syzbot


pool: cpu free list modified: mbufpl (4)

Status: upstream: reported on 2024/04/15 20:42
Reported-by: syzbot+daecb1649911bafa9776@syzkaller.appspotmail.com
First crash: 70d, last: 39d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: cpu free list modified: mbufpl syz 15863 1420d 1707d 3/3 fixed on 2020/08/05 06:16
openbsd pool: cpu free list modified: mbufpl (2) 1 731d 731d 0/3 auto-obsoleted due to no activity on 2022/09/22 19:57
openbsd pool: cpu free list modified: mbufpl (3) 1 245d 245d 0/3 auto-obsoleted due to no activity on 2024/01/22 11:03

Sample crash report:
panic: pool_cache_item_magic_check: mbufpl cpu free list modified: item addr 0xfffffd806aa00c00+16 0x0!=0x57923d1e97611057
Starting stack trace...
panic(ffffffff8285400c) at panic+0x16f sys/kern/subr_prf.c:229
pool_cache_get(ffffffff82daa4b8) at pool_cache_get+0x302
pool_get(ffffffff82daa4b8,2) at pool_get+0x96 sys/kern/subr_pool.c:573
m_clget(0,2,800) at m_clget+0x1bf m_gethdr sys/kern/uipc_mbuf.c:277 [inline]
m_clget(0,2,800) at m_clget+0x1bf sys/kern/uipc_mbuf.c:394
vio_populate_rx_mbufs(ffff8000001a0000) at vio_populate_rx_mbufs+0xf1 vio_add_rx_mbuf sys/dev/pv/if_vio.c:975 [inline]
vio_populate_rx_mbufs(ffff8000001a0000) at vio_populate_rx_mbufs+0xf1 sys/dev/pv/if_vio.c:1018
vio_rx_intr(ffff8000001a0050) at vio_rx_intr+0x64 sys/dev/pv/if_vio.c:1155
intr_handler(ffff80002a123170,ffff80000067b200) at intr_handler+0x93 sys/arch/amd64/amd64/intr.c:543
Xintr_ioapic_edge25_untramp() at Xintr_ioapic_edge25_untramp+0x18f
Xspllower() at Xspllower+0x1d
sowakeup(ffff800000dc39f8,ffff800000dc3ab8) at sowakeup+0x91 sys/kern/uipc_socket2.c:631
sorwakeup(ffff800000dc39f8) at sorwakeup+0xfb sys/kern/uipc_socket.c:1884
tcp_input(ffff80002a1235a8,ffff80002a1235b4,6,2) at tcp_input+0x4961 sys/netinet/tcp_input.c:1062
ip_deliver(ffff80002a1235a8,ffff80002a1235b4,6,2,0) at ip_deliver+0x34e sys/netinet/ip_input.c:728
ipintr() at ipintr+0xe3 sys/netinet/ip_input.c:311
if_netisr(0) at if_netisr+0xfa sys/net/if.c:1063
taskq_thread(ffff80000002c000) at taskq_thread+0xf5 sys/kern/kern_task.c:448
end trace frame: 0x0, count: 241
End of stack trace.
syncing disks...panic: pool_cache_item_magic_check: mbufpl cpu free list modified: item addr 0xfffffd806aa00c00+16 0x0!=0x57923d1e97611057
Starting stack trace...
panic(ffffffff8285400c) at panic+0x16f sys/kern/subr_prf.c:229
pool_cache_get(ffffffff82daa4b8) at pool_cache_get+0x302
pool_get(ffffffff82daa4b8,2) at pool_get+0x96 sys/kern/subr_pool.c:573
m_clget(0,2,800) at m_clget+0x1bf m_gethdr sys/kern/uipc_mbuf.c:277 [inline]
m_clget(0,2,800) at m_clget+0x1bf sys/kern/uipc_mbuf.c:394
vio_populate_rx_mbufs(ffff8000001a0000) at vio_populate_rx_mbufs+0xf1 vio_add_rx_mbuf sys/dev/pv/if_vio.c:975 [inline]
vio_populate_rx_mbufs(ffff8000001a0000) at vio_populate_rx_mbufs+0xf1 sys/dev/pv/if_vio.c:1018
vio_rx_intr(ffff8000001a0050) at vio_rx_intr+0x64 sys/dev/pv/if_vio.c:1155
intr_handler(ffff80002a122510,ffff80000067b200) at intr_handler+0x93 sys/arch/amd64/amd64/intr.c:543
Xintr_ioapic_edge25_untramp() at Xintr_ioapic_edge25_untramp+0x18f
Xspllower() at Xspllower+0x1d
timeout_run(ffff800035b7e0f8) at timeout_run+0xd0 sys/kern/kern_timeout.c:666
softclock_process_tick_timeout(ffff800035b7e0f8,0) at softclock_process_tick_timeout+0x19d sys/kern/kern_timeout.c:723
softclock(0) at softclock+0x139 sys/kern/kern_timeout.c:755
softintr_dispatch(0) at softintr_dispatch+0xcd sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x27
tsleep(fffffd806fa2eb08,11,ffffffff8284f06f,0) at tsleep+0x13a sys/kern/kern_synch.c:144
getblk(fffffd807efa4870,1fa4e0,4000,0,ffffffffffffffff) at getblk+0x137 sys/kern/vfs_bio.c:1025
bread(fffffd807efa4870,1fa4e0,4000,ffff80002a122a88) at bread+0x3e bio_doread sys/kern/vfs_bio.c:430 [inline]
bread(fffffd807efa4870,1fa4e0,4000,ffff80002a122a88) at bread+0x3e sys/kern/vfs_bio.c:475
ffs_update(fffffd807750b770,0) at ffs_update+0x14c sys/ufs/ffs/ffs_inode.c:91
VOP_FSYNC(fffffd806f04ec00,fffffd807f7d3e38,2,ffff8000ffffe290) at VOP_FSYNC+0xd2 sys/kern/vfs_vops.c:311
ffs_sync_vnode(fffffd806f04ec00,ffff80002a122c18) at ffs_sync_vnode+0x16b sys/ufs/ffs/ffs_vfsops.c:1081
vfs_mount_foreach_vnode(ffff8000006cec00,ffffffff825950a0,ffff80002a122c18) at vfs_mount_foreach_vnode+0x55 sys/kern/vfs_subr.c:910
ffs_sync(ffff8000006cec00,2,0,fffffd807f7d3e38,ffff8000ffffe290) at ffs_sync+0x104 sys/ufs/ffs/ffs_vfsops.c:1131
sys_sync(ffff8000ffffe290,0,0) at sys_sync+0xbc sys/kern/vfs_syscalls.c:536
vfs_syncwait(ffff8000ffffe290,1) at vfs_syncwait+0x3b
vfs_shutdown(ffff8000ffffe290) at vfs_shutdown+0x61 sys/kern/vfs_subr.c:1791
boot(100) at boot+0xe9 sys/arch/amd64/amd64/machdep.c:900
reboot(100) at reboot+0x84
panic(ffffffff8285400c) at panic+0x18f sys/kern/subr_prf.c:231
pool_cache_get(ffffffff82daa4b8) at pool_cache_get+0x302
pool_get(ffffffff82daa4b8,2) at pool_get+0x96 sys/kern/subr_pool.c:573
m_clget(0,2,800) at m_clget+0x1bf m_gethdr sys/kern/uipc_mbuf.c:277 [inline]
m_clget(0,2,800) at m_clget+0x1bf sys/kern/uipc_mbuf.c:394
vio_populate_rx_mbufs(ffff8000001a0000) at vio_populate_rx_mbufs+0xf1 vio_add_rx_mbuf sys/dev/pv/if_vio.c:975 [inline]
vio_populate_rx_mbufs(ffff8000001a0000) at vio_populate_rx_mbufs+0xf1 sys/dev/pv/if_vio.c:1018
vio_rx_intr(ffff8000001a0050) at vio_rx_intr+0x64 sys/dev/pv/if_vio.c:1155
intr_handler(ffff80002a123170,ffff80000067b200) at intr_handler+0x93 sys/arch/amd64/amd64/intr.c:543
Xintr_ioapic_edge25_untramp() at Xintr_ioapic_edge25_untramp+0x18f
Xspllower() at Xspllower+0x1d
sowakeup(ffff800000dc39f8,ffff800000dc3ab8) at sowakeup+0x91 sys/kern/uipc_socket2.c:631
sorwakeup(ffff800000dc39f8) at sorwakeup+0xfb sys/kern/uipc_socket.c:1884
tcp_input(ffff80002a1235a8,ffff80002a1235b4,6,2) at tcp_input+0x4961 sys/netinet/tcp_input.c:1062
ip_deliver(ffff80002a1235a8,ffff80002a1235b4,6,2,0) at ip_deliver+0x34e sys/netinet/ip_input.c:728
ipintr() at ipintr+0xe3 sys/netinet/ip_input.c:311
if_netisr(0) at if_netisr+0xfa sys/net/if.c:1063
taskq_thread(ffff80000002c000) at taskq_thread+0xf5 sys/kern/kern_task.c:448
end trace frame: 0x0, count: 214
End of stack trace.

dump to dev 4,1 not possible
rebooting...
SeaBIOS (version 1.8.2-google)
Total RAM Size = 0x0000000080000000 = 2048 MiB
CPUs found: 2     Max CPUs supported: 2
SeaBIOS (version 1.8.2-google)
Machine UUID dc1537e2-3f8b-09d0-7a97-ada6c38139e5
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f27f0: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Sending Seabios boot VM event.
Booting from Hard Disk 0...
>> OpenBSD/amd64 BOOT 3.65
boot> set $maxwidth = 0
set: syntax error
boot> show panic
boot: illegal argument panic
boot> trace
boot> show registers
boot> show proc
boot> ps
boot> show all locks
boot> show malloc
boot> show all pools
boot> machine ddbcpu 0
machine: syntax error
boot> trace
boot> machine ddbcpu 1
machine: syntax error
boot> trace

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/16 16:34 openbsd b20edd337af0 ad5321c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: cpu free list modified: mbufpl
2024/04/15 20:41 openbsd 7019ae976ad9 459f4b00 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: cpu free list modified: mbufpl
* Struck through repros no longer work on HEAD.