syzbot


uvm_fault: wsevent_fini

Status: fixed on 2020/03/24 16:19
Reported-by: syzbot+34c3041bfd96c888c8bd@syzkaller.appspotmail.com
Fix commit: be78d62e13f6 Ensure that me_evp is still NULL before assignment during open of wscons devices. This condition is checked early on during open but since the same routine could end up sleeping before assigning me_evp, a race against adding the same wscons device to a wsmux could be lost. This in turn can cause a NULL deference during close.
First crash: 920d, last: 920d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: wsevent_fini (2) 1 808d 808d 3/3 fixed on 2020/07/30 07:21
openbsd uvm_fault: wsevent_fini (3) C 2 660d 660d 3/3 fixed on 2020/12/06 19:54

Sample crash report:
uvm_fault(0xfffffd807f0002e0, 0x28, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      wsevent_fini+0x12:      movq    0x28(%r14),%r15
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
kernel page fault
uvm_fault(0xfffffd807f0002e0, 0x28, 0, 1) -> e
wsevent_fini(0) at wsevent_fini+0x12 sys/dev/wscons/wsevent.c:130
end trace frame: 0xffff800021fbd0a0, count: 0
ddb{1}> trace
wsevent_fini(0) at wsevent_fini+0x12 sys/dev/wscons/wsevent.c:130
wsmouseclose(4400,1,2000,ffff800020ac6768) at wsmouseclose+0x92 sys/dev/wscons/wsmouse.c:360
spec_close(ffff800021fbd120) at spec_close+0x311 sys/kern/spec_vnops.c:555
VOP_CLOSE(fffffd806e2f35b8,1,fffffd807f7bf7e0,ffff800020ac6768) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:174
vn_closefile(fffffd80682c4ed8,ffff800020ac6768) at vn_closefile+0xd7 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd80682c4ed8,ffff800020ac6768) at vn_closefile+0xd7 sys/kern/vfs_vnops.c:614
fdrop(fffffd80682c4ed8,ffff800020ac6768) at fdrop+0xc2 sys/kern/kern_descrip.c:1276
closef(fffffd80682c4ed8,ffff800020ac6768) at closef+0x11c sys/kern/kern_descrip.c:1260
fdfree(ffff800020ac6768) at fdfree+0x101 sys/kern/kern_descrip.c:1192
exit1(ffff800020ac6768,0,0,1) at exit1+0x32c sys/kern/kern_exit.c:197
sys_exit(ffff800020ac6768,ffff800021fbd3b0,ffff800021fbd400) at sys_exit+0x16 sys/kern/kern_exit.c:95
syscall(ffff800021fbd480) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800021fbd480) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffef7b0, count: -12
ddb{1}> show registers
rdi                                0
rsi               0xffff800020ac676c
rbp               0xffff800021fbd050
rbx                                0
rdx               0xffff800020ac6768
rcx                                0
rax                                0
r8                0xffffffff8131bee7    witness_assert+0x207
r9                               0x5
r10                             0x14
r11               0x11db9c8b4ff54699
r12                           0x4000    __ALIGN_SIZE+0x3000
r13                           0x2000    __ALIGN_SIZE+0x1000
r14                                0
r15                                0
rip               0xffffffff81db55e2    wsevent_fini+0x12
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800021fbd030
ss                              0x10
wsevent_fini+0x12:      movq    0x28(%r14),%r15
ddb{1}> show proc
PROC (syz-executor.0) pid=493303 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    pri=0, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff800020ac64f8,0xffffffff82636ea8
    process=0xffff800020a92f88 user=0xffff800021fb8000, vmspace=0xfffffd807f0002e0
    estcpu=36, cpticks=6, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  5955  178768      0      0  3     0x14200  bored         sosplice
 31499   35471  68434      0  3        0x82  nanosleep     syz-executor.1
 99234  117402  68434      0  3        0x82  nanosleep     syz-executor.0
 68434   85168  68226      0  3        0x82  thrsleep      syz-fuzzer
 68434  219749  68226      0  3   0x4000082  thrsleep      syz-fuzzer
 68434  411115  68226      0  3   0x4000082  thrsleep      syz-fuzzer
 68434  203200  68226      0  3   0x4000082  thrsleep      syz-fuzzer
 68434  267283  68226      0  3   0x4000082  thrsleep      syz-fuzzer
 68434  435396  68226      0  3   0x4000082  kqread        syz-fuzzer
 68434  207052  68226      0  3   0x4000082  thrsleep      syz-fuzzer
 68434  380881  68226      0  3   0x4000082  thrsleep      syz-fuzzer
 68434  328935  68226      0  3   0x4000082  thrsleep      syz-fuzzer
 68434   43767  68226      0  3   0x4000082  thrsleep      syz-fuzzer
 68226  518479  33926      0  3    0x10008a  pause         ksh
 33926  366988  22993      0  3        0x92  select        sshd
 14007  239585      1      0  3    0x100083  ttyin         getty
 22993  389248      1      0  3        0x80  select        sshd
 51705  519979  29548     74  3    0x100092  bpf           pflogd
 29548  218915      1      0  3        0x80  netio         pflogd
 62998  304312  53723     73  3    0x100090  kqread        syslogd
 53723  338151      1      0  3    0x100082  netio         syslogd
 18925  452317      1     77  3    0x100090  poll          dhclient
 71600  403730      1      0  3        0x80  poll          dhclient
 50767  168233      0      0  3     0x14200  bored         smr
   365  507839      0      0  3     0x14200  pgzero        zerothread
 33350  338188      0      0  3     0x14200  aiodoned      aiodoned
  8178  357431      0      0  3     0x14200  syncer        update
 88228  496516      0      0  3     0x14200  cleaner       cleaner
 30761  320300      0      0  3     0x14200  reaper        reaper
 33048  319619      0      0  3     0x14200  pgdaemon      pagedaemon
 61837  505975      0      0  3     0x14200  bored         crynlk
 30008  219093      0      0  3     0x14200  bored         crypto
 79149  478220      0      0  3  0x40014200  acpi0         acpi0
  1385  180970      0      0  3  0x40014200                idle1
 93854  101158      0      0  3     0x14200  bored         softnet
 25316  499890      0      0  3     0x14200  bored         systqmp
 73447  315040      0      0  3     0x14200  bored         systq
 34899  262912      0      0  3  0x40014200  bored         softclock
 14415  122704      0      0  7  0x40014200                idle0
     1   31723      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9483   6401K    6670K  78643K     10991        0
            pcb    13      8K       8K  78643K        73        0
         rtable   104      3K       4K  78643K       288        0
         ifaddr    53     12K      13K  78643K       100        0
       counters    43     33K      34K  78643K        61        0
       ioctlops     0      0K       4K  78643K      1481        0
            iov     0      0K      24K  78643K        72        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1222     77K      77K  78643K      1331        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         4        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       0K  78643K        13        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1809    196K     290K  78643K     12766        0
      file desc     5     13K      25K  78643K       206        0
           proc    62     63K      95K  78643K       441        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        32        0
       in_multi    46      2K       3K  78643K        85        0
    ether_multi     1      0K       0K  78643K         9        0
            mrt     0      0K       0K  78643K         4        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    49    228K     228K  78643K        49        0
           exec     0      0K       1K  78643K       218        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   106     54K      54K  78643K      1613        0
       UVM aobj     8      3K       4K  78643K        13        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        58        0
            NDP     7      0K       0K  78643K        21        0
           temp    86   3043K    3107K  78643K      3433        0
         kqueue     3      4K      10K  78643K        31        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        8    0        2     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       88    0       86     1     0     1     1     0     8    0
rtentry    112       56    0       14     2     0     2     2     0     8    0
unpcb      120      108    0       96     1     0     1     1     0     8    0
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpqe       32       24    0       24     1     1     0     1     0     8    0
tcpcb      544      108    0      104     1     0     1     1     0     8    0
inpcb      280      297    0      290     2     0     2     2     0     8    1
nd6         48        7    0        3     1     0     1     1     0     8    0
ppxss      1128       4    0        4     1     0     1     1     0     8    1
pffrag     232        2    0        2     1     0     1     1     0   482    1
pffrnode    88        2    0        2     1     0     1     1     0     8    1
pffrent     40        4    0        4     1     0     1     1     0     8    1
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       25    0        3     1     0     1     1     0     8    0
pfstkey    112       25    0        3     1     0     1     1     0     8    0
pfstate    328       25    0        3     2     0     2     2     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      232    0       49    13     0    13    13     0     8    0
art_table   32      234    0       49     2     0     2     2     0     8    0
art_node    16       55    0       16     1     0     1     1     0     8    0
sysvmsgpl   40       26    0       14     1     0     1     1     0     8    0
semapl     112       11    0        1     1     0     1     1     0     8    0
shmpl      112       11    0        5     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1681    0      275    46     0    46    46     0     8    0
ffsino     272     1681    0      275    94     0    94    94     0     8    0
nchpl      144     2185    0      567    61     0    61    61     0     8    0
uvmvnodes   72     1796    0        0    33     0    33    33     0     8    0
vnodes     208     1796    0        0    95     0    95    95     0     8    0
namei      1024    5810    0     5810     1     0     1     1     0     8    1
percpumem   16       41    0        9     1     0     1     1     0     8    0
vcpupl     1984       3    0        0     1     0     1     1     0     8    0
vmpool     560        5    0        2     1     0     1     1     0     8    0
scsiplug    64        1    0        1     1     1     0     1     0     8    0
scxspl     192     6541    0     6541     5     4     1     4     0     8    1
plimitpl   152       21    0       13     1     0     1     1     0     8    0
sigapl     424      422    0      390     4     0     4     4     0     8    0
futexpl     56     3147    0     3147     1     0     1     1     0     8    1
knotepl    112       90    0       71     1     0     1     1     0     8    0
kqueuepl   144      130    0      128     1     0     1     1     0     8    0
pipelkpl    48       97    0       87     1     0     1     1     0     8    0
pipepl     120      194    0      175     1     0     1     1     0     8    0
fdescpl    496      406    0      390     3     0     3     3     0     8    0
filepl     152     2558    0     2445     6     1     5     5     0     8    0
lockfpl    104       42    0       41     1     0     1     1     0     8    0
lockfspl    48       16    0       15     1     0     1     1     0     8    0
sessionpl  112       18    0        7     1     0     1     1     0     8    0
pgrppl      48       18    0        7     1     0     1     1     0     8    0
ucredpl     96      178    0      169     1     0     1     1     0     8    0
zombiepl   144      391    0      389     1     0     1     1     0     8    0
processpl  984      422    0      389     6     1     5     5     0     8    0
procpl     624      842    0      800     4     0     4     4     0     8    0
sosppl     128        3    0        3     1     1     0     1     0     8    0
sockpl     400      493    0      472     3     0     3     3     0     8    0
mcl64k     65536      7    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096       4    0        0     1     0     1     1     0     8    0
mcl2k2     2112       3    0        0     1     0     1     1     0     8    0
mcl2k      2048     161    0        0    20     0    20    20     0     8    0
mtagpl      80       15    0        0     1     0     1     1     0     8    0
mbufpl     256      174    0        0    11     0    11    11     0     8    0
bufpl      280     4392    0      173   302     0   302   302     0     8    0
anonpl      16    50146    0    36737    65     6    59    64     0   124    3
amapchunkpl 152    3386    0     3243    20     3    17    20     0   158   10
amappl16   192     1620    0      882    38     0    38    38     0     8    0
amappl15   184        2    0        0     1     0     1     1     0     8    0
amappl14   176        9    0        7     2     1     1     1     0     8    0
amappl13   168       35    0       33     1     0     1     1     0     8    0
amappl12   160        9    0        8     2     1     1     1     0     8    0
amappl11   152      158    0      138     1     0     1     1     0     8    0
amappl10   144      118    0      109     1     0     1     1     0     8    0
amappl9    136      389    0      386     1     0     1     1     0     8    0
amappl8    128      301    0      288     1     0     1     1     0     8    0
amappl7    120      208    0      196     1     0     1     1     0     8    0
amappl6    112      107    0      103     1     0     1     1     0     8    0
amappl5    104      306    0      290     1     0     1     1     0     8    0
amappl4     96      510    0      478     2     1     1     2     0     8    0
amappl3     88      112    0      106     1     0     1     1     0     8    0
amappl2     80     2325    0     2256     3     1     2     3     0     8    0
amappl1     72    19065    0    18616    25    14    11    20     0     8    0
amappl      80     1102    0     1055     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       12    0        5     1     0     1     1     0     8    0
uaddrrnd    24      411    0      392     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      411    0      392     1     0     1     1     0     8    0
vmmpekpl   168     7066    0     7036     2     0     2     2     0     8    0
vmmpepl    168    56371    0    54481    99    11    88    94     0   357    1
vmsppl     368      410    0      392     2     0     2     2     0     8    0
pdppl      4096     830    0      787     6     0     6     6     0     8    0
pvpl        32   171430    0   154977   159     6   153   158     0   265   18
pmappl     232      410    0      392     2     0     2     2     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      168    0        3     5     0     5     5     0     8    0

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2020/03/18 21:51 openbsd 27a9da7eb1aa 2c31c529 .config log report
* Struck through repros no longer work on HEAD.