syzbot


uvm_faultn(ADDR, 0x40b, 0, 1l) -> e

Status: closed as dup on 2019/11/16 13:22
Reported-by: syzbot+d81d0cd422d2a7e1fda0@syzkaller.appspotmail.com
First crash: 1832d, last: 1832d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
uvm_fault: in_delmulti syz 375431 1570d 1856d

Sample crash report:
uvm_faultn(0xfffffd803f011e330, 0x40b, 0, 1l) -> e
: page fault trap, code=0
Stopped at      in_delmulti+0x8d:       movl    0xc(%r14),%r15d
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xfffffd803f011330, 0x40b, 0, 1) -> e
in_delmulti(3ff) at in_delmulti+0x8d sys/netinet/in.c:894
end trace frame: 0xffff800015962ff0, count: 0
ddb> trace
in_delmulti(3ff) at in_delmulti+0x8d sys/netinet/in.c:894
in_purgeaddr(ffff800000a81900) at in_purgeaddr+0x156 sys/netinet/in.c:740
in_ifdetach(ffff800000a3b800) at in_ifdetach+0x74 sys/netinet/in.c:949
if_detach(ffff800000a3b800) at if_detach+0x140 sys/net/if.c:1151
tun_clone_destroy(ffff800000a3b800) at tun_clone_destroy+0x1c0 sys/net/if_tun.c:278
spec_close(ffff800015963170) at spec_close+0x311 sys/kern/spec_vnops.c:555
VOP_CLOSE(fffffd80360af8f0,7,fffffd803f7c6c60,ffff80001491b160) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:175
vn_closefile(fffffd8036202f08,ffff80001491b160) at vn_closefile+0xd3 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd8036202f08,ffff80001491b160) at vn_closefile+0xd3 sys/kern/vfs_vnops.c:610
fdrop(fffffd8036202f08,ffff80001491b160) at fdrop+0xc2 sys/kern/kern_descrip.c:1273
closef(fffffd8036202f08,ffff80001491b160) at closef+0x118 sys/kern/kern_descrip.c:1257
fdfree(ffff80001491b160) at fdfree+0x100 sys/kern/kern_descrip.c:1189
exit1(ffff80001491b160,19,1) at exit1+0x32f sys/kern/kern_exit.c:196
postsig(ffff80001491b160,19) at postsig+0x4a6 sigexit sys/kern/kern_sig.c:1499 [inline]
postsig(ffff80001491b160,19) at postsig+0x4a6 sys/kern/kern_sig.c:1431
userret(ffff80001491b160) at userret+0x159 sys/kern/kern_sig.c:1889
syscall(ffff8000159635f0) at syscall+0x42e mi_syscall_return sys/sys/syscall_mi.h:115 [inline]
syscall(ffff8000159635f0) at syscall+0x42e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff4d70, count: -16
ddb> show registers
rdi                              0x2
rsi                                0
rbp               0xffff800015962fa0
rbx                                0
rdx                              0x3
rcx                              0x1
rax                                0
r8                0xffff800000a81900
r9                               0x5
r10               0x893f090ecd00f23d
r11               0x96662fb1233ef8d7
r12                                0
r13                              0x3
r14                            0x3ff
r15                              0x1
rip               0xffffffff81cef26d    in_delmulti+0x8d
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800015962f40
ss                              0x10
in_delmulti+0x8d:       movl    0xc(%r14),%r15d
ddb> show proc
PROC (syz-executor.1) pid=197740 stat=onproc
    flags process=a<EXEC,EXITING> proc=2000<WEXIT>
    pri=17, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff80001491a290,0xffff80001491aef8
    process=0xffff8000ffff6d90 user=0xffff80001595e000, vmspace=0xfffffd803f011330
    estcpu=36, cpticks=2, pctcpu=0.0
    user=0, sys=0, intr=1
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 73373  115306  53182      0  3        0x82  nanosleep     syz-executor.0
 93089  316753      0      0  3     0x14200  acct          acct
 63819  444933      0      0  3     0x14200  bored         sosplice
 53182  253238  92091      0  3        0x82  thrsleep      syz-fuzzer
 53182  432086  92091      0  3   0x4000082  nanosleep     syz-fuzzer
 53182  167771  92091      0  2   0x4000082                syz-fuzzer
 53182  155571  92091      0  3   0x4000082  thrsleep      syz-fuzzer
 53182  236695  92091      0  3   0x4000082  thrsleep      syz-fuzzer
 53182  410456  92091      0  3   0x4000082  thrsleep      syz-fuzzer
 53182  386273  92091      0  3   0x4000082  thrsleep      syz-fuzzer
 53182  196483  92091      0  3   0x4000082  thrsleep      syz-fuzzer
 92091  504235  65716      0  3    0x10008a  pause         ksh
 65716  258844  23469      0  3        0x92  select        sshd
 90477  461172      1      0  3    0x100083  ttyin         getty
 23469  274393      1      0  3        0x80  select        sshd
 86525   59914  94882     73  3    0x100090  kqread        syslogd
 94882  408197      1      0  3    0x100082  netio         syslogd
 37196   21324      0      0  2     0x14200                zerothread
  8447  479385      0      0  3     0x14200  aiodoned      aiodoned
 52135  343011      0      0  3     0x14200  syncer        update
 73473  493078      0      0  3     0x14200  cleaner       cleaner
  8991  328540      0      0  3     0x14200  reaper        reaper
 11211  174227      0      0  3     0x14200  pgdaemon      pagedaemon
  1717  172927      0      0  3     0x14200  bored         crynlk
 49407  348024      0      0  3     0x14200  bored         crypto
 53736  366899      0      0  3  0x40014200  acpi0         acpi0
 96970  162535      0      0  2     0x14200                softnet
 10576  421723      0      0  2     0x14200                systqmp
 43662  176885      0      0  3     0x14200  bored         systq
 86231  502697      0      0  3  0x40014200  bored         softclock
 44533  373835      0      0  3  0x40014200                idle0
  8925  514650      0      0  3     0x14200  bored         smr
     1  140364      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9523   6310K    6974K  78643K     12670        0        0
            pcb    13      8K       9K  78643K       225        0        0
         rtable   106      4K       4K  78643K       525        0        0
         ifaddr   103     17K      19K  78643K       227        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K      1159        0        0
            iov     0      0K      28K  78643K       737        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1215     76K      77K  78643K      1942        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        26        0        0
         VM map     6      1K       1K  78643K        10        0        0
            sem    12      0K       0K  78643K       941        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1794    195K     288K  78643K     12646        0        0
      file desc     4      9K      25K  78643K      1577        0        0
          sigio     0      0K       0K  78643K        77        0        0
           proc    44     30K      54K  78643K       679        0        0
        subproc    23      1K       2K  78643K       136        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       112        0        0
       in_multi    71      3K       4K  78643K       182        0        0
    ether_multi     1      0K       0K  78643K         9        0        0
            mrt     0      0K       0K  78643K         2        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys   108    477K     477K  78643K       108        0        0
           exec     0      0K       1K  78643K       377        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   126     56K      60K  78643K      5227        0        0
       UVM aobj   103      7K       7K  78643K       104        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       176        0        0
            NDP    14      0K       0K  78643K        54        0        0
           temp   142   3535K    3601K  78643K     67700        0        0
         kqueue     0      0K       0K  78643K        10        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       24    0       19     1     0     1     1     0     8    0
rtpcb       80      145    0      145     3     2     1     1     0     8    1
rtentry    112      123    0       82     2     0     2     2     0     8    0
unpcb      120     1811    0     1805     1     0     1     1     0     8    0
syncache   264       10    0       10     4     3     1     1     0     8    1
tcpqe       32      290    0      290     2     2     0     1     0     8    0
tcpcb      544     1076    0     1072     5     4     1     2     0     8    0
ipq         40        8    0        8     5     5     0     1     0     8    0
ipqe        40      278    0      278     5     5     0     1     0     8    0
inpcb      280     1843    0     1838     8     6     2     2     0     8    0
rttmr       72        1    0        0     1     0     1     1     0     8    0
nd6         48       18    0       15     2     1     1     1     0     8    0
pkpcb       40        2    0        2     1     1     0     1     0     8    0
swfcl       56        2    0        0     1     0     1     1     0     8    0
ppxss      1128       9    0        9     6     5     1     1     0     8    1
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      566    0      336    19     3    16    16     0     8    0
art_table   32      568    0      336     3     0     3     3     0     8    0
art_node    16      122    0       80     1     0     1     1     0     8    0
sysvmsgpl   40       46    0       27     1     0     1     1     0     8    0
semupl     112        4    0        4     1     1     0     1     0     8    0
semapl     112      939    0      929     1     0     1     1     0     8    0
shmpl      112      102    0        1     3     0     3     3     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     4052    0     2657    46     0    46    46     0     8    0
ffsino     240     4052    0     2657    83     0    83    83     0     8    0
nchpl      144     7777    0     7333    60    40    20    60     0     8    0
uvmvnodes   72     4665    0        0    85     0    85    85     0     8    0
vnodes     208     4665    0        0   246     0   246   246     0     8    0
namei      1024   21614    0    21614     2     1     1     1     0     8    1
vcpupl     1984       4    0        0     1     0     1     1     0     8    0
vmpool     520        8    0        4     2     1     1     1     0     8    0
scxspl     192    27876    0    27876    12    10     2     7     0     8    2
plimitpl   152       92    0       86     1     0     1     1     0     8    0
sigapl     432     1729    0     1719     2     0     2     2     0     8    0
futexpl     56    50804    0    50804     2     1     1     1     0     8    1
knotepl    112      762    0      743     1     0     1     1     0     8    0
kqueuepl   104     1710    0     1708     1     0     1     1     0     8    0
pipepl     128     1958    0     1940     6     4     2     2     0     8    1
fdescpl    424     1730    0     1719     2     0     2     2     0     8    0
filepl     120    17366    0    17292     8     4     4     5     0     8    1
lockfpl    104     3347    0     3347     1     0     1     1     0     8    1
lockfspl    48      862    0      862     1     0     1     1     0     8    1
sessionpl  112       23    0       15     1     0     1     1     0     8    0
pgrppl      48       31    0       23     1     0     1     1     0     8    0
ucredpl     96     1037    0     1031     1     0     1     1     0     8    0
zombiepl   144     1721    0     1719     2     1     1     1     0     8    0
processpl  864     1747    0     1719     4     0     4     4     0     8    0
procpl     632     4132    0     4097     5     1     4     5     0     8    0
sosppl     128       72    0       72     8     7     1     1     0     8    1
sockpl     384     3843    0     3833    17    13     4     5     0     8    2
mcl64k     65536    128    0      128    13     9     4     4     0     8    4
mcl16k     16384     12    0       12     6     5     1     1     0     8    1
mcl12k     12288     28    0       28     8     7     1     1     0     8    1
mcl9k      9216      12    0       12     6     6     0     1     0     8    0
mcl8k      8192     527    0      527     3     2     1     1     0     8    1
mcl4k      4096     242    0      242     3     2     1     1     0     8    1
mcl2k2     2112      14    0       14     5     4     1     1     0     8    1
mcl2k      2048   71994    0    71952    20    14     6    14     0     8    0
mtagpl      80       69    0       69     3     2     1     1     0     8    1
mbufpl     256   126523    0   126442    74    62    12    27     0     8    1
bufpl      256    12015    0     5927   381     0   381   381     0     8    0
anonpl      16   196800    0   176066   123    21   102   102     0    62   13
amapchunkpl 152    9707    0     9567    50    33    17    31     0   158   10
amappl16   192     8891    0     7718    99    33    66    72     0     8    6
amappl15   184      507    0      506     1     0     1     1     0     8    0
amappl14   176      170    0      166     1     0     1     1     0     8    0
amappl13   168      501    0      498     1     0     1     1     0     8    0
amappl12   160       11    0        9     1     0     1     1     0     8    0
amappl11   152       64    0       60     1     0     1     1     0     8    0
amappl10   144      298    0      297     2     1     1     1     0     8    0
amappl9    136      826    0      822     1     0     1     1     0     8    0
amappl8    128      409    0      367     2     0     2     2     0     8    0
amappl7    120      360    0      354     1     0     1     1     0     8    0
amappl6    112       66    0       52     1     0     1     1     0     8    0
amappl5    104      211    0      204     1     0     1     1     0     8    0
amappl4     96     2240    0     2215     1     0     1     1     0     8    0
amappl3     88      194    0      187     1     0     1     1     0     8    0
amappl2     80    13773    0    13720     3     1     2     3     0     8    0
amappl1     72    42271    0    41911    27    18     9    20     0     8    0
amappl      80     4485    0     4445     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64      103    0        1     2     0     2     2     0     8    0
uaddrrnd    24     1738    0     1719     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1738    0     1719     1     0     1     1     0     8    0
vmmpekpl   168    17172    0    17143     2     0     2     2     0     8    0
vmmpepl    168   217894    0   215822   236   100   136   145     0   357   34
vmsppl     272     1729    0     1719     3     2     1     2     0     8    0
pdppl      4096    3482    0     3450     6     1     5     6     0     8    0
pvpl        32   551371    0   527668   383    46   337   337     0   265  137
pmappl     200     1737    0     1723     1     0     1     1     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      625    0      107    15     0    15    15     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/16 11:27 openbsd b78dbe0757a3 d5696d51 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.