syzbot


assert "ifa == rt->rt_ifa" failed in n da6s.secr

Status: closed as dup on 2019/10/13 14:17
Reported-by: syzbot+b178202b1b20d38c38b6@syzkaller.appspotmail.com
First crash: 1628d, last: 1628d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
assert "ifa == rt->rt_ifa" failed in nd6.c (2) 262 1605d 1642d

Sample crash report:
panic: kernel diagnostic assertion "ifa == rt->rt_ifa" failed: file "/syzkaller/managers/multicopraen/ick:er nkeelrn/esyl s/dinaetgnionsetti6c/n da6s.secr"t,i onl i"n!e _k9e4r7n
e
lStopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 241203  19635      0           0  0x4000000    1  syz-executor.1
*147353  32104      0           0  0x4000000    0  syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff82206f14,ffffffff821fe563,3b3,ffffffff821c09cc) at __assert+0x2b sys/kern/subr_prf.c:154
nd6_rtrequest(ffff800000aa0800,1,fffffd80629104d8) at nd6_rtrequest+0xbb4 sys/netinet6/nd6.c:947
rtrequest(1,ffff800022f6efa8,1,ffff800022f6f078,0) at rtrequest+0x9bf sys/net/route.c:973
rt_ifa_add(ffff800000adc100,240404,ffff800000adc158,0) at rt_ifa_add+0x290 sys/net/route.c:1133
rt_ifa_addlocal(ffff800000adc100) at rt_ifa_addlocal+0x16d sys/net/route.c:1242
in_ifinit(ffff800000aa0800,ffff800000adc100,ffff800022f6f3a0,0) at in_ifinit+0x1cf sys/netinet/in.c:614
in_ioctl_sifaddr(8020690c,ffff800022f6f390,ffff800000aa0800,1) at in_ioctl_sifaddr+0x208 sys/netinet/in.c:360
in_ioctl(8020690c,ffff800022f6f390,ffff800000aa0800,1) at in_ioctl+0x1e7 sys/netinet/in.c:231
ifioctl(fffffd80615af628,8020690c,ffff800022f6f390,ffff800020a5f8b8) at ifioctl+0xb64 sys/net/if.c:2202
sys_ioctl(ffff800020a5f8b8,ffff800022f6f4a8,ffff800022f6f4f0) at sys_ioctl+0x5b9
syscall(ffff800022f6f570) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800022f6f570) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,ffffffffffffff36,0,3,683a7772010) at Xsyscall+0x128
end of kernel
end trace frame: 0x685dc9b3890, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel diagnostic assertion "ifa == rt->rt_ifa" failed: file "/syzkaller/managers/multicore/kernel/sys/netinet6/nd6.c", line 947
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff82206f14,ffffffff821fe563,3b3,ffffffff821c09cc) at __assert+0x2b sys/kern/subr_prf.c:154
nd6_rtrequest(ffff800000aa0800,1,fffffd80629104d8) at nd6_rtrequest+0xbb4 sys/netinet6/nd6.c:947
rtrequest(1,ffff800022f6efa8,1,ffff800022f6f078,0) at rtrequest+0x9bf sys/net/route.c:973
rt_ifa_add(ffff800000adc100,240404,ffff800000adc158,0) at rt_ifa_add+0x290 sys/net/route.c:1133
rt_ifa_addlocal(ffff800000adc100) at rt_ifa_addlocal+0x16d sys/net/route.c:1242
in_ifinit(ffff800000aa0800,ffff800000adc100,ffff800022f6f3a0,0) at in_ifinit+0x1cf sys/netinet/in.c:614
in_ioctl_sifaddr(8020690c,ffff800022f6f390,ffff800000aa0800,1) at in_ioctl_sifaddr+0x208 sys/netinet/in.c:360
in_ioctl(8020690c,ffff800022f6f390,ffff800000aa0800,1) at in_ioctl+0x1e7 sys/netinet/in.c:231
ifioctl(fffffd80615af628,8020690c,ffff800022f6f390,ffff800020a5f8b8) at ifioctl+0xb64 sys/net/if.c:2202
sys_ioctl(ffff800020a5f8b8,ffff800022f6f4a8,ffff800022f6f4f0) at sys_ioctl+0x5b9
syscall(ffff800022f6f570) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800022f6f570) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,ffffffffffffff36,0,3,683a7772010) at Xsyscall+0x128
end of kernel
end trace frame: 0x685dc9b3890, count: -14
ddb{0}> show registers
rdi               0xffffffff81807637    db_enter+0x17
rsi                           0x4d04    __ALIGN_SIZE+0x3d04
rbp               0xffff800022f6ece0
rbx               0xffff800022f6ed90
rdx                           0x4d05    __ALIGN_SIZE+0x3d05
rcx               0xffff800021952000
rax               0xffff800021952000
r8                0xffffffff8142986f    kprintf+0x16f
r9                               0x1
r10                             0x25
r11               0x3809e5acb2c4ffb3
r12                     0x3000000008
r13               0xffff800022f6ecf0
r14                            0x100
r15                              0x1
rip               0xffffffff81807638    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800022f6ecd0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor.0) pid=147353 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=80, usrpri=80, nice=20
    forw=0xffffffffffffffff, list=0xffff800020a5e008,0xffff800020abe790
    process=0xffff800020adc700 user=0xffff800022f6a000, vmspace=0xfffffd807f00b8a0
    estcpu=30, cpticks=0, pctcpu=0.1
    user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 19635  326200  44330      0  2           0                syz-executor.1
 19635  241203  44330      0  7   0x4000000                syz-executor.1
 32104  218642  22321      0  2           0                syz-executor.0
*32104  147353  22321      0  7   0x4000000                syz-executor.0
 22321  312348  10259      0  3        0x82  nanosleep     syz-executor.0
 44330  180576  10259      0  2       0x482                syz-executor.1
 97777   18750      0      0  3     0x14200  bored         sosplice
 10259  270741  45905      0  3        0x82  thrsleep      syz-fuzzer
 10259  141449  45905      0  3   0x4000082  nanosleep     syz-fuzzer
 10259     758  45905      0  3   0x4000082  thrsleep      syz-fuzzer
 10259  475595  45905      0  3   0x4000082  thrsleep      syz-fuzzer
 10259  170362  45905      0  3   0x4000082  kqread        syz-fuzzer
 10259   31282  45905      0  3   0x4000082  thrsleep      syz-fuzzer
 10259   74308  45905      0  3   0x4000082  thrsleep      syz-fuzzer
 10259  418730  45905      0  3   0x4000082  thrsleep      syz-fuzzer
 10259  361706  45905      0  3   0x4000082  thrsleep      syz-fuzzer
 10259  262778  45905      0  3   0x4000082  thrsleep      syz-fuzzer
 45905  192805  53319      0  3    0x10008a  pause         ksh
 53319  310225  67468      0  3        0x92  select        sshd
 12003  489883      1      0  3    0x100083  ttyin         getty
 67468  421277      1      0  3        0x80  select        sshd
 14332  394035  22228     74  2    0x100492                pflogd
 22228  157765      1      0  3        0x80  netio         pflogd
 55614  178725  77187     73  3    0x100090  kqread        syslogd
 77187  164516      1      0  3    0x100082  netio         syslogd
 51846  341075      1     77  3    0x100090  poll          dhclient
 98638   62759      1      0  3        0x80  poll          dhclient
 31064   13117      0      0  2     0x14200                zerothread
 34269   80243      0      0  3     0x14200  aiodoned      aiodoned
 87112  444192      0      0  2     0x14200                update
 15611  477207      0      0  3     0x14200  cleaner       cleaner
 81764  134599      0      0  3     0x14200  reaper        reaper
 61882   33966      0      0  3     0x14200  pgdaemon      pagedaemon
 92659  348244      0      0  3     0x14200  bored         crynlk
 54951  374683      0      0  3     0x14200  bored         crypto
 46785  145409      0      0  3  0x40014200  acpi0         acpi0
 93399  440685      0      0  3  0x40014200                idle1
 45032  258869      0      0  2     0x14200                softnet
 64097  483281      0      0  2     0x14200                systqmp
  9907  279143      0      0  3     0x14200  bored         systq
 60298  496967      0      0  2  0x40014200                softclock
 78981  314649      0      0  3  0x40014200                idle0
  9732  489459      0      0  3     0x14200  bored         smr
     1  354088      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 32104 (syz-executor.0) thread 0xffff800020a5f8b8 (147353)
exclusive rwlock netlock r = 0 (0xffffffff824b42d8)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  in_ioctl_sifaddr+0x69
#2  in_ioctl+0x1e7 sys/netinet/in.c:231
#3  ifioctl+0xb64 sys/net/if.c:2202
#4  sys_ioctl+0x5b9
#5  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#5  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#6  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff826329b0)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  syscall+0x400 mi_syscall sys/sys/syscall_mi.h:83 [inline]
#1  syscall+0x400 sys/arch/amd64/amd64/trap.c:555
#2  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9582   6452K    7521K  78643K     14334        0        0
            pcb    13      8K       8K  78643K       393        0        0
         rtable   101     13K      13K  78643K      1273        0        0
         ifaddr    83     17K      18K  78643K       411        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       4K  78643K      1597        0        0
            iov     0      0K      32K  78643K       321        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1218     77K      77K  78643K      2558        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        21        0        0
         VM map    15      7K       8K  78643K        32        0        0
            sem    12      0K       0K  78643K       363        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1808    196K     290K  78643K     12765        0        0
      file desc     6     17K      25K  78643K      1654        0        0
          sigio     0      0K       0K  78643K        34        0        0
           proc    61     63K      83K  78643K       838        0        0
        subproc    32      2K       2K  78643K       136        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       100        0        0
       in_multi    20      1K       2K  78643K       254        0        0
    ether_multi     1      0K       0K  78643K        19        0        0
            mrt     0      0K       0K  78643K         6        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    54    238K     238K  78643K        54        0        0
           exec     0      0K       1K  78643K       453        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   140    161K     161K  78643K      6764        0        0
       UVM aobj   130      4K       4K  78643K       133        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       339        0        0
            NDP    20      0K       0K  78643K       125        0        0
           temp   229   3561K    3641K  78643K     38683        0        0
         kqueue     0      0K       0K  78643K        20        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       39    0       36     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80      150    0      148     1     0     1     1     0     8    0
rtentry    112      222    0      186     2     0     2     2     0     8    0
unpcb      120      886    0      874     3     2     1     2     0     8    0
syncache   264        5    0        5     2     2     0     1     0     8    0
tcpqe       32       57    0       57     3     3     0     1     0     8    0
tcpcb      544      555    0      551     1     0     1     1     0     8    0
inpcb      280     4582    0     4573     6     3     3     3     0     8    2
rttmr       72        3    0        2     1     0     1     1     0     8    0
nd6         48       30    0       27     1     0     1     1     0     8    0
pkpcb       40        4    0        4     2     2     0     1     0     8    0
ppxss      1128      58    0       58     4     3     1     1     0     8    1
pffrag     232       47    0       47     3     2     1     1     0   482    1
pffrnode    88       47    0       47     3     2     1     1     0     8    1
pffrent     40      960    0      960     3     2     1     1     0     8    1
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24      152    0       82     1     0     1     1     0     8    0
pfstkey    112      152    0       82     3     0     3     3     0     8    0
pfstate    328      152    0       82     7     0     7     7     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       2    0        1     2     1     1     2     0     8    0
art_heap4  256     1006    0      799    22     8    14    16     0     8    0
art_table   32     1008    0      800     4     2     2     3     0     8    0
art_node    16      221    0      187     1     0     1     1     0     8    0
sysvmsgpl   40       37    0       20     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      359    0      349     1     0     1     1     0     8    0
shmpl      112      131    0        3     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     3923    0     2516    46     0    46    46     0     8    0
ffsino     272     3923    0     2516    95     0    95    95     0     8    0
nchpl      144     6487    0     6027    61    41    20    61     0     8    0
uvmvnodes   72     4908    0        0    90     0    90    90     0     8    0
vnodes     208     4908    0        0   259     0   259   259     0     8    0
namei      1024   20053    0    20053     1     0     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
vcpupl     1984      13    0        0     2     0     2     2     0     8    0
vmpool     552       30    0       17     2     0     2     2     0     8    1
scsiplug    64        3    0        3     2     2     0     1     0     8    0
scxspl     192    21826    0    21826    18    17     1     7     0     8    1
plimitpl   152      164    0      156     1     0     1     1     0     8    0
sigapl     432     1836    0     1820     3     1     2     3     0     8    0
futexpl     56    37791    0    37791     1     0     1     1     0     8    1
knotepl    112     1121    0     1102     3     2     1     3     0     8    0
kqueuepl   104     1761    0     1759     1     0     1     1     0     8    0
pipepl     112      960    0      941     1     0     1     1     0     8    0
fdescpl    488     1837    0     1820     3     0     3     3     0     8    0
filepl     152    16244    0    16142    13     7     6     7     0     8    2
lockfpl    104      537    0      536     1     0     1     1     0     8    0
lockfspl    48      190    0      189     1     0     1     1     0     8    0
sessionpl  112       24    0       13     1     0     1     1     0     8    0
pgrppl      48       34    0       23     1     0     1     1     0     8    0
ucredpl     96     1483    0     1473     1     0     1     1     0     8    0
zombiepl   144     1820    0     1820     1     0     1     1     0     8    1
processpl  896     1853    0     1820     4     0     4     4     0     8    0
procpl     632     5642    0     5598     6     1     5     5     0     8    1
srpgc       64        2    0        2     1     1     0     1     0     8    0
sosppl     128      766    0      766     1     0     1     1     0     8    1
sockpl     384     5639    0     5616    12     7     5     7     0     8    1
mcl64k     65536    259    0        0    33     0    33    33     0     8    0
mcl16k     16384      9    0        0     2     0     2     2     0     8    0
mcl12k     12288     21    0        0     2     0     2     2     0     8    0
mcl9k      9216      11    0        0     1     0     1     1     0     8    0
mcl8k      8192      17    0        0     3     0     3     3     0     8    0
mcl4k      4096      14    0        0     2     0     2     2     0     8    0
mcl2k2     2112       4    0        0     1     0     1     1     0     8    0
mcl2k      2048     146    0        0    17     0    17    17     0     8    0
mtagpl      80       62    0        0     1     0     1     1     0     8    0
mbufpl     256      723    0        0    44     0    44    44     0     8    0
bufpl      256    12951    0     5903   441     0   441   441     0     8    0
anonpl      16   227481    0   207508   134    37    97    97     0   124   15
amapchunkpl 152   12582    0    12446    24    17     7    12     0   158    1
amappl16   192    10837    0     9715   118    49    69    69     0     8   12
amappl15   184       86    0       86     2     2     0     1     0     8    0
amappl14   176      570    0      566     1     0     1     1     0     8    0
amappl13   168        2    0        2     2     2     0     1     0     8    0
amappl12   160       27    0       24     1     0     1     1     0     8    0
amappl11   152      514    0      496     1     0     1     1     0     8    0
amappl10   144      542    0      536     1     0     1     1     0     8    0
amappl9    136      694    0      688     1     0     1     1     0     8    0
amappl8    128      272    0      239     3     1     2     2     0     8    0
amappl7    120      597    0      592     1     0     1     1     0     8    0
amappl6    112      491    0      480     1     0     1     1     0     8    0
amappl5    104      189    0      175     1     0     1     1     0     8    0
amappl4     96     1716    0     1685     1     0     1     1     0     8    0
amappl3     88     1088    0     1078     1     0     1     1     0     8    0
amappl2     80    13487    0    13406     3     0     3     3     0     8    0
amappl1     72    50074    0    49616    25    15    10    20     0     8    0
amappl      80     6015    0     5965     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      132    0        3     3     0     3     3     0     8    0
uaddrrnd    24     1867    0     1820     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1867    0     1820     1     0     1     1     0     8    0
vmmpekpl   168    17979    0    17943     2     0     2     2     0     8    0
vmmpepl    168   239201    0   236803   196    61   135   142     0   357   29
vmsppl     368     1836    0     1820     2     0     2     2     0     8    0
pdppl      4096    3741    0     3687     8     0     8     8     0     8    1
pvpl        32   621727    0   599733   267    52   215   219     0   265   30
pmappl     232     1866    0     1837     2     0     2     2     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      680    0       12    20     0    20    20     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/13 13:59 openbsd 1701c8faa8ab 2f661ec4 .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.