syzbot


panic: receive 1: so ADDR, so_type 3, sb_cc 2458

Status: closed as dup on 2020/02/07 09:35
Reported-by: syzbot+4e68f021354bd94e9418@syzkaller.appspotmail.com
First crash: 1512d, last: 1512d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
panic: receive 1: so ADDR, so_type 3, sb_cc 6586 1 1525d 1525d

Sample crash report:
panic: receive 1: so 0xfffffd806f6da000, so_type 3, sb_cc 2458
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 343082  67459      0        0x10  0x4000080    1  syz-executor.0
*111790  97599      0           0          0    0  dhclient
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff821c5148) at panic+0x15c sys/kern/subr_prf.c:207
soreceive(fffffd806f6da000,0,ffff800020abd378,0,0,ffff800020abd284) at soreceive+0x16ec sys/kern/uipc_socket.c:823
soo_read(fffffd8071c1b098,ffff800020abd378,0) at soo_read+0x53 sys/kern/sys_socket.c:70
dofilereadv(ffff800020a7cc38,6,ffff800020abd378,0,ffff800020abd460) at dofilereadv+0x1a1 sys/kern/sys_generic.c:236
sys_read(ffff800020a7cc38,ffff800020abd410,ffff800020abd460) at sys_read+0x83 sys/kern/sys_generic.c:156
syscall(ffff800020abd4e0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020abd4e0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffda5f0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
receive 1: so 0xfffffd806f6da000, so_type 3, sb_cc 2458
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff821c5148) at panic+0x15c sys/kern/subr_prf.c:207
soreceive(fffffd806f6da000,0,ffff800020abd378,0,0,ffff800020abd284) at soreceive+0x16ec sys/kern/uipc_socket.c:823
soo_read(fffffd8071c1b098,ffff800020abd378,0) at soo_read+0x53 sys/kern/sys_socket.c:70
dofilereadv(ffff800020a7cc38,6,ffff800020abd378,0,ffff800020abd460) at dofilereadv+0x1a1 sys/kern/sys_generic.c:236
sys_read(ffff800020a7cc38,ffff800020abd410,ffff800020abd460) at sys_read+0x83 sys/kern/sys_generic.c:156
syscall(ffff800020abd4e0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020abd4e0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffda5f0, count: -8
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020abd0c0
rbx               0xffff800020abd170
rdx               0xffff800020a7cc38
rcx                                0
rax                                0
r8                0xffffffff818f043f    kprintf+0x16f
r9                               0x1
r10                             0x25
r11               0x6eaaa43efc07d6d4
r12                     0x3000000008
r13               0xffff800020abd0d0
r14                            0x100
r15                              0x1
rip               0xffffffff81fcbbd8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020abd0b0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (dhclient) pid=111790 stat=onproc
    flags process=0 proc=0
    pri=24, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800020a7c758,0xffff800020a7ceb8
    process=0xffff800020a903d0 user=0xffff800020ab8000, vmspace=0xfffffd807efff730
    estcpu=0, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 67459  234455  17590      0  2        0x10                syz-executor.0
 67459  343082  17590      0  7   0x4000090                syz-executor.0
 97114  284664      0      0  3     0x14200  bored         sosplice
 27985  370344  60423      0  2         0x2                syz-executor.1
 17590  375876  60423      0  3        0x82  nanosleep     syz-executor.0
 60423  223301  89796      0  3        0x82  thrsleep      syz-fuzzer
 60423   66474  89796      0  3   0x4000082  nanosleep     syz-fuzzer
 60423   85932  89796      0  3   0x4000082  thrsleep      syz-fuzzer
 60423  143704  89796      0  3   0x4000082  thrsleep      syz-fuzzer
 60423   12076  89796      0  3   0x4000082  thrsleep      syz-fuzzer
 60423   50798  89796      0  3   0x4000082  thrsleep      syz-fuzzer
 60423  397604  89796      0  3   0x4000082  thrsleep      syz-fuzzer
 60423  280144  89796      0  3   0x4000082  thrsleep      syz-fuzzer
 60423  480861  89796      0  3   0x4000082  thrsleep      syz-fuzzer
 60423   37630  89796      0  3   0x4000082  kqread        syz-fuzzer
 89796  279868  33367      0  3    0x10008a  pause         ksh
 33367  285257  41554      0  3        0x92  select        sshd
 97832  266771      1      0  3    0x100083  ttyin         getty
 41554  188279      1      0  3        0x80  select        sshd
 63483  317620  71792     74  3    0x100092  bpf           pflogd
 71792   64206      1      0  3        0x80  netio         pflogd
 22145   99965  38746     73  3    0x100090  kqread        syslogd
 38746  340678      1      0  3    0x100082  netio         syslogd
 16979  233530      1     77  3    0x100090  poll          dhclient
*97599  111790      1      0  7           0                dhclient
 88634  235879      0      0  3     0x14200  pgzero        zerothread
 72443   22060      0      0  3     0x14200  aiodoned      aiodoned
  2262  425519      0      0  3     0x14200  syncer        update
 11475   82472      0      0  3     0x14200  cleaner       cleaner
 91368   68121      0      0  3     0x14200  reaper        reaper
 19573  458620      0      0  3     0x14200  pgdaemon      pagedaemon
  1071  467970      0      0  3     0x14200  bored         crynlk
 52804  119366      0      0  3     0x14200  bored         crypto
 45823  390729      0      0  3  0x40014200  acpi0         acpi0
 66057   92344      0      0  3  0x40014200                idle1
 64864   75155      0      0  3     0x14200  bored         softnet
  5520  439693      0      0  3     0x14200  bored         systqmp
 58503  459465      0      0  3     0x14200  bored         systq
 40431  409814      0      0  3  0x40014200  bored         softclock
 90319  520668      0      0  3  0x40014200                idle0
 32818  445791      0      0  3     0x14200  bored         smr
     1  276174      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 67459 (syz-executor.0) thread 0xffff800020ac24f8 (234455)
exclusive rwlock futex r = 0 (0xffffffff82507de0)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1164
#1  sys_futex+0x13d sys/kern/sys_futex.c:116
#2  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#2  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#3  Xsyscall+0x128
Process 97599 (dhclient) thread 0xffff800020a7cc38 (111790)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff826236a0)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1164
#1  solock+0x66 sys/kern/uipc_socket2.c:292
#2  soreceive+0x114 sys/kern/uipc_socket.c:731
#3  soo_read+0x53 sys/kern/sys_socket.c:70
#4  dofilereadv+0x1a1 sys/kern/sys_generic.c:236
#5  sys_read+0x83 sys/kern/sys_generic.c:156
#6  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#6  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#7  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9513   6673K   10581K  78643K     11616        0
            pcb    20      8K       8K  78643K       127        0
         rtable   101      3K       3K  78643K       272        0
         ifaddr    68     14K      14K  78643K       101        0
       counters    45     34K      34K  78643K        51        0
       ioctlops     0      0K       4K  78643K      1477        0
            iov     0      0K      12K  78643K        16        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1240     78K      78K  78643K      1508        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         4        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       0K  78643K        36        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1809    196K     290K  78643K     12766        0
      file desc     5     13K      25K  78643K       251        0
          sigio     0      0K       0K  78643K         4        0
           proc    61     63K      95K  78643K       472        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        20        0
       in_multi    63      3K       3K  78643K       109        0
    ether_multi     1      0K       0K  78643K         9        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    43    201K     201K  78643K        43        0
           exec     0      0K       1K  78643K       225        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   115     38K      38K  78643K      1738        0
       UVM aobj    21      2K       2K  78643K        23        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        48        0
            NDP    10      0K       0K  78643K        20        0
           temp   103   3013K    3077K  78643K      8364        0
         kqueue     3      4K      12K  78643K        33        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        8    0        0     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       27    0       25     1     0     1     1     0     8    0
rtentry    112       64    0       22     2     0     2     2     0     8    0
unpcb      120      226    0      210     2     0     2     2     0     8    1
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpqe       32       96    0       96     1     1     0     1     0     8    0
tcpcb      544       95    0       91     1     0     1     1     0     8    0
inpcb      280      481    0      463     2     0     2     2     0     8    0
nd6         48        9    0        7     1     0     1     1     0     8    0
pkpcb       40        4    0        4     1     1     0     1     0     8    0
pffrag     232        3    0        3     2     1     1     1     0   482    1
pffrnode    88        3    0        3     2     1     1     1     0     8    1
pffrent     40       92    0       92     2     1     1     1     0     8    1
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       38    0        3     1     0     1     1     0     8    0
pfstkey    112       38    0        3     2     0     2     2     0     8    0
pfstate    328       38    0        3     4     0     4     4     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      324    0      141    15     1    14    14     0     8    1
art_table   32      325    0      141     2     0     2     2     0     8    0
art_node    16       63    0       23     1     0     1     1     0     8    0
sysvmsgpl   40       35    0       18     1     0     1     1     0     8    0
semupl     112        4    0        4     1     0     1     1     0     8    1
semapl     112       34    0       24     1     0     1     1     0     8    0
shmpl      112       21    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1805    0      396    46     0    46    46     0     8    0
ffsino     272     1805    0      396    95     0    95    95     0     8    0
nchpl      144     2357    0      750    61     0    61    61     0     8    0
uvmvnodes   72     2067    0        0    38     0    38    38     0     8    0
vnodes     208     2067    0        0   109     0   109   109     0     8    0
namei      1024    6419    0     6419     1     0     1     1     0     8    1
percpumem   16       36    0        3     1     0     1     1     0     8    0
vcpupl     1984       1    0        0     1     0     1     1     0     8    0
vmpool     560        1    0        0     1     0     1     1     0     8    0
scxspl     192     7264    0     7264     7     1     6     6     0     8    6
plimitpl   152       31    0       23     1     0     1     1     0     8    0
sigapl     432      450    0      435     3     1     2     3     0     8    0
futexpl     56     4218    0     4218     1     0     1     1     0     8    1
knotepl    112       97    0       78     1     0     1     1     0     8    0
kqueuepl   104       65    0       63     1     0     1     1     0     8    0
pipelkpl    48      123    0      111     1     0     1     1     0     8    0
pipepl     120      246    0      223     2     0     2     2     0     8    0
fdescpl    496      451    0      435     3     0     3     3     0     8    0
filepl     152     2979    0     2861     6     0     6     6     0     8    1
lockfpl    104       37    0       35     1     0     1     1     0     8    0
lockfspl    48       15    0       13     1     0     1     1     0     8    0
sessionpl  112       18    0        7     1     0     1     1     0     8    0
pgrppl      48       20    0        9     1     0     1     1     0     8    0
ucredpl     96      235    0      225     1     0     1     1     0     8    0
zombiepl   144      435    0      435     1     0     1     1     0     8    1
processpl  960      467    0      435     5     0     5     5     0     8    0
procpl     624      955    0      913     4     0     4     4     0     8    0
sosppl     128        3    0        3     1     0     1     1     0     8    1
sockpl     400      742    0      710     5     0     5     5     0     8    1
mcl64k     65536     15    0        0     2     0     2     2     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      3    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192       7    0        0     1     0     1     1     0     8    0
mcl4k      4096       4    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     150    0        0    18     0    18    18     0     8    0
mtagpl      80       14    0        0     1     0     1     1     0     8    0
mbufpl     256      514    0        0    32     0    32    32     0     8    0
bufpl      280     4664    0      193   320     0   320   320     0     8    0
anonpl      16    57128    0    39714    76     1    75    75     0   125    4
amapchunkpl 152    2222    0     2079     8     1     7     8     0   158    0
amappl16   192     2163    0     1216    52     0    52    52     0     8    4
amappl15   184       58    0       55     1     0     1     1     0     8    0
amappl14   176      130    0      127     1     0     1     1     0     8    0
amappl13   168      116    0      115     1     0     1     1     0     8    0
amappl12   160        4    0        4     1     1     0     1     0     8    0
amappl11   152       56    0       40     1     0     1     1     0     8    0
amappl10   144        9    0        6     1     0     1     1     0     8    0
amappl9    136      609    0      605     1     0     1     1     0     8    0
amappl8    128      145    0      117     2     0     2     2     0     8    0
amappl7    120      101    0       90     1     0     1     1     0     8    0
amappl6    112       62    0       51     1     0     1     1     0     8    0
amappl5    104      136    0      120     1     0     1     1     0     8    0
amappl4     96      831    0      795     2     1     1     2     0     8    0
amappl3     88      223    0      214     1     0     1     1     0     8    0
amappl2     80     2699    0     2625     3     1     2     3     0     8    0
amappl1     72    19871    0    19426    26    16    10    20     0     8    0
amappl      80     1211    0     1165     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       22    0        2     1     0     1     1     0     8    0
uaddrrnd    24      452    0      435     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      452    0      435     1     0     1     1     0     8    0
vmmpekpl   168     7154    0     7112     3     0     3     3     0     8    0
vmmpepl    168    62545    0    60415   119    11   108   114     0   357   14
vmsppl     368      451    0      435     2     0     2     2     0     8    0
pdppl      4096     911    0      871     6     0     6     6     0     8    0
pvpl        32   187648    0   167031   181     0   181   181     0   265   13
pmappl     232      451    0      435     2     0     2     2     0     8    1
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      192    0        4     6     0     6     6     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/06 13:42 openbsd 2ee00db36bd4 5be3a391 .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.