syzbot


panic() at panic+0x147

Status: closed as dup on 2018/12/22 08:50
Reported-by: syzbot+f11dfe51dfa6f37822b3@syzkaller.appspotmail.com
First crash: 2184d, last: 2153d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
panic: fifo_badop called C 8841 1853d 2188d

Sample crash report:
panic() at panic+0x147 sys/kern/subr_prf.c:208
fifo_badop(ffffffff817b4f62) at fifo_badop+0x12 sys/miscfs/fifofs/fifo_vnops.c:491
VOP_STRATEGY(ffffff0005d84600) at VOP_STRATEGY+0x6b sys/kern/vfs_vops.c:715
bwrite(ffff800014ab0570) at bwrite+0x195 sys/kern/vfs_bio.c:742
VOP_BWRITE(ffffff00317ddb00) at VOP_BWRITE+0x47 sys/kern/vfs_vops.c:727
ufs_mkdir(ffffffff81e1a7f0) at ufs_mkdir+0x5a9 sys/ufs/ufs/ufs_vnops.c:1250
VOP_MKDIR(ffff800014a33528,1ed,ffffff9c,ffff800014ab0528) at VOP_MKDIR+0x65 sys/kern/vfs_vops.c:445
domkdirat(ffff800014ab0760,ffff800014a33528,ffff8000149cf980,880) at domkdirat+0x10f sys/kern/vfs_syscalls.c:2859
syscall(0) at syscall+0x3e4
Xsyscall(6,88,7f7fffffaba0,88,0,7f7fffffabe0) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffffac10, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> show panic
fifo_badop called
ddb> trace
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
fifo_badop(ffffffff817b4f62) at fifo_badop+0x12 sys/miscfs/fifofs/fifo_vnops.c:491
VOP_STRATEGY(ffffff0005d84600) at VOP_STRATEGY+0x6b sys/kern/vfs_vops.c:715
bwrite(ffff800014ab0570) at bwrite+0x195 sys/kern/vfs_bio.c:742
VOP_BWRITE(ffffff00317ddb00) at VOP_BWRITE+0x47 sys/kern/vfs_vops.c:727
ufs_mkdir(ffffffff81e1a7f0) at ufs_mkdir+0x5a9 sys/ufs/ufs/ufs_vnops.c:1250
VOP_MKDIR(ffff800014a33528,1ed,ffffff9c,ffff800014ab0528) at VOP_MKDIR+0x65 sys/kern/vfs_vops.c:445
domkdirat(ffff800014ab0760,ffff800014a33528,ffff8000149cf980,880) at domkdirat+0x10f sys/kern/vfs_syscalls.c:2859
syscall(0) at syscall+0x3e4
Xsyscall(6,88,7f7fffffaba0,88,0,7f7fffffabe0) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffffac10, count: -11
ddb> show registers
rdi               0xffffffff81e0ae68    kprintf_mutex
rsi                              0x5
rbp               0xffff800014ab01b0
rbx               0xffff800014ab0250
rdx                            0x3fd
rcx                                0
rax                                0
r8                0xffff800014ab0180
r9                                 0
r10               0xffff800014aaffc8
r11               0xffffffff8158eaf0    x86_bus_space_io_read_1
r12                     0x3000000008
r13               0xffff800014ab01c0
r14                            0x100
r15               0xffffffff81c303e5    apollo_pio_rec+0xba5
rip               0xffffffff81aac5da    db_enter+0xa
cs                               0x8
rflags                         0x246
rsp               0xffff800014ab01b0
ss                              0x10
db_enter+0xa:   popq    %rbp
ddb> show proc
PROC (syz-executor0) pid=46911 stat=onproc
    flags process=2<EXEC> proc=0
    pri=17, usrpri=79, nice=20
    forw=0xffffffffffffffff, list=0xffff800014a32e20,0xffff800014a339e8
    process=0xffff8000149cf980 user=0xffff800014aab000, vmspace=0xffffff003f12bb58
    estcpu=36, cpticks=2, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 43398  445768      1      0  3    0x100083  ttyin         getty
 40170  269304      0      0  3     0x14200  bored         sosplice
 10276  160099  49983      0  2         0x2                syz-executor1
* 6458   46911  49983      0  7         0x2                syz-executor0
 49983   48402  45328      0  3        0x82  thrsleep      syz-fuzzer
 49983  513441  45328      0  3   0x4000082  nanosleep     syz-fuzzer
 49983  448474  45328      0  3   0x4000082  thrsleep      syz-fuzzer
 49983   57027  45328      0  3   0x4000082  thrsleep      syz-fuzzer
 49983  245105  45328      0  3   0x4000082  kqread        syz-fuzzer
 49983   58406  45328      0  3   0x4000082  thrsleep      syz-fuzzer
 49983  260150  45328      0  3   0x4000082  thrsleep      syz-fuzzer
 45328  153896  80916      0  3    0x10008a  pause         ksh
 80916   44835  73304      0  3        0x92  select        sshd
 73304  254265      1      0  3        0x80  select        sshd
 68549  317277  82623     73  3    0x100090  kqread        syslogd
 82623  111044      1      0  3    0x100082  netio         syslogd
 63726   16461      1     77  3    0x100090  poll          dhclient
 57961  440579      1      0  3        0x80  poll          dhclient
 75854  482811      0      0  3     0x14200  pgzero        zerothread
 43598   46960      0      0  3     0x14200  aiodoned      aiodoned
 27014  418093      0      0  3     0x14200  syncer        update
 81321  326953      0      0  3     0x14200  cleaner       cleaner
 80991  404470      0      0  3     0x14200  reaper        reaper
 42719  203947      0      0  3     0x14200  pgdaemon      pagedaemon
  9284  358113      0      0  3     0x14200  bored         crynlk
 97155   63865      0      0  3     0x14200  bored         crypto
 74544  104188      0      0  3  0x40014200  acpi0         acpi0
 11054  214030      0      0  3     0x14200  bored         softnet
 35812  137519      0      0  3     0x14200  bored         systqmp
 48862    2577      0      0  3     0x14200  bored         systq
 53763   92123      0      0  2  0x40014200                softclock
 38120  463129      0      0  3  0x40014200                idle0
     1  435742      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/30 11:24 openbsd 1a6243b7c046 35e3f847 .config console log report ci-openbsd-main
2018/12/18 21:25 openbsd 3d7285cf5747 cda92f77 .config console log report ci-openbsd-main
2018/12/09 04:19 openbsd 3173a78d3f87 e699a2b9 .config console log report ci-openbsd-main
2018/12/04 13:53 openbsd f939acc2595a 03f94a45 console log report ci-openbsd-main
2018/12/03 07:02 openbsd 87d30890b5c0 7dcaeaf3 console log report ci-openbsd-main
2018/11/29 19:53 openbsd d6477fdb83ee 4b6d14f2 console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.