syzbot


protection_fault: copyout

Status: upstream: reported on 2025/02/05 03:58
Reported-by: syzbot+8ae7bb4e6771ee01e83e@syzkaller.appspotmail.com
First crash: 209d, last: 18d

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      copyout+0x57:   repe movsq      (%rsi),%es:(%rdi)
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003694ff30) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003694ff30) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xeb330c9c510, count: -3
ddb> show registers
rdi                   0x200000001208
rsi               0xdeafbeaddeafbead
rbp               0xffff80003694fe60
rbx                                0
rdx               0xffff80003694a000
rcx                       0x1bd5f7d5
rax                       0xdeafbead
r8                    0x7f7fffffc000
r9                                 0
r10               0x2bcd75545ef421bb
r11               0xffffffff82bb3410    copy_fault
r12               0xfffffd806db53e60
r13               0xfffffd8074745200
r14               0xffff8000015ea800
r15                   0x200000001208
rip               0xffffffff82bb3337    copyout+0x57
cs                               0x8
rflags                       0x50203    acpi_pdirpa+0x3c074
rsp               0xffff80003694fdb0
ss                              0x10
copyout+0x57:   repe movsq      (%rsi),%es:(%rdi)
ddb> show proc
PROC (syz-executor) tid=51260 pid=84072 tcnt=4 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=36, usrpri=50, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a7e34d0,0xffff80002a7e22b8
    process=0xffff80002cd2f6e8 user=0xffff80003694a000, vmspace=0xfffffd8062923b98
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 48960  466779  59150      0  2           0                syz-executor
 48960  154644  59150      0  3   0x4000080  fsleep        syz-executor
 98378  323694  76977      0  2           0                syz-executor
 98378  383042  76977      0  3   0x4000080  ttyin         syz-executor
 69107  331667  90304      0  2           0                syz-executor
 69107  176369  90304      0  3   0x4000080  fsleep        syz-executor
 71026  441581     32      0  2           0                syz-executor
 71026   61927     32      0  3   0x4000080  fsleep        syz-executor
 84072  470671  76463      0  2           0                syz-executor
*84072   51260  76463      0  7   0x4000000                syz-executor
 84072  358876  76463      0  3   0x4000080  fsleep        syz-executor
 84072  210650  76463      0  2   0x4000000                syz-executor
 70865   83487  86717      0  3      0x3000  suspend       syz-executor
 70865  452242  86717      0  2   0x4081000                syz-executor
 70865  235588  86717      0  3   0x4081000  inode         syz-executor
    32   51836  61567      0  3        0x82  nanoslp       syz-executor
 50824   71339      1      0  3    0x100083  ttyin         getty
 74636  118304      0      0  3     0x14200  bored         sosplice
 76463   14186  61567      0  3        0x82  nanoslp       syz-executor
 90304  327945  61567      0  3        0x82  nanoslp       syz-executor
 76977  311781  61567      0  3        0x82  nanoslp       syz-executor
 86717  321458  61567      0  3        0x82  nanoslp       syz-executor
 88977  228302  61567      0  3        0x82  wait          syz-executor
 59150  151909  61567      0  3        0x82  nanoslp       syz-executor
 97548  105859  61567      0  3        0x82  nanoslp       syz-executor
 61567  436676   8924      0  3        0x82  kqread        syz-executor
  8924  109771   9939      0  3    0x10008a  sigsusp       ksh
  9939  252449   8845      0  3        0x98  kqread        sshd-session
  8845   93794  77988      0  3        0x92  kqread        sshd-session
 77988  352726      1      0  3        0x88  kqread        sshd
 82985  327140  31898     73  3   0x1100090  kqread        syslogd
 31898  436346      1      0  3    0x100082  sbwait        syslogd
  1583  120783      1      0  3    0x100080  kqread        resolvd
 28405  423168      0      0  3     0x14200  bored         smr
  1073  448975      0      0  2     0x14200                zerothread
  4107  329944      0      0  3     0x14200  aiodoned      aiodoned
 13620  330037      0      0  3     0x14200  syncer        update
 40347  178291      0      0  3     0x14200  cleaner       cleaner
  7204  305717      0      0  3     0x14200  reaper        reaper
 56713  363488      0      0  3     0x14200  pgdaemon      pagedaemon
 34551   91016      0      0  3     0x14200  bored         viomb
 23584  292958      0      0  3  0x40014200  acpi0         acpi0
 23627  432990      0      0  3     0x14200  bored         softnet7
 61283  228486      0      0  3     0x14200  bored         softnet6
 71057   44074      0      0  3     0x14200  bored         softnet5
 45403  249660      0      0  3     0x14200  bored         softnet4
 31393  151893      0      0  3     0x14200  bored         softnet3
 20022  155582      0      0  3     0x14200  bored         softnet2
  6911  390053      0      0  3     0x14200  bored         softnet1
 78010  497076      0      0  3     0x14200  bored         softnet0
 14535  455065      0      0  3     0x14200  bored         systqmp
 47820   98433      0      0  3     0x14200  bored         systq
 44392  436306      0      0  3  0x40014200  tmoslp        softclock
 78122  500230      0      0  3  0x40014200                idle0
     1  188945      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10180  11044K   13193K 166960K     12388        0
            pcb    18     14K      16K 166960K       341        0
         rtable   210      7K       7K 166960K       420        0
             pf    32     13K      17K 166960K       139        0
         ifaddr    43      8K       8K 166960K        93        0
        ifgroup    50      2K       2K 166960K       153        0
         sysctl     4      1K       9K 166960K        16        0
       counters    32     17K      18K 166960K        77        0
       ioctlops     0      0K       8K 166960K       196        0
            iov     0      0K      18K 166960K        86        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1462     92K      93K 166960K      2065        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        24        0
         VM map     2      1K       1K 166960K         2        0
            sem    24      3K       4K 166960K       217        0
        dirhash    12      2K       2K 166960K        24        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     240K 166960K      1013        0
          sigio     0      0K       0K 166960K        43        0
           proc    54     43K     124K 166960K       602        0
        subproc    72      4K       4K 166960K        82        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       101        0
       in_multi   102      7K       7K 166960K       140        0
    ether_multi     1      0K       0K 166960K         5        0
            mrt     1      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    97    440K     440K 166960K        97        0
           exec     0      0K       1K 166960K       517        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   220    134K     166K 166960K     10825        0
       UVM aobj    92      3K       3K 166960K        99        0
     pinsyscall    33     66K      96K 166960K      2060        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        54        0
            NDP    13      0K       2K 166960K        62        0
           temp    58   8639K    8717K 166960K     56361        0
         kqueue     8     14K      30K 166960K       205        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      119    0      118     1     0     1     1     0     8    0
rtentry    136      129    0       39     4     0     4     4     0     8    0
unpcb      144      777    0      767     8     5     3     6     0     8    2
syncache   336        4    0        4     2     1     1     1     0     8    1
tcpqe       32        1    0        1     1     0     1     1     0     8    1
tcpcb      736      403    0      396    12     5     7     7     0     8    6
arp         88       14    0        2     1     0     1     1     0     8    0
ipq         40        2    0        1     1     0     1     1     0     8    0
ipqe        40        4    0        3     1     0     1     1     0     8    0
inpcb      328     1048    0     1038    12     5     7     7     0     8    5
ip6q        72        9    0        2     1     0     1     1     0     8    0
ip6af       40       13    0        6     1     0     1     1     0     8    0
nd6        104       23    0        5     1     0     1     1     0     8    0
pkpcb       40        7    0        7     3     2     1     1     0     8    1
kcovpl      48        9    0        1     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     1     0     1     0     8    0
ppxss      1072      32    0       32     1     0     1     1     0     8    1
pppxif     1384       6    0        6     2     1     1     1     0     8    1
pfrktable  1344       3    0        3     1     1     0     1     0     8    0
pftag       88        2    0        1     2     1     1     1     0     8    0
pfrule     1344      10    0       10     3     2     1     1     0     8    1
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      601    0      160    31     3    28    30     0     8    0
art_table   40      604    0      160     5     0     5     5     0     8    0
art_node    32      126    0       47     1     0     1     1     0     8    0
sysvmsgpl   40       13    0       10     1     0     1     1     0     8    0
semupl     112        2    0        2     1     1     0     1     0     8    0
semapl     112      176    0      154     1     0     1     1     0     8    0
shmpl      112       96    0        7     3     0     3     3     0     8    0
dirhash    1024      25    0        8     3     0     3     3     0     8    0
dino2pl    256     3276    0     1780    95     0    95    95     0     8    0
ffsino     256     3276    0     1780    95     0    95    95     0     8    0
nchpl      144     4706    0     3021    63     0    63    63     0     8    0
rtmask      32        5    0        5     1     0     1     1     0     8    1
uvmvnodes   80     3690    0        0    76     0    76    76     0     8    0
vnodes     216     3690    0        0   205     0   205   205     0     8    0
namei      1024   16399    0    16399     5     2     3     3     0     8    3
kstatmem   264       88    0       66     2     0     2     2     0     8    0
scsiplug    72        5    0        5     2     1     1     1     0     8    1
scxspl     216    18344    0    18344    16    14     2     8     1     8    2
plimitpl   152      345    0      327     1     0     1     1     0     8    0
sigapl     424     1300    0     1252     9     2     7     8     0     8    0
knotepl    120   276620    0   276587    22    13     9    16     0     8    7
kqueuepl   184      425    0      418     5     3     2     4     0     8    1
pipepl     304      289    0      261     3     0     3     3     0     8    0
fdescpl    448     1257    0     1230     5     1     4     5     0     8    0
filepl     120     8308    0     8106    17     3    14    14     0     8    7
lockfpl    104      302    0      301     1     0     1     1     0     8    0
lockfspl    48      131    0      130     1     0     1     1     0     8    0
sessionpl  144       24    0       17     1     0     1     1     0     8    0
pgrppl      48      146    0      131     1     0     1     1     0     8    0
ucredpl    104     1372    0     1362     1     0     1     1     0     8    0
zombiepl   144     1587    0     1584     2     1     1     1     0     8    0
processpl  1168    1300    0     1252     7     3     4     6     0     8    0
procpl     664     2732    0     2675     8     2     6     8     0     8    0
sosppl     168        6    0        6     2     1     1     1     0     8    1
sockpl     552     2015    0     1994    15     8     7    12     0     8    4
mcl64k     65536    117    0      116     3     1     2     2     0     8    1
mcl12k     12288      4    0        4     2     1     1     1     0     8    1
mcl8k      8192      77    0       77     3     2     1     1     0     8    1
mcl4k      4096    3634    0     3582    17     9     8    15     0     8    1
mcl2k      2048    1466    0     1459     4     2     2     4     0     8    0
mtagpl      96        5    0        5     2     2     0     1     0     8    0
mbufpl     256    15191    0    15034    26     5    21    21     0     8    7
bufpl      280     6576    0      348   446     0   446   446     0     8    0
anonpl      24   201002    0   194031   103    43    60    60     0   187    6
amapchunkpl 152   36432    0    35857    43     9    34    34     0   158   10
amappl16   200     3954    0     3744    54    34    20    21     0     8    4
amappl15   192       25    0       25     1     1     0     1     0     8    0
amappl14   184      113    0      105     1     0     1     1     0     8    0
amappl13   176        7    0        7     1     1     0     1     0     8    0
amappl12   168     1888    0     1861     3     1     2     3     0     8    0
amappl11   160       42    0       38     1     0     1     1     0     8    0
amappl10   152        7    0        7     1     1     0     1     0     8    0
amappl9    144      257    0      257     1     1     0     1     0     8    0
amappl8    136       35    0       33     1     0     1     1     0     8    0
amappl7    128      102    0       94     1     0     1     1     0     8    0
amappl6    120      182    0      177     1     0     1     1     0     8    0
amappl5    112      113    0      109     1     0     1     1     0     8    0
amappl4    104      274    0      258     1     0     1     1     0     8    0
amappl3     96     7009    0     6898     4     1     3     4     0     8    0
amappl2     88      645    0      604     2     0     2     2     0     8    0
amappl1     80    11572    0    11114    13     1    12    13     0     8    0
amappl      88     9999    0     9825     5     0     5     5     0    92    0
dma8192    8192       2    0        2     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       2    0        1     1     0     1     1     0     8    0
dma256     256       71    0       71     2     2     0     1     0     8    0
dma128     128      254    0      254     2     2     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        8    0        8     2     1     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       98    0        7     2     0     2     2     0     8    0
uaddrrnd    24     1257    0     1230     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1257    0     1230     1     0     1     1     0     8    0
vmmpekpl   168    11368    0    11340     2     0     2     2     0     8    0
vmmpepl    168    83240    0    81431   112    27    85   100     0   357    3
vmsppl     368     1256    0     1230     4     1     3     4     0     8    0
rwobjpl     40    27006    0    22308    48     0    48    48     0     8    0
pdppl      4096    2521    0     2460   105    42    63    83     0     8    2
pvpl        32   558500    0   546417   189    68   121   141     0   265    7
pmappl     216     1256    0     1230     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      426    0       82    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003694ff30) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003694ff30) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xeb330c9c510, count: -3
ddb> machine ddbcpu 1
No such command
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003694ff30) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003694ff30) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xeb330c9c510, count: -3

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/14 18:11 openbsd 7a15ea66e78c dcc075fb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/07/07 22:05 openbsd e35fec96032e 4f67c4ae .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/06/04 05:33 openbsd 51e28e2b9751 a30356b7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/04/02 05:42 openbsd 60e47db49e73 c799dfdd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/04/01 19:20 openbsd f4478a09da45 36d76a97 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/03/11 07:06 openbsd 4b6c60d68713 16256247 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/03/06 17:20 openbsd 03a0e6b8181a 831e3629 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/02/05 03:57 openbsd 9d84dc8a699e 5896748e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
* Struck through repros no longer work on HEAD.