syzbot


protection_fault: copyout

Status: upstream: reported on 2025/02/05 03:58
Reported-by: syzbot+8ae7bb4e6771ee01e83e@syzkaller.appspotmail.com
First crash: 160d, last: 7d17h

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      copyout+0x57:   repe movsq      (%rsi),%es:(%rdi)
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003c941b20) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c941b20) at syscall+0x97e sys/arch/amd64/amd64/trap.c:742
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7e9d68fdb80, count: -3
ddb> show registers
rdi                   0x200000001208
rsi               0xdeaf4152deaf4152
rbp               0xffff80003c941a40
rbx                                0
rdx               0xffff80003c93c000
rcx                       0x1bd5e82a
rax                       0xdeaf4152
r8                    0x7f7fffffc000
r9                                 0
r10               0xdf79e530eae99a1e
r11               0xffffffff810effe0    copy_fault
r12               0xfffffd806a6d7e10
r13               0xfffffd806ec2f700
r14               0xffff8000014c9300
r15                   0x200000001208
rip               0xffffffff810eff07    copyout+0x57
cs                               0x8
rflags                       0x50202    acpi_pdirpa+0x3c073
rsp               0xffff80003c941990
ss                              0x10
copyout+0x57:   repe movsq      (%rsi),%es:(%rdi)
ddb> show proc
PROC (syz-executor) tid=197800 pid=19307 tcnt=5 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=82, usrpri=82, slppri=22, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a7f14a0,0xffff80002a7f1740
    process=0xffff800036516458 user=0xffff80003c93c000, vmspace=0xfffffd806c29d010
    estcpu=32, cpticks=0, pctcpu=0.1, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 47755   80531  15064      0  2           0                syz-executor
 47755   21051  15064      0  3   0x4000080  fsleep        syz-executor
 59888  346952   5536      0  2           0                syz-executor
 59888  359329   5536      0  3   0x4000080  fsleep        syz-executor
 96997  348098  75721      0  2           0                syz-executor
 96997  389388  75721      0  3   0x4000080  fsleep        syz-executor
 96997   30165  75721      0  3   0x4000080  fsleep        syz-executor
 92252   83246     44      0  2           0                syz-executor
 92252  414533     44      0  3   0x4000080  fsleep        syz-executor
 92252    1533     44      0  3   0x4000080  fsleep        syz-executor
 19307  179725  12110      0  2           0                syz-executor
*19307  197800  12110      0  7   0x4000000                syz-executor
 19307  352414  12110      0  3   0x4000080  fsleep        syz-executor
 19307  405622  12110      0  3   0x4000080  fsleep        syz-executor
 19307  307529  12110      0  3   0x4000080  fsleep        syz-executor
 39650  227744  45375      0  2           0                syz-executor
 39650  522753  45375      0  3   0x4000080  kqpoll        syz-executor
 39650  443362  45375      0  3   0x4000080  fsleep        syz-executor
 39650   65970  45375      0  3   0x4000080  fsleep        syz-executor
 39650     296  45375      0  2   0x4000000                syz-executor
 78590   44752      0      0  3     0x14280  nfsidl        nfsio
 26548  388310      0      0  3     0x14280  nfsidl        nfsio
 75511  426287      0      0  3     0x14280  nfsidl        nfsio
 66558  314780      0      0  3     0x14280  nfsidl        nfsio
 83847  172639      0      0  3     0x14280  nfsidl        nfsio
 60826  123015      0      0  3     0x14280  nfsidl        nfsio
 68813    5413      0      0  3     0x14280  nfsidl        nfsio
  4304  164119      0      0  3     0x14280  nfsidl        nfsio
 96823   88007      0      0  3     0x14280  nfsidl        nfsio
 97170  497678      0      0  3     0x14280  nfsidl        nfsio
 82887   88609      0      0  3     0x14280  nfsidl        nfsio
 46302   27487      0      0  3     0x14280  nfsidl        nfsio
 23739  175315      0      0  3     0x14280  nfsidl        nfsio
 95204   58168      0      0  3     0x14280  nfsidl        nfsio
 68936  104067      0      0  3     0x14280  nfsidl        nfsio
 80948  413471      0      0  3     0x14280  nfsidl        nfsio
 30607  288605      0      0  3     0x14280  nfsidl        nfsio
 23640   29153      0      0  3     0x14280  nfsidl        nfsio
 17503  327806      0      0  3     0x14280  nfsidl        nfsio
  3467  399703      0      0  3     0x14280  nfsidl        nfsio
 24280  265634  78174      0  2         0x2                syz-executor
 15990  381874      0      0  3     0x14200  bored         sosplice
  5536  185343  78174      0  3        0x82  nanoslp       syz-executor
 15064    8004  78174      0  3        0x82  nanoslp       syz-executor
    44  205859  78174      0  3        0x82  nanoslp       syz-executor
 45375  380037  78174      0  3        0x82  nanoslp       syz-executor
 12110  523223  78174      0  3        0x82  nanoslp       syz-executor
 75200  500297  78174      0  2         0x2                syz-executor
 75721    5680  78174      0  3        0x82  nanoslp       syz-executor
 78174  326902  41696      0  3        0x82  kqread        syz-executor
 41696  515541  67977      0  3    0x10008a  sigsusp       ksh
 67977  428690  51507      0  3        0x98  kqread        sshd-session
 51507  473613  46243      0  3        0x92  kqread        sshd-session
 86905  139654      1      0  3    0x100083  ttyopn        getty
 46243  458987      1      0  3        0x88  kqread        sshd
 46381   10080  77730     73  3   0x1100090  kqread        syslogd
 77730  321658      1      0  3    0x100082  sbwait        syslogd
 68420  479288      1      0  3    0x100080  kqread        resolvd
 17829  326533  93906     77  3    0x100092  kqread        dhcpleased
 62664  250572  93906     77  3    0x100092  kqread        dhcpleased
 93906  256491      1      0  3        0x80  kqread        dhcpleased
 66937  352593      0      0  3     0x14200  bored         smr
 46626  123732      0      0  2     0x14200                zerothread
 56015  129158      0      0  3     0x14200  aiodoned      aiodoned
 18787   70939      0      0  3     0x14200  syncer        update
 65515  207877      0      0  3     0x14200  cleaner       cleaner
 74851  220634      0      0  3     0x14200  reaper        reaper
 72151   71270      0      0  3     0x14200  pgdaemon      pagedaemon
 67735  316087      0      0  3     0x14200  bored         viomb
  6302  320451      0      0  3  0x40014200  acpi0         acpi0
 47575  403841      0      0  3     0x14200  bored         softnet3
 27502  143738      0      0  3     0x14200  bored         softnet2
 56321  218763      0      0  3     0x14200  bored         softnet1
 81601  277958      0      0  3     0x14200  bored         softnet0
 58609  124440      0      0  3     0x14200  bored         systqmp
 47470    3357      0      0  3     0x14200  bored         systq
 23547   48185      0      0  3  0x40014200  tmoslp        softclock
  5527  521589      0      0  3  0x40014200                idle0
     1  164581      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10209  11064K   11627K 166960K     12114        0
            pcb    18     14K      16K 166960K       174        0
         rtable   204     10K      11K 166960K       538        0
             pf    35     14K      18K 166960K       100        0
         ifaddr    35      5K       8K 166960K        75        0
        ifgroup    50      2K       2K 166960K       114        0
         sysctl     4      1K       9K 166960K        10        0
       counters    32     17K      18K 166960K        61        0
       ioctlops     0      0K       4K 166960K       136        0
            iov     0      0K      16K 166960K        97        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1364     86K      87K 166960K      1894        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        12        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        19        0
        dirhash    12      2K       2K 166960K        15        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    16     57K      97K 166960K       673        0
          sigio     0      0K       0K 166960K        11        0
           proc    60     59K     124K 166960K       573        0
        subproc    72      4K       4K 166960K        82        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        58        0
       in_multi    73      5K       7K 166960K       125        0
    ether_multi     1      0K       0K 166960K         5        0
            mrt     0      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   235   1049K    1049K 166960K       235        0
           exec     0      0K       2K 166960K       673        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   222    152K     165K 166960K      7621        0
       UVM aobj    23      2K       2K 166960K        26        0
     pinsyscall    37     74K      96K 166960K      1726        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        36        0
            NDP    11      0K       2K 166960K        49        0
           temp    49   8676K    8804K 166960K      8365        0
         kqueue    13     20K      33K 166960K       145        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       84    0       81     1     0     1     1     0     8    0
rtentry    136      141    0       64     4     0     4     4     0     8    0
unpcb      144      351    0      336     5     2     3     3     0     8    2
syncache   336        5    0        5     3     2     1     1     0     8    1
tcpqe       32        3    0        3     2     1     1     1     0     8    1
tcpcb      736      260    0      252     8     6     2     7     0     8    1
arp         88       25    0       10     1     0     1     1     0     8    0
ipq         40        3    0        1     1     0     1     1     0     8    0
ipqe        40        8    0        6     1     0     1     1     0     8    0
inpcb      328      673    0      659    15    13     2    10     0     8    0
ip6q        72        4    0        0     1     0     1     1     0     8    0
ip6af       40        6    0        1     1     0     1     1     0     8    0
nd6        104       29    0       10     1     0     1     1     0     8    0
pkpcb       40        1    0        1     1     1     0     1     0     8    0
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1072      20    0       20     2     1     1     1     0     8    1
pppxif     1384       4    0        4     3     2     1     1     0     8    1
pfstscr     40        2    0        2     1     0     1     1     0     8    1
pfrktable  1344       3    0        1     1     0     1     1     0     8    0
pfanchor   1288       2    0        0     1     0     1     1     0     8    0
pftag       88        2    0        1     1     0     1     1     0     8    0
pfqueue    320        1    0        0     1     0     1     1     0     8    0
pfstitem    24        2    0        0     1     0     1     1     0     8    0
pfstkey    128        3    0        1     1     0     1     1     0     8    0
pfstate    384        2    0        1     1     0     1     1     0     8    0
pfrule     1344       6    0        4     2     1     1     1     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      563    0      231    29     2    27    29     0     8    1
art_table   32      566    0      231     4     0     4     4     0     8    0
art_node    16      140    0       72     1     0     1     1     0     8    0
sysvmsgpl   40        7    0        2     1     0     1     1     0     8    0
semapl     112       17    0        7     1     0     1     1     0     8    0
shmpl      112       23    0        3     1     0     1     1     0     8    0
dirhash    1024      19    0        2     3     0     3     3     0     8    0
dino2pl    256     2607    0     1108    95     0    95    95     0     8    0
ffsino     248     2607    0     1108    95     0    95    95     0     8    0
nchpl      144     3532    0     1852    63     0    63    63     0     8    0
rtmask      32        2    0        2     1     1     0     1     0     8    0
uvmvnodes   80     2971    0        0    61     0    61    61     0     8    0
vnodes     216     2971    0        0   166     0   166   166     0     8    0
namei      1024   12116    0    12116     5     4     1     2     0     8    1
pfiaddrpl  120        2    0        0     1     0     1     1     0     8    0
kstatmem   264       62    0       40     3     1     2     3     0     8    0
scsiplug    72        3    0        3     2     1     1     1     0     8    1
scxspl     216    12717    0    12717    11     9     2     8     1     8    2
plimitpl   152      217    0      201     1     0     1     1     0     8    0
sigapl     424      972    0      907     9     1     8     8     0     8    0
knotepl    120    41684    0    41637    43    32    11    17     0     8    8
kqueuepl   184      223    0      212     1     0     1     1     0     8    0
pipepl     296      150    0      123     3     0     3     3     0     8    0
fdescpl    440      933    0      905     5     1     4     5     0     8    0
filepl     120     5453    0     5241    16     6    10    12     0     8    1
lockfpl    104      400    0      398     2     1     1     2     0     8    0
lockfspl    48      157    0      155     1     0     1     1     0     8    0
sessionpl  144       23    0       15     1     0     1     1     0     8    0
pgrppl      48      104    0       88     1     0     1     1     0     8    0
ucredpl    104      995    0      983     1     0     1     1     0     8    0
zombiepl   144     1061    0     1061     1     0     1     1     0     8    1
processpl  1160     972    0      907     5     0     5     5     0     8    0
procpl     656     1861    0     1782     9     0     9     9     0     8    2
sosppl     168        8    0        8     2     1     1     1     0     8    1
sockpl     528     1118    0     1086    14     9     5     9     0     8    1
mcl64k     65536     47    0       47     3     2     1     1     0     8    1
mcl16k     16384      3    0        3     2     1     1     1     0     8    1
mcl12k     12288      1    0        1     1     0     1     1     0     8    1
mcl8k      8192       9    0        9     3     2     1     1     0     8    1
mcl4k      4096    3163    0     3110    16     8     8    16     0     8    1
mcl2k2     2112      65    0       65     1     1     0     1     0     8    0
mcl2k      2048    1151    0     1140     4     1     3     4     0     8    0
mtagpl      96       56    0       10     2     0     2     2     0     8    0
mbufpl     256     9886    0     9701    16     2    14    16     0     8    0
bufpl      280     4351    0      119   303     0   303   303     0     8    0
anonpl      24   169762    0   166649    72    38    34    53     0   187    1
amapchunkpl 152   25286    0    24827    36    10    26    30     0   158    6
amappl16   200     3250    0     3218    28    21     7    18     0     8    0
amappl15   192        6    0        6     1     1     0     1     0     8    0
amappl14   184      110    0      100     1     0     1     1     0     8    0
amappl13   176        5    0        5     1     1     0     1     0     8    0
amappl12   168     1569    0     1541     3     1     2     3     0     8    0
amappl11   160       41    0       31     1     0     1     1     0     8    0
amappl10   152        6    0        6     1     1     0     1     0     8    0
amappl9    144      244    0      244     1     1     0     1     0     8    0
amappl8    136       22    0       21     1     0     1     1     0     8    0
amappl7    128      114    0      104     1     0     1     1     0     8    0
amappl6    120      184    0      180     1     0     1     1     0     8    0
amappl5    112      124    0      117     1     0     1     1     0     8    0
amappl4    104      291    0      276     1     0     1     1     0     8    0
amappl3     96     4742    0     4640     4     0     4     4     0     8    0
amappl2     88      628    0      572     2     0     2     2     0     8    0
amappl1     80    10269    0     9730    13     1    12    13     0     8    0
amappl      88     6865    0     6707     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       20    0       19     1     0     1     1     0     8    0
aobjpl      72       25    0        3     1     0     1     1     0     8    0
uaddrrnd    24      933    0      905     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      933    0      905     1     0     1     1     0     8    0
vmmpekpl   168     8880    0     8840     3     0     3     3     0     8    0
vmmpepl    168    64059    0    62262   106    17    89    96     0   357    4
vmsppl     360      932    0      905     4     1     3     4     0     8    0
rwobjpl     32    22016    0    18181    32     0    32    32     0     8    0
pdppl      4096    1872    0     1810   104    38    66    82     0     8    4
pvpl        32   435454    0   427105   160    61    99   123     0   265   13
pmappl     216      932    0      905     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      297    0       70     8     0     8     8     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003c941b20) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c941b20) at syscall+0x97e sys/arch/amd64/amd64/trap.c:742
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7e9d68fdb80, count: -3
ddb> machine ddbcpu 1
No such command
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003c941b20) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c941b20) at syscall+0x97e sys/arch/amd64/amd64/trap.c:742
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7e9d68fdb80, count: -3

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/07 22:05 openbsd e35fec96032e 4f67c4ae .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/06/04 05:33 openbsd 51e28e2b9751 a30356b7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/04/02 05:42 openbsd 60e47db49e73 c799dfdd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/04/01 19:20 openbsd f4478a09da45 36d76a97 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/03/11 07:06 openbsd 4b6c60d68713 16256247 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/03/06 17:20 openbsd 03a0e6b8181a 831e3629 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/02/05 03:57 openbsd 9d84dc8a699e 5896748e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
* Struck through repros no longer work on HEAD.