syzbot


assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c

Status: upstream: reported on 2024/05/14 12:38
Reported-by: syzbot+abc8d93c32e45bd3984f@syzkaller.appspotmail.com
First crash: 191d, last: 7d02h

Sample crash report:
login: panic: malloc: allocation too large, type = 2, size = 1768304430
Starting stack trace...
panic(ffffffff830396cc) at panic+0x1d0 sys/kern/subr_prf.c:229
malloc(69662f2e,2,2) at malloc+0xcf4 sys/kern/kern_malloc.c:330
bpf_allocbufs(ffff8000013dc400) at bpf_allocbufs+0x85 sys/net/bpf.c:1667
bpf_setif(ffff8000013dc400,ffff80002a140b00) at bpf_setif+0x22a sys/net/bpf.c:1209
bpfioctl(51700,8020426c,ffff80002a140b00,2,ffff800029fe6a58) at bpfioctl+0xc42 sys/net/bpf.c:956
VOP_IOCTL(fffffd807abc89a0,8020426c,ffff80002a140b00,2,fffffd807f7d3478,ffff800029fe6a58) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806b760570,8020426c,ffff80002a140b00,ffff800029fe6a58) at vn_ioctl+0xf6 sys/kern/vfs_vnops.c:525
sys_ioctl(ffff800029fe6a58,ffff80002a140ce0,ffff80002a140c30) at sys_ioctl+0x67c
syscall(ffff80002a140ce0) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline]
syscall(ffff80002a140ce0) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6042b4011d0, count: 247
End of stack trace.
syncing disks...panic: kernel diagnostic assertion "rw_write_held(uobj->vmobjlock)" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uvm_vnode.c", line 610
Starting stack trace...
panic(ffffffff830f52aa) at panic+0x1d0 sys/kern/subr_prf.c:229
__assert(ffffffff830a87dc,ffffffff82fe6b3e,262,ffffffff83025db4) at __assert+0x29
uvn_flush(fffffd806cf16980,0,0,31) at uvn_flush+0xdfd sys/uvm/uvm_vnode.c:753
uvm_vnp_sync(ffff800000b66000) at uvm_vnp_sync+0x1e7 sys/uvm/uvm_vnode.c:1541
sys_sync(ffff800029fe6a58,0,0) at sys_sync+0xd4 sys/kern/vfs_syscalls.c:536
vfs_syncwait(ffff800029fe6a58,1) at vfs_syncwait+0x44
vfs_shutdown(ffff800029fe6a58) at vfs_shutdown+0x97 sys/kern/vfs_subr.c:1793
boot(100) at boot+0x15c sys/arch/amd64/amd64/machdep.c:907
reboot(100) at reboot+0xb1
panic(ffffffff830396cc) at panic+0x1f9 sys/kern/subr_prf.c:231
malloc(69662f2e,2,2) at malloc+0xcf4 sys/kern/kern_malloc.c:330
bpf_allocbufs(ffff8000013dc400) at bpf_allocbufs+0x85 sys/net/bpf.c:1667
bpf_setif(ffff8000013dc400,ffff80002a140b00) at bpf_setif+0x22a sys/net/bpf.c:1209
bpfioctl(51700,8020426c,ffff80002a140b00,2,ffff800029fe6a58) at bpfioctl+0xc42 sys/net/bpf.c:956
VOP_IOCTL(fffffd807abc89a0,8020426c,ffff80002a140b00,2,fffffd807f7d3478,ffff800029fe6a58) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806b760570,8020426c,ffff80002a140b00,ffff800029fe6a58) at vn_ioctl+0xf6 sys/kern/vfs_vnops.c:525
sys_ioctl(ffff800029fe6a58,ffff80002a140ce0,ffff80002a140c30) at sys_ioctl+0x67c
syscall(ffff80002a140ce0) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:178 [inline]
syscall(ffff80002a140ce0) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6042b4011d0, count: 238
End of stack trace.

dump to dev 4,1 not possible
rebooting...
SeaBIOS (version 1.8.2-google)
Total RAM Size = 0x0000000080000000 = 2048 MiB
CPUs found: 2     Max CPUs supported: 2
SeaBIOS (version 1.8.2-google)
Machine UUID 8f385a59-d101-44dd-592e-0bd3fdfaf750
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f27c0: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Sending Seabios boot VM event.
Booting from Hard Disk 0...
>> OpenBSD/amd64 BOOT 3.67
boot> set $lines = 0
set: syntax error
boot> set $maxwidth = 0
set: syntax error
boot> show panic
boot: illegal argument panic
boot> trace
boot> show registers
boot> show proc
boot> ps
boot> show all locks
boot> show malloc
boot> show all pools
boot> machine ddbcpu 0
machine: syntax error
boot> trace
boot> machine ddbcpu 1
machine: syntax error
boot> trace

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/14 16:12 openbsd e7951f0f6b15 77f3eeb7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/11/14 07:11 openbsd 22062e2afa72 a8c99394 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/11/13 14:01 openbsd 81e7fdf6c2d5 4dfba277 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/10/21 10:49 openbsd e432ca3c48ac cd6fc0a3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/10/21 04:42 openbsd e432ca3c48ac cd6fc0a3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/10/21 04:18 openbsd e432ca3c48ac cd6fc0a3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/10/07 00:36 openbsd e1668dfc1242 d7906eff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/09/29 11:41 openbsd b3a69e4eefa8 ba29ff75 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/07/30 06:42 openbsd 235013eb5537 a4e01e1e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/07/12 17:32 openbsd e24fbf55691f eaeb5c15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
2024/05/14 12:37 openbsd 5dea098c4cfa fdb4c10c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
* Struck through repros no longer work on HEAD.