syzbot


panic: malloc: allocation too large, type = 2, size = ADDR

Status: fixed on 2019/03/30 20:17
Reported-by: syzbot+5a77a0fd8810d0785f61@syzkaller.appspotmail.com
Fix commit: fd7c80607c62 Restrict the number of allowed wsmux devices, just like wskbd and wsmouse already does. Otherwise, malloc could panic if the device minor is sufficiently large.
First crash: 1406d, last: 1343d
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
panic: mallocarray: overflow ADDR * 8 C 234 1343d 1405d 0/3 closed as dup on 2019/01/27 21:51
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: malloc: allocation too large, type = 2, size = ADDR (2) C 16842 1179d 1196d 3/3 fixed on 2019/09/10 23:33

Sample crash report:
panic: malloc: allocation too large, type = 2, size = 3462255744

Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*238102    451      0         0x2          0    0K syz-executor5947
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x174 sys/kern/subr_prf.c:208
malloc(ce5dd480,2,2) at malloc+0xa6f sys/kern/kern_malloc.c:339
wsmux_getmux(19cbba8f) at wsmux_getmux+0x71 sys/dev/wscons/wsmux.c:139
wsmux_do_ioctl(ffff80000069ea00,80085761,ffff800020baef50,f,ffff800020b952d0) at wsmux_do_ioctl+0x29e wsmux_add_mux sys/dev/wscons/wsmux.c:579 [inline]
wsmux_do_ioctl(ffff80000069ea00,80085761,ffff800020baef50,f,ffff800020b952d0) at wsmux_do_ioctl+0x29e sys/dev/wscons/wsmux.c:432
VOP_IOCTL(fffffd806dc943f0,80085761,ffff800020baef50,f,fffffd807f7c7c60,ffff800020b952d0) at VOP_IOCTL+0x9a sys/kern/vfs_vops.c:290
vn_ioctl(fffffd806fcae000,80085761,ffff800020baef50,ffff800020b952d0) at vn_ioctl+0xc9 sys/kern/vfs_vnops.c:512
sys_ioctl(ffff800020b952d0,ffff800020baf098,ffff800020baf080) at sys_ioctl+0x646
syscall(ffff800020baf130) at syscall+0x5ac mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(ffff800020baf130) at syscall+0x5ac sys/arch/amd64/amd64/trap.c:574
Xsyscall(6,0,7f7ffffdb428,0,1,7f7ffffdb438) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffdb3c0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
malloc: allocation too large, type = 2, size = 3462255744

ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x174 sys/kern/subr_prf.c:208
malloc(ce5dd480,2,2) at malloc+0xa6f sys/kern/kern_malloc.c:339
wsmux_getmux(19cbba8f) at wsmux_getmux+0x71 sys/dev/wscons/wsmux.c:139
wsmux_do_ioctl(ffff80000069ea00,80085761,ffff800020baef50,f,ffff800020b952d0) at wsmux_do_ioctl+0x29e wsmux_add_mux sys/dev/wscons/wsmux.c:579 [inline]
wsmux_do_ioctl(ffff80000069ea00,80085761,ffff800020baef50,f,ffff800020b952d0) at wsmux_do_ioctl+0x29e sys/dev/wscons/wsmux.c:432
VOP_IOCTL(fffffd806dc943f0,80085761,ffff800020baef50,f,fffffd807f7c7c60,ffff800020b952d0) at VOP_IOCTL+0x9a sys/kern/vfs_vops.c:290
vn_ioctl(fffffd806fcae000,80085761,ffff800020baef50,ffff800020b952d0) at vn_ioctl+0xc9 sys/kern/vfs_vnops.c:512
sys_ioctl(ffff800020b952d0,ffff800020baf098,ffff800020baf080) at sys_ioctl+0x646
syscall(ffff800020baf130) at syscall+0x5ac mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(ffff800020baf130) at syscall+0x5ac sys/arch/amd64/amd64/trap.c:574
Xsyscall(6,0,7f7ffffdb428,0,1,7f7ffffdb438) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffdb3c0, count: -10
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020baeae0
rbx               0xffff800020baeb90
rdx               0xffffffff81f52f17    apollo_pio_rec+0xa34b
rcx                            0x201
rax                              0x1
r8                0xffffffff81316553    kprintf+0x183
r9                               0x1
r10               0x6622ea658ae1a5a4
r11               0x80862c2d27170396
r12                     0x3000000008
r13               0xffff800020baeaf0
r14                            0x100
r15                              0x1
rip               0xffffffff81264218    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020baead0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor5947) pid=238102 stat=onproc
    flags process=2<EXEC> proc=0
    pri=53, usrpri=53, nice=20
    forw=0xffffffffffffffff, list=0xffff800020b944c0,0xffffffff82334d38
    process=0xffff800020b7a9f0 user=0xffff800020baa000, vmspace=0xfffffd806e96f5a8
    estcpu=3, cpticks=2, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*  451  238102  40473      0  7         0x2                syz-executor5947
 40473  342080   6160      0  3    0x10008a  pause         ksh
  6160   97041  11171      0  3        0x92  select        sshd
 96887  364862      1      0  3    0x100083  ttyin         getty
 11171  324338      1      0  3        0x80  select        sshd
 46359   73016  59667     73  3    0x100090  kqread        syslogd
 59667  217043      1      0  3    0x100082  netio         syslogd
 85598  109612      1     77  3    0x100090  poll          dhclient
 34954  267295      1      0  3        0x80  poll          dhclient
 20177  480661      0      0  3     0x14200  pgzero        zerothread
 87275  286348      0      0  3     0x14200  aiodoned      aiodoned
 19324  315280      0      0  3     0x14200  syncer        update
 83090  417733      0      0  3     0x14200  cleaner       cleaner
 60913  460744      0      0  3     0x14200  reaper        reaper
 17796  472361      0      0  3     0x14200  pgdaemon      pagedaemon
   315  359712      0      0  3     0x14200  bored         crynlk
 69728  160737      0      0  3     0x14200  bored         crypto
  4673  396320      0      0  3  0x40014200  acpi0         acpi0
 44075  404219      0      0  7  0x40014200                idle1
 93285  142819      0      0  3     0x14200  bored         softnet
 67027   13923      0      0  3     0x14200  bored         systqmp
 31919  321243      0      0  3     0x14200  bored         systq
   487  423675      0      0  3  0x40014200  bored         softclock
 36683   70859      0      0  3  0x40014200                idle0
     1  381705      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 451 (syz-executor5947) thread 0xffff800020b952d0 (238102)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8235c720) locked @ /syzkaller/managers/multicore/kernel/sys/sys/syscall_mi.h:90
#0  witness_lock+0x58a sys/kern/subr_witness.c:1205
#1  syscall+0x47f mi_syscall sys/sys/syscall_mi.h:91 [inline]
#1  syscall+0x47f sys/arch/amd64/amd64/trap.c:574
#2  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9444   6323K    6323K  78643K     10532        0        0
            pcb    23      9K       9K  78643K        55        0        0
         rtable    61      2K       2K  78643K       115        0        0
         ifaddr    21      7K       7K  78643K        21        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       2K  78643K        13        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1167     73K      73K  78643K      1172        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       1K  78643K         2        0        0
         VM map     2      1K       1K  78643K         2        0        0
            sem     2      0K       0K  78643K         2        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1792    194K     288K  78643K     12592        0        0
      file desc     1      0K       0K  78643K         1        0        0
           proc    40     38K      46K  78643K       207        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
       in_multi    11      0K       0K  78643K        11        0        0
    ether_multi     1      0K       0K  78643K         1        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    18     79K      79K  78643K        18        0        0
           exec     0      0K       1K  78643K       150        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    47      2K       3K  78643K       651        0        0
       UVM aobj     2      2K       2K  78643K         2        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
            NDP     3      0K       0K  78643K         3        0        0
           temp    30   2347K    2411K  78643K      1695        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        2    0        0     1     0     1     1     0     8    0
inpcbpl    280       22    0       14     1     0     1     1     0     8    0
plimitpl   152       13    0        8     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
syncache   264        5    0        5     1     0     1     1     0     8    1
tcpqe       32        2    0        2     1     0     1     1     0     8    1
tcpcb      544        8    0        3     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1383    0       17    45     0    45    45     0     8    0
ffsino     272     1383    0       17    92     0    92    92     0     8    0
nchpl      144     1555    0       30    57     0    57    57     0     8    0
uvmvnodes   72     1392    0        0    26     0    26    26     0     8    0
vnodes     200     1392    0        0    74     0    74    74     0     8    0
namei      1024    3262    0     3262     2     1     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
scxspl     192     2350    0     2350     8     3     5     6     0     8    5
sigapl     432      174    0      164     2     0     2     2     0     8    0
knotepl    112        5    0        0     1     0     1     1     0     8    0
kqueuepl   104        1    0        0     1     0     1     1     0     8    0
pipepl     112      114    0      107     2     1     1     1     0     8    0
fdescpl    488      175    0      164     2     0     2     2     0     8    0
filepl     152      808    0      765     2     0     2     2     0     8    0
lockfpl    104        6    0        6     1     1     0     1     0     8    0
lockfspl    32        3    0        3     1     1     0     1     0     8    0
sessionpl  112       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl     96       47    0       40     1     0     1     1     0     8    0
zombiepl   144      164    0      164     2     1     1     1     0     8    1
processpl  840      189    0      164     4     0     4     4     0     8    0
procpl     600      189    0      164     3     0     3     3     0     8    0
sockpl     384       64    0       46     2     0     2     2     0     8    0
mcl4k      4096       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      67    0        0     9     0     9     9     0     8    0
mtagpl      80        1    0        0     1     0     1     1     0     8    0
mbufpl     256       86    0        0     6     0     6     6     0     8    0
bufpl      256     1998    0      254   109     0   109   109     0     8    0
anonpl      16    16861    0    15782     6     1     5     6     0   125    0
amapchunkpl 152     487    0      452     2     0     2     2     0   158    0
amappl16   192       68    0       63     1     0     1     1     0     8    0
amappl15   184        1    0        0     1     0     1     1     0     8    0
amappl14   176        1    0        1     1     1     0     1     0     8    0
amappl13   168       15    0       12     1     0     1     1     0     8    0
amappl12   160        7    0        7     1     1     0     1     0     8    0
amappl11   152      173    0      164     1     0     1     1     0     8    0
amappl10   144       44    0       43     1     0     1     1     0     8    0
amappl9    136       58    0       57     1     0     1     1     0     8    0
amappl8    128      102    0       96     1     0     1     1     0     8    0
amappl7    120       29    0       25     1     0     1     1     0     8    0
amappl6    112       40    0       35     1     0     1     1     0     8    0
amappl5    104      436    0      425     1     0     1     1     0     8    0
amappl4     96      265    0      243     1     0     1     1     0     8    0
amappl3     88      115    0      110     1     0     1     1     0     8    0
amappl2     80      566    0      532     1     0     1     1     0     8    0
amappl1     72    11778    0    11396    14     4    10    14     0     8    0
amappl      72      365    0      346     1     0     1     1     0    75    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      175    0      164     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      175    0      164     1     0     1     1     0     8    0
vmmpekpl   168     5123    0     5103     1     0     1     1     0     8    0
vmmpepl    168    23571    0    22887    51    18    33    43     0   357    1
vmsppl     360      174    0      164     2     0     2     2     0     8    0
pdppl      4096     357    0      328     5     0     5     5     0     8    0
pvpl        32    69535    0    66834    30     4    26    26     0   265    1
pmappl     224      174    0      164     1     0     1     1     0     8    0
extentpl    40       39    0       25     1     0     1     1     0     8    0
phpool     112      237    0        3     7     0     7     7     0     8    0
ddb{0}> 

Crashes (914):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2019/02/19 08:49 openbsd 644ac04beb28 59f36113 .config log report syz C
ci-openbsd-multicore 2019/02/09 09:58 openbsd ff85eb9967fa fa6c7b70 .config log report syz C
ci-openbsd-multicore 2019/02/04 20:49 openbsd 6e31582a5a78 d672172c .config log report syz C
ci-openbsd-multicore 2019/01/26 21:35 openbsd fdee2cadce4b c73f090a .config log report syz C
ci-openbsd-multicore 2019/03/30 17:26 openbsd 67caf7119898 c35ee0ea .config log report
ci-openbsd-multicore 2019/03/30 15:48 openbsd 67caf7119898 c35ee0ea .config log report
ci-openbsd-multicore 2019/03/30 13:53 openbsd 67caf7119898 c35ee0ea .config log report
ci-openbsd-multicore 2019/03/30 10:32 openbsd 67caf7119898 c35ee0ea .config log report
ci-openbsd-main 2019/03/30 09:08 openbsd 67caf7119898 c35ee0ea .config log report
ci-openbsd-multicore 2019/03/30 06:53 openbsd 20a5560209a4 c35ee0ea .config log report
ci-openbsd-multicore 2019/03/30 03:08 openbsd 20a5560209a4 c35ee0ea .config log report
ci-openbsd-main 2019/03/30 02:07 openbsd 20a5560209a4 c35ee0ea .config log report
ci-openbsd-main 2019/03/29 21:40 openbsd 20a5560209a4 c35ee0ea .config log report
ci-openbsd-multicore 2019/03/29 20:16 openbsd 20a5560209a4 c35ee0ea .config log report
ci-openbsd-multicore 2019/03/29 16:16 openbsd 6218530a164e e825006c .config log report
ci-openbsd-main 2019/03/29 15:29 openbsd 6218530a164e e825006c .config log report
ci-openbsd-main 2019/03/29 13:58 openbsd 6218530a164e e825006c .config log report
ci-openbsd-multicore 2019/03/29 12:41 openbsd 6218530a164e e825006c .config log report
ci-openbsd-multicore 2019/03/29 11:21 openbsd 6218530a164e e825006c .config log report
ci-openbsd-main 2019/03/29 10:20 openbsd 6218530a164e e825006c .config log report
ci-openbsd-main 2019/03/29 07:23 openbsd 6218530a164e e825006c .config log report
ci-openbsd-main 2019/03/29 05:20 openbsd 6218530a164e 14c58f8d .config log report
ci-openbsd-main 2019/03/29 01:31 openbsd 7ac074f6b41e 14c58f8d .config log report
ci-openbsd-main 2019/03/28 23:24 openbsd 7ac074f6b41e 14c58f8d .config log report
ci-openbsd-multicore 2019/03/28 18:33 openbsd 8423d6adca2c 14c58f8d .config log report
ci-openbsd-main 2019/03/28 14:23 openbsd 7ac074f6b41e f94f56fe .config log report
ci-openbsd-multicore 2019/03/28 11:19 openbsd 8423d6adca2c f94f56fe .config log report
ci-openbsd-multicore 2019/03/28 04:20 openbsd c95a22197bfd f94f56fe .config log report
ci-openbsd-main 2019/03/28 03:05 openbsd c95a22197bfd f94f56fe .config log report
ci-openbsd-multicore 2019/03/27 21:18 openbsd c95a22197bfd f94f56fe .config log report
ci-openbsd-main 2019/03/27 19:52 openbsd 709e530bc956 70d776a2 .config log report
ci-openbsd-multicore 2019/03/27 12:08 openbsd 690d147bdb68 70d776a2 .config log report
ci-openbsd-main 2019/03/27 03:37 openbsd 6baecefef8fe 55684ce1 .config log report
ci-openbsd-main 2019/03/27 01:18 openbsd 6baecefef8fe 55684ce1 .config log report
ci-openbsd-main 2019/03/26 20:15 openbsd 6baecefef8fe 55684ce1 .config log report
ci-openbsd-multicore 2019/03/26 18:44 openbsd ad597a5fc5a3 55684ce1 .config log report
ci-openbsd-multicore 2019/03/26 14:57 openbsd 6a51f920f2c9 55684ce1 .config log report
ci-openbsd-main 2019/03/26 12:25 openbsd 6a51f920f2c9 55684ce1 .config log report
ci-openbsd-main 2019/03/26 09:10 openbsd 6a51f920f2c9 55684ce1 .config log report
ci-openbsd-main 2019/03/26 02:44 openbsd 13a73e99f6f8 52a20ba4 .config log report
ci-openbsd-main 2019/03/26 00:52 openbsd 13a73e99f6f8 52a20ba4 .config log report
ci-openbsd-multicore 2019/03/26 00:06 openbsd 13a73e99f6f8 52a20ba4 .config log report
ci-openbsd-multicore 2019/03/25 22:29 openbsd 13a73e99f6f8 52a20ba4 .config log report
ci-openbsd-multicore 2019/03/25 19:25 openbsd 13a73e99f6f8 52a20ba4 .config log report
ci-openbsd-main 2019/03/25 17:26 openbsd 13a73e99f6f8 52a20ba4 .config log report
ci-openbsd-multicore 2019/03/25 11:12 openbsd 13a73e99f6f8 2c86e0a5 .config log report
ci-openbsd-multicore 2019/03/25 05:01 openbsd b3dbd5f2ca08 2c86e0a5 .config log report
ci-openbsd-multicore 2019/03/25 02:48 openbsd b3dbd5f2ca08 2c86e0a5 .config log report
ci-openbsd-pf 2019/03/05 15:49 openbsd 41e5a6229bec 3419571c .config log report
ci-openbsd-multicore 2019/01/26 21:15 openbsd fdee2cadce4b c73f090a .config log report
* Struck through repros no longer work on HEAD.