syzbot


panic: rw_enter: vcpulock locking against myself

Status: fixed on 2021/09/06 04:40
Reported-by: syzbot+c78b5644c7dc3d9b689a@syzkaller.appspotmail.com
Fix commit: 5f3d69798ad5 vmm(4): fix vcpu locking issues reported by syzbot
First crash: 456d, last: 456d

Sample crash report:
panic: rw_enter: vcpulock locking against myself
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*239124  43544      0           0  0x4000000    0  syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff8246be6e) at panic+0x161 sys/kern/subr_prf.c:202
rw_enter(ffff800024916a60,1) at rw_enter+0x36f sys/kern/kern_rwlock.c:174
vm_run(ffff8000216e1480) at vm_run+0x20f sys/arch/amd64/amd64/vmm.c:4232
VOP_IOCTL(fffffd806ec3dc90,c0205602,ffff8000216e1480,1,fffffd807f7d8900,ffff8000216687e0) at VOP_IOCTL+0x91 sys/kern/vfs_vops.c:295
vn_ioctl(fffffd806980f6a8,c0205602,ffff8000216e1480,ffff8000216687e0) at vn_ioctl+0xb5 sys/kern/vfs_vnops.c:531
sys_ioctl(ffff8000216687e0,ffff8000216e1598,ffff8000216e15f0) at sys_ioctl+0x49e
syscall(ffff8000216e1660) at syscall+0x571 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5f3645c90a0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: rw_enter: vcpulock locking against myself
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff8246be6e) at panic+0x161 sys/kern/subr_prf.c:202
rw_enter(ffff800024916a60,1) at rw_enter+0x36f sys/kern/kern_rwlock.c:174
vm_run(ffff8000216e1480) at vm_run+0x20f sys/arch/amd64/amd64/vmm.c:4232
VOP_IOCTL(fffffd806ec3dc90,c0205602,ffff8000216e1480,1,fffffd807f7d8900,ffff8000216687e0) at VOP_IOCTL+0x91 sys/kern/vfs_vops.c:295
vn_ioctl(fffffd806980f6a8,c0205602,ffff8000216e1480,ffff8000216687e0) at vn_ioctl+0xb5 sys/kern/vfs_vnops.c:531
sys_ioctl(ffff8000216687e0,ffff8000216e1598,ffff8000216e15f0) at sys_ioctl+0x49e
syscall(ffff8000216e1660) at syscall+0x571 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5f3645c90a0, count: -9
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff8000216e1120
rbx                              0x4
rdx                             0x8b
rcx                              0x2
rax                             0x31
r8                0xffffffff813e3a25    kprintf+0x145
r9                               0x1
r10               0xa062e1da398b67fd
r11               0xa99ebe9c7d96973b
r12                                0
r13               0xffff8000216687e4
r14                                0
r15                              0x1
rip               0xffffffff8155ed48    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff8000216e1110
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor.0) pid=239124 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=80, usrpri=80, nice=20
    forw=0xffffffffffffffff, list=0xffff800021669260,0xffffffff8280e698
    process=0xffff80002164afc8 user=0xffff8000216dc000, vmspace=0xfffffd806b068120
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 43544  340103  95756      0  2           0                syz-executor.0
*43544  239124  95756      0  7   0x4000000                syz-executor.0
  9651  135118  37853      0  2         0x2                syz-executor.1
 88405  360603      0      0  3     0x14200  bored         sosplice
 95756  324501  37853      0  3        0x82  nanoslp       syz-executor.0
 37853  185936  61704      0  3        0x82  thrsleep      syz-fuzzer
 37853  317913  61704      0  3   0x4000082  thrsleep      syz-fuzzer
 37853  359996  61704      0  3   0x4000082  kqread        syz-fuzzer
 37853   47017  61704      0  3   0x4000082  thrsleep      syz-fuzzer
 37853   73284  61704      0  3   0x4000082  thrsleep      syz-fuzzer
 37853  137806  61704      0  3   0x4000082  thrsleep      syz-fuzzer
 37853   28479  61704      0  3   0x4000082  thrsleep      syz-fuzzer
 61704  464313  86325      0  3    0x10008a  sigsusp       ksh
 86325  325433  15221      0  3        0x9a  select        sshd
 70110  122689      1      0  3    0x100083  ttyin         getty
 15221  229947      1      0  3        0x88  select        sshd
  5513  364252  46190     73  3    0x100090  kqread        syslogd
 46190   11538      1      0  3    0x100082  netio         syslogd
 56464  515076      1      0  3    0x100080  kqread        resolvd
 57822  293020  95387     77  3    0x100092  kqread        dhcpleased
 48642  178913  95387     77  3    0x100092  kqread        dhcpleased
 95387   24186      1      0  3        0x80  kqread        dhcpleased
 34540   57491      0      0  3     0x14200  bored         smr
  4338   90880      0      0  2     0x14200                zerothread
 33555  197537      0      0  3     0x14200  aiodoned      aiodoned
 49512    3391      0      0  3     0x14200  syncer        update
 87076  156849      0      0  3     0x14200  cleaner       cleaner
 95942  183569      0      0  3     0x14200  reaper        reaper
 19041   70450      0      0  3     0x14200  pgdaemon      pagedaemon
 80303  400625      0      0  3     0x14200  bored         crynlk
 35732  507648      0      0  3     0x14200  bored         crypto
 74095  518415      0      0  3     0x14200  bored         viomb
  4055  137371      0      0  3  0x40014200  acpi0         acpi0
 98812  114128      0      0  3     0x14200  bored         softnet
 86803   65920      0      0  3     0x14200  bored         systqmp
 43656  291681      0      0  3     0x14200  bored         systq
 72436  325371      0      0  3  0x40014200  bored         softclock
 70062  328683      0      0  3  0x40014200                idle0
     1  437391      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10125   6356K    7122K  78643K     14052        0
            pcb    13      8K       8K  78643K       124        0
         rtable   110      4K       7K  78643K       367        0
         ifaddr    53     11K      13K  78643K       103        0
       counters    21     16K      16K  78643K        28        0
       ioctlops     0      0K       4K  78643K       110        0
            iov     0      0K      16K  78643K        95        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         5        0
         vnodes  1221     77K      77K  78643K      2138        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K        12        0
         VM map     2      0K       0K  78643K         2        0
            sem    10      0K       0K  78643K        10        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12598        0
      file desc     5     13K      25K  78643K      2735        0
          sigio     0      0K       0K  78643K        23        0
           proc    61     55K      71K  78643K       512        0
        subproc    32      2K       2K  78643K        85        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       108        0
       in_multi    33      2K       2K  78643K       194        0
    ether_multi     1      0K       0K  78643K        41        0
            mrt     0      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    43    201K     201K  78643K        43        0
           exec     0      0K       2K  78643K       500        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   221     97K     116K  78643K     33505        0
       UVM aobj     8      7K       7K  78643K         8        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        89        0
            NDP     8      0K       0K  78643K        25        0
           temp   113   4197K    4261K  78643K     21022        0
         kqueue    10     14K      28K  78643K       234        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       98    0       95     1     0     1     1     0     8    0
rtentry    112       78    0       34     2     0     2     2     0     8    0
unpcb      120      594    0      581     1     0     1     1     0     8    0
syncache   296        6    0        6     2     2     0     1     0     8    0
tcpqe       32      424    0      424     2     2     0     1     0     8    0
tcpcb      736      298    0      291     7     5     2     3     0     8    1
arp         88       12    0        6     1     0     1     1     0     8    0
inpcb      304      912    0      904     5     4     1     2     0     8    0
nd6         48       15    0        9     1     0     1     1     0     8    0
kcovpl      48        5    0        3     1     0     1     1     0     8    0
pfstscr     40        8    0        7     1     0     1     1     0     8    0
pfrktable  1344      14    0       14     1     0     1     1     0     8    1
pftag       88        4    0        4     1     0     1     1     0     8    1
pfstitem    24        2    0        0     1     0     1     1     0     8    0
pfstkey    112       16    0       14     1     0     1     1     0     8    0
pfstate    320        8    0        7     1     0     1     1     0     8    0
pfrule     1360      15    0       15     3     2     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      321    0      132    12     0    12    12     0     8    0
art_table   32      322    0      132     2     0     2     2     0     8    0
art_node    16       77    0       37     1     0     1     1     0     8    0
sysvmsgpl   40        8    0        2     1     0     1     1     0     8    0
semapl     112        8    0        0     1     0     1     1     0     8    0
shmpl      112        5    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     4797    0     3393    89     0    89    89     0     8    0
ffsino     240     4797    0     3393    83     0    83    83     0     8    0
nchpl      144     8237    0     6638    60     0    60    60     0     8    0
uvmvnodes   72     5503    0        0   101     0   101   101     0     8    0
vnodes     224     5503    0        0   324     0   324   324     0     8    0
namei      1024   20974    0    20973     2     1     1     1     0     8    0
vcpupl     1984       5    0        0     1     0     1     1     0     8    0
vmpool     528       15    0       10     1     0     1     1     0     8    0
pfiaddrpl  120        4    0        4     1     0     1     1     0     8    1
scsiplug    72       14    0       14     2     2     0     1     0     8    0
scxspl     216    24125    0    24125    10     9     1     8     0     8    1
plimitpl   152       83    0       75     1     0     1     1     0     8    0
sigapl     424     2957    0     2925     4     0     4     4     0     8    0
futexpl     56    25268    0    25268     2     1     1     1     0     8    1
knotepl    112      436    0      398     2     0     2     2     0     8    0
kqueuepl   184     1674    0     1667     1     0     1     1     0     8    0
pipepl     304      264    0      254     1     0     1     1     0     8    0
fdescpl    432     2941    0     2925     3     1     2     3     0     8    0
filepl     120    10563    0    10453     5     1     4     4     0     8    0
lockfpl    104      444    0      442     1     0     1     1     0     8    0
lockfspl    48      172    0      170     1     0     1     1     0     8    0
sessionpl  144       20    0       10     1     0     1     1     0     8    0
pgrppl      48       36    0       26     1     0     1     1     0     8    0
ucredpl     96     1408    0     1398     1     0     1     1     0     8    0
zombiepl   144     2925    0     2925     1     0     1     1     0     8    1
processpl  1008    2957    0     2925     5     0     5     5     0     8    0
procpl     672     5835    0     5796     4     0     4     4     0     8    0
sosppl     168       37    0       37     2     2     0     1     0     8    0
sockpl     448     1614    0     1590     6     2     4     4     0     8    0
mcl64k     65536     59    0       59     3     3     0     1     0     8    0
mcl16k     16384     52    0       52     6     6     0     1     0     8    0
mcl12k     12288    126    0      126     9     8     1     1     0     8    1
mcl9k      9216      27    0       27     5     5     0     1     0     8    0
mcl8k      8192      38    0       38     5     4     1     1     0     8    1
mcl4k      4096     142    0      142     8     7     1     1     0     8    1
mcl2k2     2112      18    0       18     3     3     0     1     0     8    0
mcl2k      2048   68055    0    67992    47    33    14    20     0     8    5
mtagpl      96      260    0      146     7     3     4     5     0     8    0
mbufpl     256   193247    0   192811    94    63    31    45     0     8    0
bufpl      280     7422    0     1015   458     0   458   458     0     8    0
anonpl      24   718491    0   707248    79     9    70    74     0   188    1
amapchunkpl 152   80678    0    80211    33    12    21    32     0   158    0
amappl16   200     5576    0     5225    22     3    19    22     0     8    0
amappl15   192     2176    0     2174     1     0     1     1     0     8    0
amappl14   184      218    0      214     1     0     1     1     0     8    0
amappl13   176       98    0       97     1     0     1     1     0     8    0
amappl12   168        2    0        1     1     0     1     1     0     8    0
amappl11   160       38    0       27     1     0     1     1     0     8    0
amappl10   152      127    0      122     1     0     1     1     0     8    0
amappl9    144       14    0       11     1     0     1     1     0     8    0
amappl8    136      638    0      584     2     0     2     2     0     8    0
amappl7    128      272    0      260     1     0     1     1     0     8    0
amappl6    120      142    0      125     1     0     1     1     0     8    0
amappl5    112     3153    0     3138     1     0     1     1     0     8    0
amappl4    104      860    0      835     1     0     1     1     0     8    0
amappl3     96      188    0      187     1     0     1     1     0     8    0
amappl2     88      548    0      492     2     0     2     2     0     8    0
amappl1     80    50904    0    50493    12     3     9    12     0     8    0
amappl      88    32865    0    32722     4     0     4     4     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        7    0        0     1     0     1     1     0     8    0
uaddrrnd    24     2956    0     2935     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2956    0     2935     1     0     1     1     0     8    0
vmmpekpl   168    19526    0    19505     2     0     2     2     0     8    0
vmmpepl    168   323489    0   321883   114    39    75    87     0   357    0
vmsppl     272     2955    0     2935     3     1     2     2     0     8    0
rwobjpl     24    56562    0    55504     7     0     7     7     0     8    0
pdppl      4096    5918    0     5875    71    26    45    47     0     8    2
pvpl        32  1553944    0  1539358   175    50   125   135     0   265    5
pmappl     192     2955    0     2935     2     0     2     2     0     8    1
extentpl    40       58    0       40     1     0     1     1     0     8    0
phpool     112      446    0      155     9     0     9     9     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff8246be6e) at panic+0x161 sys/kern/subr_prf.c:202
rw_enter(ffff800024916a60,1) at rw_enter+0x36f sys/kern/kern_rwlock.c:174
vm_run(ffff8000216e1480) at vm_run+0x20f sys/arch/amd64/amd64/vmm.c:4232
VOP_IOCTL(fffffd806ec3dc90,c0205602,ffff8000216e1480,1,fffffd807f7d8900,ffff8000216687e0) at VOP_IOCTL+0x91 sys/kern/vfs_vops.c:295
vn_ioctl(fffffd806980f6a8,c0205602,ffff8000216e1480,ffff8000216687e0) at vn_ioctl+0xb5 sys/kern/vfs_vnops.c:531
sys_ioctl(ffff8000216687e0,ffff8000216e1598,ffff8000216e15f0) at sys_ioctl+0x49e
syscall(ffff8000216e1660) at syscall+0x571 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5f3645c90a0, count: -9
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff8246be6e) at panic+0x161 sys/kern/subr_prf.c:202
rw_enter(ffff800024916a60,1) at rw_enter+0x36f sys/kern/kern_rwlock.c:174
vm_run(ffff8000216e1480) at vm_run+0x20f sys/arch/amd64/amd64/vmm.c:4232
VOP_IOCTL(fffffd806ec3dc90,c0205602,ffff8000216e1480,1,fffffd807f7d8900,ffff8000216687e0) at VOP_IOCTL+0x91 sys/kern/vfs_vops.c:295
vn_ioctl(fffffd806980f6a8,c0205602,ffff8000216e1480,ffff8000216687e0) at vn_ioctl+0xb5 sys/kern/vfs_vnops.c:531
sys_ioctl(ffff8000216687e0,ffff8000216e1598,ffff8000216e15f0) at sys_ioctl+0x49e
syscall(ffff8000216e1660) at syscall+0x571 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5f3645c90a0, count: -9

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2021/09/02 05:55 openbsd e42df31d2641 7eb7e152 .config log report panic: rw_enter: vcpulock locking against myself
* Struck through repros no longer work on HEAD.