syzbot


uvm_fault: uvm_unmap_remove (2)

Status: fixed on 2019/12/04 16:31
Reported-by: syzbot+dbd6e2a7583e958e69f8@syzkaller.appspotmail.com
Fix commit: 3c82c0b2df98 Fix uvm_unmap_remove panic when tearing down VMs.
First crash: 1897d, last: 1814d
Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
uvm_faulta(ADDRg518, ADDR, 0, 1) - > e 1 1871d 1871d 0/3 closed as dup on 2019/10/09 07:02
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: uvm_unmap_remove C 780 1897d 1916d 3/3 fixed on 2019/09/12 08:35

Sample crash report:
uvm_fault(0xffffffff8252d4a8, 0xffff800000a66000, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      uvm_unmap_remove+0x3eb: movq    0x100(%r15),%r15
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff8252d4a8, 0xffff800000a66000, 0, 1) -> e
uvm_unmap_remove(ffff800000a65f00,0,1000000,ffff8000148dfce0,0,1) at uvm_unmap_remove+0x3eb uvmspace_dused sys/uvm/uvm_map.c:501 [inline]
uvm_unmap_remove(ffff800000a65f00,0,1000000,ffff8000148dfce0,0,1) at uvm_unmap_remove+0x3eb sys/uvm/uvm_map.c:2221
end trace frame: 0xffff8000148dfd90, count: 0
ddb> trace
uvm_unmap_remove(ffff800000a65f00,0,1000000,ffff8000148dfce0,0,1) at uvm_unmap_remove+0x3eb uvmspace_dused sys/uvm/uvm_map.c:501 [inline]
uvm_unmap_remove(ffff800000a65f00,0,1000000,ffff8000148dfce0,0,1) at uvm_unmap_remove+0x3eb sys/uvm/uvm_map.c:2221
uvm_share(ffff800000a65f00,0,7,fffffd803f011330,20000000,80000000) at uvm_share+0x55b
vm_impl_init_vmx(ffff8000ffff3a68,ffff8000ffff4500) at vm_impl_init_vmx+0xf1 sys/arch/amd64/amd64/vmm.c:1270
vm_create(ffff800000a64000,ffff8000ffff4500) at vm_create+0x193 vm_impl_init sys/arch/amd64/amd64/vmm.c:1385 [inline]
vm_create(ffff800000a64000,ffff8000ffff4500) at vm_create+0x193 sys/arch/amd64/amd64/vmm.c:1174
VOP_IOCTL(fffffd80360cd9c0,c5005601,ffff800000a64000,1,fffffd803f7c6c00,ffff8000ffff4500) at VOP_IOCTL+0x88 sys/kern/vfs_vops.c:291
vn_ioctl(fffffd8037561000,c5005601,ffff800000a64000,ffff8000ffff4500) at vn_ioctl+0xb7 sys/kern/vfs_vnops.c:533
sys_ioctl(ffff8000ffff4500,ffff8000148e0138,ffff8000148e0180) at sys_ioctl+0x5b9
syscall(ffff8000148e0200) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffcc6a0, count: -9
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff8000148dfcb0
rbx                                0
rdx                          0x10000    __ALIGN_SIZE+0xf000
rcx                                0
rax               0xffff800000a65f00
r8                                 0
r9                               0x1
r10               0xbdc3bd6b0a2a7926
r11               0x3150c89bb9a5e56f
r12                                0
r13               0xfffffd8037147050
r14                          0x10000    __ALIGN_SIZE+0xf000
r15               0xffff800000a65f00
rip               0xffffffff8112bc9b    uvm_unmap_remove+0x3eb
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000148dfc00
ss                              0x10
uvm_unmap_remove+0x3eb: movq    0x100(%r15),%r15
ddb> show proc
PROC (syz-executor7296) pid=230542 stat=onproc
    flags process=0 proc=0
    pri=52, usrpri=52, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff5158,0xffffffff82578840
    process=0xffff8000148a2378 user=0xffff8000148db000, vmspace=0xfffffd803f011330
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*12930  230542  92772      0  7           0                syz-executor7296
 92772  132105  79337      0  3        0x82  nanosleep     syz-executor7296
 79337  325870  18551      0  3    0x10008a  pause         ksh
 18551  148924  65948      0  3        0x92  select        sshd
 75136  137875      1      0  3    0x100083  ttyin         getty
 65948   68016      1      0  3        0x80  select        sshd
 41320    2975  76062     73  3    0x100090  kqread        syslogd
 76062  120279      1      0  3    0x100082  netio         syslogd
 50494  332607      1     77  3    0x100090  poll          dhclient
 17214  146845      1      0  3        0x80  poll          dhclient
 10916  506233      0      0  3     0x14200  pgzero        zerothread
 60065  142006      0      0  3     0x14200  aiodoned      aiodoned
 27175  265034      0      0  3     0x14200  syncer        update
  2221   74522      0      0  3     0x14200  cleaner       cleaner
 22655   75090      0      0  3     0x14200  reaper        reaper
 77788   52806      0      0  3     0x14200  pgdaemon      pagedaemon
 62559  324921      0      0  3     0x14200  bored         crynlk
 74260  283336      0      0  3     0x14200  bored         crypto
 98284   71315      0      0  3  0x40014200  acpi0         acpi0
 50034  166461      0      0  3     0x14200  bored         softnet
 60249  258647      0      0  3     0x14200  bored         systqmp
 80046  165099      0      0  3     0x14200  bored         systq
  7391  120342      0      0  3  0x40014200  bored         softclock
  8623  128992      0      0  3  0x40014200                idle0
 93741  375803      0      0  3     0x14200  bored         smr
     1  456139      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9445   6329K    6329K  78643K     10557        0        0
            pcb    13      8K       8K  78643K        13        0        0
         rtable    61      1K       2K  78643K       115        0        0
         ifaddr    24      7K       7K  78643K        24        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     1      2K       2K  78643K        24        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1181     74K      74K  78643K      1196        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       1K  78643K         2        0        0
         VM map     3      0K       0K  78643K        13        0        0
            sem     2      0K       0K  78643K         2        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1794    195K     288K  78643K     12646        0        0
      file desc     1      0K       0K  78643K         1        0        0
          sigio     1      0K       0K  78643K        11        0        0
           proc    47     38K      46K  78643K       278        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
       in_multi    11      0K       0K  78643K        11        0        0
    ether_multi     1      0K       0K  78643K         1        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    18     79K      79K  78643K        18        0        0
           exec     0      0K       1K  78643K       162        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    53      3K       3K  78643K       707        0        0
       UVM aobj     2      2K       2K  78643K         2        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
            NDP     3      0K       0K  78643K         3        0        0
           temp    32   3518K    3579K  78643K      1708        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        2    0        0     1     0     1     1     0     8    0
rtpcb       80       26    0       23     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      120       71    0       61     1     0     1     1     0     8    0
syncache   264        5    0        5     1     0     1     1     0     8    1
tcpcb      544        8    0        5     1     0     1     1     0     8    0
inpcb      280       22    0       16     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1389    0       15    45     0    45    45     0     8    0
ffsino     240     1389    0       15    81     0    81    81     0     8    0
nchpl      144     1577    0       44    57     0    57    57     0     8    0
uvmvnodes   72     1409    0        0    26     0    26    26     0     8    0
vnodes     208     1409    0        0    75     0    75    75     0     8    0
namei      1024    3604    0     3604     1     0     1     1     0     8    1
vmpool     520       11    0       10     1     0     1     1     0     8    0
scxspl     192     2396    0     2396     2     1     1     2     0     8    1
plimitpl   152       13    0        8     1     0     1     1     0     8    0
sigapl     432      186    0      175     2     0     2     2     0     8    0
knotepl    112        5    0        0     1     0     1     1     0     8    0
kqueuepl   104       23    0       20     1     0     1     1     0     8    0
pipepl     128      224    0      213     1     0     1     1     0     8    0
fdescpl    424      187    0      175     2     0     2     2     0     8    0
filepl     120     1128    0     1073     2     0     2     2     0     8    0
lockfpl    104        5    0        4     1     0     1     1     0     8    0
lockfspl    48        3    0        2     1     0     1     1     0     8    0
sessionpl  112       17    0        9     1     0     1     1     0     8    0
pgrppl      48       50    0       41     1     0     1     1     0     8    0
ucredpl     96       47    0       40     1     0     1     1     0     8    0
zombiepl   144      175    0      175     1     0     1     1     0     8    1
processpl  864      201    0      175     4     0     4     4     0     8    0
procpl     632      201    0      175     3     0     3     3     0     8    0
sockpl     384      119    0      100     2     0     2     2     0     8    0
mcl4k      4096      10    0       10     1     0     1     1     0     8    1
mcl2k      2048    5774    0     5746     6     0     6     6     0     8    2
mtagpl      80        2    0        2     1     1     0     1     0     8    0
mbufpl     256     9936    0     9893     5     1     4     4     0     8    0
bufpl      256     2046    0      240   113     0   113   113     0     8    0
anonpl      16    16952    0    15832     7     2     5     7     0    62    0
amapchunkpl 152     473    0      437     2     0     2     2     0   158    0
amappl16   192       81    0       76     1     0     1     1     0     8    0
amappl14   176       35    0       31     1     0     1     1     0     8    0
amappl12   160        5    0        5     1     0     1     1     0     8    1
amappl11   152       40    0       29     1     0     1     1     0     8    0
amappl10   144        1    0        1     1     0     1     1     0     8    1
amappl9    136      374    0      373     1     0     1     1     0     8    0
amappl8    128       84    0       79     1     0     1     1     0     8    0
amappl7    120       15    0       14     1     0     1     1     0     8    0
amappl6    112       42    0       37     1     0     1     1     0     8    0
amappl5    104      150    0      140     1     0     1     1     0     8    0
amappl4     96      395    0      370     1     0     1     1     0     8    0
amappl3     88      101    0       96     1     0     1     1     0     8    0
amappl2     80      718    0      667     2     0     2     2     0     8    0
amappl1     72    11927    0    11545    16     7     9    16     0     8    0
amappl      80      374    0      353     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      198    0      175     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      198    0      175     1     0     1     1     0     8    0
vmmpekpl   168     5549    0     5536     1     0     1     1     0     8    0
vmmpepl    168    25446    0    24689    48     9    39    48     0   357    5
vmsppl     272      186    0      175     1     0     1     1     0     8    0
pdppl      4096     402    0      370     5     0     5     5     0     8    0
pvpl        32    70466    0    67690    26     0    26    26     0   265    3
pmappl     200      197    0      185     1     0     1     1     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      226    0        3     7     0     7     7     0     8    0

Crashes (7836):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/17 20:55 openbsd eb818a3e8307 d5696d51 .config console log report syz C ci-openbsd-main
2019/11/15 06:10 openbsd 3d133dcfcb5d a24fe792 .config console log report syz C ci-openbsd-main
2019/09/17 23:48 openbsd 6c9a643d349f 13dcda9b .config console log report syz C ci-openbsd-main
2019/10/09 00:00 openbsd 70f1de17401b b1ebbfef .config console log report syz ci-openbsd-main
2019/10/01 04:25 openbsd 9eb036517c72 c7a4fb99 .config console log report syz ci-openbsd-main
2019/09/28 14:22 openbsd dd0887e41377 eb6b9855 .config console log report syz ci-openbsd-main
2019/12/04 15:20 openbsd 502b49aa2bd0 0ecb9746 .config console log report ci-openbsd-main
2019/12/04 14:19 openbsd 502b49aa2bd0 0ecb9746 .config console log report ci-openbsd-main
2019/12/04 13:18 openbsd 502b49aa2bd0 0ecb9746 .config console log report ci-openbsd-main
2019/12/04 12:12 openbsd 502b49aa2bd0 0ecb9746 .config console log report ci-openbsd-main
2019/12/04 11:00 openbsd 502b49aa2bd0 0ecb9746 .config console log report ci-openbsd-main
2019/12/04 09:28 openbsd 502b49aa2bd0 0ecb9746 .config console log report ci-openbsd-main
2019/12/04 07:55 openbsd 502b49aa2bd0 0ecb9746 .config console log report ci-openbsd-main
2019/12/04 06:12 openbsd 502b49aa2bd0 0ecb9746 .config console log report ci-openbsd-main
2019/12/04 02:31 openbsd afd2bec52a56 4b0a22b9 .config console log report ci-openbsd-main
2019/12/04 01:24 openbsd afd2bec52a56 4b0a22b9 .config console log report ci-openbsd-main
2019/12/04 00:23 openbsd afd2bec52a56 4b0a22b9 .config console log report ci-openbsd-main
2019/12/03 23:16 openbsd afd2bec52a56 4b0a22b9 .config console log report ci-openbsd-main
2019/12/03 22:07 openbsd afd2bec52a56 4b0a22b9 .config console log report ci-openbsd-main
2019/12/03 21:48 openbsd afd2bec52a56 4b0a22b9 .config console log report ci-openbsd-main
2019/12/03 20:12 openbsd afd2bec52a56 4b0a22b9 .config console log report ci-openbsd-main
2019/12/03 16:35 openbsd afd2bec52a56 4b0a22b9 .config console log report ci-openbsd-main
2019/12/03 14:44 openbsd afd2bec52a56 ab342da3 .config console log report ci-openbsd-main
2019/12/03 13:13 openbsd afd2bec52a56 ab342da3 .config console log report ci-openbsd-main
2019/12/03 10:56 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/03 10:55 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/03 08:50 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/03 07:06 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/03 04:57 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/03 04:02 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/03 02:43 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/03 01:29 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/03 00:11 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/02 22:39 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/02 21:27 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/02 20:08 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/02 18:19 openbsd 9f5f6f881ebc ab342da3 .config console log report ci-openbsd-main
2019/12/02 15:57 openbsd de168a128e45 f879db37 .config console log report ci-openbsd-main
2019/12/02 14:37 openbsd de168a128e45 f879db37 .config console log report ci-openbsd-main
2019/12/02 12:49 openbsd de168a128e45 f879db37 .config console log report ci-openbsd-main
2019/12/02 10:35 openbsd de168a128e45 f879db37 .config console log report ci-openbsd-main
2019/12/02 09:35 openbsd de168a128e45 f879db37 .config console log report ci-openbsd-main
2019/12/02 08:32 openbsd de168a128e45 f879db37 .config console log report ci-openbsd-main
2019/12/02 07:25 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/12/02 05:27 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/12/02 04:17 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/12/02 03:24 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/12/02 01:43 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/12/02 00:38 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/12/01 22:57 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/12/01 22:37 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/12/01 21:33 openbsd e41f21f1a78d f879db37 .config console log report ci-openbsd-main
2019/09/12 08:55 openbsd caeae271c597 0b7672ee .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.