syzbot


pool: free list modified: mbufpl (3)

Status: auto-obsoleted due to no activity on 2024/01/18 14:10
Reported-by: syzbot+35d783cdde9512183454@syzkaller.appspotmail.com
First crash: 198d, last: 198d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: mbufpl (4) 1 3d01h 3d01h 0/3 upstream: reported on 2024/05/02 23:52
openbsd pool: free list modified: mbufpl syz 13 1965d 1979d 3/3 fixed on 2019/01/06 10:35
openbsd pool: free list modified: mbufpl (2) syz 1781 1370d 1698d 0/3 closed as dup on 2020/05/08 06:40

Sample crash report:
login: panic: pool_do_get: mbufpl free list modified: page 0xfffffd807a8c4000; item addr 0xfffffd807a8c4600; offset 0x0=0x0 != 0xd7beed5cf24e1e7a
Starting stack trace...
panic(ffffffff8282f0b0) at panic+0x159 sys/kern/subr_prf.c:229
pool_do_get(ffffffff82c81970,2,ffff80002167b658) at pool_do_get+0x427 sys/kern/subr_pool.c:738
pool_get(ffffffff82c81970,2) at pool_get+0xb7 sys/kern/subr_pool.c:582
m_copym(fffffd806838c900,16d4,5a8,2) at m_copym+0x1b2 m_get sys/kern/uipc_mbuf.c:244 [inline]
m_copym(fffffd806838c900,16d4,5a8,2) at m_copym+0x1b2 sys/kern/uipc_mbuf.c:661
tcp_chopper(fffffd806838c900,ffff80002167b828,ffff80000019e2a8,5a8) at tcp_chopper+0x3c7 sys/netinet/tcp_output.c:1291
tcp_if_output_tso(ffff80000019e2a8,ffff80002167b9e8,ffff8000006c6d60,fffffd806f2792a0,1000,5dc) at tcp_if_output_tso+0x107 sys/netinet/tcp_output.c:1383
if_output_tso(ffff80000019e2a8,ffff80002167b9e8,ffff8000006c6d60,fffffd806f2792a0,5dc) at if_output_tso+0x8f sys/net/if.c:917
ip_output(fffffd806838c900,0,fffffd806f3631c8,800,0,fffffd806f363150,87305c8f162e8349) at ip_output+0xe9f sys/netinet/ip_output.c:456
tcp_output(ffff800000cea328) at tcp_output+0x2727 sys/netinet/tcp_output.c:1089
tcp_send(fffffd806e5c63a0,fffffd806838c800,0,0) at tcp_send+0xf5 sys/netinet/tcp_usrreq.c:849
sosend(fffffd806e5c63a0,0,ffff80002167be18,0,0,80) at sosend+0x66d
dofilewritev(ffff800021634a98,4,ffff80002167be18,0,ffff80002167bf00) at dofilewritev+0x1a0 sys/kern/sys_generic.c:375
sys_write(ffff800021634a98,ffff80002167beb0,ffff80002167bf00) at sys_write+0x87 sys/kern/sys_generic.c:295
syscall(ffff80002167bf80) at syscall+0x4a8 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f0e0f8689a0, count: 242
End of stack trace.

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/10/20 14:09 openbsd 77568e37aedd 361b23dc .config console log report ci-openbsd-main pool: free list modified: mbufpl
* Struck through repros no longer work on HEAD.