syzbot


uvm_fault: km_free (2)

Status: auto-obsoleted due to no activity on 2024/11/09 02:06
Reported-by: syzbot+bcfb7e93c9db34608a33@syzkaller.appspotmail.com
First crash: 370d, last: 123d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: km_free 6 883d 1071d 0/3 auto-obsoleted due to no activity on 2022/10/10 22:33

Sample crash report:
uvm_fault(0xfffffd806c25b168, 0x0, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      km_free+0x191:  movq    $0,0(%rax)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*459121  39871      0   0x8000000  0x4000000    0  syz-executor
km_free(0,1000,ffffffff832374a0,ffffffff832374b8) at km_free+0x191 sys/uvm/uvm_km.c:870
pool_p_free(ffffffff834f1d10,fffffd805c1a1f90) at pool_p_free+0x1ba sys/kern/subr_pool.c:1012
pool_reclaim(ffffffff834f1d10) at pool_reclaim+0x2a6 sys/kern/subr_pool.c:1151
pool_reclaim_all() at pool_reclaim_all+0x48
kern_sysctl_locked(ffff80002a5af224,1,0,ffff80002a5af258,20001440,4,5542b643c7322394) at kern_sysctl_locked+0x15f9 sys/kern/kern_sysctl.c:728
kern_sysctl(ffff80002a5af224,1,0,ffff80002a5af258,20001440,4,dde1a5747b7dec56) at kern_sysctl+0x9b2 sys/kern/kern_sysctl.c:577
sys_sysctl(ffff800037623460,ffff80002a5af390,ffff80002a5af2e0) at sys_sysctl+0x41f
syscall(ffff80002a5af390) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a724d5a2b0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd806c25b168, 0x0, 0, 2) -> e
ddb> trace
km_free(0,1000,ffffffff832374a0,ffffffff832374b8) at km_free+0x191 sys/uvm/uvm_km.c:870
pool_p_free(ffffffff834f1d10,fffffd805c1a1f90) at pool_p_free+0x1ba sys/kern/subr_pool.c:1012
pool_reclaim(ffffffff834f1d10) at pool_reclaim+0x2a6 sys/kern/subr_pool.c:1151
pool_reclaim_all() at pool_reclaim_all+0x48
kern_sysctl_locked(ffff80002a5af224,1,0,ffff80002a5af258,20001440,4,5542b643c7322394) at kern_sysctl_locked+0x15f9 sys/kern/kern_sysctl.c:728
kern_sysctl(ffff80002a5af224,1,0,ffff80002a5af258,20001440,4,dde1a5747b7dec56) at kern_sysctl+0x9b2 sys/kern/kern_sysctl.c:577
sys_sysctl(ffff800037623460,ffff80002a5af390,ffff80002a5af2e0) at sys_sysctl+0x41f
syscall(ffff80002a5af390) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a724d5a2b0, count: -9
ddb> show registers
rdi               0xffff800030df0000
rsi                          0x103b6    __ALIGN_SIZE+0xf3b6
rbp               0xffff80002a5aee80
rbx               0xffffffff832374a0    kv_page
rdx               0xffff800030df0000
rcx                          0x103b5    __ALIGN_SIZE+0xf3b5
rax                                0
r8                                 0
r9                                 0
r10               0x18ed376943c55a38
r11               0xc6376a61cd4de7a3
r12                           0x1000    __ALIGN_SIZE
r13                                0
r14                           0x1000    __ALIGN_SIZE
r15                    0x28000000000
rip               0xffffffff81bfcde1    km_free+0x191
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a5aee10
ss                              0x10
km_free+0x191:  movq    $0,0(%rax)
ddb> show proc
PROC (syz-executor) tid=459121 pid=39871 tcnt=2 stat=onproc
    flags process=8000000<PIN> proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800037622020,0xffff800037622f60
    process=0xffff80002a4e2010 user=0xffff80002a5aa000, vmspace=0xfffffd806c25b168
    estcpu=8, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 98540  178507  23308      0  2   0x8000000                syz-executor
 98540  434025  23308      0  3   0xc000080  fsleep        syz-executor
  5431  320084  89204      0  2   0x8000000                syz-executor
  5431  367770  89204      0  3   0xc000080  fsleep        syz-executor
 39871   51558  38561      0  2   0x8000000                syz-executor
*39871  459121  38561      0  7   0xc000000                syz-executor
 72778  513030      0      0  3     0x14200  acct          acct
 34183  349402      1      0  3  0x18000082  nanoslp       getty
 49396  485853  24204      0  3   0x8000080  nanoslp       syz-executor
 49396  521242  24204      0  3   0xc000000  smrbar        syz-executor
 49396  247979  24204      0  3   0xc000080  fsleep        syz-executor
 59157  171018  64632      0  3   0x8000002  clonelk       syz-executor
 30978  464287  64632      0  3   0x8000082  piperd        syz-executor
 62417   17990  64632      0  3   0x8000082  piperd        syz-executor
 27564  234293  64632      0  2   0x8000482                syz-executor
 38561  159363  64632      0  2   0x8000482                syz-executor
 23308   83642  64632      0  2   0x8000482                syz-executor
 24204  512530  64632      0  3   0x8000082  nanoslp       syz-executor
 89204   44956  64632      0  2   0x8000482                syz-executor
 36415  436587      0      0  3     0x14200  bored         sosplice
 64632   75493  34596      0  2   0x8000002                syz-executor
 34596  142685  18537      0  3   0x810008a  sigsusp       ksh
 18537   90844  21413      0  3  0x18000098  kqread        sshd-session
 21413  197815  62918      0  3  0x18000092  kqread        sshd-session
 62918   94309      1      0  3  0x18000088  kqread        sshd
 69187  158775  12648     73  3  0x19100090  kqread        syslogd
 12648  402432      1      0  3  0x18100082  sbwait        syslogd
 73881  447343      1      0  3  0x18100080  kqread        resolvd
  6641  346341  36070     77  3  0x18100092  kqread        dhcpleased
 46356  501576  36070     77  3  0x18100092  kqread        dhcpleased
 36070  272311      1      0  3  0x18000080  kqread        dhcpleased
  5326  222153      0      0  3     0x14200  bored         smr
 47308  247328      0      0  2     0x14200                zerothread
 36548  445312      0      0  3     0x14200  aiodoned      aiodoned
 62759   94592      0      0  3     0x14200  syncer        update
 17035   33798      0      0  3     0x14200  cleaner       cleaner
 65317  132801      0      0  3     0x14200  reaper        reaper
 45310   38276      0      0  3     0x14200  pgdaemon      pagedaemon
 19670  516848      0      0  3     0x14200  bored         viomb
 82510  148047      0      0  3  0x40014200  acpi0         acpi0
 34476  257560      0      0  3     0x14200  bored         softnet3
 48110  305262      0      0  3     0x14200  bored         softnet2
 60475   69394      0      0  3     0x14200  bored         softnet1
 14138  115381      0      0  2     0x14200                softnet0
 91391  107164      0      0  3     0x14200  bored         systqmp
 23366   63190      0      0  3     0x14200  bored         systq
 56906  136972      0      0  3  0x40014200  tmoslp        softclock
 37575  343722      0      0  3  0x40014200                idle0
     1   56034      0      0  3   0x8000082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10187  10232K   10546K 166960K     12709        0
            pcb    17     16K      18K 166960K       401        0
         rtable   191      8K      10K 166960K      1234        0
             pf    36     14K      16K 166960K       137        0
         ifaddr    39      6K       8K 166960K       166        0
        ifgroup    55      2K       2K 166960K       211        0
         sysctl     3      0K       1K 166960K         7        0
       counters    31     17K      18K 166960K        71        0
       ioctlops     0      0K       4K 166960K       258        0
            iov     0      0K      16K 166960K       152        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1461     92K      92K 166960K      2692        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K      13K 166960K        24        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       188        0
        dirhash    12      2K       2K 166960K        30        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    15     53K      93K 166960K      1160        0
          sigio     0      0K       0K 166960K        14        0
           proc    59     59K     116K 166960K      1213        0
        subproc   104      6K       6K 166960K       429        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       126        0
       in_multi    78      5K       7K 166960K       399        0
    ether_multi     1      0K       0K 166960K         3        0
            mrt     1      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     0      0K       1K 166960K       779        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   211     76K      92K 166960K     10828        0
       UVM aobj    79      3K       3K 166960K        81        0
     pinsyscall    36     72K      96K 166960K      2809        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        46        0
            NDP    12      0K       2K 166960K       118        0
           temp    74   6812K    6880K 166960K     48685        0
         kqueue    13     20K      32K 166960K       172        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      321    0      318     3     2     1     3     0     8    0
rtentry    112      400    0      317     4     1     3     4     0     8    0
unpcb      144     1383    0     1366     6     4     2     6     0     8    0
syncache   336        9    0        9     1     1     0     1     0     8    0
tcpqe       32        1    0        1     1     1     0     1     0     8    0
tcpcb      808      516    0      511    14    13     1    14     0     8    0
arp         88       70    0       54     1     0     1     1     0     8    0
ipq         40        4    0        4     1     1     0     1     0     8    0
ipqe        40        5    0        5     1     1     0     1     0     8    0
inpcb      336     1693    0     1684    21    19     2    21     0     8    0
nd6        104      105    0       87     1     0     1     1     0     8    0
pkpcb       40       12    0       12     1     1     0     1     0     8    0
kcovpl      48       33    0       25     1     0     1     1     0     8    0
ppxss      1072       5    0        5     1     1     0     1     0     8    0
pfstscr     40        3    0        3     1     1     0     1     0     8    0
pfosfp      40        1    0        0     1     0     1     1     0     8    0
pfosfpen   112        1    0        0     1     0     1     1     0     8    0
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pftag       88        5    0        2     1     0     1     1     0     8    0
pfstitem    24        4    0        0     1     0     1     1     0     8    0
pfstkey    128        7    0        3     1     0     1     1     0     8    0
pfstate    344        4    0        2     1     0     1     1     0     8    0
pfrule     1344      27    0       25     1     0     1     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256     1586    0     1226    31     2    29    30     0     8    0
art_table   32     1588    0     1226     4     0     4     4     0     8    0
art_node    16      397    0      324     1     0     1     1     0     8    0
sysvmsgpl   40       14    0        9     1     0     1     1     0     8    0
semapl     112      184    0      174     1     0     1     1     0     8    0
shmpl      112       78    0        2     3     0     3     3     0     8    0
dirhash    1024      29    0       12     3     0     3     3     0     8    0
dino2pl    256     3085    0     1546    97     0    97    97     0     8    0
ffsino     240     3085    0     1546    91     0    91    91     0     8    0
nchpl      144     4282    0     2577    64     0    64    64     0     8    0
uvmvnodes   80     4166    0        0    86     0    86    86     0     8    0
vnodes     216     4166    0        0   232     0   232   232     0     8    0
namei      1024   18823    0    18823     2     2     0     2     0     8    0
vcpupl     3904       9    0        1     1     0     1     1     0     8    0
vmpool     664       10    0        2     1     0     1     1     0     8    0
kstatmem   264      104    0       80     3     1     2     3     0     8    0
scsiplug    72        2    0        2     1     1     0     1     0     8    0
scxspl     216    23790    0    23790     8     7     1     8     1     8    1
plimitpl   152      220    0      202     1     0     1     1     0     8    0
sigapl     424     1392    0     1347     6     0     6     6     0     8    0
futexpl     64    15532    0    15529     1     0     1     1     0     8    0
knotepl    120    26421    0    26374    10     7     3    10     0     8    0
kqueuepl   184      395    0      382     4     3     1     4     0     8    0
pipepl     288      303    0      275     5     2     3     5     0     8    0
fdescpl    432     1373    0     1346     5     1     4     5     0     8    0
filepl     120    11430    0    11177    16     7     9    16     0     8    0
lockfpl    104      415    0      412     2     1     1     2     0     8    0
lockfspl    48      182    0      179     1     0     1     1     0     8    0
sessionpl  144       47    0       40     1     0     1     1     0     8    0
pgrppl      48       93    0       78     1     0     1     1     0     8    0
ucredpl    104     1286    0     1275     1     0     1     1     0     8    0
zombiepl   144     1348    0     1347     1     0     1     1     0     8    0
processpl  1088    1392    0     1347     4     0     4     4     0     8    0
procpl     648     2443    0     2393     6     1     5     6     0     8    0
sosppl     168        5    0        5     1     1     0     1     0     8    0
sockpl     504     3417    0     3388    78    73     5    33     0     8    0
mcl64k     65536     14    0       14     1     1     0     1     0     8    0
mcl16k     16384      4    0        4     1     1     0     1     0     8    0
mcl12k     12288      1    0        1     1     1     0     1     0     8    0
mcl8k      8192      29    0       29     1     1     0     1     0     8    0
mcl4k      4096       5    0        5     1     1     0     1     0     8    0
mcl2k2     2112       3    0        3     1     1     0     1     0     8    0
mcl2k      2048    7513    0     7399    26    11    15    26     0     8    0
mtagpl      96       23    0       20     1     0     1     1     0     8    0
mbufpl     256    17623    0    17407    35    20    15    35     0     8    0
bufpl      280     7341    0     1096   447     0   447   447     0     8    0
anonpl      24   256859    0   253716    58     5    53    58     0   187   27
amapchunkpl 152   36266    0    35844    38     0    38    38     0   158   21
amappl16   200     5596    0     5572    20     8    12    15     0     8    8
amappl15   192       14    0       14     1     0     1     1     0     8    1
amappl14   184      154    0      144     1     0     1     1     0     8    0
amappl13   176        8    0        8     1     0     1     1     0     8    1
amappl12   168     2411    0     2384     2     0     2     2     0     8    0
amappl11   160       48    0       38     1     0     1     1     0     8    0
amappl10   152        9    0        9     1     0     1     1     0     8    1
amappl9    144      128    0      128     1     0     1     1     0     8    1
amappl8    136       15    0       14     1     0     1     1     0     8    0
amappl7    128      148    0      138     1     0     1     1     0     8    0
amappl6    120      407    0      406     1     0     1     1     0     8    0
amappl5    112      226    0      216     1     0     1     1     0     8    0
amappl4    104      362    0      347     1     0     1     1     0     8    0
amappl3     96     7044    0     6946     4     0     4     4     0     8    0
amappl2     88      941    0      884     2     0     2     2     0     8    0
amappl1     80    12095    0    11562    14     0    14    14     0     8    2
amappl      88    10242    0    10092     5     0     5     5     0    92    0
dma32768   32768      1    0        1     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       80    0        2     2     0     2     2     0     8    0
uaddrrnd    24     1383    0     1348     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1383    0     1348     1     0     1     1     0     8    0
vmmpekpl   168    12605    0    12556     3     0     3     3     0     8    0
vmmpepl    168    91062    0    89404    92     0    92    92     0   357   15
vmsppl     344     1382    0     1348     4     0     4     4     0     8    0
rwobjpl     24    32276    0    27192    31     0    31    31     0     8    0
pdppl      4096    2772    0     2704   130    60    70    80     0     8    2
pvpl        32   697142    0   687950   224     0   224   224     0   265  137
pmappl     216     1382    0     1348     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      548    0      207    13     0    13    13     0     8    1
ddb> machine ddbcpu 0
No such command
ddb> trace
km_free(0,1000,ffffffff832374a0,ffffffff832374b8) at km_free+0x191 sys/uvm/uvm_km.c:870
pool_p_free(ffffffff834f1d10,fffffd805c1a1f90) at pool_p_free+0x1ba sys/kern/subr_pool.c:1012
pool_reclaim(ffffffff834f1d10) at pool_reclaim+0x2a6 sys/kern/subr_pool.c:1151
pool_reclaim_all() at pool_reclaim_all+0x48
kern_sysctl_locked(ffff80002a5af224,1,0,ffff80002a5af258,20001440,4,5542b643c7322394) at kern_sysctl_locked+0x15f9 sys/kern/kern_sysctl.c:728
kern_sysctl(ffff80002a5af224,1,0,ffff80002a5af258,20001440,4,dde1a5747b7dec56) at kern_sysctl+0x9b2 sys/kern/kern_sysctl.c:577
sys_sysctl(ffff800037623460,ffff80002a5af390,ffff80002a5af2e0) at sys_sysctl+0x41f
syscall(ffff80002a5af390) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a724d5a2b0, count: -9
ddb> machine ddbcpu 1
No such command
ddb> trace
km_free(0,1000,ffffffff832374a0,ffffffff832374b8) at km_free+0x191 sys/uvm/uvm_km.c:870
pool_p_free(ffffffff834f1d10,fffffd805c1a1f90) at pool_p_free+0x1ba sys/kern/subr_pool.c:1012
pool_reclaim(ffffffff834f1d10) at pool_reclaim+0x2a6 sys/kern/subr_pool.c:1151
pool_reclaim_all() at pool_reclaim_all+0x48
kern_sysctl_locked(ffff80002a5af224,1,0,ffff80002a5af258,20001440,4,5542b643c7322394) at kern_sysctl_locked+0x15f9 sys/kern/kern_sysctl.c:728
kern_sysctl(ffff80002a5af224,1,0,ffff80002a5af258,20001440,4,dde1a5747b7dec56) at kern_sysctl+0x9b2 sys/kern/kern_sysctl.c:577
sys_sysctl(ffff800037623460,ffff80002a5af390,ffff80002a5af2e0) at sys_sysctl+0x41f
syscall(ffff80002a5af390) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a724d5a2b0, count: -9

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/11 02:06 openbsd 6d453ff9e2fb 6f4edef4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: km_free
2024/05/28 06:27 openbsd 98f39564523a f550015e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/05/21 13:23 openbsd 6fb00c133d1f 4c0d3ee3 .config console log report ci-openbsd-multicore uvm_fault: km_free
2024/05/06 19:57 openbsd 27da0d9a6e0d d884b519 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/04/12 18:57 openbsd 474ea8ba1797 c8349e48 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: km_free
2024/04/08 15:24 openbsd e16d075e3f83 7591ebb5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/03/31 19:59 openbsd 2ee472d028ec 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/03/17 14:56 openbsd d108608d837e 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: km_free
2024/01/22 04:33 openbsd 83cbdf3a02e6 9bd8dcda .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: km_free
2023/12/07 19:27 openbsd 0d0a919f69d9 28b24332 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
* Struck through repros no longer work on HEAD.