syzbot


uvm_fault: ufs_symlink

Status: upstream: reported on 2024/05/21 13:45
Reported-by: syzbot+ca7c8e61d26701e9a126@syzkaller.appspotmail.com
First crash: 31d, last: 31d

Sample crash report:
uvm_fault(0xfffffd8069084d80, 0x18, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      ufs_symlink+0xa2:       movq    0x18(%rbx),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*177924  64706      0   0x8000000  0x4000000    0  syz-executor.4
ufs_symlink(ffff8000329b3b10) at ufs_symlink+0xa2 sys/ufs/ufs/ufs_vnops.c:1304
VOP_SYMLINK(fffffd80776197d8,ffff8000329b3c90,ffff8000329b3cc0,ffff8000329b3bc0,ffff80002a676000) at VOP_SYMLINK+0xd7 sys/kern/vfs_vops.c:432
dosymlinkat(ffff80002a678cf0,20000040,9,20000340) at dosymlinkat+0x158 sys/kern/vfs_syscalls.c:1810
syscall(ffff8000329b3e40) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xbd5504fb090, count: 10
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd8069084d80, 0x18, 0, 1) -> e
ddb> trace
ufs_symlink(ffff8000329b3b10) at ufs_symlink+0xa2 sys/ufs/ufs/ufs_vnops.c:1304
VOP_SYMLINK(fffffd80776197d8,ffff8000329b3c90,ffff8000329b3cc0,ffff8000329b3bc0,ffff80002a676000) at VOP_SYMLINK+0xd7 sys/kern/vfs_vops.c:432
dosymlinkat(ffff80002a678cf0,20000040,9,20000340) at dosymlinkat+0x158 sys/kern/vfs_syscalls.c:1810
syscall(ffff8000329b3e40) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xbd5504fb090, count: -5
ddb> show registers
rdi               0xffff80002a676000
rsi                            0xd2a
rbp               0xffff8000329b3b00
rbx                                0
rdx                              0x7
rcx               0xffcf9a939699d0d1
rax                              0x7
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xf180eaa840c72b8f
r11               0x565d5687a3f0aa30
r12                              0x7
r13               0xfffffd8077619898
r14               0xffff8000329b3c90
r15               0xffff8000329b3b10
rip               0xffffffff81838802    ufs_symlink+0xa2
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000329b3ab0
ss                                 0
ufs_symlink+0xa2:       movq    0x18(%rbx),%r14
ddb> show proc
PROC (syz-executor.4) tid=177924 pid=64706 tcnt=3 stat=onproc
    flags process=8000000 proc=4000000<THREAD>
    runpri=17, usrpri=85, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002d5242c0,0xffff80002a679740
    process=0xffff800035c8f2c8 user=0xffff8000329ae000, vmspace=0xfffffd8069084d80
    estcpu=35, cpticks=3, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 67148  160599  50272      0  2   0x8000000                syz-executor.3
 67148  229379  50272      0  3   0xc000080  ttyout        syz-executor.3
 62371   94373  44939      0  2   0x8000000                syz-executor.6
 62371  220562  44939      0  3   0xc000080  fsleep        syz-executor.6
  1039   36826  31046      0  2   0x8000000                syz-executor.0
  1039  169439  31046      0  2   0xc000000                syz-executor.0
 75811  516679  46640      0  3   0x8000080  nanoslp       syz-executor.5
 75811  484668  46640      0  3   0xc000080  kqpoll        syz-executor.5
 75811  379320  46640      0  3   0xc000080  fsleep        syz-executor.5
 64706  520815  27069      0  2   0x8000000                syz-executor.4
*64706  177924  27069      0  7   0xc000000                syz-executor.4
 64706   18520  27069      0  3   0xc000080  fsleep        syz-executor.4
 27069  281291  52867      0  3   0x8000082  nanoslp       syz-executor.4
 46640  288579  52867      0  3   0x8000082  nanoslp       syz-executor.5
 99857  399748  52867      0  2   0x8000482                syz-executor.2
 50272  399437  52867      0  3   0x8000082  nanoslp       syz-executor.3
 31046  109664  52867      0  3   0x8000082  nanoslp       syz-executor.0
 81787  326285  52867      0  2   0x8000482                syz-executor.7
 44939  107949  52867      0  3   0x8000082  nanoslp       syz-executor.6
 68371  387417      0      0  3     0x14200  acct          acct
 47923  340179  24788      0  3  0x18100082  netio         ndp
 24788   75828      1      0  3   0x810008a  sigsusp       sh
 27665  196372      0      0  3     0x14280  nfsidl        nfsio
 92475   43279      0      0  3     0x14280  nfsidl        nfsio
 73007  371201      0      0  3     0x14280  nfsidl        nfsio
  9766  308868      0      0  3     0x14280  nfsidl        nfsio
 93523  447553      0      0  3     0x14280  nfsidl        nfsio
 92498  140372      0      0  3     0x14280  nfsidl        nfsio
 51042  426192      0      0  3     0x14280  nfsidl        nfsio
 56011  367798      0      0  3     0x14280  nfsidl        nfsio
 91931  468018      0      0  3     0x14280  nfsidl        nfsio
 37907  447349      0      0  3     0x14280  nfsidl        nfsio
 63203  205328      0      0  3     0x14280  nfsidl        nfsio
  7121   62287      0      0  3     0x14280  nfsidl        nfsio
 26204  279063      0      0  3     0x14280  nfsidl        nfsio
 45100  235472      0      0  3     0x14280  nfsidl        nfsio
 33986  169607      0      0  3     0x14280  nfsidl        nfsio
  8798  305580      0      0  3     0x14280  nfsidl        nfsio
 45339  232146      0      0  3     0x14280  nfsidl        nfsio
 50450  260711      0      0  3     0x14280  nfsidl        nfsio
 66711  187880      0      0  3     0x14280  nfsidl        nfsio
 32912  364412      0      0  3     0x14280  nfsidl        nfsio
  4192  102918      1      0  3  0x18100083  ttyin         getty
 13830  105392      0      0  3     0x14200  bored         sosplice
 52867  371629   7000      0  3  0x1a000082  thrsleep      syz-fuzzer
 52867  401809   7000      0  3  0x1e000082  thrsleep      syz-fuzzer
 52867  421417   7000      0  3  0x1e000082  thrsleep      syz-fuzzer
 52867  477202   7000      0  3  0x1e000082  wait          syz-fuzzer
 52867   15697   7000      0  3  0x1e000082  wait          syz-fuzzer
 52867   37067   7000      0  3  0x1e000082  kqread        syz-fuzzer
 52867   31621   7000      0  3  0x1e000082  wait          syz-fuzzer
 52867  465040   7000      0  3  0x1e000082  wait          syz-fuzzer
 52867  183890   7000      0  3  0x1e000082  wait          syz-fuzzer
 52867  189130   7000      0  3  0x1e000082  wait          syz-fuzzer
 52867  105110   7000      0  3  0x1e000082  thrsleep      syz-fuzzer
 52867   83419   7000      0  3  0x1e000082  thrsleep      syz-fuzzer
 52867   38266   7000      0  3  0x1e000082  wait          syz-fuzzer
 52867  288358   7000      0  3  0x1e000082  wait          syz-fuzzer
  7000  137107  65870      0  3   0x810008a  sigsusp       ksh
 65870  137858  25305      0  3  0x1800009a  kqread        sshd
 25305  323096      1      0  3  0x18000088  kqread        sshd
 49534  341857   4968     73  2  0x19100010                syslogd
  4968  315422      1      0  3  0x18100082  sbwait        syslogd
 23588  394402      1      0  3  0x18100080  kqread        resolvd
 60788  264494   3038     77  3  0x18100092  kqread        dhcpleased
 33429   65804   3038     77  3  0x18100092  kqread        dhcpleased
  3038  434465      1      0  3  0x18000080  kqread        dhcpleased
  9605  292443      0      0  3     0x14200  bored         smr
 41986  202323      0      0  2     0x14200                zerothread
 19676  250367      0      0  3     0x14200  aiodoned      aiodoned
 50335  506059      0      0  3     0x14200  syncer        update
 65980  173001      0      0  3     0x14200  cleaner       cleaner
 81134  449790      0      0  3     0x14200  reaper        reaper
 14413  391106      0      0  3     0x14200  pgdaemon      pagedaemon
 62841  390302      0      0  3     0x14200  bored         viomb
 76753  286426      0      0  3  0x40014200  acpi0         acpi0
 96024  366888      0      0  3     0x14200  bored         softnet3
 25226  290089      0      0  3     0x14200  bored         softnet2
 72323  419219      0      0  3     0x14200  bored         softnet1
 25567  315166      0      0  2     0x14200                softnet0
   923   82240      0      0  3     0x14200  bored         systqmp
 67458  280894      0      0  3     0x14200  bored         systq
 11427     391      0      0  2  0x40014200                softclock
 35881  138996      0      0  3  0x40014200                idle0
     1  203547      0      0  3   0x8000082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10204   6683K   10571K 166960K     14265        0
            pcb    17     16K      18K 166960K       231        0
         rtable   218      8K       9K 166960K      1960        0
             pf    33      9K      10K 166960K       160        0
         ifaddr    44     12K      12K 166960K       258        0
        ifgroup    58      2K       2K 166960K       291        0
         sysctl     3      0K       0K 166960K         3        0
       counters    32     17K      17K 166960K        91        0
       ioctlops     0      0K       2K 166960K       171        0
            iov     0      0K      18K 166960K        91        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1417     89K      89K 166960K      3282        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        27        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      1K       1K 166960K        53        0
        dirhash    12      2K       2K 166960K        51        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    17     61K     101K 166960K      2009        0
          sigio     1      0K       0K 166960K        28        0
           proc    58     59K     116K 166960K      1857        0
        subproc   117      7K       8K 166960K       793        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       224        0
       in_multi    98      7K       7K 166960K       642        0
    ether_multi     1      0K       0K 166960K        16        0
            mrt     1      0K       0K 166960K         3        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    85    387K     387K 166960K        85        0
           exec     0      0K       1K 166960K      1211        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   285     97K     116K 166960K     17343        0
       UVM aobj    56      7K       7K 166960K        61        0
     pinsyscall    38     76K     102K 166960K      4393        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K        71        0
            NDP    13      0K       2K 166960K       180        0
           temp    77   6812K    6940K 166960K     94537        0
         kqueue    13     20K      26K 166960K       183        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      272    0      267     1     0     1     1     0     8    0
rtentry    112      696    0      599     4     0     4     4     0     8    1
unpcb      144      981    0      966     2     1     1     2     0     8    0
syncache   336        9    0        9     2     1     1     1     0     8    1
sackhl      24        2    0        2     1     0     1     1     0     8    1
tcpqe       32        5    0        5     1     0     1     1     0     8    1
tcpcb      808      451    0      445     6     4     2     5     0     8    1
arp         88      134    0      117     1     0     1     1     0     8    0
ipq         40        6    0        6     1     0     1     1     0     8    1
ipqe        40       97    0       97     1     0     1     1     0     8    1
inpcb      352     1792    0     1777    15    12     3    13     0     8    1
nd6        104      174    0      149     1     0     1     1     0     8    0
pkpcb       40       13    0       13     2     1     1     1     0     8    1
kcovpl      48       61    0       52     1     0     1     1     0     8    0
ppxss      1072       6    0        6     2     1     1     1     0     8    1
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256     2706    0     2250    56    27    29    30     0     8    0
art_table   32     2708    0     2250     4     0     4     4     0     8    0
art_node    16      689    0      602     1     0     1     1     0     8    0
sysvmsgpl   40        9    0        4     1     0     1     1     0     8    0
semupl     112        4    0        4     1     1     0     1     0     8    0
semapl     112       40    0       30     1     0     1     1     0     8    0
shmpl      112       58    0        5     2     0     2     2     0     8    0
dirhash    1024      43    0       26     3     0     3     3     0     8    0
dino2pl    256     3932    0     2415    96     0    96    96     0     8    0
ffsino     240     3932    0     2415    90     0    90    90     0     8    0
nchpl      144     6356    0     4623    67     0    67    67     0     8    0
uvmvnodes   80     5574    0        0   114     0   114   114     0     8    0
vnodes     216     5574    0        0   310     0   310   310     0     8    0
vnodes: pool(0xffffffff82d3acb8:vnodes): page inconsistency: page 0x0; at page head addr 0xfffffd80684f5f90 (p 0xfffffd80684f5000)
namei      1024   26746    0    26745     4     2     2     3     0     8    1
vcpupl     3904       5    0        1     1     0     1     1     0     8    0
vmpool     664       16    0       12     1     0     1     1     0     8    0
kstatmem   264      144    0      118     2     0     2     2     0     8    0
scsiplug    72        5    0        5     2     1     1     1     0     8    1
scxspl     216    43641    0    43641     9     7     2     8     1     8    2
plimitpl   152      303    0      287     1     0     1     1     0     8    0
sigapl     424     2228    0     2160     9     0     9     9     0     8    0
futexpl     64    25650    0    25647     1     0     1     1     0     8    0
knotepl    120     9541    0     9459    22    10    12    15     0     8    8
kqueuepl   184      398    0      387     1     0     1     1     0     8    0
pipepl     288      517    0      487     5     0     5     5     0     8    2
fdescpl    432     2189    0     2161     5     0     5     5     0     8    0
filepl     120    13111    0    12836    15     5    10    14     0     8    1
lockfpl    104      504    0      501     1     0     1     1     0     8    0
lockfspl    48      226    0      223     1     0     1     1     0     8    0
sessionpl  144       70    0       53     1     0     1     1     0     8    0
pgrppl      48       84    0       67     1     0     1     1     0     8    0
ucredpl    104     1747    0     1737     1     0     1     1     0     8    0
zombiepl   144     2163    0     2160     1     0     1     1     0     8    0
processpl  1080    2228    0     2160     6     0     6     6     0     8    0
procpl     656     3740    0     3652     9     0     9     9     0     8    1
sosppl     168        5    0        5     2     1     1     1     0     8    1
sockpl     504     3075    0     3043    24    17     7    20     0     8    2
mcl64k     65536     12    0       12     2     1     1     1     0     8    1
mcl16k     16384      1    0        1     1     0     1     1     0     8    1
mcl12k     12288      4    0        4     2     1     1     1     0     8    1
mcl8k      8192      48    0       48     2     1     1     1     0     8    1
mcl4k      4096      10    0       10     1     0     1     1     0     8    1
mcl2k      2048   27705    0    27609    46    25    21    38     0     8    8
mtagpl      96       49    0       46     1     0     1     1     0     8    0
mbufpl     256    69167    0    68943   115    93    22    63     0     8    1
bufpl      280    11212    0     3088   581     0   581   581     0     8    0
anonpl      24   419046    0   412901   113    46    67    95     0   188    4
amapchunkpl 152   57827    0    57183    59    21    38    49     0   158   10
amappl16   200     9533    0     9385    39    18    21    21     0     8    9
amappl15   192       12    0       11     1     0     1     1     0     8    0
amappl14   184      302    0      289     2     1     1     2     0     8    0
amappl13   176        6    0        6     1     1     0     1     0     8    0
amappl12   168     3512    0     3483     2     0     2     2     0     8    0
amappl11   160       53    0       43     1     0     1     1     0     8    0
amappl10   152      100    0       90     1     0     1     1     0     8    0
amappl9    144      143    0      142     1     0     1     1     0     8    0
amappl8    136      169    0      139     2     0     2     2     0     8    0
amappl7    128       76    0       62     1     0     1     1     0     8    0
amappl6    120      927    0      912     2     1     1     2     0     8    0
amappl5    112      348    0      336     1     0     1     1     0     8    0
amappl4    104      847    0      815     3     1     2     2     0     8    1
amappl3     96    11031    0    10952     3     0     3     3     0     8    0
amappl2     88     2833    0     2757     3     1     2     3     0     8    0
amappl1     80    18226    0    17711    25    11    14    22     0     8    1
amappl      88    16367    0    16177     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       60    0        5     1     0     1     1     0     8    0
uaddrrnd    24     2205    0     2173     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2205    0     2173     1     0     1     1     0     8    0
vmmpekpl   168    20521    0    20463     3     0     3     3     0     8    0
vmmpepl    168   166680    0   164797   134    27   107   112     0   357   12
vmsppl     344     2204    0     2173     4     0     4     4     0     8    0
rwobjpl     24    50302    0    43547    43     0    43    43     0     8    0
pdppl      4096    4416    0     4350   275   204    71    87     0     8    5
pvpl        32  1060062    0  1047470   416   240   176   359     0   265   37
pmappl     216     2204    0     2173     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      733    0      377    12     0    12    12     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
ufs_symlink(ffff8000329b3b10) at ufs_symlink+0xa2 sys/ufs/ufs/ufs_vnops.c:1304
VOP_SYMLINK(fffffd80776197d8,ffff8000329b3c90,ffff8000329b3cc0,ffff8000329b3bc0,ffff80002a676000) at VOP_SYMLINK+0xd7 sys/kern/vfs_vops.c:432
dosymlinkat(ffff80002a678cf0,20000040,9,20000340) at dosymlinkat+0x158 sys/kern/vfs_syscalls.c:1810
syscall(ffff8000329b3e40) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xbd5504fb090, count: -5
ddb> machine ddbcpu 1
No such command
ddb> trace
ufs_symlink(ffff8000329b3b10) at ufs_symlink+0xa2 sys/ufs/ufs/ufs_vnops.c:1304
VOP_SYMLINK(fffffd80776197d8,ffff8000329b3c90,ffff8000329b3cc0,ffff8000329b3bc0,ffff80002a676000) at VOP_SYMLINK+0xd7 sys/kern/vfs_vops.c:432
dosymlinkat(ffff80002a678cf0,20000040,9,20000340) at dosymlinkat+0x158 sys/kern/vfs_syscalls.c:1810
syscall(ffff8000329b3e40) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xbd5504fb090, count: -5

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/21 13:44 openbsd d0fe8eba4c8c 4c0d3ee3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_symlink
* Struck through repros no longer work on HEAD.