syzbot


protection_fault: copyout

Status: upstream: reported on 2025/02/05 03:58
Reported-by: syzbot+8ae7bb4e6771ee01e83e@syzkaller.appspotmail.com
First crash: 121d, last: 1d23h

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      copyout+0x57:   repe movsq      (%rsi),%es:(%rdi)
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003812f4c0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003812f4c0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xdbd4d2732f0, count: -3
ddb> show registers
rdi                   0x200000001208
rsi               0xdeadbeefdeadbeef
rbp               0xffff80003812f3e0
rbx                                0
rdx               0xffff80003812a000
rcx                       0x1bd5b7dd
rax                       0xdeadbeef
r8                    0x7f7fffffc000
r9                                 0
r10               0xf800757f0af23c65
r11               0xffffffff819ee850    copy_fault
r12               0xfffffd806a606e68
r13               0xfffffd80690fc600
r14               0xffff8000014b2800
r15                   0x200000001208
rip               0xffffffff819ee777    copyout+0x57
cs                               0x8
rflags                       0x50207    acpi_pdirpa+0x3c078
rsp               0xffff80003812f330
ss                                 0
copyout+0x57:   repe movsq      (%rsi),%es:(%rdi)
ddb> show proc
PROC (syz-executor) tid=162782 pid=79198 tcnt=4 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=36, usrpri=83, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a8b8a70,0xffff80002a7ce028
    process=0xffff800034115238 user=0xffff80003812a000, vmspace=0xfffffd806c19e018
    estcpu=33, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  3076  140992  70479      0  2           0                syz-executor
  3076  317464  70479      0  3   0x4000080  fifow         syz-executor
 79198  358316  32005      0  2           0                syz-executor
*79198  162782  32005      0  7   0x4000000                syz-executor
 79198  409588  32005      0  3   0x4000080  fsleep        syz-executor
 79198  356285  32005      0  2   0x4000000                syz-executor
 89991  357615   1295      0  3        0x80  nanoslp       syz-executor
 89991   80395   1295      0  3   0x4000080  kqpoll        syz-executor
 89991  226751   1295      0  3   0x4000080  fsleep        syz-executor
 89991  183542   1295      0  3   0x4000080  fsleep        syz-executor
 50654  449287      0      0  3     0x14200  acct          acct
 87606  355395      1      0  3    0x100083  ttyin         getty
 39199  126474      0      0  3     0x14200  bored         sosplice
 96933    1702  38132      0  3        0x82  wait          syz-executor
 70479  507176  38132      0  3        0x82  nanoslp       syz-executor
 95466  251260  38132      0  2         0x2                syz-executor
 63654  157804  38132      0  2         0x2                syz-executor
  9285  344228  38132      0  3        0x82  nanoslp       syz-executor
  1295   30984  38132      0  3        0x82  nanoslp       syz-executor
 22108   76002  38132      0  3        0x82  nanoslp       syz-executor
 32005  487104  38132      0  3        0x82  nanoslp       syz-executor
 38132  252778  34680      0  3        0x82  kqread        syz-executor
 34680  493345  88177      0  3    0x10008a  sigsusp       ksh
 88177  288742  74171      0  3        0x98  kqread        sshd-session
 74171   60927   4225      0  3        0x92  kqread        sshd-session
  4225  322588      1      0  3        0x88  kqread        sshd
 15319  448080  96872     73  3   0x1100090  kqread        syslogd
 96872  427617      1      0  3    0x100082  sbwait        syslogd
 82306  222491      1      0  3    0x100080  kqread        resolvd
 19373   12622  75811     77  3    0x100092  kqread        dhcpleased
 14617   42755  75811     77  3    0x100092  kqread        dhcpleased
 75811  284534      1      0  3        0x80  kqread        dhcpleased
 38464  433335      0      0  3     0x14200  bored         smr
 74338  429735      0      0  2     0x14200                zerothread
 10051  522854      0      0  3     0x14200  aiodoned      aiodoned
 30365  476822      0      0  3     0x14200  syncer        update
 33836  212503      0      0  3     0x14200  cleaner       cleaner
 14480  498377      0      0  3     0x14200  reaper        reaper
 80197  261771      0      0  3     0x14200  pgdaemon      pagedaemon
 69084  514985      0      0  3     0x14200  bored         viomb
  7239    2760      0      0  3  0x40014200  acpi0         acpi0
 91505  499088      0      0  3     0x14200  bored         softnet3
 21476  233359      0      0  3     0x14200  bored         softnet2
 16544  419984      0      0  3     0x14200  bored         softnet1
 40145  422176      0      0  3     0x14200  bored         softnet0
 88985   44391      0      0  3     0x14200  bored         systqmp
  1195   15287      0      0  3     0x14200  bored         systq
  9858  352612      0      0  3  0x40014200  tmoslp        softclock
  6816  467194      0      0  3  0x40014200                idle0
     1   25137      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10200  11124K   11665K 166960K     14034        0
            pcb    17     13K      13K 166960K       184        0
         rtable   197      8K       9K 166960K       566        0
             pf    35     13K      16K 166960K       504        0
         ifaddr    39      6K       7K 166960K        92        0
        ifgroup    59      2K       2K 166960K       144        0
         sysctl     3      1K       9K 166960K        13        0
       counters    34     18K      18K 166960K        83        0
       ioctlops     0      0K       4K 166960K       333        0
            iov     0      0K      16K 166960K       145        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1490     94K      94K 166960K      3014        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        29        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        64        0
        dirhash    12      2K       2K 166960K        39        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    16     57K     236K 166960K      1341        0
          sigio     0      0K       0K 166960K       157        0
           proc    60     59K     100K 166960K       603        0
        subproc    72      4K       4K 166960K        83        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       165        0
       in_multi    80      6K       7K 166960K       161        0
    ether_multi     1      0K       0K 166960K         7        0
            mrt     0      0K       0K 166960K         3        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    85    387K     387K 166960K        85        0
           exec     0      0K       1K 166960K       503        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         7        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   226    155K     170K 166960K     13494        0
       UVM aobj   131      4K       4K 166960K       132        0
     pinsyscall    37     74K      98K 166960K      2385        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        53        0
            NDP    13      0K       2K 166960K        66        0
           temp    76   8687K    8758K 166960K     37754        0
         kqueue    14     22K      28K 166960K       206        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      172    0      169     3     0     3     3     0     8    2
rtentry    136      154    0       71     4     0     4     4     0     8    0
unpcb      144      956    0      939     8     6     2     7     0     8    1
syncache   336        6    0        6     2     1     1     1     0     8    1
tcpqe       32        3    0        3     2     1     1     1     0     8    1
tcpcb      808      743    0      734    21    13     8     8     0     8    7
arp         88       23    0        7     1     0     1     1     0     8    0
ipq         40        1    0        0     1     0     1     1     0     8    0
ipqe        40        3    0        2     1     0     1     1     0     8    0
inpcb      328     1677    0     1664    24    14    10    13     0     8    8
ip6q        72        1    0        0     1     0     1     1     0     8    0
nd6        104       34    0       15     1     0     1     1     0     8    0
pkpcb       40       57    0       57     3     2     1     1     0     8    1
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1072      41    0       41     3     2     1     1     0     8    1
pppxif     1384       3    0        3     2     1     1     1     0     8    1
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pfanchor   1288       1    0        0     1     0     1     1     0     8    0
pfrule     1344      99    0       65     3     0     3     3     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      661    0      275    31     3    28    29     0     8    2
art_table   32      663    0      275     4     0     4     4     0     8    0
art_node    16      149    0       74     1     0     1     1     0     8    0
sysvmsgpl   40       47    0       43     2     1     1     1     0     8    0
semupl     112        2    0        2     1     1     0     1     0     8    0
semapl     112       61    0       51     1     0     1     1     0     8    0
shmpl      112      129    0        1     4     0     4     4     0     8    0
dirhash    1024      35    0       18     3     0     3     3     0     8    0
dino2pl    256     3839    0     2345    95     0    95    95     0     8    0
ffsino     248     3839    0     2345    95     0    95    95     0     8    0
nchpl      144     5669    0     3993    63     0    63    63     0     8    0
rtmask      32        8    0        8     2     1     1     1     0     8    1
uvmvnodes   80     5048    0        0   104     0   104   104     0     8    0
vnodes     216     5048    0        0   281     0   281   281     0     8    0
namei      1024   21074    0    21073     6     3     3     3     0     8    2
kstatmem   264       90    0       64     2     0     2     2     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        9    0        9     2     1     1     1     0     8    1
scxspl     216    20983    0    20983     8     7     1     8     1     8    1
plimitpl   152      374    0      358     1     0     1     1     0     8    0
sigapl     424     1613    0     1567     8     1     7     8     0     8    0
knotepl    120    51027    0    50980    39    29    10    17     0     8    8
kqueuepl   184      570    0      558     7     6     1     7     0     8    0
pipepl     296      260    0      233     5     2     3     5     0     8    0
fdescpl    440     1574    0     1546     5     1     4     5     0     8    0
filepl     120    11466    0    11214    21     9    12    17     0     8    3
lockfpl    104      655    0      653     2     0     2     2     0     8    1
lockfspl    48      213    0      211     1     0     1     1     0     8    0
sessionpl  144       26    0       18     1     0     1     1     0     8    0
pgrppl      48      119    0      103     1     0     1     1     0     8    0
ucredpl    104     1926    0     1914     1     0     1     1     0     8    0
zombiepl   144     1901    0     1898     2     1     1     1     0     8    0
processpl  1160    1613    0     1567     5     1     4     5     0     8    0
procpl     656     3472    0     3419     7     1     6     7     0     8    0
sosppl     168        4    0        4     2     1     1     1     0     8    1
sockpl     528     2957    0     2919    29    18    11    14     0     8    8
mcl64k     65536     35    0       35     3     2     1     1     0     8    1
mcl16k     16384      2    0        2     2     2     0     1     0     8    0
mcl9k      9216       3    0        3     3     2     1     1     0     8    1
mcl8k      8192      17    0       16     3     2     1     1     0     8    0
mcl4k      4096    4067    0     4012    15     7     8    15     0     8    0
mcl2k2     2112       2    0        2     1     0     1     1     0     8    1
mcl2k      2048    1474    0     1471     4     2     2     3     0     8    1
mtagpl      96      227    0       63     5     0     5     5     0     8    0
mbufpl     256    17981    0    17686    85    54    31    84     0     8    7
bufpl      280     8941    0     2714   445     0   445   445     0     8    0
anonpl      24   228876    0   225582    66    19    47    47     0   187   18
amapchunkpl 152   57541    0    57071    49    15    34    34     0   158   12
amappl16   200     4333    0     4301    36    24    12    15     0     8    8
amappl15   192        9    0        9     2     1     1     1     0     8    1
amappl14   184      111    0      101     1     0     1     1     0     8    0
amappl13   176       10    0        9     2     1     1     1     0     8    0
amappl12   168     2204    0     2176     3     1     2     3     0     8    0
amappl11   160       44    0       34     1     0     1     1     0     8    0
amappl10   152        5    0        5     1     1     0     1     0     8    0
amappl9    144      245    0      245     2     1     1     1     0     8    1
amappl8    136       29    0       27     1     0     1     1     0     8    0
amappl7    128      102    0       92     1     0     1     1     0     8    0
amappl6    120      188    0      184     1     0     1     1     0     8    0
amappl5    112      117    0      110     1     0     1     1     0     8    0
amappl4    104      315    0      299     1     0     1     1     0     8    0
amappl3     96     9063    0     8956     4     0     4     4     0     8    0
amappl2     88      647    0      591     2     0     2     2     0     8    0
amappl1     80    13473    0    12926    15     1    14    14     0     8    1
amappl      88    12561    0    12402     5     0     5     5     0    92    0
dma65536   65536      1    0        1     1     0     1     1     0     8    1
dma4096    4096       2    0        2     2     1     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      259    0      259     2     1     1     1     0     8    1
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      131    0        1     3     0     3     3     0     8    0
uaddrrnd    24     1574    0     1546     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1574    0     1546     1     0     1     1     0     8    0
vmmpekpl   168    13518    0    13481     3     0     3     3     0     8    0
vmmpepl    168   101727    0    99905   105    10    95    95     0   357    9
vmsppl     360     1573    0     1546     4     1     3     4     0     8    0
rwobjpl     32    32289    0    26255    50     0    50    50     0     8    1
pdppl      4096    3155    0     3092   113    46    67    83     0     8    4
pvpl        32   667528    0   658731   149    25   124   124     0   265   31
pmappl     216     1573    0     1546     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      390    0      137     9     0     9     9     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003812f4c0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003812f4c0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xdbd4d2732f0, count: -3
ddb> machine ddbcpu 1
No such command
ddb> trace
copyout() at copyout+0x57
syscall(ffff80003812f4c0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003812f4c0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xdbd4d2732f0, count: -3

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/04 05:33 openbsd 51e28e2b9751 a30356b7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/04/02 05:42 openbsd 60e47db49e73 c799dfdd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/04/01 19:20 openbsd f4478a09da45 36d76a97 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/03/11 07:06 openbsd 4b6c60d68713 16256247 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/03/06 17:20 openbsd 03a0e6b8181a 831e3629 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
2025/02/05 03:57 openbsd 9d84dc8a699e 5896748e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: copyout
* Struck through repros no longer work on HEAD.