pool: free list modified: inpcb (3)

pool: free list modified: inpcb (3)

Status: upstream: reported on 2024/08/09 18:18
Reported-by: syzbot+dec5b972fe3fe57ec719@syzkaller.appspotmail.com
First crash: 38d, last: 38d

▶ ▼ Similar bugs (2)

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
openbsd	pool: free list modified: inpcb				2	812d	838d	0/3	auto-obsoleted due to no activity on 2022/09/25 16:01
openbsd	pool: free list modified: inpcb (2)				2	667d	720d	0/3	auto-obsoleted due to no activity on 2023/02/17 15:15

Sample crash report:

panic: pool_p_free: inpcb free list modified: page 0xfffffd8074b88000; item addr 0xfffffd8074b88e78; offset 0x0=0x0
Starting stack trace...
panic(ffffffff8308ccdf) at panic+0x1d0 sys/kern/subr_prf.c:229
pool_p_free(ffffffff834f58a0,fffffd806bfd9e78) at pool_p_free+0x26c sys/kern/subr_pool.c:986
pool_gc_pages(0) at pool_gc_pages+0x357 sys/kern/subr_pool.c:1583
taskq_thread(ffffffff834bcda0) at taskq_thread+0x157 sys/kern/kern_task.c:448
end trace frame: 0x0, count: 253
End of stack trace.

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2024/08/09 18:18	openbsd	6798d9df8413	8828007b	.config	console log	report				[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: inpcb

* ~~Struck through~~ repros no longer work on HEAD.