syzbot


panic: broken type ref (2)

Status: closed as dup on 2020/05/15 21:37
Reported-by: syzbot+dca384550d60d2d43a22@syzkaller.appspotmail.com
First crash: 1531d, last: 1452d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
uvm_fault: in_delmulti syz 375431 1450d 1736d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: broken type ref (4) 3 100d 101d 0/3 auto-obsoleted due to no activity on 2024/07/14 16:31
openbsd panic: broken type ref (3) 1 786d 786d 0/3 closed as invalid on 2022/06/02 05:14
openbsd panic: broken type ref 1 1538d 1538d 0/3 closed as invalid on 2020/05/11 22:47

Sample crash report:
panic: broken type ref

goroutine 25 [running]:
github.com/google/syzkaller/prog.ArgCommon.Type(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/prog.go:39
github.com/google/syzkaller/prog.(*ConstArg).Size(0xc002c42c40, 0xc002c42c40)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/prog.go:59 +0xef
github.com/google/syzkaller/prog.foreachArgImpl(0x98ee00, 0xc002c0fc60, 0xc002c5c080, 0xc000ef53f0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:142 +0x2af
github.com/google/syzkaller/prog.foreachArgImpl(0x98ee00, 0xc002c0fc40, 0xc002c5c080, 0xc000ef53f0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:141 +0x298
github.com/google/syzkaller/prog.foreachArgImpl(0x98ee40, 0xc002c45440, 0xc002c5c080, 0xc000ef53f0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:156 +0x54c
github.com/google/syzkaller/prog.ForeachArg(0xc002c39e00, 0xc000ef53f0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:122 +0xde
github.com/google/syzkaller/prog.getCompatibleResources(0xc002c39d80, 0x8f3c34, 0xb, 0xc002a0f100, 0x0, 0x0, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:892 +0xb9
github.com/google/syzkaller/prog.(*randGen).resourceCentric(0xc002a0f100, 0xc002665f90, 0xbf6d00, 0x0, 0x897d00, 0xc000000001, 0xc002751ce0, 0xc000ef55f8, 0x7b46fe)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:840 +0x105
github.com/google/syzkaller/prog.(*ResourceType).generate(0xbf6d00, 0xc002a0f100, 0xc002665f90, 0xc00227c900, 0x98ed80, 0xc002751ce0, 0x0, 0x0, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:669 +0x285
github.com/google/syzkaller/prog.(*randGen).generateArgImpl(0xc002a0f100, 0xc002665f90, 0x993aa0, 0xbf6d00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:658 +0x40b
github.com/google/syzkaller/prog.(*randGen).generateArg(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:608
github.com/google/syzkaller/prog.(*randGen).generateArgs(0xc002a0f100, 0xc002665f90, 0xc8e160, 0xc, 0xc, 0xc002a0f000, 0x203000, 0x203000, 0x203000, 0x0, ...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:596 +0x113
github.com/google/syzkaller/prog.(*StructType).generate(0xc037a0, 0xc002a0f100, 0xc002665f90, 0x0, 0xcdc800, 0x1, 0xc000376000, 0x2cd1e5108, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:780 +0x7c
github.com/google/syzkaller/prog.(*randGen).generateArgImpl(0xc002a0f100, 0xc002665f90, 0x993b80, 0xc037a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:658 +0x40b
github.com/google/syzkaller/prog.(*randGen).generateArg(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:608
github.com/google/syzkaller/prog.(*randGen).generateArgs(0xc002a0f100, 0xc002665f90, 0xbfef40, 0x2, 0x2, 0xc00000d700, 0xbfd140, 0xc002850230, 0x84a560, 0xc00000d720, ...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:596 +0x113
github.com/google/syzkaller/prog.(*StructType).generate(0xc03980, 0xc002a0f100, 0xc002665f90, 0x0, 0xcdc800, 0x91b090, 0x0, 0x0, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:780 +0x7c
github.com/google/syzkaller/prog.(*randGen).generateArgImpl(0xc002a0f100, 0xc002665f90, 0x993b80, 0xc03980, 0xcd0000, 0x0, 0x0, 0x0, 0x0, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:658 +0x40b
github.com/google/syzkaller/prog.(*randGen).generateArg(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:608
github.com/google/syzkaller/prog.(*UnionType).mutate(0xbfe980, 0xc002a0f100, 0xc002665f90, 0x98eec0, 0xc002a0f020, 0xc002a0ec08, 0xbfe940, 0x2, 0x2, 0xc002840bd0, ...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/mutation.go:457 +0x18b
github.com/google/syzkaller/prog.(*Target).mutateArg(0xc0000756c0, 0xc002a0f100, 0xc002665f90, 0x98eec0, 0xc002a0f020, 0xc002a0ec08, 0xbfe940, 0x2, 0x2, 0xc002840bd0, ...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/mutation.go:229 +0xec
github.com/google/syzkaller/prog.(*mutator).mutateArg(0xc000ef5ec0, 0xa)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/mutation.go:182 +0x275
github.com/google/syzkaller/prog.(*Prog).Mutate(0xc002850180, 0x988ac0, 0xc003422b10, 0x14, 0xc00331bec0, 0xc003000000, 0x26ff, 0x3000)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/mutation.go:47 +0x330
main.(*Proc).loop(0xc00331bf40)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:95 +0x3e5
created by main.main
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:267 +0x1175


OpenBSD/amd64 (ci-openbsd-main-4.c.syzkaller.internal) (tty00)

login: 

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/02 23:17 openbsd 84e8f3e59749 63a73341 .config console log report ci-openbsd-main
2020/07/23 14:18 openbsd d8b0789b8b82 340ea530 .config console log report ci-openbsd-multicore
2020/07/23 06:38 openbsd fad015d206fd 340ea530 .config console log report ci-openbsd-main
2020/07/19 16:38 openbsd 6a6361194be2 9c812472 .config console log report ci-openbsd-main
2020/07/12 23:33 openbsd 1721822955a2 9ebcc5b1 .config console log report ci-openbsd-main
2020/07/04 17:52 openbsd 474af46fb119 bed10395 .config console log report ci-openbsd-multicore
2020/06/29 16:46 openbsd c3a4abad4b7f 0375051c .config console log report ci-openbsd-multicore
2020/06/27 14:49 openbsd dbf2cc62e98d 032b4239 .config console log report ci-openbsd-multicore
2020/06/26 03:27 openbsd 579159636626 aea82c00 .config console log report ci-openbsd-multicore
2020/06/23 06:15 openbsd 4d943fd61ab7 1afe1535 .config console log report ci-openbsd-main
2020/06/21 23:20 openbsd f5cd887ee666 eabcced4 .config console log report ci-openbsd-multicore
2020/06/20 18:41 openbsd c4b445c6ea7c c655ec77 .config console log report ci-openbsd-main
2020/06/18 12:09 openbsd ae375af6dd72 d45a4d69 .config console log report ci-openbsd-multicore
2020/06/16 05:01 openbsd f32c3515e400 baca2611 .config console log report ci-openbsd-main
2020/06/05 07:11 openbsd 21ddc59af3b7 2420d1bc .config console log report ci-openbsd-main
2020/05/17 19:53 openbsd 557f50bebc15 37bccd4e .config console log report ci-openbsd-main
2020/05/15 21:31 openbsd 435df7980549 d7f9fffa .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.