syzbot


protection_fault: __x86_indirect_thunk_r11 (2)

Status: upstream: reported on 2024/03/06 09:09
Reported-by: syzbot+96da3c3ca04921c53668@syzkaller.appspotmail.com
First crash: 53d, last: 4d04h
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: __x86_indirect_thunk_r11 1 181d 181d 0/3 auto-obsoleted due to no activity on 2024/01/28 10:43

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      __x86_indirect_thunk_r11+0x14:  ret
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
rt_match(ffff800037a4d7e0,0,1,0) at rt_match+0xc3 rt_clone sys/net/route.c:383 [inline]
rt_match(ffff800037a4d7e0,0,1,0) at rt_match+0xc3 sys/net/route.c:358
ip_multicast_if(ffff800037a4d890,0,ffff800037a4d878) at ip_multicast_if+0xec sys/netinet/ip_output.c:1364
ip_setmoptions(c,fffffd8079d64ed8,fffffd806817a400,0) at ip_setmoptions+0x378 sys/netinet/ip_output.c:1533
sosetopt(fffffd805c209c08,0,c,fffffd806817a400) at sosetopt+0xe1
sys_setsockopt(ffff80002daf6040,ffff800037a4daa0,ffff800037a4d9f0) at sys_setsockopt+0x1d6 sys/kern/uipc_syscalls.c:1231
syscall(ffff800037a4daa0) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9d861077580, count: -8
ddb> show registers
rdi               0xffff800000e54800
rsi                              0xb
rbp               0xffff800037a4d6c0
rbx               0xffff800000e591b0
rdx               0xfffffd806865be88
rcx                            0x6f2
rax               0xffffffff824215b5    rtrequest+0x9b5
r8                             0x100
r9                0xfffffd806865be88
r10               0x32201d8c1667ed5b
r11                  0x99da90002fd09
r12               0xffff800037a4d778
r13                                0
r14               0xfffffd806865be88
r15               0xffff800037a4d6d8
rip               0xffffffff82305304    __x86_indirect_thunk_r11+0x14
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800037a4d5c0
ss                              0x10
__x86_indirect_thunk_r11+0x14:  ret
ddb> show proc
PROC (syz-executor.7) tid=339849 pid=43980 tcnt=2 stat=onproc
    flags process=8000000 proc=4000000<THREAD>
    runpri=32, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0
    forw=0xffffffffffffffff, list=0xffff80002daf62d0,0xffff80002daf6800
    process=0xffff80002db39518 user=0xffff800037a48000, vmspace=0xfffffd80695ee978
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 37635   68802  33896      0  2   0x8000000                syz-executor.3
 37635  319252  33896      0  3   0xc000080  fsleep        syz-executor.3
 43980  316530  32053      0  2   0x8000000                syz-executor.7
*43980  339849  32053      0  7   0xc000000                syz-executor.7
 83577  164935  91941      0  3   0x8000080  nanoslp       syz-executor.5
 83577  160647  91941      0  3   0xc000080  bell          syz-executor.5
 83577  156995  91941      0  3   0xc000080  fsleep        syz-executor.5
 40585  208218  90858      0  3  0x18100082  netio         arp
 90858   37556  89460      0  3   0x810008a  sigsusp       sh
 33896  480978   8446      0  3   0x8000082  nanoslp       syz-executor.3
 89460  428444   8446      0  3   0x8000082  wait          syz-executor.4
 32053  429780   8446      0  2   0x8000482                syz-executor.7
 91941  426402   8446      0  2   0x8000482                syz-executor.5
 64241  105624   8446      0  3   0x8000082  nanoslp       syz-executor.1
  7809  236197   8446      0  3   0x8000082  wait          syz-executor.6
 34611  393290   8446      0  2   0x8000482                syz-executor.0
 75469  270274      1      0  3  0x18100083  ttyin         getty
 28169  242375      0      0  3     0x14200  bored         sosplice
  8446  440621  74931      0  3  0x1a000082  wait          syz-fuzzer
  8446   27974  74931      0  3  0x1e000082  thrsleep      syz-fuzzer
  8446  341006  74931      0  3  0x1e000082  thrsleep      syz-fuzzer
  8446  281322  74931      0  3  0x1e000082  thrsleep      syz-fuzzer
  8446  149101  74931      0  3  0x1e000082  wait          syz-fuzzer
  8446  135841  74931      0  3  0x1e000082  wait          syz-fuzzer
  8446  431057  74931      0  3  0x1e000082  wait          syz-fuzzer
  8446  437272  74931      0  3  0x1e000082  wait          syz-fuzzer
  8446  499068  74931      0  3  0x1e000082  kqread        syz-fuzzer
  8446  213396  74931      0  3  0x1e000082  wait          syz-fuzzer
  8446  375919  74931      0  3  0x1e000082  thrsleep      syz-fuzzer
  8446   43310  74931      0  3  0x1e000082  wait          syz-fuzzer
  8446  184996  74931      0  3  0x1e000082  wait          syz-fuzzer
  8446  227175  74931      0  3  0x1e000082  thrsleep      syz-fuzzer
  8446   92230  74931      0  3  0x1e000082  thrsleep      syz-fuzzer
 74931   63169  78453      0  3   0x810008a  sigsusp       ksh
 78453  339225  79179      0  3  0x1800009a  kqread        sshd
 79179    9956      1      0  3  0x18000088  kqread        sshd
 27627  387965  63352     73  2  0x19100010                syslogd
 63352  510511      1      0  3  0x18100082  sbwait        syslogd
 49961  420852      1      0  3  0x18100080  kqread        resolvd
  4410   93307  39981     77  3  0x18100092  kqread        dhcpleased
 14423  374369  39981     77  3  0x18100092  kqread        dhcpleased
 39981  514965      1      0  3  0x18000080  kqread        dhcpleased
 37180  200150      0      0  3     0x14200  bored         smr
 92634  499341      0      0  2     0x14200                zerothread
  6680  217679      0      0  3     0x14200  aiodoned      aiodoned
 78193  361519      0      0  3     0x14200  syncer        update
 52846  140826      0      0  3     0x14200  cleaner       cleaner
 71591  431709      0      0  3     0x14200  reaper        reaper
 16262   52039      0      0  3     0x14200  pgdaemon      pagedaemon
 88605  245312      0      0  3     0x14200  bored         viomb
 29551  487182      0      0  3  0x40014200  acpi0         acpi0
 13846  206190      0      0  3     0x14200  bored         softnet3
 64576  254324      0      0  3     0x14200  bored         softnet2
 49108  228513      0      0  3     0x14200  bored         softnet1
 40117   91211      0      0  3     0x14200  bored         softnet0
 29468  357246      0      0  3     0x14200  bored         systqmp
 75676   55435      0      0  3     0x14200  bored         systq
  9313  327347      0      0  2  0x40014200                softclock
 99161   81016      0      0  3  0x40014200                idle0
     1  454110      0      0  3   0x8080082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10187   6432K    7073K 166960K     17113        0
            pcb    17     17K      22K 166960K       720        0
         rtable   217      7K       9K 166960K      4276        0
             pf    33      9K       9K 166960K       334        0
         ifaddr    43     13K      14K 166960K       548        0
        ifgroup    58      2K       2K 166960K       619        0
         sysctl     4      1K       1K 166960K        11        0
       counters    32     17K      17K 166960K       172        0
       ioctlops     0      0K       2K 166960K       343        0
            iov     0      0K      16K 166960K       162        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1465     92K      93K 166960K      5352        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        91        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       371        0
        dirhash    12      2K       2K 166960K        51        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    16     57K     109K 166960K      4768        0
          sigio     0      0K       0K 166960K       153        0
           proc    58     59K     124K 166960K      4012        0
        subproc   104      6K       8K 166960K      1775        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     2      0K       0K 166960K       512        0
       in_multi    80      6K       7K 166960K      1491        0
    ether_multi     1      0K       0K 166960K        34        0
            mrt     1      0K       0K 166960K        10        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    85    387K     387K 166960K        85        0
           exec     0      0K       1K 166960K      2152        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   305    140K     142K 166960K     37717        0
       UVM aobj   133      4K       4K 166960K       145        0
     pinsyscall    37     74K     103K 166960K      9032        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       194        0
            NDP    13      0K       2K 166960K       395        0
           temp    78   6812K    6940K 166960K    205851        0
         kqueue    12     18K      30K 166960K       477        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      748    0      744     3     0     3     3     0     8    2
rtentry    112     1531    0     1434     4     0     4     4     0     8    1
unpcb      144     2384    0     2369     4     0     4     4     0     8    3
syncache   336        4    0        4     1     0     1     1     0     8    1
tcpcb      808     1036    0     1031     8     0     8     8     0     8    7
arp         88      299    0      282     1     0     1     1     0     8    0
ipq         40        7    0        6     1     0     1     1     0     8    0
ipqe        40       53    0       52     1     0     1     1     0     8    0
inpcb      352     4051    0     4037    11     1    10    11     0     8    8
nd6        104      385    0      367     1     0     1     1     0     8    0
pkpcb       40       31    0       31     1     0     1     1     0     8    1
kcovpl      48      136    0      128     1     0     1     1     0     8    0
ppxss      1072      10    0       10     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     5778    0     5390    75    50    25    30     0     8    0
art_table   32     5779    0     5390     4     0     4     4     0     8    0
art_node    16     1516    0     1428     1     0     1     1     0     8    0
sysvmsgpl   40       19    0       11     1     0     1     1     0     8    0
semapl     112      369    0      359     1     0     1     1     0     8    0
shmpl      112      142    0       14     4     0     4     4     0     8    0
dirhash    1024      43    0       26     3     0     3     3     0     8    0
dino2pl    256     6854    0     5342    96     0    96    96     0     8    1
ffsino     240     6854    0     5342    90     0    90    90     0     8    0
nchpl      144    12537    0    11938    66    34    32    66     0     8    8
uvmvnodes   80     8628    0        0   177     0   177   177     0     8    0
vnodes     216     8628    0        0   480     0   480   480     0     8    0
namei      1024   52153    0    52153     2     0     2     2     0     8    2
vcpupl     3904      29    0        0     4     0     4     4     0     8    0
vmpool     664       63    0       34     3     0     3     3     0     8    0
kstatmem   264      306    0      280     2     0     2     2     0     8    0
scsiplug    72        3    0        3     1     0     1     1     0     8    1
scxspl     216    87291    0    87291     8     0     8     8     1     8    8
plimitpl   152      672    0      656     1     0     1     1     0     8    0
sigapl     424     4836    0     4790     9     0     9     9     0     8    2
futexpl     64    53808    0    53806     1     0     1     1     0     8    0
knotepl    120    12680    0    12596    11     0    11    11     0     8    7
kqueuepl   184      858    0      850     2     0     2     2     0     8    1
pipepl     288     1058    0     1031     3     0     3     3     0     8    0
fdescpl    432     4796    0     4769     5     0     5     5     0     8    1
filepl     120    26765    0    26516    14     0    14    14     0     8    6
lockfpl    104      928    0      926     1     0     1     1     0     8    0
lockfspl    48      369    0      367     1     0     1     1     0     8    0
sessionpl  144      147    0      131     1     0     1     1     0     8    0
pgrppl      48      235    0      219     1     0     1     1     0     8    0
ucredpl    104     3281    0     3269     1     0     1     1     0     8    0
zombiepl   144     4794    0     4790     1     0     1     1     0     8    0
processpl  1072    4836    0     4790     6     0     6     6     0     8    0
procpl     656     8508    0     8444     9     0     9     9     0     8    2
sosppl     168       41    0       41     1     0     1     1     0     8    1
sockpl     504     7268    0     7235    18     5    13    17     0     8    8
mcl64k     65536      7    0        7     1     0     1     1     0     8    1
mcl16k     16384      4    0        4     1     0     1     1     0     8    1
mcl12k     12288      1    0        1     1     0     1     1     0     8    1
mcl9k      9216       2    0        2     1     0     1     1     0     8    1
mcl8k      8192      73    0       73     1     0     1     1     0     8    1
mcl4k      4096      16    0       16     1     0     1     1     0     8    1
mcl2k      2048   43335    0    43233    41    20    21    35     0     8    7
mtagpl      96      178    0      174     1     0     1     1     0     8    0
mbufpl     256   121310    0   121122   183   161    22   147     0     8    6
bufpl      280    16069    0     7440   617     0   617   617     0     8    0
anonpl      24   600187    0   594146    70     0    70    70     0   188   10
amapchunkpl 152  119641    0   118968    43     0    43    43     0   158   13
amappl16   200    11003    0    10892    33    18    15    19     0     8    7
amappl15   192        7    0        7     1     0     1     1     0     8    1
amappl14   184      653    0      639     2     0     2     2     0     8    1
amappl13   176        9    0        8     1     0     1     1     0     8    0
amappl12   168     7176    0     7145     3     0     3     3     0     8    0
amappl11   160       51    0       41     1     0     1     1     0     8    0
amappl10   152      169    0      160     1     0     1     1     0     8    0
amappl9    144      150    0      149     1     0     1     1     0     8    0
amappl8    136      503    0      471     2     0     2     2     0     8    0
amappl7    128       63    0       48     1     0     1     1     0     8    0
amappl6    120     1851    0     1836     2     0     2     2     0     8    1
amappl5    112      634    0      622     1     0     1     1     0     8    0
amappl4    104     1246    0     1215     2     0     2     2     0     8    1
amappl3     96    22323    0    22235     3     0     3     3     0     8    0
amappl2     88     5500    0     5426     4     0     4     4     0     8    2
amappl1     80    31264    0    30749    22     2    20    22     0     8    6
amappl      88    36157    0    35957     6     0     6     6     0    92    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      144    0       12     3     0     3     3     0     8    0
uaddrrnd    24     4859    0     4803     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     4859    0     4803     1     0     1     1     0     8    0
vmmpekpl   168    38557    0    38489     4     0     4     4     0     8    0
vmmpepl    168   327233    0   325397   113     0   113   113     0   357   24
vmsppl     344     4858    0     4803     6     0     6     6     0     8    0
rwobjpl     24    84867    0    74985    60     0    60    60     0     8    0
pdppl      4096    9724    0     9635   440   343    97   105     0     8    8
pvpl        32  1820861    0  1808856   375    29   346   375     0   265  217
pmappl     216     4858    0     4803     4     0     4     4     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      968    0      579    15     0    15    15     0     8    2
ddb> machine ddbcpu 0
No such command
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
rt_match(ffff800037a4d7e0,0,1,0) at rt_match+0xc3 rt_clone sys/net/route.c:383 [inline]
rt_match(ffff800037a4d7e0,0,1,0) at rt_match+0xc3 sys/net/route.c:358
ip_multicast_if(ffff800037a4d890,0,ffff800037a4d878) at ip_multicast_if+0xec sys/netinet/ip_output.c:1364
ip_setmoptions(c,fffffd8079d64ed8,fffffd806817a400,0) at ip_setmoptions+0x378 sys/netinet/ip_output.c:1533
sosetopt(fffffd805c209c08,0,c,fffffd806817a400) at sosetopt+0xe1
sys_setsockopt(ffff80002daf6040,ffff800037a4daa0,ffff800037a4d9f0) at sys_setsockopt+0x1d6 sys/kern/uipc_syscalls.c:1231
syscall(ffff800037a4daa0) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9d861077580, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
rt_match(ffff800037a4d7e0,0,1,0) at rt_match+0xc3 rt_clone sys/net/route.c:383 [inline]
rt_match(ffff800037a4d7e0,0,1,0) at rt_match+0xc3 sys/net/route.c:358
ip_multicast_if(ffff800037a4d890,0,ffff800037a4d878) at ip_multicast_if+0xec sys/netinet/ip_output.c:1364
ip_setmoptions(c,fffffd8079d64ed8,fffffd806817a400,0) at ip_setmoptions+0x378 sys/netinet/ip_output.c:1533
sosetopt(fffffd805c209c08,0,c,fffffd806817a400) at sosetopt+0xe1
sys_setsockopt(ffff80002daf6040,ffff800037a4daa0,ffff800037a4d9f0) at sys_setsockopt+0x1d6 sys/kern/uipc_syscalls.c:1231
syscall(ffff800037a4daa0) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9d861077580, count: -8

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/24 07:28 openbsd e6c7c102cf5d 21339d7b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/04/23 06:19 openbsd 19e99d061340 21339d7b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/04/21 19:29 openbsd 8a9424f8c5c9 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/04/21 11:12 openbsd 8a9424f8c5c9 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/04/02 15:05 openbsd 2ee472d028ec 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/03/30 13:47 openbsd 2ee472d028ec 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/03/26 19:17 openbsd c2de78a730b8 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/03/20 16:53 openbsd 10309c388f04 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/03/17 17:54 openbsd d108608d837e 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/03/10 09:13 openbsd c8df64f9c06b 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/03/06 11:37 openbsd cf53fb485466 f39a7eed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
2024/03/06 09:08 openbsd cf53fb485466 f39a7eed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
* Struck through repros no longer work on HEAD.