process=0xffff8000ffff9158 user=0xffff80003ca22000, vmspace=0xfffffd806c1cc448
    estcpu=33, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 68877  108507  82562      0  2           0                syz-executor
 68877  283704  82562      0  3   0x4000080  fsleep        syz-executor
 70825  348261  38774      0  2           0                syz-executor
 70825  443832  38774      0  3   0x4000080  fsleep        syz-executor
  1822  388364    944      0  2           0                syz-executor
  1822  501320    944      0  3   0x4000080  fsleep        syz-executor
 28126  203481  50636      0  2           0                syz-executor
*28126  498575  50636      0  7   0x4000000                syz-executor
 28126  196912  50636      0  3   0x4000000  futex         syz-executor
 28126  397165  50636      0  2   0x4000000                syz-executor
 93348  246679  76813      0  2           0                syz-executor
 93348  361489  76813      0  2   0x4000000                syz-executor
 93348  104428  76813      0  3   0x4000080  fsleep        syz-executor
 19149  515040  80520      0  2           0                syz-executor
 19149  136829  80520      0  2   0x4000000                syz-executor
 19149  214069  80520      0  3   0x4000080  fsleep        syz-executor
 53980  157302  83953      0  2         0x1                syz-executor
 53980  504621  83953      0  3   0x4000000  futex         syz-executor
 53980  149173  83953      0  2   0x4000001                syz-executor
 87570   30362      1      0  3    0x100083  ttyin         getty
  9740  410660  29881      0  2         0x2                syz-executor
 16481  391132      0      0  3     0x14200  bored         sosplice
 80520  357332  29881      0  3        0x82  nanoslp       syz-executor
 83953  191256  29881      0  3        0x82  nanoslp       syz-executor
 82562  198622  29881      0  3        0x82  nanoslp       syz-executor
 38774  414276  29881      0  3        0x82  nanoslp       syz-executor
 50636  471821  29881      0  3        0x82  nanoslp       syz-executor
 76813  366895  29881      0  3        0x82  nanoslp       syz-executor
   944   60129  29881      0  3        0x82  nanoslp       syz-executor
 29881   94344  97978      0  3        0x82  kqread        syz-executor
 97978  250175  14474      0  3    0x10008a  sigsusp       ksh
 14474  164370  55320      0  3        0x98  kqread        sshd-session
 55320  266818  12725      0  3        0x92  kqread        sshd-session
 12725  203310      1      0  3        0x88  kqread        sshd
 29219  206766  40057     73  3   0x1100090  kqread        syslogd
 40057  457146      1      0  3    0x100082  sbwait        syslogd
 16545  283507      1      0  3    0x100080  kqread        resolvd
 69738  170521  26791     77  3    0x100092  kqread        dhcpleased
 10691  326267  26791     77  3    0x100092  kqread        dhcpleased
 26791  262010      1      0  3        0x80  kqread        dhcpleased
 99473   94261      0      0  3     0x14200  bored         smr
 87297  183225      0      0  2     0x14200                zerothread
  6916  226264      0      0  3     0x14200  aiodoned      aiodoned
  3503    9221      0      0  3     0x14200  syncer        update
  6515   64505      0      0  3     0x14200  cleaner       cleaner
 21721  313085      0      0  3     0x14200  reaper        reaper
 84063  175292      0      0  3     0x14200  pgdaemon      pagedaemon
 49789  291923      0      0  3     0x14200  bored         viomb
  5060   59485      0      0  3  0x40014200  acpi0         acpi0
 86730  128080      0      0  3     0x14200  bored         softnet3
 83296  167004      0      0  3     0x14200  bored         softnet2
 87846  233621      0      0  3     0x14200  bored         softnet1
 58564  403250      0      0  3     0x14200  bored         softnet0
 89240   48170      0      0  3     0x14200  bored         systqmp
 19643  438399      0      0  3     0x14200  bored         systq
 86280   88120      0      0  3  0x40014200  tmoslp        softclock
 15247  422051      0      0  3  0x40014200                idle0
     1  277869      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10181  11130K   11251K 166960K     11949        0
            pcb    18     14K      16K 166960K       263        0
         rtable   181      9K      12K 166960K       561        0
             pf    35     14K      18K 166960K       103        0
         ifaddr    35      5K       7K 166960K        64        0
        ifgroup    50      2K       2K 166960K        93        0
         sysctl     3      1K       1K 166960K         3        0
       counters    30     17K      17K 166960K        41        0
       ioctlops     0      0K       8K 166960K       194        0
            iov     0      0K      24K 166960K       177        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1426     90K      90K 166960K      1989        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        14        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        35        0
        dirhash    12      2K       3K 166960K        36        0
           ACPI  1690    195K     286K 166960K     12468        0
      file desc    18     65K      97K 166960K      1059        0
          sigio     0      0K       0K 166960K        48        0
           proc    65     67K     124K 166960K       586        0
        subproc    72      4K       4K 166960K        84        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       150        0
       in_multi    73      5K       7K 166960K       147        0
    ether_multi     1      0K       0K 166960K         4        0
            mrt     1      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    73    334K     334K 166960K        73        0
           exec     0      0K       1K 166960K       527        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   212     72K      88K 166960K     11203        0
       UVM aobj    53      2K       4K 166960K        55        0
     pinsyscall    39     78K      96K 166960K      2126        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        35        0
            NDP    11      0K       2K 166960K        43        0
           temp    58   6887K    6988K 166960K     33986        0
         kqueue    13     20K      30K 166960K       190        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      107    0      104     1     0     1     1     0     8    0
rtentry    112      175    0      100     4     0     4     4     0     8    0
unpcb      144      735    0      711     5     1     4     4     0     8    2
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      808      300    0      296     6     3     3     4     0     8    2
arp         88       38    0       23     1     0     1     1     0     8    0
ipq         40        3    0        2     1     0     1     1     0     8    0
ipqe        40       47    0       46     1     0     1     1     0     8    0
inpcb      344     1238    0     1228    11     8     3     8     0     8    2
nd6        104       31    0       14     1     0     1     1     0     8    0
pkpcb       40        6    0        6     3     2     1     1     0     8    1
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1072       4    0        4     2     1     1     1     0     8    1
pfstscr     40       15    0       13     1     0     1     1     0     8    0
pfrktable  1344       6    0        4     1     0     1     1     0     8    0
pfanchor   1288       3    0        1     1     0     1     1     0     8    0
pftag       88        4    0        1     1     0     1     1     0     8    0
pfqueue    320        1    0        1     1     0     1     1     0     8    1
pfstitem    24        7    0        0     1     0     1     1     0     8    0
pfstkey    128       36    0       31     1     0     1     1     0     8    0
pfstate    344       25    0       21     1     0     1     1     0     8    0
pfrule     1344      15    0       14     1     0     1     1     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      603    0      262    30     5    25    29     0     8    1
art_table   32      606    0      262     4     0     4     4     0     8    0
art_node    16      172    0      111     1     0     1     1     0     8    0
sysvmsgpl   40       24    0       23     2     1     1     1     0     8    0
semapl     112       31    0       21     1     0     1     1     0     8    0
shmpl      112       52    0        2     2     0     2     2     0     8    0
dirhash    1024      33    0       16     3     0     3     3     0     8    0
dino2pl    256     3122    0     1625    95     0    95    95     0     8    0
ffsino     248     3122    0     1625    95     0    95    95     0     8    0
nchpl      144     4673    0     2995    63     0    63    63     0     8    0
uvmvnodes   80     3636    0        0    75     0    75    75     0     8    0
vnodes     216     3636    0        0   202     0   202   202     0     8    0
namei      1024   15975    0    15975     4     3     1     2     0     8    1
pfiaddrpl  120        1    0        1     1     1     0     1     0     8    0
kstatmem   264       44    0       22     2     0     2     2     0     8    0
scsiplug    72        3    0        3     2     1     1     1     0     8    1
scxspl     216    15816    0    15816    15    14     1     8     1     8    1
plimitpl   152      285    0      268     1     0     1     1     0     8    0
sigapl     424     1341    0     1294     7     1     6     7     0     8    0
futexpl     64    13652    0    13646     1     0     1     1     0     8    0
knotepl    120    38750    0    38703    33    23    10    17     0     8    8
kqueuepl   184      267    0      258     1     0     1     1     0     8    0
pipepl     296      229    0      202     8     5     3     8     0     8    0
fdescpl    440     1323    0     1293     5     1     4     5     0     8    0
filepl     120     7699    0     7479    15     6     9    12     0     8    0
lockfpl    104      430    0      427     1     0     1     1     0     8    0
lockfspl    48      161    0      158     1     0     1     1     0     8    0
sessionpl  144       24    0       16     1     0     1     1     0     8    0
pgrppl      48       44    0       28     1     0     1     1     0     8    0
ucredpl    104     1184    0     1173     1     0     1     1     0     8    0
zombiepl   144     1467    0     1467     1     0     1     1     0     8    1
processpl  1104    1341    0     1294     4     0     4     4     0     8    0
procpl     648     2734    0     2675     6     0     6     6     0     8    0
sosppl     168       15    0       15     3     2     1     1     0     8    1
sockpl     528     2094    0     2056    15     7     8     8     0     8    5
mcl64k     65536     38    0       38     3     2     1     1     0     8    1
mcl16k     16384     16    0       16     3     2     1     1     0     8    1
mcl12k     12288      4    0        4     2     1     1     1     0     8    1
mcl9k      9216       5    0        5     2     1     1     1     0     8    1
mcl8k      8192      52    0       52     3     2     1     1     0     8    1
mcl4k      4096    3836    0     3785    15     7     8    13     0     8    1
mcl2k2     2112       1    0        1     1     0     1     1     0     8    1
mcl2k      2048    1291    0     1289     5     2     3     3     0     8    2
mtagpl      96      139    0       72     4     0     4     4     0     8    1
mbufpl     256    14317    0    14103    32    10    22    29     0     8    1
bufpl      280     6875    0      636   446     0   446   446     0     8    0
anonpl      24   192367    0   189182    71    38    33    45     0   187    7
amapchunkpl 152   37514    0    37042    50    22    28    36     0   158    8
amappl16   200     3529    0     3496    28    23     5    15     0     8    1
amappl15   192        5    0        5     1     1     0     1     0     8    0
amappl14   184      108    0       98     1     0     1     1     0     8    0
amappl13   176        3    0        3     1     1     0     1     0     8    0
amappl12   168     1949    0     1920     2     0     2     2     0     8    0
amappl11   160       42    0       32     1     0     1     1     0     8    0
amappl10   152       11    0       10     1     0     1     1     0     8    0
amappl9    144      244    0      244     2     1     1     1     0     8    1
amappl8    136       28    0       27     1     0     1     1     0     8    0
amappl7    128      105    0       95     1     0     1     1     0     8    0
amappl6    120      184    0      180     1     0     1     1     0     8    0
amappl5    112      135    0      128     1     0     1     1     0     8    0
amappl4    104      297    0      283     1     0     1     1     0     8    0
amappl3     96     7317    0     7209     5     1     4     4     0     8    0
amappl2     88      649    0      593     2     0     2     2     0     8    0
amappl1     80    10568    0    10046    13     1    12    13     0     8    0
amappl      88    10784    0    10620     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      254    0      254     2     1     1     1     0     8    1
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       54    0        2     1     0     1     1     0     8    0
uaddrrnd    24     1323    0     1293     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1323    0     1293     1     0     1     1     0     8    0
vmmpekpl   168    11172    0    11133     3     0     3     3     0     8    0
vmmpepl    168    84230    0    82483   100    19    81    89     0   357    3
vmsppl     360     1322    0     1293     4     1     3     4     0     8    0
rwobjpl     32    26988    0    22453    38     1    37    37     0     8    0
pdppl      4096    2652    0     2586   108    42    66    82     0     8    0
pvpl        32   572498    0   563122   163    64    99   127     0   265   14
pmappl     216     1322    0     1293     3     0     3     3     0     8    0
extentpl    40       55    0       38     1     0     1     1     0     8    0
phpool     112      314    0       81     8     1     7     8     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003ca27af0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd21883208b0, count: -3
ddb> machine ddbcpu 1
No such command
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003ca27af0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd21883208b0, count: -3

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/05 03:57 openbsd 9d84dc8a699e 5896748e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
* Struck through repros no longer work on HEAD.