syzbot


kernel: protection fault trap, code=NUM (3)

Status: closed as invalid on 2022/03/22 11:48
Reported-by: syzbot+11a3a9af75836be66279@syzkaller.appspotmail.com
First crash: 765d, last: 765d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd kernel: protection fault trap, code=NUM (5) 2 605d 606d 0/3 closed as dup on 2022/08/29 15:02
openbsd kernel: protection fault trap, code=NUM (2) C 16 847d 870d 0/3 closed as invalid on 2021/12/31 06:19
openbsd kernel: protection fault trap, code=NUM 1 950d 950d 0/3 closed as invalid on 2021/09/18 05:58
openbsd kernel: protection fault trap, code=NUM (4) 1 728d 728d 0/3 closed as invalid on 2022/04/28 06:52
openbsd kernel: protection fault trap, code=NUM (6) 40 7d15h 531d 0/3 upstream: reported on 2022/11/10 22:10

Sample crash report:
exclusive kernel: protection fault trap, code=0
Faulted in DDB; continuing...
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10175   6479K    6895K  78643K     12127        0
            pcb    46     10K      10K  78643K       113        0
         rtable   216      6K       7K  78643K       395        0
         ifaddr    79     16K      17K  78643K       105        0
         sysctl     2      0K       0K  78643K         2        0
       counters    54     35K      35K  78643K        62        0
       ioctlops     0      0K       4K  78643K      1569        0
            iov     0      0K      16K  78643K        30        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         5        0
         vnodes  1349     84K      84K  78643K      1623        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K        14        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       0K  78643K        26        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    13     45K      89K  78643K       468        0
          sigio     0      0K       0K  78643K        75        0
           proc    67     87K     111K  78643K       534        0
        subproc   104      6K       7K  78643K       117        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     1      0K       0K  78643K         5        0
       in_multi    90      6K       6K  78643K       120        0
    ether_multi     2      0K       0K  78643K         6        0
            mrt     0      0K       0K  78643K         6        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    49    228K     228K  78643K        49        0
           exec     0      0K       2K  78643K       679        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   350    181K     181K  78643K      7551        0
       UVM aobj    18      2K       2K  78643K        23        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     2      0K       0K  78643K        12        0
            NDP    11      0K       1K  78643K        33        0
           temp    94   4699K    4763K  78643K      8813        0
         kqueue    12     18K      20K  78643K        34        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120       45    0       42     1     0     1     1     0     8    0
rtentry    112      124    0       25     4     0     4     4     0     8    0
unpcb      136       84    0       69     1     0     1     1     0     8    0
syncache   296        4    0        4     1     1     0     1     0     8    0
tcpqe       32     1013    0     1013     2     2     0     2     0     8    0
tcpcb      736      136    0       94     7     0     7     7     0     8    3
arp        120       20    0        4     1     0     1     1     0     8    0
inpcb      312      516    0      443    10     4     6     6     0     8    0
rttmr       72        2    0        2     1     1     0     1     0     8    0
nd6         48       27    0        6     1     0     1     1     0     8    0
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1248       2    0        2     1     1     0     1     0     8    0
pffrent     40        3    0        3     1     0     1     1     0     8    1
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       32    0       12     1     0     1     1     0     8    0
pfstkey    112       32    0       12     1     0     1     1     0     8    0
pfstate    320       32    0       12     2     0     2     2     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      497    0       88    29     0    29    29     0     8    2
art_table   32      498    0       88     4     0     4     4     0     8    0
art_node    16      123    0       33     1     0     1     1     0     8    0
sysvmsgpl   40       16    0       13     1     0     1     1     0     8    0
semapl     112       20    0       10     1     0     1     1     0     8    0
shmpl      112       20    0        5     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1926    0      484    91     0    91    91     0     8    0
ffsino     272     1926    0      484    97     0    97    97     0     8    0
nchpl      144     2576    0      941    62     0    62    62     0     8    0
uvmvnodes   80     2297    0        0    47     0    47    47     0     8    0
vnodes     224     2297    0        0   136     0   136   136     0     8    0
namei      1024    9037    0     9037     4     3     1     2     0     8    1
percpumem   16       43    0        4     1     0     1     1     0     8    0
vcpupl     2048       7    0        0     1     0     1     1     0     8    0
vmpool     560        8    0        1     1     0     1     1     0     8    0
scxspl     216     7998    0     7998     9     8     1     8     0     8    1
plimitpl   152       32    0       17     1     0     1     1     0     8    0
sigapl     424      768    0      723     7     1     6     6     0     8    0
futexpl     64     2568    0     2566     1     0     1     1     0     8    0
knotepl    120      108    0        0     4     0     4     4     0     8    0
kqueuepl   216       43    0       35     1     0     1     1     0     8    0
pipepl     336      166    0      138     3     0     3     3     0     8    0
fdescpl    496      754    0      728     6     2     4     5     0     8    0
filepl     152     3778    0     3473    19     3    16    16     0     8    4
lockfpl    104       77    0       75     1     0     1     1     0     8    0
lockfspl    48       38    0       36     1     0     1     1     0     8    0
sessionpl  144       25    0        8     1     0     1     1     0     8    0
pgrppl      48       25    0        8     1     0     1     1     0     8    0
ucredpl     96      376    0      363     1     0     1     1     0     8    0
zombiepl   144      728    0      723     2     1     1     1     0     8    0
processpl  1064     768    0      723     4     0     4     4     0     8    0
procpl     672     1456    0     1393     7     0     7     7     0     8    1
srpgc       96        4    0        4     2     1     1     1     0     8    1
sockpl     480      645    0      553    19     7    12    13     0     8    0
mcl64k     65536     11    0        0     2     0     2     2     0     8    0
mcl16k     16384      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      3    0        0     1     0     1     1     0     8    0
mcl9k      9216       4    0        0     1     0     1     1     0     8    0
mcl8k      8192       5    0        0     1     0     1     1     0     8    0
mcl4k      4096       9    0        0     2     0     2     2     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048     298    0        0    37     0    37    37     0     8    0
mtagpl      96       39    0        0     1     0     1     1     0     8    0
mbufpl     256      399    0        0    23     0    23    23     0     8    0
bufpl      288     4238    0      146   293     0   293   293     0     8    0
anonpl      24   165725    0   146489   123     4   119   119     0   186    0
amapchunkpl 152   17475    0    16588    38     2    36    36     0   158    0
amappl16   200     1458    0      901    31     1    30    30     0     8    0
amappl15   192      118    0      113     1     0     1     1     0     8    0
amappl14   184       14    0       11     1     0     1     1     0     8    0
amappl13   176       93    0       90     1     0     1     1     0     8    0
amappl12   168      109    0      103     1     0     1     1     0     8    0
amappl11   160      106    0       88     1     0     1     1     0     8    0
amappl10   152      134    0      122     1     0     1     1     0     8    0
amappl9    144      546    0      540     1     0     1     1     0     8    0
amappl8    136      637    0      590     2     0     2     2     0     8    0
amappl7    128      174    0      161     1     0     1     1     0     8    0
amappl6    120      271    0      250     2     1     1     2     0     8    0
amappl5    112      584    0      562     1     0     1     1     0     8    0
amappl4    104      922    0      896     2     1     1     2     0     8    0
amappl3     96      280    0      265     1     0     1     1     0     8    0
amappl2     88      603    0      553     3     1     2     3     0     8    0
amappl1     80    16880    0    16289    19     5    14    19     0     8    0
amappl      88     7075    0     6808     8     1     7     7     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       22    0        5     1     0     1     1     0     8    0
uaddrrnd    24      762    0      726     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      762    0      726     1     0     1     1     0     8    0
vmmpekpl   168     9990    0     9923     4     0     4     4     0     8    0
vmmpepl    168    73092    0    70562   138    22   116   135     0   357    0
vmsppl     368      761    0      726     6     2     4     4     0     8    0
rwobjpl     56    20918    0    17038    58     2    56    56     0     8    0
pdppl      4096    1531    0     1459   117    41    76    81     0     8    4
pvpl        32   415823    0   392313   265    35   230   263     0   265   36
pmappl     248      761    0      726     4     1     3     3     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112      733    0       53    20     0    20    20     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffffffff8294dff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
x86_bus_space_io_write_1(3f8,0,28) at x86_bus_space_io_write_1+0x31 sys/arch/amd64/amd64/bus_space.c:759
comcnputc(800,28) at comcnputc+0x128 bus_space_barrier machine/bus.h:481 [inline]
comcnputc(800,28) at comcnputc+0x128 sys/dev/ic/com.c:1263
cnputc(28) at cnputc+0x4b sys/dev/cons.c:239
db_putchar(28) at db_putchar+0x3fc sys/ddb/db_output.c:155
kprintf() at kprintf+0x20ec sys/kern/subr_prf.c:1068
db_printf(ffffffff82608896) at db_printf+0x85 sys/kern/subr_prf.c:502
panic(ffffffff825a56b6) at panic+0xd7 sys/kern/subr_prf.c:220
witness_checkorder(ffffffff82b47030,9,0) at witness_checkorder+0x116d sys/kern/subr_witness.c:833
__mp_lock(ffffffff82b46e28) at __mp_lock+0xa1 read_rflags machine/cpufunc.h:195 [inline]
__mp_lock(ffffffff82b46e28) at __mp_lock+0xa1 intr_disable machine/cpufunc.h:216 [inline]
__mp_lock(ffffffff82b46e28) at __mp_lock+0xa1 sys/kern/kern_lock.c:142
selwakeup(fffffd8066371568) at selwakeup+0x16 klist_empty sys/sys/event.h:361 [inline]
selwakeup(fffffd8066371568) at selwakeup+0x16 sys/kern/sys_generic.c:885
sorwakeup(fffffd8066371450) at sorwakeup+0xc9 sys/kern/uipc_socket.c:1699
end trace frame: 0xffff800023e75900, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff8294dff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
x86_bus_space_io_write_1(3f8,0,28) at x86_bus_space_io_write_1+0x31 sys/arch/amd64/amd64/bus_space.c:759
comcnputc(800,28) at comcnputc+0x128 bus_space_barrier machine/bus.h:481 [inline]
comcnputc(800,28) at comcnputc+0x128 sys/dev/ic/com.c:1263
cnputc(28) at cnputc+0x4b sys/dev/cons.c:239
db_putchar(28) at db_putchar+0x3fc sys/ddb/db_output.c:155
kprintf() at kprintf+0x20ec sys/kern/subr_prf.c:1068
db_printf(ffffffff82608896) at db_printf+0x85 sys/kern/subr_prf.c:502
panic(ffffffff825a56b6) at panic+0xd7 sys/kern/subr_prf.c:220
witness_checkorder(ffffffff82b47030,9,0) at witness_checkorder+0x116d sys/kern/subr_witness.c:833
__mp_lock(ffffffff82b46e28) at __mp_lock+0xa1 read_rflags machine/cpufunc.h:195 [inline]
__mp_lock(ffffffff82b46e28) at __mp_lock+0xa1 intr_disable machine/cpufunc.h:216 [inline]
__mp_lock(ffffffff82b46e28) at __mp_lock+0xa1 sys/kern/kern_lock.c:142
selwakeup(fffffd8066371568) at selwakeup+0x16 klist_empty sys/sys/event.h:361 [inline]
selwakeup(fffffd8066371568) at selwakeup+0x16 sys/kern/sys_generic.c:885
sorwakeup(fffffd8066371450) at sorwakeup+0xc9 sys/kern/uipc_socket.c:1699
rip6_input(ffff800023e75c08,ffff800023e75c14,3a,18) at rip6_input+0x692 sys/netinet6/raw_ip6.c:224
icmp6_input(ffff800023e75c08,ffff800023e75c14,3a,18) at icmp6_input+0x8e8 sys/netinet6/icmp6.c:762
ip_deliver(ffff800023e75c08,ffff800023e75c14,3a,18) at ip_deliver+0x322 sys/netinet/ip_input.c:657
ip6_input_if(ffff800023e75c08,ffff800023e75c14,29,0,ffff80000019f2a8) at ip6_input_if+0x920
ipv6_input(ffff80000019f2a8,fffffd8072db8700) at ipv6_input+0x48 sys/netinet6/ip6_input.c:169
if_input_local(ffff80000019f2a8,fffffd8072db8700,18) at if_input_local+0x136 sys/net/if.c:778
ip6_output(fffffd806a823b00,ffff800000c23980,fffffd806bc69a60,0,0,fffffd806bc699e8) at ip6_output+0xf57
rip6_output(fffffd807f00eb00,fffffd8068fa7070,ffff800023e75f70,0) at rip6_output+0x4ad sys/netinet6/raw_ip6.c:490
rip6_usrreq(fffffd8068fa7070,9,fffffd807f00eb00,0,0,ffff8000ffff4a80) at rip6_usrreq+0x5d3 sys/netinet6/raw_ip6.c:679
sosend(fffffd8068fa7070,0,ffff800023e761a8,0,0,0) at sosend+0x632 sys/kern/uipc_socket.c:582
dofilewritev(ffff8000ffff4a80,4,ffff800023e761a8,0,ffff800023e762a0) at dofilewritev+0x19c sys/kern/sys_generic.c:381
sys_write(ffff8000ffff4a80,ffff800023e76248,ffff800023e762a0) at sys_write+0x83 sys/kern/sys_generic.c:301
syscall(ffff800023e76310) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800023e76310) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xcfb32a2fad0, count: -28
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff8258f849) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff826021d1,ffffffff826102ef,aae,ffffffff825c283e) at __assert+0x25 sys/kern/subr_prf.c:161
uvm_map_teardown(fffffd80753ab468) at uvm_map_teardown+0x2e8 sys/uvm/uvm_map.c:2736
uvmspace_free(fffffd80753ab468) at uvmspace_free+0xa6 sys/uvm/uvm_map.c:3685
reaper(ffff8000210f9a40) at reaper+0x18b sys/kern/kern_exit.c:457
end trace frame: 0x0, count: 9
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff8258f849) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff826021d1,ffffffff826102ef,aae,ffffffff825c283e) at __assert+0x25 sys/kern/subr_prf.c:161
uvm_map_teardown(fffffd80753ab468) at uvm_map_teardown+0x2e8 sys/uvm/uvm_map.c:2736
uvmspace_free(fffffd80753ab468) at uvmspace_free+0xa6 sys/uvm/uvm_map.c:3685
reaper(ffff8000210f9a40) at reaper+0x18b sys/kern/kern_exit.c:457
end trace frame: 0x0, count: -6

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/03/22 01:02 openbsd 4ff57d1d979c e2d91b1d .config console log report ci-openbsd-multicore kernel: protection fault trap, code=NUM
* Struck through repros no longer work on HEAD.