syzbot


kernel: protection fault trap, code=NUM (7)

Status: upstream: reported on 2024/08/26 11:56
Reported-by: syzbot+fe48665f243f29057e61@syzkaller.appspotmail.com
First crash: 87d, last: 36d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd kernel: protection fault trap, code=NUM (3) 1 975d 975d 0/3 closed as invalid on 2022/03/22 11:48
openbsd kernel: protection fault trap, code=NUM (5) 2 815d 816d 0/3 closed as dup on 2022/08/29 15:02
openbsd kernel: protection fault trap, code=NUM (2) C 16 1057d 1080d 0/3 closed as invalid on 2021/12/31 06:19
openbsd kernel: protection fault trap, code=NUM 1 1160d 1160d 0/3 closed as invalid on 2021/09/18 05:58
openbsd kernel: protection fault trap, code=NUM (4) 1 938d 938d 0/3 closed as invalid on 2022/04/28 06:52
openbsd kernel: protection fault trap, code=NUM (6) 42 195d 741d 0/3 auto-obsoleted due to no activity on 2024/08/08 04:33

Sample crash report:
kernel: protection fault trap, code=0
Faulted in DDB; continuing...
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10223  11052K   11059K 166960K     13979        0
            pcb    17     28K      32K 166960K        29        0
         rtable   222      6K       7K 166960K     31828        0
             pf    31     16K      16K 166960K      1831        0
         ifaddr    40     15K      19K 166960K      3609        0
        ifgroup    50      2K       2K 166960K      3634        0
         sysctl     4      1K       5K 166960K       102        0
       counters    64     36K      36K 166960K      1848        0
       ioctlops     0      0K       2K 166960K      2280        0
            iov     0      0K      36K 166960K      5537        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1484     93K      93K 166960K     26473        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K      13K 166960K      1254        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K      1614        0
        dirhash    21      4K       5K 166960K      1329        0
           ACPI  1690    195K     286K 166960K     12468        0
      file desc    34    126K     181K 166960K     67473        0
          sigio     0      0K       0K 166960K      2226        0
           proc    58     79K     176K 166960K     31668        0
        subproc   130      8K      13K 166960K     13949        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K     15052        0
       in_multi    89      6K       8K 166960K     12541        0
    ether_multi     1      0K       0K 166960K       450        0
            mrt     1      0K       0K 166960K        18        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   307   1367K    1367K 166960K       307        0
           exec     0      0K       1K 166960K     23389        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   331     94K     148K 166960K    587227        0
       UVM aobj   131      4K       8K 166960K       158        0
     pinsyscall    56    112K     148K 166960K     93062        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K      4862        0
            NDP    11      0K       2K 166960K      2689        0
           temp    84   6825K    6954K 166960K    448621        0
         kqueue    13     20K      38K 166960K     11176        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120    10711    0    10706    79    78     1     3     0     8    0
rtentry    112    10591    0    10487    19    15     4     4     0     8    0
unpcb      144    68357    0    68336   284   280     4    11     0     8    3
syncache   336     1235    0     1235    51    50     1     1     0     8    1
tcpqe       32      612    0      612    65    64     1     1     0     8    1
tcpcb      808    45197    0    45043   361   338    23    33     0     8    2
arp        120     1833    0     1816     1     0     1     1     0     8    0
ipq         40      298    0      294    10     9     1     1     0     8    0
ipqe        40     5191    0     5186    10     9     1     1     0     8    0
inpcb      336   103357    0   103197   404   383    21    29     0     8    0
ip6q        72       13    0       13     9     9     0     1     0     8    0
ip6af       40       26    0       26     9     9     0     1     0     8    0
nd6        136     3367    0     3344    18    16     2     2     0     8    1
kcovpl      48     1073    0     1063     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256    42374    0    41950   248   217    31    33     0     8    1
art_table   32    42375    0    41950    14     9     5     5     0     8    0
art_node    16    10590    0    10495     1     0     1     1     0     8    0
sysvmsgpl   40       22    0       18     3     2     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112     1611    0     1601     1     0     1     1     0     8    0
shmpl      112      155    0       27     4     0     4     4     0     8    0
dirhash    1024     923    0      887    38    33     5     6     0     8    0
dino2pl    256    89538    0    84443   323     4   319   319     0     8    0
ffsino     272    89538    0    84443   343     2   341   341     0     8    0
nchpl      144   166629    0   163438   119     0   119   119     0     8    0
uvmvnodes   80    11948    0        0   244     0   244   244     0     8    0
vnodes     216    11948    0        0   664     0   664   664     0     8    0
namei      1024  694164    0   694164    64    63     1     3     0     8    1
percpumem   16      938    0      892     1     0     1     1     0     8    0
kstatmem   264     1806    0     1784     4     2     2     2     0     8    0
scxspl     216   630279    0   630279   189   185     4     8     1     8    4
plimitpl   152    22793    0    22766     2     0     2     2     0     8    0
sigapl     424    65916    0    65852    19    11     8     9     0     8    0
futexpl     64   816655    0   816648    33    32     1     1     0     8    0
knotepl    120     2853    0        0    27     2    25    25     0     8    0
kqueuepl   216    23605    0    23593   186   185     1     9     0     8    0
pipepl     320    13762    0    13728   155   149     6     9     0     8    2
fdescpl    496    65897    0    65852    30    23     7     8     0     8    0
filepl     152   495399    0   495008   293   276    17    29     0     8    1
lockfpl    104    19290    0    19288    11    10     1     4     0     8    0
lockfspl    48     5781    0     5779     1     0     1     1     0     8    0
sessionpl  144     1215    0     1197     3     1     2     2     0     8    0
pgrppl      48     4134    0     4108     1     0     1     1     0     8    0
ucredpl    104    98739    0    98721     1     0     1     1     0     8    0
zombiepl   144    65853    0    65852     1     0     1     1     0     8    0
processpl  1160   65916    0    65852     8     2     6     6     0     8    0
procpl     648   158443    0   158363     9     2     7     8     0     8    0
srpgc       96       49    0       49    22    22     0     1     0     8    0
sosppl     168      827    0      826    21    20     1     1     0     8    0
sockpl     664   184113    0   183927   510   484    26    39     0     8    2
mcl64k     65536    138    0        0     7     0     7     7     0     8    0
mcl16k     16384     14    0        0     2     0     2     2     0     8    0
mcl12k     12288     12    0        0     2     0     2     2     0     8    0
mcl9k      9216       5    0        0     1     0     1     1     0     8    0
mcl8k      8192      26    0        0     3     0     3     3     0     8    0
mcl4k      4096     361    0        0    20     8    12    20     0     8    0
mcl2k2     2112      14    0        0     1     0     1     1     0     8    0
mcl2k      2048     880    0        0    20    14     6    11     0     8    0
mtagpl      96       17    0        0     1     0     1     1     0     8    0
mbufpl     256     6604    0        0   327     0   327   327     0     8    0
bufpl      280   111964    0   100013   854     0   854   854     0     8    0
anonpl      24  7978097    0  7956651   838   708   130   144     0   185    0
amapchunkpl 152 1941227    0  1940225   612   560    52    58     0   158   11
amappl16   200   193845    0   193049   809   767    42    49     0     8    0
amappl15   192       21    0       21    14    14     0     1     0     8    0
amappl14   184     2517    0     2504     3     2     1     2     0     8    0
amappl13   176       91    0       91    42    41     1     1     0     8    1
amappl12   168    81062    0    81014     5     2     3     3     0     8    0
amappl11   160       54    0       43     1     0     1     1     0     8    0
amappl10   152       53    0       52     2     1     1     1     0     8    0
amappl9    144      127    0      126     2     1     1     1     0     8    0
amappl8    136       32    0       30     1     0     1     1     0     8    0
amappl7    128     2199    0     2186     1     0     1     1     0     8    0
amappl6    120     9039    0     9033     1     0     1     1     0     8    0
amappl5    112     3993    0     3983     1     0     1     1     0     8    0
amappl4    104     4201    0     4182     1     0     1     1     0     8    0
amappl3     96   397798    0   397644     7     2     5     5     0     8    0
amappl2     88    16921    0    16849     3     0     3     3     0     8    0
amappl1     80   340042    0   339440    53    34    19    25     0     8    0
amappl      88   573895    0   573627     8     1     7     7     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      157    0       27     3     0     3     3     0     8    0
uaddrrnd    24    65897    0    65852     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    65897    0    65852     1     0     1     1     0     8    0
vmmpekpl   168   574403    0   574352     5     1     4     5     0     8    0
vmmpepl    168  4153091    0  4149980   743   595   148   174     0   357    2
vmsppl     440    65896    0    65852    16    10     6     7     0     8    0
rwobjpl     56  1030541    0  1016639   280    84   196   196     0     8    0
pdppl      4096  131801    0   131704  2175  2078    97   125     0     8    0
pvpl        32    48294    0        0   384     0   384   384     0   265    0
pmappl     248    65896    0    65852     8     4     4     4     0     8    0
extentpl    40       55    0       38     1     0     1     1     0     8    0
phpool     112     4390    0     3192    35     0    35    35     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0x6ef6e067370, count: -1
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666
acpitimer_delay(1) at acpitimer_delay+0x194 acpitimer_read sys/dev/acpi/acpitimer.c:142 [inline]
acpitimer_delay(1) at acpitimer_delay+0x194 sys/dev/acpi/acpitimer.c:125
comcnputc(800,20) at comcnputc+0x29b sys/dev/ic/com.c:1269
cnputc(20) at cnputc+0x61 sys/dev/cons.c:218
db_putchar(63) at db_putchar+0x524 db_force_whitespace sys/ddb/db_output.c:102 [inline]
db_putchar(63) at db_putchar+0x524 sys/ddb/db_output.c:153
kprintf() at kprintf+0x2aba sys/kern/subr_prf.c:1065
db_printf(ffffffff83085579) at db_printf+0x9b
panic(ffffffff83076ff4) at panic+0x103 sys/kern/subr_prf.c:216
witness_checkorder(fffffd806cf7ad08,1,0) at witness_checkorder+0x1113 sys/kern/subr_witness.c:843
rw_enter(fffffd806cf7acf8,2) at rw_enter+0x122
uvmfault_lookup(ffff80002a117ab0,0) at uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1785
end trace frame: 0xffff80002a1179a0, count: 0
ddb{1}> trace
x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666
acpitimer_delay(1) at acpitimer_delay+0x194 acpitimer_read sys/dev/acpi/acpitimer.c:142 [inline]
acpitimer_delay(1) at acpitimer_delay+0x194 sys/dev/acpi/acpitimer.c:125
comcnputc(800,20) at comcnputc+0x29b sys/dev/ic/com.c:1269
cnputc(20) at cnputc+0x61 sys/dev/cons.c:218
db_putchar(63) at db_putchar+0x524 db_force_whitespace sys/ddb/db_output.c:102 [inline]
db_putchar(63) at db_putchar+0x524 sys/ddb/db_output.c:153
kprintf() at kprintf+0x2aba sys/kern/subr_prf.c:1065
db_printf(ffffffff83085579) at db_printf+0x9b
panic(ffffffff83076ff4) at panic+0x103 sys/kern/subr_prf.c:216
witness_checkorder(fffffd806cf7ad08,1,0) at witness_checkorder+0x1113 sys/kern/subr_witness.c:843
rw_enter(fffffd806cf7acf8,2) at rw_enter+0x122
uvmfault_lookup(ffff80002a117ab0,0) at uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1785
uvm_fault_check(ffff80002a117ab0,ffff80002a117ae8,ffff80002a117b10) at uvm_fault_check+0x47 sys/uvm/uvm_fault.c:672
uvm_fault(fffffd806cf7ac18,20000000,0,2) at uvm_fault+0x112 sys/uvm/uvm_fault.c:600
kpageflttrap(ffff80002a117c50,20000340) at kpageflttrap+0x2d0 sys/arch/amd64/amd64/trap.c:279
kerntrap(ffff80002a117c50) at kerntrap+0x14a sys/arch/amd64/amd64/trap.c:332
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x62
kern_sysctl(ffff80002a117fd4,5,20000100,ffff80002a118008,0,37,cb4a422a9747a9ae) at kern_sysctl+0x320 sys/kern/kern_sysctl.c:500
sys_sysctl(ffff8000ffff71d0,ffff80002a118140,ffff80002a118090) at sys_sysctl+0x422
syscall(ffff80002a118140) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a118140) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6ef4e97bc60, count: -24

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/15 22:53 openbsd 26dd3e34b386 bde2d81c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid kernel: protection fault trap, code=NUM
2024/09/14 02:30 openbsd 3800fc3581d8 ff60e2ca .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore kernel: protection fault trap, code=NUM
2024/09/03 09:10 openbsd 67ce4081c6b7 8045124c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid kernel: protection fault trap, code=NUM
2024/09/01 12:18 openbsd 8bcce81a6842 1eda0d14 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore kernel: protection fault trap, code=NUM
2024/08/28 20:18 openbsd cd07c7058b7d ef3de9e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid kernel: protection fault trap, code=NUM
2024/08/26 11:55 openbsd a3863cb83aca d7d32352 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore kernel: protection fault trap, code=NUM
* Struck through repros no longer work on HEAD.