syzbot


kernel: protection fault trap, code=0

Status: fixed on 2018/12/04 18:27
Reported-by: syzbot+de8d2459ecf4cdc576a1@syzkaller.appspotmail.com
Fix commit: In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
First crash: 1966d, last: 1961d
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd kernel: protection fault trap, code=0 (6) C 55024 1596d 1680d 3/3 fixed on 2019/12/05 05:48
openbsd kernel: protection fault trap, code=0 (4) C 759 1762d 1875d 3/3 fixed on 2019/06/22 17:44
openbsd kernel: protection fault trap, code=0 (8) syz 1348 1163d 1352d 3/3 fixed on 2021/02/10 20:48
openbsd kernel: protection fault trap, code=0 (3) C 3 1908d 1908d 3/3 fixed on 2019/01/27 23:19
openbsd kernel: protection fault trap, code=0 (7) syz 774692 1352d 1596d 3/3 fixed on 2020/08/05 06:16
openbsd kernel: protection fault trap, code=0 (2) syz 109 1913d 1937d 3/3 fixed on 2019/01/22 07:18
openbsd kernel: protection fault trap, code=0 (5) C 607 1687d 1761d 3/3 fixed on 2019/09/05 13:34

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      m_extfree+0x3d: movq    %rax,0x90(%r15)
ddb> 
ddb> set $lines = 0
ddb> show panic
the kernel did not panic
ddb> trace
m_extfree(da3dcd11548f7e3f) at m_extfree+0x3d
m_free(ffffff006db88400) at m_free+0xee
m_freem(16) at m_freem+0x2d
soreceive(0,ffffff006e6fea88,0,0,ffff8000210fcc50,ffff8000210fcb60) at soreceive+0x1131
recvit(ffff8000210fcc80,ffff8000210fcd88,ffff8000210fcd70,ffff8000210c3078,0) at recvit+0x28c
sys_recvmsg(ffff8000210fce10,ffff8000210c3078,ffff8000210a5660) at sys_recvmsg+0x120
syscall(0) at syscall+0x3e4
Xsyscall(6,0,0,0,1,7f7fffff21a8) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff2160, count: -8
ddb> show registers
rdi                              0x7
rsi                             0x42
rbp               0xffff8000210fca50
rbx                                0
rdx               0xffffffffffffbeef
rcx               0xffffffff81e8e3b0    mbstat_boot_boot_cpumem
rax               0x371496c40e18ba99
r8                                 0
r9                0xffff8000210c3078
r10               0xda3dcd11548f7e3f
r11               0xffffffff816a34a0    pool_lock_mtx_leave
r12                           0xdead    __ALIGN_SIZE+0xcead
r13               0xffffff006e6fea88
r14               0xffffff006db88400
r15               0x307c2f590a204b3c
rip               0xffffffff81adbf1d    m_extfree+0x3d
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000210fca40
ss                              0x10
m_extfree+0x3d: movq    %rax,0x90(%r15)
ddb> show proc
PROC (syz-executor8170) pid=96642 stat=onproc
    flags process=2<EXEC> proc=0
    pri=50, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff8000210c32d0,0xffffffff81eafaa0
    process=0xffff8000210a5660 user=0xffff8000210f7000, vmspace=0xffffff007f12b528
    estcpu=0, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*49901   96642  36687      0  7         0x2                syz-executor8170
 36687    1941  64844      0  3    0x10008a  pause         ksh
 64844  149296  32328      0  3        0x92  select        sshd
 33033  329785      1      0  3    0x100083  ttyin         getty
 32328  468257      1      0  3        0x80  select        sshd
 67061  368879  40352     73  3    0x100090  kqread        syslogd
 40352  238667      1      0  3    0x100082  netio         syslogd
 41089  275142      1     77  3    0x100090  poll          dhclient
 58298  351436      1      0  3        0x80  poll          dhclient
 99277  312932      0      0  2     0x14200                zerothread
 92306  334436      0      0  3     0x14200  aiodoned      aiodoned
  2795  448611      0      0  3     0x14200  syncer        update
 85307  328015      0      0  3     0x14200  cleaner       cleaner
 49730  420142      0      0  3     0x14200  reaper        reaper
 88669  404666      0      0  3     0x14200  pgdaemon      pagedaemon
 35323  210131      0      0  3     0x14200  bored         crynlk
 88011  297031      0      0  3     0x14200  bored         crypto
 36143   35021      0      0  3  0x40014200  acpi0         acpi0
 37234  125684      0      0  3     0x14200  bored         softnet
 30399    2859      0      0  3     0x14200  bored         systqmp
  6370  291812      0      0  3     0x14200  bored         systq
 12619  110843      0      0  3  0x40014200  bored         softclock
  1096  371011      0      0  3  0x40014200                idle0
     1  259157      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> 

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/04 07:01 openbsd f939acc2595a 03f94a45 console log report syz C ci-openbsd-main
2018/12/04 02:58 openbsd f939acc2595a 03f94a45 console log report syz C ci-openbsd-main
2018/12/04 00:41 openbsd f939acc2595a 03f94a45 console log report syz C ci-openbsd-main
2018/12/03 21:38 openbsd f939acc2595a 03f94a45 console log report syz C ci-openbsd-main
2018/12/01 09:30 openbsd e9b93a3e5ebc 28e157f1 console log report syz C ci-openbsd-main
2018/12/04 04:12 openbsd f939acc2595a 03f94a45 console log report syz ci-openbsd-main
2018/12/04 14:16 openbsd f939acc2595a 03f94a45 console log report ci-openbsd-main
2018/12/04 10:08 openbsd f939acc2595a 03f94a45 console log report ci-openbsd-main
2018/12/04 04:35 openbsd f939acc2595a 03f94a45 console log report ci-openbsd-main
2018/12/03 12:05 openbsd 87d30890b5c0 7dcaeaf3 console log report ci-openbsd-main
2018/12/02 22:31 openbsd 87d30890b5c0 28e157f1 console log report ci-openbsd-main
2018/12/02 04:22 openbsd 3f7c3e6a6fe6 28e157f1 console log report ci-openbsd-main
2018/12/01 15:47 openbsd e9b93a3e5ebc 28e157f1 console log report ci-openbsd-main
2018/12/01 02:55 openbsd e9b93a3e5ebc d8988561 console log report ci-openbsd-main
2018/11/30 23:16 openbsd d93678d71f23 ade12e91 console log report ci-openbsd-main
2018/11/29 23:26 openbsd 25236b556a2d 66071e27 console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.