syzbot


panic: uvm_fault_unwire_locked: address not in map (2)

Status: auto-closed as invalid on 2019/10/25 08:37
Reported-by: syzbot+af6bdd2a9ef1720cc969@syzkaller.appspotmail.com
First crash: 1465d, last: 1337d
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: uvm_fault_unwire_locked: address not in map C 2 1499d 1499d 3/3 fixed on 2019/01/11 00:09
openbsd panic: uvm_fault_unwire_locked: address not in map (4) C 12 25d 304d 0/3 upstream: reported C repro on 2022/04/04 00:45
openbsd panic: uvm_fault_unwire_locked: address not in map (3) 1 409d 409d 3/3 fixed on 2021/12/22 03:26

Sample crash report:
panic: uvm_fault_unwire_locked: address not in map
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 184839  34874  32767        0x10          0    0  syz-executor.1
*412273  34874  32767        0x10  0x4000000    1K syz-executor.1
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:212
uvm_fault_unwire_locked(fffffd807effd170,21a683000,21a683000) at uvm_fault_unwire_locked+0x332
uvm_map_pageable_wire(fffffd807effd170,fffffd806a9c4010,fffffd806b2fee10,ffff800020bee000,3,3) at uvm_map_pageable_wire+0x5e0 sys/uvm/uvm_map.c:2370
uvm_map_protect(fffffd807effd170,20ffc000,21000000,1,0) at uvm_map_protect+0x6f4 sys/uvm/uvm_map.c:3380
syscall(ffff800021ff9e80) at syscall+0x552 mi_syscall sys/sys/syscall_mi.h:90 [inline]
syscall(ffff800021ff9e80) at syscall+0x552 sys/arch/amd64/amd64/trap.c:554
Xsyscall(6,0,ffffffffffffff97,0,3,1a8c3010) at Xsyscall+0x128
end of kernel
end trace frame: 0x21d17bbb0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
uvm_fault_unwire_locked: address not in map
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:212
uvm_fault_unwire_locked(fffffd807effd170,21a683000,21a683000) at uvm_fault_unwire_locked+0x332
uvm_map_pageable_wire(fffffd807effd170,fffffd806a9c4010,fffffd806b2fee10,ffff800020bee000,3,3) at uvm_map_pageable_wire+0x5e0 sys/uvm/uvm_map.c:2370
uvm_map_protect(fffffd807effd170,20ffc000,21000000,1,0) at uvm_map_protect+0x6f4 sys/uvm/uvm_map.c:3380
syscall(ffff800021ff9e80) at syscall+0x552 mi_syscall sys/sys/syscall_mi.h:90 [inline]
syscall(ffff800021ff9e80) at syscall+0x552 sys/arch/amd64/amd64/trap.c:554
Xsyscall(6,0,ffffffffffffff97,0,3,1a8c3010) at Xsyscall+0x128
end of kernel
end trace frame: 0x21d17bbb0, count: -7
ddb{1}> show registers
rdi               0xffffffff8172c2d7    db_enter+0x17
rsi                           0x1598    __ALIGN_SIZE+0x598
rbp               0xffff800021ff9b00
rbx               0xffff800021ff9bb0
rdx                           0x1599    __ALIGN_SIZE+0x599
rcx               0xffff800020bee000
rax               0xffff800020bee000
r8                0xffffffff810de823    kprintf+0x173
r9                               0x1
r10                             0x25
r11               0x24eead30984cdcfb
r12                     0x3000000008
r13               0xffff800021ff9b10
r14                            0x100
r15                              0x1
rip               0xffffffff8172c2d8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800021ff9af0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.1) pid=412273 stat=onproc
    flags process=10<SUGID> proc=4000000<THREAD>
    pri=73, usrpri=73, nice=20
    forw=0xffffffffffffffff, list=0xffff800020b39878,0xffffffff82347f00
    process=0xffff800020b3ad30 user=0xffff800021ff4000, vmspace=0xfffffd807effd170
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 34874  184839  69906  32767  7        0x10                syz-executor.1
*34874  412273  69906  32767  7   0x4000010                syz-executor.1
 69906   75578  70032  32767  3        0x90  nanosleep     syz-executor.1
 70032  236985  82041      0  3        0x82  wait          syz-executor.1
 12023  501308      0      0  3     0x14200  bored         sosplice
 82041  210119   9580      0  3        0x82  thrsleep      syz-fuzzer
 82041  357222   9580      0  3   0x4000082  nanosleep     syz-fuzzer
 82041  419154   9580      0  3   0x4000082  thrsleep      syz-fuzzer
 82041  115746   9580      0  3   0x4000082  thrsleep      syz-fuzzer
 82041   78923   9580      0  3   0x4000082  nanosleep     syz-fuzzer
 82041   34477   9580      0  3   0x4000082  thrsleep      syz-fuzzer
 82041  345414   9580      0  3   0x4000082  thrsleep      syz-fuzzer
 82041   26243   9580      0  3   0x4000082  thrsleep      syz-fuzzer
 82041  251794   9580      0  3   0x4000082  thrsleep      syz-fuzzer
 82041  358431   9580      0  3   0x4000082  kqread        syz-fuzzer
  9580  466269  57569      0  3    0x10008a  pause         ksh
 57569  479705  20645      0  3        0x92  select        sshd
 52319  473652      1      0  3    0x100083  ttyin         getty
 20645  404337      1      0  3        0x80  select        sshd
 92858  309705  30086     73  3    0x100090  kqread        syslogd
 30086  328417      1      0  3    0x100082  netio         syslogd
 81845  136814      1     77  3    0x100090  poll          dhclient
 13193  461569      1      0  3        0x80  poll          dhclient
 27364  293242      0      0  3     0x14200  pgzero        zerothread
 74373  494876      0      0  3     0x14200  aiodoned      aiodoned
 12220  368458      0      0  3     0x14200  syncer        update
 91900  164803      0      0  3     0x14200  cleaner       cleaner
 25573  182522      0      0  3     0x14200  reaper        reaper
 69943   84095      0      0  3     0x14200  pgdaemon      pagedaemon
 87486   11872      0      0  3     0x14200  bored         crynlk
 39943  485836      0      0  3     0x14200  bored         crypto
 12552  265951      0      0  3  0x40014200  acpi0         acpi0
 95031  256036      0      0  3  0x40014200                idle1
 69168   60277      0      0  3     0x14200  bored         softnet
 90103  279817      0      0  3     0x14200  bored         systqmp
 38017  301654      0      0  3     0x14200  bored         systq
 67575  344185      0      0  3  0x40014200  bored         softclock
 24751  439070      0      0  3  0x40014200                idle0
 33548  213092      0      0  3     0x14200  bored         smr
     1   78368      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
CPU 1:
exclusive mutex &uvm.pageqlock r = 0 (0xffffffff82394bb0)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1161
#1  mtx_enter_try+0x102
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  uvm_fault_unwire_locked+0x61 sys/uvm/uvm_fault.c:1344
#4  uvm_map_pageable_wire+0x5e0 sys/uvm/uvm_map.c:2370
#5  uvm_map_protect+0x6f4 sys/uvm/uvm_map.c:3380
#6  syscall+0x552 mi_syscall sys/sys/syscall_mi.h:90 [inline]
#6  syscall+0x552 sys/arch/amd64/amd64/trap.c:554
#7  Xsyscall+0x128
Process 34874 (syz-executor.1) thread 0xffff800020b39608 (412273)
exclusive rwlock vmmaplk r = 0 (0xfffffd807effd188)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1161
#1  uvm_map_pageable_wire+0x35a vm_map_unbusy_ln sys/uvm/uvm_map.c:5433 [inline]
#1  uvm_map_pageable_wire+0x35a sys/uvm/uvm_map.c:2351
#2  uvm_map_protect+0x6f4 sys/uvm/uvm_map.c:3380
#3  syscall+0x552 mi_syscall sys/sys/syscall_mi.h:90 [inline]
#3  syscall+0x552 sys/arch/amd64/amd64/trap.c:554
#4  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8239dcf0)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1161
#1  syscall+0x412 mi_syscall sys/sys/syscall_mi.h:81 [inline]
#1  syscall+0x412 sys/arch/amd64/amd64/trap.c:554
#2  Xsyscall+0x128
exclusive mutex &uvm.pageqlock r = 0 (0xffffffff82394bb0)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1161
#1  mtx_enter_try+0x102
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  uvm_fault_unwire_locked+0x61 sys/uvm/uvm_fault.c:1344
#4  uvm_map_pageable_wire+0x5e0 sys/uvm/uvm_map.c:2370
#5  uvm_map_protect+0x6f4 sys/uvm/uvm_map.c:3380
#6  syscall+0x552 mi_syscall sys/sys/syscall_mi.h:90 [inline]
#6  syscall+0x552 sys/arch/amd64/amd64/trap.c:554
#7  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9455   6319K    6321K  78643K     10922        0        0
            pcb    23      9K      10K  78643K      1669        0        0
         rtable    83      2K       3K  78643K      3534        0        0
         ifaddr    31     11K      12K  78643K       502        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       2K  78643K       152        0        0
            iov     0      0K      32K  78643K       255        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1209     76K      76K  78643K      3199        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        48        0        0
         VM map     2      1K       1K  78643K         2        0        0
            sem    12      0K       0K  78643K       210        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1808    196K     290K  78643K     12628        0        0
      file desc     5     13K      33K  78643K      3750        0        0
          sigio     0      0K       0K  78643K        37        0        0
           proc    41     38K      70K  78643K      3614        0        0
        subproc    17      1K       2K  78643K      1309        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       424        0        0
       in_multi    22      1K       2K  78643K       932        0        0
    ether_multi     1      0K       0K  78643K        14        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    60    265K     265K  78643K        60        0        0
           exec     0      0K       1K  78643K      1294        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    87     13K      31K  78643K     13061        0        0
       UVM aobj   130      6K       6K  78643K       159        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       187        0        0
            NDP     6      0K       0K  78643K       234        0        0
           temp    97   2733K    2834K  78643K     19403        0        0
         kqueue     0      0K       0K  78643K        26        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64      156    0      152     1     0     1     1     0     8    0
inpcbpl    280     1762    0     1755     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtentry    112      870    0      837     2     0     2     2     0     8    1
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpcb      544      660    0      656     1     0     1     1     0     8    0
nd6         48      231    0      228     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     3599    0     3451    16     4    12    13     0     8    2
art_table   32     3600    0     3451     2     0     2     2     0     8    0
art_node    16      869    0      839     1     0     1     1     0     8    0
sysvmsgpl   40       13    0        3     1     0     1     1     0     8    0
semapl     112      208    0      198     1     0     1     1     0     8    0
shmpl      112      157    0       29     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     5203    0     3733    48     0    48    48     0     8    0
ffsino     272     5203    0     3733   100     1    99    99     0     8    0
nchpl      144     9481    0     7856    61     0    61    61     0     8    0
uvmvnodes   72     5926    0        0   108     0   108   108     0     8    0
vnodes     200     5926    0        0   312     0   312   312     0     8    0
namei      1024   37109    0    37109     2     1     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
scxspl     192    25510    0    25510    13    12     1     6     0     8    1
plimitpl   152      313    0      305     1     0     1     1     0     8    0
sigapl     432     3696    0     3683     6     4     2     3     0     8    0
futexpl     56    28768    0    28768     1     0     1     1     0     8    1
knotepl    112     2242    0     2225     1     0     1     1     0     8    0
kqueuepl   104      762    0      760     1     0     1     1     0     8    0
pipepl     112     2588    0     2573     9     8     1     2     0     8    0
fdescpl    488     3697    0     3683     3     0     3     3     0     8    1
filepl     152    21562    0    21487     9     4     5     6     0     8    2
lockfpl    104      610    0      610     5     4     1     1     0     8    1
lockfspl    48      211    0      211     5     4     1     1     0     8    1
sessionpl  112       92    0       83     1     0     1     1     0     8    0
pgrppl      48      119    0      110     1     0     1     1     0     8    0
ucredpl     96     6394    0     6386     1     0     1     1     0     8    0
zombiepl   144     3683    0     3682     2     1     1     1     0     8    0
processpl  840     3713    0     3682     4     0     4     4     0     8    0
procpl     624     9217    0     9176     4     0     4     4     0     8    0
srpgc       64      456    0      456    11    10     1     1     0     8    1
sosppl     128       44    0       44     8     8     0     1     0     8    0
sockpl     384     3475    0     3458     3     0     3     3     0     8    1
mcl64k     65536      8    0        0     1     0     1     1     0     8    0
mcl16k     16384      4    0        0     1     0     1     1     0     8    0
mcl12k     12288     17    0        0     2     0     2     2     0     8    0
mcl9k      9216      17    0        0     2     0     2     2     0     8    0
mcl8k      8192       6    0        0     1     0     1     1     0     8    0
mcl4k      4096      11    0        0     2     0     2     2     0     8    0
mcl2k2     2112       8    0        0     1     0     1     1     0     8    0
mcl2k      2048     126    0        0    15     1    14    15     0     8    0
mtagpl      80        1    0        0     1     0     1     1     0     8    0
mbufpl     256      293    0        0    12     0    12    12     0     8    0
bufpl      256     9967    0     2962   439     0   439   439     0     8    0
anonpl      16   355149    0   350078    88    46    42    43     0   125   11
amapchunkpl 152   30029    0    29937    40    35     5    12     0   158    1
amappl16   192    13802    0    13482    90    63    27    29     0     8    8
amappl15   184      583    0      583     5     5     0     1     0     8    0
amappl14   176     1410    0     1406     2     1     1     1     0     8    0
amappl13   168      315    0      312     6     5     1     1     0     8    0
amappl12   160      203    0      200     1     0     1     1     0     8    0
amappl11   152      745    0      731     1     0     1     1     0     8    0
amappl10   144      489    0      485     2     1     1     1     0     8    0
amappl9    136     2077    0     2072     1     0     1     1     0     8    0
amappl8    128     1472    0     1448     1     0     1     1     0     8    0
amappl7    120      564    0      555     1     0     1     1     0     8    0
amappl6    112      586    0      577     1     0     1     1     0     8    0
amappl5    104      739    0      729     1     0     1     1     0     8    0
amappl4     96     3315    0     3293     1     0     1     1     0     8    0
amappl3     88     1312    0     1301     1     0     1     1     0     8    0
amappl2     80    23208    0    23145     4     2     2     3     0     8    0
amappl1     72   107271    0   106846    23    13    10    19     0     8    0
amappl      80    10641    0    10605     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      158    0       29     3     0     3     3     0     8    0
uaddrrnd    24     3697    0     3683     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3697    0     3683     1     0     1     1     0     8    0
vmmpekpl   168    34993    0    34967     2     0     2     2     0     8    0
vmmpepl    168   416811    0   415490   157    79    78    85     0   357   15
vmsppl     368     3696    0     3683     2     0     2     2     0     8    0
pdppl      4096    7402    0     7366     6     0     6     6     0     8    1
pvpl        32  1048063    0  1039895   255   140   115   116     0   265   32
pmappl     232     3696    0     3683     8     7     1     2     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      608    0        9    18     0    18    18     0     8    0

Crashes (7):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-setuid 2019/06/05 06:18 openbsd 759317bf8c07 bfb4a51e .config console log report
ci-openbsd-setuid 2019/05/27 06:45 openbsd 95c8efefea12 85c57315 .config console log report
ci-openbsd-multicore 2019/05/24 13:07 openbsd b21d7bd479d1 0dadcd9d .config console log report
ci-openbsd-setuid 2019/05/23 13:42 openbsd d8ae46340142 0dadcd9d .config console log report
ci-openbsd-main 2019/04/22 20:19 openbsd 1afff35ce04b 0a77c33c .config console log report
ci-openbsd-main 2019/03/15 01:28 openbsd fee69528d2cd d72db19b .config console log report
ci-openbsd-setuid 2019/01/28 11:48 openbsd c41c16f02568 1602ad52 .config console log report
* Struck through repros no longer work on HEAD.