syzbot
KASAN: invalid memory access in kprintf
Status:
upstream: reported on 2026/09/10 09:30
Reported-by: syzbot+9adb7482405fa8ba76d2@syzkaller.appspotmail.com
Fix commit:
Merge remote-tracking branch 'origin/master' into tick-merge
Patched on: [ci-openbsd-kasan], missing on: [ci-openbsd-main ci-openbsd-multicore ci-openbsd-setuid]
First crash: 10d, last: 7d21h
Sample crash report:
panic: Caught invalid memory access at ffff800001705788 size 1 op 0
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*141440 43026 0 0 0x4000000 0K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff8463e8d1) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load1_noabort(ffff800001705788) at __asan_load1_noabort+0xbc
kprintf() at kprintf+0x2a71 sys/kern/subr_prf.c:1065
addlog(ffffffff84a1fdc0) at addlog+0xdf sys/kern/subr_prf.c:329
pf_osfp_add(ffff800001705700) at pf_osfp_add+0x56e sys/net/pf_osfp.c:346
pfioctl(14900,c088444f,ffff800001705700,2,ffff800029a80fc0) at pfioctl+0x4656 sys/net/pf_ioctl.c:3457
VOP_IOCTL(ffff8000110aedc0,c088444f,ffff800001705700,2,ffff8000001195b0,ffff800029a80fc0) at VOP_IOCTL+0x131 sys/kern/vfs_vops.c:264
vn_ioctl(ffff800001c572c0,c088444f,ffff800001705700,ffff800029a80fc0) at vn_ioctl+0x18c sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800029a80fc0,ffff800035707c60,ffff800035707bc0) at sys_ioctl+0x868 sys/kern/sys_generic.c:510
syscall(ffff800035707c60) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800035707c60) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5394bb62a0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff800001705788 size 1 op 0
ddb{0}> show kasan
KASAN: invalid read of 1 byte at 0xffff800001705788 from pc 0xffffffff823490e1
KASAN: first bad byte at 0xffff800001705788 (+0); shadow 0xfb: malloc redzone (out-of-bounds)
KASAN: 0xffff800001705788 is 136 bytes inside the 256-byte malloc slot [0xffff800001705700..0xffff800001705800)
KASAN: allocated at:
#0 malloc+0xf70 sys/kern/kern_malloc.c:487
#1 sys_ioctl+0x4e8 sys/kern/sys_generic.c:-1
#2 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#2 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#3 Xsyscall+0x128
KASAN: pc: kprintf+0x2a71
KASAN: call trace:
#0 __asan_load1_noabort+0x9b kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 __asan_load1_noabort+0x9b sys/kern/subr_kasan.c:1096
#1 kprintf+0x2a71 sys/kern/subr_prf.c:1065
#2 addlog+0xdf sys/kern/subr_prf.c:329
#3 pf_osfp_add+0x56e sys/net/pf_osfp.c:346
#4 pfioctl+0x4656 sys/net/pf_ioctl.c:3457
#5 VOP_IOCTL+0x131 sys/kern/vfs_vops.c:264
#6 vn_ioctl+0x18c sys/kern/vfs_vnops.c:537
#7 sys_ioctl+0x868 sys/kern/sys_generic.c:510
#8 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#9 Xsyscall+0x128
KASAN: shadow of 0xffff800001705680..0xffff800001705900 (1 cell = 8 bytes):
0xffff800001705680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff800001705700: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
>0xffff800001705780: 08[fb]fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff800001705800: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
0xffff800001705880: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff8463e8d1) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load1_noabort(ffff800001705788) at __asan_load1_noabort+0xbc
kprintf() at kprintf+0x2a71 sys/kern/subr_prf.c:1065
addlog(ffffffff84a1fdc0) at addlog+0xdf sys/kern/subr_prf.c:329
pf_osfp_add(ffff800001705700) at pf_osfp_add+0x56e sys/net/pf_osfp.c:346
pfioctl(14900,c088444f,ffff800001705700,2,ffff800029a80fc0) at pfioctl+0x4656 sys/net/pf_ioctl.c:3457
VOP_IOCTL(ffff8000110aedc0,c088444f,ffff800001705700,2,ffff8000001195b0,ffff800029a80fc0) at VOP_IOCTL+0x131 sys/kern/vfs_vops.c:264
vn_ioctl(ffff800001c572c0,c088444f,ffff800001705700,ffff800029a80fc0) at vn_ioctl+0x18c sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800029a80fc0,ffff800035707c60,ffff800035707bc0) at sys_ioctl+0x868 sys/kern/sys_generic.c:510
syscall(ffff800035707c60) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800035707c60) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5394bb62a0, count: -12
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800035706cf0
rbx 0xffff800035706d60
rdx 0
rcx 0xffffffff85103ff0 cpu_info_full_primary+0x1ff0
rax 0xffff80000013a800
r8 0x101010101010101
r9 0x8080808080808080
r10 0x2
r11 0xffffffff81a9ac60 x86_bus_space_io_read_1
r12 0xffffffff8463e8d1 .str.5+0x9b131
r13 0xffffffff85104c10 cpu_info_full_primary+0x2c10
r14 0xffffffff85104e0f cpu_info_full_primary+0x2e0f
r15 0x1
rip 0xffffffff82f99727 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff800035706cf0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=141440 pid=43026 tcnt=2 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=81, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff8000298f2fa8,0xffff8000299f0fc8
process=0xffff8000298ece80 user=0xffff8000356fc000, vmspace=0xffff800001c7ed78
estcpu=31, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
3051 124754 9817 0 3 0x2 0 clonelk ifconfig
9817 367921 76199 0 3 0x100002 0x88 sigsusp sh
43026 335467 71624 0 2 0 0 syz-executor
*43026 141440 71624 0 7 0 0x4000000 syz-executor
82552 410925 67593 0 2 0x10 0 syz-executor
82552 377070 67593 0 2 0x10 0x4000000 syz-executor
82552 253222 67593 0 2 0x10 0x4000000 syz-executor
82552 487008 67593 0 2 0x10 0x4000000 syz-executor
82552 148872 67593 0 2 0x10 0x4000000 syz-executor
82552 218896 67593 0 2 0x10 0x4000000 syz-executor
82552 211624 67593 0 2 0x10 0x4000000 syz-executor
82552 155673 67593 0 2 0x10 0x4000000 syz-executor
76199 463381 23089 0 3 0x2 0x80 wait syz-executor
67593 275915 23089 0 3 0x2 0x80 nanoslp syz-executor
91251 5717 1 0 3 0x100003 0x80 ttyin getty
13212 500177 23089 0 3 0x2 0 biowait syz-executor
71624 510002 23089 0 3 0x2 0x80 nanoslp syz-executor
8873 310387 0 0 3 0x14000 0x200 acct acct
86117 68885 23089 0 3 0x2 0x80 piperd syz-executor
75721 231389 0 0 3 0x14000 0x280 nfsidl nfsio
98863 397166 0 0 3 0x14000 0x280 nfsidl nfsio
64669 490573 0 0 3 0x14000 0x280 nfsidl nfsio
70892 293739 0 0 3 0x14000 0x280 nfsidl nfsio
28937 505541 0 0 3 0x14000 0x280 nfsidl nfsio
61602 114002 0 0 3 0x14000 0x280 nfsidl nfsio
97596 120915 0 0 3 0x14000 0x280 nfsidl nfsio
16532 65403 0 0 3 0x14000 0x280 nfsidl nfsio
80178 235762 0 0 3 0x14000 0x280 nfsidl nfsio
27685 458742 0 0 3 0x14000 0x280 nfsidl nfsio
12770 271572 0 0 3 0x14000 0x280 nfsidl nfsio
86208 462454 0 0 3 0x14000 0x280 nfsidl nfsio
65833 486001 0 0 3 0x14000 0x280 nfsidl nfsio
23118 187556 0 0 3 0x14000 0x280 nfsidl nfsio
14604 509818 0 0 3 0x14000 0x280 nfsidl nfsio
7278 18828 0 0 3 0x14000 0x280 nfsidl nfsio
14212 55041 0 0 3 0x14000 0x280 nfsidl nfsio
31574 511508 0 0 3 0x14000 0x280 nfsidl nfsio
65032 205180 0 0 3 0x14000 0x280 nfsidl nfsio
47802 43218 0 0 3 0x14000 0x280 nfsidl nfsio
76929 120854 23089 0 3 0x2 0 getblk syz-executor
23089 232581 1 0 3 0x2 0x80 wait syz-executor
55346 39304 59245 74 3 0x1100012 0x80 bpf pflogd
59245 470058 1 0 3 0 0x80 sbwait pflogd
90403 283582 1 73 3 0x1100010 0x80 kqread syslogd
63773 298362 0 0 3 0x14000 0x200 bored smr
88213 259411 0 0 2 0x14000 0x200 zerothread
79801 468923 0 0 3 0x14000 0x200 aiodoned aiodoned
87673 510376 0 0 3 0x14000 0x200 syncer update
57962 177469 0 0 3 0x14000 0x200 cleaner cleaner
53677 445498 0 0 3 0x14000 0x200 reaper reaper
84893 24899 0 0 3 0x14000 0x200 pgdaemon pagedaemon
59554 154986 0 0 3 0x14000 0x200 bored viomb
87663 73418 0 0 3 0x14000 0x40000200 acpi0 acpi0
20021 374686 0 0 7 0x14000 0x40000200 idle1
93464 270615 0 0 3 0x14000 0x200 bored softnet1
7528 162860 0 0 3 0x14000 0x200 bored softnet0
72147 216826 0 0 3 0x14000 0x200 bored systqmp
7158 188933 0 0 3 0x14000 0x200 bored systq
22238 100200 0 0 3 0x14000 0x200 tmoslp softclockmp
54734 13666 0 0 3 0x14000 0x40000200 tmoslp softclock
85853 122788 0 0 3 0x14000 0x40000200 idle0
1 97147 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10010000 0x200 scheduler swapper
ddb{0}> show all locks
Process 43026 (syz-executor) thread 0xffff800029a80fc0 (141440)
Process 13212 (syz-executor) thread 0xffff8000298f3ca0 (500177)
Process 76929 (syz-executor) thread 0xffff8000298f34d8 (120854)
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11056 12246K 12438K 166960K 12523 0
pcb 17 28K 30K 166960K 59 0
rtable 227 21K 23K 166960K 1773 0
pf 39 24K 31K 166960K 181 0
ifaddr 41 13K 13K 166960K 242 0
ifgroup 55 2K 2K 166960K 261 0
sysctl 3 1K 13K 166960K 12 0
counters 70 42K 43K 166960K 176 0
ioctlops 1 0K 4K 166960K 1608 0
iov 0 0K 20K 166960K 141 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1371 88K 88K 166960K 2119 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 6K 166960K 8 0
VM map 2 1K 1K 166960K 2 0
sem 26 1K 1K 166960K 97 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 14 49K 97K 166960K 1173 0
proc 40 95K 209K 166960K 1930 0
subproc 72 9K 9K 166960K 495 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 26 0
in_multi 88 6K 7K 166960K 607 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 29 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 55 384K 384K 166960K 55 0
exec 0 0K 2K 166960K 1000 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM amap 133 155K 255K 166960K 10162 0
UVM aobj 10 8K 8K 166960K 12 0
pinsyscall 1046 1747K 1833K 166960K 3548 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 3 0
NDP 12 0K 2K 166960K 172 0
temp 40 9175K 9203K 166960K 11581 0
kqueue 4 13K 49K 166960K 75 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 127 0 127 2 1 1 1 0 8 1
rtentry 176 621 0 522 6 1 5 6 0 8 0
unpcb 144 674 0 668 8 6 2 6 0 8 1
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 36 0 35 1 0 1 1 0 8 0
arp 136 111 0 95 1 0 1 1 0 8 0
inpcb 328 801 0 799 9 6 3 7 0 8 2
nd6 152 165 0 144 2 0 2 2 0 8 0
pkpcb 40 1 0 1 1 1 0 1 0 8 0
kcovpl 48 55 0 47 1 0 1 1 0 8 0
ppxss 1192 3 0 3 2 2 0 1 0 8 0
pfstscr 40 1 0 1 1 1 0 1 0 8 0
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 1 0 0 1 0 1 1 0 8 0
pfosfp 40 1428 0 1428 5 5 0 5 0 8 0
pfosfpen 112 1428 0 1428 21 21 0 21 0 8 0
pfrktable 1344 7 0 5 1 0 1 1 0 8 0
pfanchor 1288 3 0 1 1 0 1 1 0 8 0
pftag 88 2 0 0 1 0 1 1 0 8 0
pfqueue 320 1 0 0 1 0 1 1 0 8 0
pfstitem 24 57 0 25 1 0 1 1 0 8 0
pfstkey 128 59 0 27 2 0 2 2 0 8 0
pfstate 448 58 0 26 5 0 5 5 0 8 0
pfrule 1360 26 0 19 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 2500 0 2083 36 7 29 29 0 8 2
art_table 40 2501 0 2083 5 0 5 5 0 8 0
art_node 32 621 0 531 1 0 1 1 0 8 0
sysvmsgpl 40 2 0 1 1 0 1 1 0 8 0
semupl 112 4 0 4 1 1 0 1 0 8 0
semapl 72 92 0 68 1 0 1 1 0 8 0
shmpl 112 9 0 2 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 2234 0 641 100 0 100 100 0 8 0
ffsino 296 2234 0 641 123 0 123 123 0 8 0
nchpl 144 2952 0 1041 71 0 71 71 0 8 0
vnodes 216 2971 0 0 166 0 166 166 0 8 0
namei 1024 16315 0 16314 3 2 1 2 0 8 0
percpumem 16 104 0 53 1 0 1 1 0 8 0
pfiaddrpl 120 2 0 1 1 0 1 1 0 8 0
kstatmem 264 133 0 104 3 0 3 3 0 8 0
scxspl 216 12403 0 12402 4 3 1 3 1 8 0
plimitpl 152 99 0 87 1 0 1 1 0 8 0
sigapl 424 1423 0 1367 9 0 9 9 0 8 0
knotepl 120 136 0 0 5 0 5 5 0 8 0
kqueuepl 224 119 0 116 1 0 1 1 0 8 0
pipepl 344 312 0 285 3 0 3 3 0 8 0
fdescpl 528 1385 0 1366 3 0 3 3 0 8 0
filepl 160 6081 0 5908 16 5 11 15 0 8 0
lockfpl 104 421 0 421 2 1 1 1 0 8 1
lockfspl 48 195 0 195 2 1 1 1 0 8 1
sessionpl 144 91 0 86 1 0 1 1 0 8 0
pgrppl 48 147 0 134 1 0 1 1 0 8 0
ucredpl 104 410 0 402 1 0 1 1 0 8 0
zombiepl 144 1369 0 1367 1 0 1 1 0 8 0
processpl 1232 1423 0 1367 6 0 6 6 0 8 0
procpl 664 2122 0 2058 8 0 8 8 0 8 0
sosppl 176 2 0 2 1 1 0 1 0 8 0
sockpl 752 1611 0 1603 21 16 5 17 0 8 3
mcl64k 65536 3 0 0 1 0 1 1 0 8 0
mcl16k 16384 4 0 0 1 0 1 1 0 8 0
mcl8k 8192 3 0 0 1 0 1 1 0 8 0
mcl4k 4096 124 0 0 16 0 16 16 0 8 0
mcl2k 2048 23 0 0 3 0 3 3 0 8 0
mextrefs 64 28 0 0 1 0 1 1 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 210 0 0 13 0 13 13 0 8 0
bufpl 272 4057 0 106 264 0 264 264 0 8 0
anonpl 32 6088 0 0 49 0 49 49 0 222 0
amapchunkpl 152 28591 0 28290 27 9 18 25 0 158 3
amappl16 200 2857 0 2846 18 6 12 14 0 8 8
amappl15 192 6 0 5 1 0 1 1 0 8 0
amappl14 184 989 0 988 1 0 1 1 0 8 0
amappl13 176 219 0 214 1 0 1 1 0 8 0
amappl12 168 1915 0 1898 2 0 2 2 0 8 0
amappl11 160 9 0 9 3 3 0 1 0 8 0
amappl10 152 69 0 62 1 0 1 1 0 8 0
amappl9 144 287 0 287 1 1 0 1 0 8 0
amappl8 136 292 0 289 1 0 1 1 0 8 0
amappl7 128 259 0 253 1 0 1 1 0 8 0
amappl6 120 621 0 618 1 0 1 1 0 8 0
amappl5 112 105 0 100 1 0 1 1 0 8 0
amappl4 104 460 0 449 1 0 1 1 0 8 0
amappl3 96 5374 0 5319 4 1 3 4 0 8 0
amappl2 88 1340 0 1303 2 0 2 2 0 8 0
amappl1 80 18023 0 17820 16 4 12 16 0 8 0
amappl 88 8583 0 8481 5 0 5 5 0 92 0
uvmvnodes 80 103 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 11 0 2 1 0 1 1 0 8 0
uaddrrnd 24 1385 0 1366 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1385 0 1366 1 0 1 1 0 8 0
vmmpekpl 168 13217 0 13174 3 0 3 3 0 8 0
vmmpepl 168 97845 0 96972 93 21 72 91 0 357 8
vmsppl 488 1384 0 1366 5 0 5 5 0 8 0
rwobjpl 80 29546 0 28985 26 3 23 26 0 8 0
pdppl 4096 2778 0 2732 178 128 50 88 0 8 4
pvpl 32 12100 0 0 99 1 98 98 0 265 0
pmappl 256 1384 0 1366 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 120 636 0 142 16 0 16 16 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}>
Struck through repros no longer work on HEAD.