syzbot


kernel: protection fault trap, code=NUM (5)

Status: closed as dup on 2022/08/29 15:02
Reported-by: syzbot+bf39e70d1ce19c1c751b@syzkaller.appspotmail.com
First crash: 606d, last: 605d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
panic: tcp_output C 762 604d 606d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd kernel: protection fault trap, code=NUM (3) 1 765d 765d 0/3 closed as invalid on 2022/03/22 11:48
openbsd kernel: protection fault trap, code=NUM (2) C 16 847d 870d 0/3 closed as invalid on 2021/12/31 06:19
openbsd kernel: protection fault trap, code=NUM 1 950d 950d 0/3 closed as invalid on 2021/09/18 05:58
openbsd kernel: protection fault trap, code=NUM (4) 1 728d 728d 0/3 closed as invalid on 2022/04/28 06:52
openbsd kernel: protection fault trap, code=NUM (6) 40 7d09h 531d 0/3 upstream: reported on 2022/11/10 22:10

Sample crash report:
exclusive kernel: protection fault trap, code=0
Faulted in DDB; continuing...
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10227   6622K    7081K  78643K     38295        0
            pcb    13     22K      26K  78643K      1591        0
         rtable   226     17K      18K  78643K      2789        0
         ifaddr    91     21K      23K  78643K      1066        0
         sysctl     3      1K       1K  78643K         7        0
       counters    54     35K      36K  78643K       604        0
       ioctlops     0      0K       4K  78643K      4968        0
            iov     0      0K      24K  78643K      1527        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1382     86K      87K  78643K      9719        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       9K  78643K       115        0
         VM map     2      1K       1K  78643K         2        0
            sem    11      1K       1K  78643K        20        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    14     49K      89K  78643K     16126        0
          sigio     0      0K       0K  78643K       137        0
           proc    71     91K     116K  78643K      2720        0
        subproc   104      6K       6K  78643K       810        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K     27318        0
       in_multi    92      6K       7K  78643K      1270        0
    ether_multi     1      0K       0K  78643K       188        0
            mrt     1      0K       0K  78643K        76        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   211    943K     943K  78643K       211        0
           exec     0      0K       2K  78643K      3512        0
     pfkey data     0      0K       0K  78643K         7        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      62K  78643K         8        0
       UVM amap   625   1602K    1602K  78643K     98377        0
       UVM aobj   131      4K       4K  78643K       132        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K       920        0
            NDP    13      0K       2K  78643K       349        0
           temp   133   4726K   70262K  78643K    163061        0
         kqueue    12     18K      26K  78643K      1085        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120      673    0      670     8     5     3     3     0     8    2
rtentry    112      942    0      848     4     1     3     4     0     8    0
unpcb      144     7443    0     7423    83    74     9    10     0     8    8
syncache   296       67    0       67    21    20     1     1     0     8    1
tcpqe       32       66    0       66    11    11     0     1     0     8    0
tcpcb      768    15621    0    15575   333   326     7    24     0     8    2
arp        120      135    0      119     1     0     1     1     0     8    0
inpcb      368    22882    0    22870   237   229     8    19     0     8    6
nd6         48      227    0      204     1     0     1     1     0     8    0
pkpcb       40      101    0      101    13    13     0     1     0     8    0
kcovpl      48       62    0       54     1     0     1     1     0     8    0
ppxss      1256     185    0      185    24    24     0     1     0     8    0
pffrag     232       59    0       59     5     5     0     1     0   482    0
pffrnode    88       59    0       59     5     5     0     1     0     8    0
pffrent     40      368    0      368    11    11     0     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pftag       88        2    0        0     1     0     1     1     0     8    0
pfstitem    24      415    0      393     1     0     1     1     0     8    0
pfstkey    120      415    0      393     2     1     1     2     0     8    0
pfstate    336      415    0      393     8     5     3     3     0     8    0
pfrule     1360      60    0       52     2     1     1     2     0     8    0
rttmr      136       15    0       15     4     4     0     1     0     8    0
art_heap8  4096       5    0        4     3     2     1     3     0     8    0
art_heap4  256     4582    0     4145    52    24    28    31     0     8    0
art_table   32     4587    0     4149     4     0     4     4     0     8    0
art_node    16      936    0      855     1     0     1     1     0     8    0
sysvmsgpl   40       15    0       10     1     0     1     1     0     8    0
semupl     112        4    0        4     1     1     0     1     0     8    0
semapl     112       13    0        4     1     0     1     1     0     8    0
shmpl      112      129    0        1     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256    23914    0    22425    94     0    94    94     0     8    0
ffsino     272    23914    0    22425   100     0   100   100     0     8    0
nchpl      144    45045    0    43403    63     0    63    63     0     8    0
rtmask      32       10    0       10     5     5     0     1     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024  158405    0   158405     6     5     1     2     0     8    1
percpumem   16      314    0      275     1     0     1     1     0     8    0
vcpupl     2048     409    0        0    52     0    52    52     0     8    0
vmpool     568      445    0       36    31     1    30    30     0     8    0
kstatmem   264      390    0      364    16    14     2     3     0     8    0
scsiplug    72        7    0        7     2     2     0     1     0     8    0
scxspl     216   137918    0   137918    42    39     3     8     0     8    3
plimitpl   152     2494    0     2478     1     0     1     1     0     8    0
sigapl     424    16345    0    16277    10     2     8     8     0     8    0
futexpl     64   143342    0   143341     4     3     1     1     0     8    0
knotepl    120     1078    0        0    14     1    13    14     0     8    0
kqueuepl   216     2933    0     2925    43    38     5     5     0     8    4
pipepl     320     4003    0     3975   117   114     3    13     0     8    0
fdescpl    496    16303    0    16276     7     3     4     5     0     8    0
filepl     152   110929    0   110680   198   180    18    20     0     8    6
lockfpl    104    12867    0    12865    30    28     2     5     0     8    1
lockfspl    48     2828    0     2826     1     0     1     1     0     8    0
sessionpl  144       79    0       62     1     0     1     1     0     8    0
pgrppl      48     1085    0     1068     1     0     1     1     0     8    0
ucredpl    104    13812    0    13800     1     0     1     1     0     8    0
zombiepl   144    16279    0    16277     2     1     1     1     0     8    0
processpl  1064   16345    0    16277     5     0     5     5     0     8    0
procpl     672    47579    0    47490    21    12     9    10     0     8    0
srpgc       96       70    0       70    21    21     0     1     0     8    0
sosppl     168      104    0      104    21    20     1     1     0     8    1
sockpl     488    31131    0    31096   466   453    13    34     0     8    6
mcl64k     65536     25    0        0     4     1     3     3     0     8    0
mcl16k     16384     30    0        0     4     2     2     3     0     8    0
mcl12k     12288     41    0        0     3     1     2     2     0     8    0
mcl9k      9216      25    0        0     2     0     2     2     0     8    0
mcl8k      8192      34    0        0     4     1     3     3     0     8    0
mcl4k      4096      34    0        0     3     0     3     3     0     8    0
mcl2k2     2112       8    0        0     1     0     1     1     0     8    0
mcl2k      2048     607    0        0    63    30    33    63     0     8    0
mtagpl      96     1087    0        0    26     1    25    26     0     8    0
mbufpl     256     1489    0        0    81     1    80    80     0     8    0
bufpl      288    29789    0    23459   453     0   453   453     0     8    0
anonpl      24  3220473    0  3198502   331   182   149   156     0   186    3
amapchunkpl 152  281660    0   280862    77    40    37    44     0   158    0
amappl16   200    43184    0    42332   173   121    52    60     0     8    1
amappl15   192     4009    0     4002     1     0     1     1     0     8    0
amappl14   184     1207    0     1204     1     0     1     1     0     8    0
amappl13   176     1925    0     1921     1     0     1     1     0     8    0
amappl12   168     2032    0     2025     1     0     1     1     0     8    0
amappl11   160     2074    0     2053     4     3     1     2     0     8    0
amappl10   152     1558    0     1550     1     0     1     1     0     8    0
amappl9    144     4003    0     3997     1     0     1     1     0     8    0
amappl8    136     2680    0     2516     6     0     6     6     0     8    0
amappl7    128     1107    0     1079     1     0     1     1     0     8    0
amappl6    120     4120    0     4100     2     1     1     2     0     8    0
amappl5    112    14350    0    14326     1     0     1     1     0     8    0
amappl4    104     5491    0     5446     2     0     2     2     0     8    0
amappl3     96    52268    0    52218     2     0     2     2     0     8    0
amappl2     88     3371    0     3332     3     2     1     2     0     8    0
amappl1     80   406323    0   405684    29    13    16    20     0     8    0
amappl      88    96455    0    96177     9     2     7     7     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      131    0        1     3     0     3     3     0     8    0
uaddrrnd    24    16748    0    16311     3     0     3     3     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    16748    0    16311     3     0     3     3     0     8    0
vmmpekpl   168   123930    0   123813     6     0     6     6     0     8    0
vmmpepl    168  1611002    0  1607278   413   228   185   208     0   357    5
vmsppl     368    16747    0    16311    43     2    41    41     0     8    0
rwobjpl     56   398261    0   390113   138    20   118   120     0     8    0
pdppl      4096   33503    0    33031  1240   762   478   480     0     8    6
pvpl        32  6411288    0  6388809   622   410   212   258     0   265    8
pmappl     248    16747    0    16311    30     2    28    28     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     2479    0     1091    40     0    40    40     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8257e290) at panic+0x177 sys/kern/subr_prf.c:198
tcp_output(ffff800000e180c8) at tcp_output+0x2cd2 sys/netinet/tcp_output.c:727
tcp_send(fffffd806904ad60,fffffd806c6b1b00,0,fffffd80684a1100) at tcp_send+0xc4 sys/netinet/tcp_usrreq.c:953
sosend(fffffd806904ad60,0,ffff8000296044a0,0,fffffd80684a1100,0) at sosend+0x62a pru_send sys/sys/protosw.h:331 [inline]
sosend(fffffd806904ad60,0,ffff8000296044a0,0,fffffd80684a1100,0) at sosend+0x62a sys/kern/uipc_socket.c:646
sendit(ffff800021312a90,5,ffff800029604620,0,ffff800029604710) at sendit+0x65d sys/kern/uipc_syscalls.c:694
sys_sendmsg(ffff800021312a90,ffff8000296046c8,ffff800029604710) at sys_sendmsg+0x198 sys/kern/uipc_syscalls.c:601
syscall(ffff800029604790) at syscall+0x4c3 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff800029604790) at syscall+0x4c3 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xdc46a39f370, count: -9
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffff800020dd8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x28 sys/arch/amd64/amd64/bus_space.c:651
comcnputc(800,20) at comcnputc+0x97 sys/dev/ic/com.c:1259
cnputc(20) at cnputc+0x4b sys/dev/cons.c:218
db_putchar(61) at db_putchar+0x316 db_force_whitespace sys/ddb/db_output.c:102 [inline]
db_putchar(61) at db_putchar+0x316 sys/ddb/db_output.c:153
kprintf() at kprintf+0x20ec sys/kern/subr_prf.c:1064
db_printf(ffffffff82621226) at db_printf+0x85 sys/kern/subr_prf.c:498
panic(ffffffff825a713f) at panic+0xd7 sys/kern/subr_prf.c:216
__assert(ffffffff8261a24c,ffffffff826270b5,9b6,ffffffff825d55cf) at __assert+0x25 sys/kern/subr_prf.c:157
uvm_map_teardown(fffffd8067693cf0) at uvm_map_teardown+0x2e8 sys/uvm/uvm_map.c:2488
uvmspace_free(fffffd8067693cf0) at uvmspace_free+0xa6 sys/uvm/uvm_map.c:3436
reaper(ffff800021233268) at reaper+0x19a sys/kern/kern_exit.c:448
end trace frame: 0x0, count: 1
ddb{1}> trace
x86_ipi_db(ffff800020dd8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x28 sys/arch/amd64/amd64/bus_space.c:651
comcnputc(800,20) at comcnputc+0x97 sys/dev/ic/com.c:1259
cnputc(20) at cnputc+0x4b sys/dev/cons.c:218
db_putchar(61) at db_putchar+0x316 db_force_whitespace sys/ddb/db_output.c:102 [inline]
db_putchar(61) at db_putchar+0x316 sys/ddb/db_output.c:153
kprintf() at kprintf+0x20ec sys/kern/subr_prf.c:1064
db_printf(ffffffff82621226) at db_printf+0x85 sys/kern/subr_prf.c:498
panic(ffffffff825a713f) at panic+0xd7 sys/kern/subr_prf.c:216
__assert(ffffffff8261a24c,ffffffff826270b5,9b6,ffffffff825d55cf) at __assert+0x25 sys/kern/subr_prf.c:157
uvm_map_teardown(fffffd8067693cf0) at uvm_map_teardown+0x2e8 sys/uvm/uvm_map.c:2488
uvmspace_free(fffffd8067693cf0) at uvmspace_free+0xa6 sys/uvm/uvm_map.c:3436
reaper(ffff800021233268) at reaper+0x19a sys/kern/kern_exit.c:448
end trace frame: 0x0, count: -14

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/08/28 21:55 openbsd 8ffe6ae0af63 07177916 .config console log report ci-openbsd-multicore kernel: protection fault trap, code=NUM
2022/08/28 07:11 openbsd 293c01dc0e68 07177916 .config console log report ci-openbsd-setuid kernel: protection fault trap, code=NUM
* Struck through repros no longer work on HEAD.