syzbot


panic: timeout_add: to_ticks < 0

Status: fixed on 2019/02/20 21:58
Reported-by: syzbot+23089c40a85aa70bed6f@syzkaller.appspotmail.com
Fix commit: 3cfc9cae129c Reject negative input from userland in spkrioctl(). One of the arguments are later passed to timeout_add() which panics if the given ticks are negative. While here, clamp arguments in pcppi_bell() in order to prevent overflow.
First crash: 1316d, last: 1311d
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
panic: timeout_add: to_ticks (-ADDR) < 0 C 5 1317d 1317d 0/3 closed as dup on 2019/02/16 08:24
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: timeout_add: to_ticks < 0 (2) syz 12 1269d 1271d 3/3 fixed on 2019/04/04 06:46
openbsd panic: timeout_add: to_ticks < 0 (3) 1 1259d 1259d 3/3 fixed on 2019/04/26 02:50

Sample crash report:
login: panic: timeout_add: to_ticks (-973078528) < 0
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*103427  70530      0         0x2          0    0K syz-executor0986
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x174 sys/kern/subr_prf.c:208
timeout_add(ffff80000066d060,c6000000) at timeout_add+0x194 sys/kern/kern_timeout.c:190
pcppi_bell(ffff80000066d000,2,c6000000,1) at pcppi_bell+0x2a0 sys/dev/isa/pcppi.c:234
spkrioctl(1b00,20005302,ffff800020baf9a0,46,ffff800020b95780) at spkrioctl+0x230 tone sys/dev/isa/spkr.c:89 [inline]
spkrioctl(1b00,20005302,ffff800020baf9a0,46,ffff800020b95780) at spkrioctl+0x230 sys/dev/isa/spkr.c:503
VOP_IOCTL(fffffd806dc86328,20005302,ffff800020baf9a0,46,fffffd807f7c7ba0,ffff800020b95780) at VOP_IOCTL+0x9a sys/kern/vfs_vops.c:290
vn_ioctl(fffffd806fcae260,20005302,ffff800020baf9a0,ffff800020b95780) at vn_ioctl+0xc9 sys/kern/vfs_vnops.c:512
sys_ioctl(ffff800020b95780,ffff800020bafae8,ffff800020bafad0) at sys_ioctl+0x646
syscall(ffff800020bafb80) at syscall+0x5ac mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(ffff800020bafb80) at syscall+0x5ac sys/arch/amd64/amd64/trap.c:574
Xsyscall(6,0,7f7ffffdec48,0,1,7f7ffffdec58) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffdebe0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
timeout_add: to_ticks (-973078528) < 0
ddb{0}> trace
db_enter() at db_enter+24
panic() at panic+372
timeout_add(ffff80000066d060,c6000000) at timeout_add+404
pcppi_bell(ffff80000066d000,2,c6000000,1) at pcppi_bell+672
spkrioctl(1b00,20005302,ffff800020baf9a0,46,ffff800020b95780) at spkrioctl+560
VOP_IOCTL(fffffd806dc86328,20005302,ffff800020baf9a0,46,fffffd807f7c7ba0,ffff800020b95780) at VOP_IOCTL+154
vn_ioctl(fffffd806fcae260,20005302,ffff800020baf9a0,ffff800020b95780) at vn_ioctl+201
sys_ioctl(ffff800020b95780,ffff800020bafae8,ffff800020bafad0) at sys_ioctl+1606
syscall(ffff800020bafb80) at syscall+1452
Xsyscall(6,0,7f7ffffdec48,0,1,7f7ffffdec58) at Xsyscall+296
end of kernel
end trace frame: 0x7f7ffffdebe0, count: -10
ddb{0}> show registers
rdi                                0
rsi                                1
rbp             18446603336770319808
rbx             18446603336770319984
rdx             18446744071594908300    apollo_pio_rec+35292
rcx                              513
rax                                1
r8              18446744071585311987    kprintf+387
r9                                 1
r10              8073321489258217710
r11              7775153245688640304
r12                     206158430216
r13             18446603336770319824
r14                              256
r15                                1
rip             18446744071590259448    db_enter+24
cs                                 8
rflags                           582
rsp             18446603336770319792
ss                                16
db_enter+24:    addq    $8,%rsp
ddb{0}> show proc
PROC (syz-executor0986) pid=103427 stat=onproc
    flags process=2<EXEC> proc=0
    pri=21, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800020b94970,0xffffffff82353980
    process=0xffff800020b7a018 user=0xffff800020baa000, vmspace=0xfffffd806e95a5a8
    estcpu=0, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*70530  103427  74615      0  7         0x2                syz-executor0986
 74615  284793  91374      0  3    0x10008a  pause         ksh
 91374  308416  64493      0  3        0x92  select        sshd
 95183   37558      1      0  3    0x100083  ttyin         getty
 64493  320702      1      0  3        0x80  select        sshd
 14554  101440  72992     73  3    0x100090  kqread        syslogd
 72992   65000      1      0  3    0x100082  netio         syslogd
 40962  182229      1     77  3    0x100090  poll          dhclient
 33046  507663      1      0  3        0x80  poll          dhclient
 15953  205988      0      0  3     0x14200  pgzero        zerothread
  7975    2125      0      0  3     0x14200  aiodoned      aiodoned
 21326  506135      0      0  3     0x14200  syncer        update
 38522   30894      0      0  3     0x14200  cleaner       cleaner
 63059  353185      0      0  3     0x14200  reaper        reaper
 80464  167060      0      0  3     0x14200  pgdaemon      pagedaemon
   921  444563      0      0  3     0x14200  bored         crynlk
 42974  379657      0      0  3     0x14200  bored         crypto
 80774   31187      0      0  3  0x40014200  acpi0         acpi0
 84264  487940      0      0  7  0x40014200                idle1
 52599  283775      0      0  3     0x14200  bored         softnet
 50024  455837      0      0  3     0x14200  bored         systqmp
  8743  432458      0      0  3     0x14200  bored         systq
 15091  285970      0      0  3  0x40014200  bored         softclock
 48248  102016      0      0  3  0x40014200                idle0
     1  180601      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 70530 (syz-executor0986) thread 0xffff800020b95780 (103427)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82309fb0) locked @ /syzkaller/managers/multicore/kernel/sys/kern/sched_bsd.c:436
#0  witness_lock+1418
#1  ___mp_acquire_count+103
#2  mi_switch+944
#3  sleep_finish+272
#4  sleep_finish_all+52
#5  tsleep+444
#6  spkrioctl+609
#7  VOP_IOCTL+154
#8  vn_ioctl+201
#9  sys_ioctl+1606
#10 syscall+1452
#11 Xsyscall+296
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9443   6315K    6316K  78643K     10530        0        0
            pcb    23      9K       9K  78643K        55        0        0
         rtable    61      2K       2K  78643K       115        0        0
         ifaddr    21      7K       7K  78643K        21        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       2K  78643K        13        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1166     73K      73K  78643K      1172        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       1K  78643K         2        0        0
         VM map     2      1K       1K  78643K         2        0        0
            sem     2      0K       0K  78643K         2        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1792    194K     288K  78643K     12592        0        0
      file desc     1      0K       0K  78643K         1        0        0
           proc    40     38K      46K  78643K       207        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
       in_multi    11      0K       0K  78643K        11        0        0
    ether_multi     1      0K       0K  78643K         1        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    18     79K      79K  78643K        18        0        0
           exec     0      0K       1K  78643K       150        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    47      2K       3K  78643K       658        0        0
       UVM aobj     2      2K       2K  78643K         2        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
            NDP     3      0K       0K  78643K         3        0        0
           temp    30   2347K    2411K  78643K      1695        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        2    0        0     1     0     1     1     0     8    0
inpcbpl    280       22    0       16     1     0     1     1     0     8    0
plimitpl   152       13    0        8     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
syncache   264        5    0        5     2     1     1     1     0     8    1
tcpcb      544        8    0        5     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1383    0       18    45     0    45    45     0     8    0
ffsino     272     1383    0       18    92     0    92    92     0     8    0
nchpl      144     1555    0       30    57     0    57    57     0     8    0
uvmvnodes   72     1392    0        0    26     0    26    26     0     8    0
vnodes     200     1392    0        0    74     0    74    74     0     8    0
namei      1024    3262    0     3262     3     2     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
scxspl     192     2359    0     2359     7     6     1     6     0     8    1
sigapl     432      174    0      164     2     0     2     2     0     8    0
knotepl    112        5    0        0     1     0     1     1     0     8    0
kqueuepl   104        1    0        0     1     0     1     1     0     8    0
pipepl     112      114    0      107     3     2     1     1     0     8    0
fdescpl    488      175    0      164     2     0     2     2     0     8    0
filepl     152      808    0      765     2     0     2     2     0     8    0
lockfpl    104        6    0        6     1     1     0     1     0     8    0
lockfspl    32        3    0        3     1     1     0     1     0     8    0
sessionpl  112       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl     96       47    0       40     1     0     1     1     0     8    0
zombiepl   144      164    0      164     3     2     1     1     0     8    1
processpl  840      189    0      164     4     0     4     4     0     8    0
procpl     600      189    0      164     3     0     3     3     0     8    0
sockpl     384       64    0       48     2     0     2     2     0     8    0
mcl4k      4096       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      64    0        0     8     0     8     8     0     8    0
mtagpl      80        1    0        0     1     0     1     1     0     8    0
mbufpl     256       98    0        0     5     0     5     5     0     8    0
bufpl      256     1998    0      254   109     0   109   109     0     8    0
anonpl      16    16943    0    15856     7     1     6     6     0   125    1
amapchunkpl 152     504    0      469     2     0     2     2     0   158    0
amappl16   192       68    0       63     1     0     1     1     0     8    0
amappl15   184        1    0        0     1     0     1     1     0     8    0
amappl14   176        1    0        1     1     1     0     1     0     8    0
amappl13   168       16    0       13     1     0     1     1     0     8    0
amappl12   160        7    0        7     2     1     1     1     0     8    1
amappl11   152      172    0      163     1     0     1     1     0     8    0
amappl10   144       43    0       43     3     2     1     1     0     8    1
amappl9    136      205    0      204     1     0     1     1     0     8    0
amappl8    128      109    0      103     1     0     1     1     0     8    0
amappl7    120       29    0       25     1     0     1     1     0     8    0
amappl6    112       43    0       38     1     0     1     1     0     8    0
amappl5    104      138    0      126     1     0     1     1     0     8    0
amappl4     96      253    0      234     1     0     1     1     0     8    0
amappl3     88      112    0      107     1     0     1     1     0     8    0
amappl2     80      559    0      525     1     0     1     1     0     8    0
amappl1     72    11702    0    11313    15     5    10    15     0     8    0
amappl      72      372    0      353     1     0     1     1     0    75    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      175    0      164     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      175    0      164     1     0     1     1     0     8    0
vmmpekpl   168     5136    0     5116     1     0     1     1     0     8    0
vmmpepl    168    23507    0    22819    54    20    34    43     0   357    3
vmsppl     360      174    0      164     2     0     2     2     0     8    0
pdppl      4096     357    0      328     5     0     5     5     0     8    0
pvpl        32    69588    0    66880    40    14    26    26     0   265    3
pmappl     224      174    0      164     1     0     1     1     0     8    0
extentpl    40       39    0       25     1     0     1     1     0     8    0
phpool     112      236    0        4     7     0     7     7     0     8    0
ddb{0}> 

Crashes (66):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2019/02/16 01:27 openbsd 9a029001a5d5 f42dee6d .config log report syz C
ci-openbsd-main 2019/02/20 21:21 openbsd a3a698175c42 c95f0707 .config log report
ci-openbsd-multicore 2019/02/20 17:48 openbsd a3a698175c42 c95f0707 .config log report
ci-openbsd-main 2019/02/20 15:43 openbsd a3a698175c42 c95f0707 .config log report
ci-openbsd-multicore 2019/02/20 14:23 openbsd a3a698175c42 c95f0707 .config log report
ci-openbsd-multicore 2019/02/20 10:10 openbsd a3a698175c42 c95f0707 .config log report
ci-openbsd-multicore 2019/02/20 06:27 openbsd a3a698175c42 4df543c9 .config log report
ci-openbsd-main 2019/02/20 04:25 openbsd a3a698175c42 4df543c9 .config log report
ci-openbsd-main 2019/02/20 00:41 openbsd 77a2d5665065 4df543c9 .config log report
ci-openbsd-main 2019/02/19 23:16 openbsd 77a2d5665065 4df543c9 .config log report
ci-openbsd-main 2019/02/19 21:31 openbsd 77a2d5665065 4df543c9 .config log report
ci-openbsd-main 2019/02/19 18:25 openbsd 77a2d5665065 4df543c9 .config log report
ci-openbsd-main 2019/02/19 15:55 openbsd 77a2d5665065 4df543c9 .config log report
ci-openbsd-multicore 2019/02/19 11:02 openbsd 644ac04beb28 59f36113 .config log report
ci-openbsd-multicore 2019/02/19 09:52 openbsd 644ac04beb28 59f36113 .config log report
ci-openbsd-multicore 2019/02/19 07:26 openbsd 644ac04beb28 59f36113 .config log report
ci-openbsd-multicore 2019/02/19 01:48 openbsd 9c4fc15973cf 59f36113 .config log report
ci-openbsd-main 2019/02/18 20:37 openbsd 9c4fc15973cf 59f36113 .config log report
ci-openbsd-multicore 2019/02/18 19:33 openbsd 9c4fc15973cf 59f36113 .config log report
ci-openbsd-multicore 2019/02/18 18:33 openbsd 9c4fc15973cf 59f36113 .config log report
ci-openbsd-main 2019/02/18 18:22 openbsd 9c4fc15973cf 59f36113 .config log report
ci-openbsd-multicore 2019/02/18 17:06 openbsd 9c4fc15973cf 59f36113 .config log report
ci-openbsd-main 2019/02/18 16:17 openbsd 9c4fc15973cf 59f36113 .config log report
ci-openbsd-multicore 2019/02/18 15:39 openbsd 9a540fb6528e 59f36113 .config log report
ci-openbsd-main 2019/02/18 12:25 openbsd 9a540fb6528e 59f36113 .config log report
ci-openbsd-main 2019/02/18 08:21 openbsd 9a540fb6528e 59f36113 .config log report
ci-openbsd-multicore 2019/02/18 08:20 openbsd 9a540fb6528e 59f36113 .config log report
ci-openbsd-main 2019/02/18 07:33 openbsd 9a540fb6528e 59f36113 .config log report
ci-openbsd-main 2019/02/18 06:26 openbsd 9a540fb6528e 59f36113 .config log report
ci-openbsd-multicore 2019/02/18 06:09 openbsd 9a540fb6528e 59f36113 .config log report
ci-openbsd-multicore 2019/02/18 05:15 openbsd 9a540fb6528e 59f36113 .config log report
ci-openbsd-main 2019/02/18 00:58 openbsd 3748d6328b3c 3e98cc30 .config log report
ci-openbsd-multicore 2019/02/18 00:20 openbsd 3748d6328b3c 3e98cc30 .config log report
ci-openbsd-main 2019/02/17 20:18 openbsd 3748d6328b3c 3e98cc30 .config log report
ci-openbsd-main 2019/02/17 19:53 openbsd 3748d6328b3c 3e98cc30 .config log report
ci-openbsd-multicore 2019/02/17 19:43 openbsd 3748d6328b3c 3e98cc30 .config log report
ci-openbsd-multicore 2019/02/17 10:09 openbsd 395e1e447075 f42dee6d .config log report
ci-openbsd-multicore 2019/02/17 09:58 openbsd 395e1e447075 f42dee6d .config log report
ci-openbsd-multicore 2019/02/17 09:53 openbsd 395e1e447075 f42dee6d .config log report
ci-openbsd-multicore 2019/02/17 09:27 openbsd 395e1e447075 f42dee6d .config log report
ci-openbsd-main 2019/02/17 07:45 openbsd 7fa57c5baf91 f42dee6d .config log report
ci-openbsd-multicore 2019/02/17 07:40 openbsd 395e1e447075 f42dee6d .config log report
ci-openbsd-main 2019/02/17 06:35 openbsd 7fa57c5baf91 f42dee6d .config log report
ci-openbsd-main 2019/02/17 04:08 openbsd 7fa57c5baf91 f42dee6d .config log report
ci-openbsd-multicore 2019/02/17 02:27 openbsd 395e1e447075 f42dee6d .config log report
ci-openbsd-main 2019/02/16 22:11 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-multicore 2019/02/16 21:27 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-multicore 2019/02/16 18:03 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-multicore 2019/02/16 16:30 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-main 2019/02/16 16:03 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-multicore 2019/02/16 14:21 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-multicore 2019/02/16 13:16 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-multicore 2019/02/16 12:55 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-main 2019/02/16 12:51 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-multicore 2019/02/16 04:57 openbsd 9a029001a5d5 f42dee6d .config log report
ci-openbsd-multicore 2019/02/16 01:11 openbsd 9a029001a5d5 f42dee6d .config log report
* Struck through repros no longer work on HEAD.