syzbot


assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c

Status: upstream: reported on 2024/05/14 12:38
Reported-by: syzbot+abc8d93c32e45bd3984f@syzkaller.appspotmail.com
First crash: 34d, last: 34d

Sample crash report:
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock
Starting stack trace...
panic(ffffffff828edd2b) at panic+0x16f sys/kern/subr_prf.c:229
witness_checkorder(ffffffff82d8d7c8,9,0) at witness_checkorder+0xd03 witness_debugger sys/kern/subr_witness.c:2524 [inline]
witness_checkorder(ffffffff82d8d7c8,9,0) at witness_checkorder+0xd03 sys/kern/subr_witness.c:786
__mp_lock(ffffffff82d8d5c0) at __mp_lock+0xa2 read_rflags machine/cpufunc.h:195 [inline]
__mp_lock(ffffffff82d8d5c0) at __mp_lock+0xa2 intr_disable machine/cpufunc.h:216 [inline]
__mp_lock(ffffffff82d8d5c0) at __mp_lock+0xa2 sys/kern/kern_lock.c:142
intr_handler(ffff80002a27e0f0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:539
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
Xspllower() at Xspllower+0x1d
mtx_enter_try(ffffffff82dfa950) at mtx_enter_try+0x103
mtx_enter(ffffffff82dfa950) at mtx_enter+0x4e sys/kern/kern_lock.c:266
pool_get(ffffffff82dfa950,9) at pool_get+0xc4 sys/kern/subr_pool.c:579
uvmspace_alloc(0,1000,1,0) at uvmspace_alloc+0x41 sys/uvm/uvm_map.c:3279
vm_impl_init(ffff80002ef31050,ffff8000ffff14b8) at vm_impl_init+0x92 sys/arch/amd64/amd64/vmm_machdep.c:1244
vm_create(ffff800000e4dc00,ffff8000ffff14b8) at vm_create+0x13e sys/dev/vmm/vmm.c:388
vmmioctl(a00,c2585601,ffff800000e4dc00,1,ffff8000ffff14b8) at vmmioctl+0x2de
VOP_IOCTL(fffffd807cf8e7a0,c2585601,ffff800000e4dc00,1,fffffd807f7d38f0,ffff8000ffff14b8) at VOP_IOCTL+0x9a sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806a1295f8,c2585601,ffff800000e4dc00,ffff8000ffff14b8) at vn_ioctl+0xc0 sys/kern/vfs_vnops.c:525
sys_ioctl(ffff8000ffff14b8,ffff80002a27e8b0,ffff80002a27e800) at sys_ioctl+0x4a9
syscall(ffff80002a27e8b0) at syscall+0x8cf mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002a27e8b0) at syscall+0x8cf sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x651dedbee30, count: 239
End of stack trace.
syncing disks...panic: kernel diagnostic assertion "rw_write_held(uobj->vmobjlock)" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uvm_vnode.c", line 609
Starting stack trace...
panic(ffffffff8295e173) at panic+0x16f sys/kern/subr_prf.c:229
__assert(ffffffff82912ef3,ffffffff82852674,261,ffffffff82890ba6) at __assert+0x29 sys/kern/subr_prf.c:157
uvn_flush(fffffd807e7da070,0,0,31) at uvn_flush+0x9b4 sys/uvm/uvm_vnode.c:752
uvm_vnp_sync(ffff8000006cec00) at uvm_vnp_sync+0x16e sys/uvm/uvm_vnode.c:1540
sys_sync(ffff8000ffff14b8,0,0) at sys_sync+0x9b sys/kern/vfs_syscalls.c:535
vfs_syncwait(ffff8000ffff14b8,1) at vfs_syncwait+0x3b
vfs_shutdown(ffff8000ffff14b8) at vfs_shutdown+0x61 sys/kern/vfs_subr.c:1791
boot(100) at boot+0xe9 sys/arch/amd64/amd64/machdep.c:900
reboot(100) at reboot+0x84
panic(ffffffff828edd2b) at panic+0x18f sys/kern/subr_prf.c:231
witness_checkorder(ffffffff82d8d7c8,9,0) at witness_checkorder+0xd03 witness_debugger sys/kern/subr_witness.c:2524 [inline]
witness_checkorder(ffffffff82d8d7c8,9,0) at witness_checkorder+0xd03 sys/kern/subr_witness.c:786
__mp_lock(ffffffff82d8d5c0) at __mp_lock+0xa2 read_rflags machine/cpufunc.h:195 [inline]
__mp_lock(ffffffff82d8d5c0) at __mp_lock+0xa2 intr_disable machine/cpufunc.h:216 [inline]
__mp_lock(ffffffff82d8d5c0) at __mp_lock+0xa2 sys/kern/kern_lock.c:142
intr_handler(ffff80002a27e0f0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:539
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
Xspllower() at Xspllower+0x1d
mtx_enter_try(ffffffff82dfa950) at mtx_enter_try+0x103
mtx_enter(ffffffff82dfa950) at mtx_enter+0x4e sys/kern/kern_lock.c:266
pool_get(ffffffff82dfa950,9) at pool_get+0xc4 sys/kern/subr_pool.c:579
uvmspace_alloc(0,1000,1,0) at uvmspace_alloc+0x41 sys/uvm/uvm_map.c:3279
vm_impl_init(ffff80002ef31050,ffff8000ffff14b8) at vm_impl_init+0x92 sys/arch/amd64/amd64/vmm_machdep.c:1244
vm_create(ffff800000e4dc00,ffff8000ffff14b8) at vm_create+0x13e sys/dev/vmm/vmm.c:388
vmmioctl(a00,c2585601,ffff800000e4dc00,1,ffff8000ffff14b8) at vmmioctl+0x2de
VOP_IOCTL(fffffd807cf8e7a0,c2585601,ffff800000e4dc00,1,fffffd807f7d38f0,ffff8000ffff14b8) at VOP_IOCTL+0x9a sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806a1295f8,c2585601,ffff800000e4dc00,ffff8000ffff14b8) at vn_ioctl+0xc0 sys/kern/vfs_vnops.c:525
sys_ioctl(ffff8000ffff14b8,ffff80002a27e8b0,ffff80002a27e800) at sys_ioctl+0x4a9
syscall(ffff80002a27e8b0) at syscall+0x8cf mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002a27e8b0) at syscall+0x8cf sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x651dedbee30, count: 230
End of stack trace.

dump to dev 4,1 not possible
rebooting...
SeaBIOS (version 1.8.2-google)
Total RAM Size = 0x0000000080000000 = 2048 MiB
CPUs found: 2     Max CPUs supported: 2
SeaBIOS (version 1.8.2-google)
Machine UUID 8f385a59-d101-44dd-592e-0bd3fdfaf750
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f27f0: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Sending Seabios boot VM event.
Booting from Hard Disk 0...
>> OpenBSD/amd64 BOOT 3.65
boot> set $maxwidth = 0
set: syntax error
boot> show panic
boot: illegal argument panic
boot> trace
boot> show registers
boot> show proc
boot> ps
boot> show all locks
boot> show malloc
boot> show all pools
boot> machine ddbcpu 0
machine: syntax error
boot> trace
boot> machine ddbcpu 1
machine: syntax error
boot> trace

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/14 12:37 openbsd 5dea098c4cfa fdb4c10c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
* Struck through repros no longer work on HEAD.