syzbot


uvm_fault: witness_checkorder (5)

Status: upstream: reported on 2024/03/25 02:45
Reported-by: syzbot+a7fc47685a6a4310195e@syzkaller.appspotmail.com
First crash: 33d, last: 8d09h
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: witness_checkorder (3) C 212 228d 481d 0/3 auto-obsoleted due to no activity on 2023/11/01 12:30
openbsd uvm_fault: witness_checkorder (2) 1 1620d 1620d 0/3 auto-closed as invalid on 2020/02/18 09:16
openbsd uvm_fault: witness_checkorder syz 2 1651d 1651d 3/3 fixed on 2019/10/22 13:03
openbsd uvm_fault: witness_checkorder (4) 1 155d 155d 0/3 auto-obsoleted due to no activity on 2024/02/21 18:24

Sample crash report:
uvm_fault(0xfffffd80765341d0, 0x28, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      witness_checkorder+0x8e:        movl    0x18(%r14),%r15d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*103172  12885      0   0x8000000  0x4000000    1K syz-executor.5
 226107  21861      0     0x14000      0x200    0  reaper
witness_checkorder(10,9,0) at witness_checkorder+0x8e sys/kern/subr_witness.c:773
rw_enter(0,1) at rw_enter+0xd1
uvm_vnp_terminate(fffffd805fc58200) at uvm_vnp_terminate+0x29 sys/uvm/uvm_vnode.c:428
vclean(fffffd805fc58200,8,ffff8000359787e8) at vclean+0x10a sys/kern/vfs_subr.c:1063
vgonel(fffffd805fc58200,ffff8000359787e8) at vgonel+0x7f sys/kern/vfs_subr.c:1175
checkalias(fffffd805f6b5b58,800,0) at checkalias+0x159
cdevvp(800,ffffffff82d9e370) at cdevvp+0x9c getdevvp sys/kern/vfs_subr.c:533 [inline]
cdevvp(800,ffffffff82d9e370) at cdevvp+0x9c sys/kern/vfs_subr.c:507
cnopen(0,1,2000,ffff8000359787e8) at cnopen+0xd3 sys/dev/cons.c:78
spec_open(ffff80003493a028) at spec_open+0x220 sys/kern/spec_vnops.c:150
VOP_OPEN(fffffd8065176b00,1,fffffd807f7d3888,ffff8000359787e8) at VOP_OPEN+0x79 sys/kern/vfs_vops.c:138
vn_open(ffff80003493a278,1,0) at vn_open+0x4e4 sys/kern/vfs_vnops.c:177
doopenat(ffff8000359787e8,ffffff9c,20000080,0,0,ffff80003493a420) at doopenat+0x269 sys/kern/vfs_syscalls.c:1126
syscall(ffff80003493a4d0) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80003493a4d0) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9b45f527f40, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/19 06:24 openbsd 78aef4a0e2ce af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2024/03/25 02:45 openbsd b9739e4cfaf4 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
* Struck through repros no longer work on HEAD.