syzbot


uvm_fault: ffs_indirtrunc

Status: upstream: reported C repro on 2022/06/19 16:27
Reported-by: syzbot+ee270b72306199c3401f@syzkaller.appspotmail.com
First crash: 227d, last: 73d
Last patch testing requests:
Created Duration User Patch Repo Result
2022/09/27 16:30 10m retest repro openbsd report log

Sample crash report:
uvm_fault(0xffffffff82ab9658, 0xffff80002100fff8, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs_indirtrunc+0x583:   movq    0(%rax,%rbx,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 17460  17383      0           0          0    0  syz-executor1274477389
ffs_indirtrunc(fffffd806d731c30,fffffffffffffff4,204740,ffffffffffffffff,0,ffff80002164f178) at ffs_indirtrunc+0x583 sys/ufs/ffs/ffs_inode.c:535
ffs_truncate(fffffd806d731c30,0,0,fffffd807f7d79c0) at ffs_truncate+0xfd5 sys/ufs/ffs/ffs_inode.c:337
ufs_setattr(ffff80002164f350) at ufs_setattr+0x6c1 sys/ufs/ufs/ufs_vnops.c:408
VOP_SETATTR(fffffd806d9df930,ffff80002164f3d0,fffffd807f7d79c0,ffff8000ffff87e8) at VOP_SETATTR+0xd0 sys/kern/vfs_vops.c:210
vn_open(ffff80002164f5a8,70f,0) at vn_open+0x431 sys/kern/vfs_vnops.c:180
doopenat(ffff8000ffff87e8,ffffff9c,20000040,70e,0,ffff80002164f790) at doopenat+0x26a sys/kern/vfs_syscalls.c:1131
syscall(ffff80002164f800) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbed50, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff82ab9658, 0xffff80002100fff8, 0, 1) -> d
ddb> trace
ffs_indirtrunc(fffffd806d731c30,fffffffffffffff4,204740,ffffffffffffffff,0,ffff80002164f178) at ffs_indirtrunc+0x583 sys/ufs/ffs/ffs_inode.c:535
ffs_truncate(fffffd806d731c30,0,0,fffffd807f7d79c0) at ffs_truncate+0xfd5 sys/ufs/ffs/ffs_inode.c:337
ufs_setattr(ffff80002164f350) at ufs_setattr+0x6c1 sys/ufs/ufs/ufs_vnops.c:408
VOP_SETATTR(fffffd806d9df930,ffff80002164f3d0,fffffd807f7d79c0,ffff8000ffff87e8) at VOP_SETATTR+0xd0 sys/kern/vfs_vops.c:210
vn_open(ffff80002164f5a8,70f,0) at vn_open+0x431 sys/kern/vfs_vnops.c:180
doopenat(ffff8000ffff87e8,ffffff9c,20000040,70e,0,ffff80002164f790) at doopenat+0x26a sys/kern/vfs_syscalls.c:1131
syscall(ffff80002164f800) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbed50, count: -8
ddb> show registers
rdi                              0x2
rsi                              0x2
rbp               0xffff80002164f0d0
rbx                            0x1ff
rdx               0xfffffd806d4f7078
rcx               0xfffffffffffffff4
rax               0xffff80002100f000
r8                0xffffffffffffffff
r9                0xffff80002164f178
r10               0x5efe2c5a7e70f4fe
r11               0x68689431f3ba02ed
r12                              0x1
r13               0xffffffffffffffff
r14                              0x2
r15               0xfffffd806d731c30
rip               0xffffffff814ab4e3    ffs_indirtrunc+0x583
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002164efe0
ss                              0x10
ffs_indirtrunc+0x583:   movq    0(%rax,%rbx,8),%r14
ddb> show proc
PROC (syz-executor1274477389) pid=17460 stat=onproc
    flags process=0 proc=0
    pri=17, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff8d28,0xffffffff82ac40d0
    process=0xffff8000ffff6bc8 user=0xffff80002164a000, vmspace=0xfffffd807f016440
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*17383   17460  35420      0  7           0                syz-executor1274477389
 35420  263656  76030      0  3        0x82  nanoslp       syz-executor1274477389
 76030  361418   2314      0  3    0x10008a  sigsusp       ksh
  2314   54824  81044      0  3        0x9a  kqread        sshd
 89143  209204      1      0  3    0x100083  ttyin         getty
 81044  260990      1      0  3        0x88  kqread        sshd
 33470  384753  75721     73  3   0x1100090  kqread        syslogd
 75721  360892      1      0  3    0x100082  netio         syslogd
  3234   19475      1      0  3    0x100080  kqread        resolvd
 34140   22736  96478     77  3    0x100092  kqread        dhcpleased
 54485  112380  96478     77  3    0x100092  kqread        dhcpleased
 96478  161641      1      0  3        0x80  kqread        dhcpleased
 40786  251645      0      0  3     0x14200  bored         smr
 79604  226408      0      0  2     0x14200                zerothread
 53209  240358      0      0  3     0x14200  aiodoned      aiodoned
 12519  419848      0      0  3     0x14200  syncer        update
 10815   61257      0      0  3     0x14200  cleaner       cleaner
 81958  116300      0      0  3     0x14200  reaper        reaper
 70064  258269      0      0  3     0x14200  pgdaemon      pagedaemon
 95102  208367      0      0  3     0x14200  bored         viomb
 52478    7275      0      0  3  0x40014200  acpi0         acpi0
 15567   95843      0      0  3     0x14200  bored         softnet
 45008   26286      0      0  3     0x14200  bored         softnet
 34695   62020      0      0  3     0x14200  bored         softnet
  4356  161682      0      0  3     0x14200  bored         softnet
 67551  304612      0      0  3     0x14200  bored         systqmp
  6557  278240      0      0  3     0x14200  bored         systq
 18803  119810      0      0  3  0x40014200  bored         softclock
 47660  490545      0      0  3  0x40014200                idle0
     1  378670      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10135   6382K    6413K  78643K     11225        0
            pcb    13      8K       8K  78643K        13        0
         rtable    58      1K       2K  78643K       104        0
         ifaddr    24      7K       7K  78643K        24        0
       counters    19     16K      16K  78643K        19        0
       ioctlops     0      0K       2K  78643K        25        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         5        0
         vnodes  1166     73K      73K  78643K      1180        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc     1      0K       0K  78643K         1        0
           proc    55     58K      59K  78643K       226        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    25    122K     122K  78643K        25        0
           exec     0      0K       2K  78643K       391        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    54     10K      10K  78643K      4444        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     3      0K       0K  78643K         3        0
           temp    18   4709K    4773K  78643K      5473        0
         kqueue    11     16K      18K  78643K        24        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       17    0       14     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      136       33    0       20     1     0     1     1     0     8    0
syncache   296        5    0        5     2     2     0     1     0     8    0
tcpcb      736        8    0        5     1     0     1     1     0     8    0
arp         88        2    0        0     1     0     1     1     0     8    0
inpcb      312       25    0       19     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1417    0       38    87     0    87    87     0     8    0
ffsino     240     1417    0       38    82     0    82    82     0     8    0
nchpl      144     1604    0       47    58     0    58    58     0     8    0
uvmvnodes   80     1427    0        0    30     0    30    30     0     8    0
vnodes     224     1427    0        0    84     0    84    84     0     8    0
namei      1024   13734    0    13734     2     1     1     1     0     8    1
kstatmem   264        6    0        0     1     0     1     1     0     8    0
scxspl     216   220546    0   220546    18    15     3     8     0     8    3
plimitpl   152       16    0        9     1     0     1     1     0     8    0
sigapl     424     3480    0     3450     4     0     4     4     0     8    0
knotepl    120    31220    0    31191     3     2     1     2     0     8    0
kqueuepl   184       20    0       13     1     0     1     1     0     8    0
pipepl     304       79    0       76     2     1     1     1     0     8    0
fdescpl    432     3464    0     3450     2     0     2     2     0     8    0
filepl     120    10601    0    10545     2     0     2     2     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       18    0        9     1     0     1     1     0     8    0
pgrppl      48       18    0        9     1     0     1     1     0     8    0
ucredpl     96       65    0       54     1     0     1     1     0     8    0
zombiepl   144     3450    0     3450     2     1     1     1     0     8    1
processpl  1000    3480    0     3450     5     1     4     5     0     8    0
procpl     672     3480    0     3450     3     0     3     3     0     8    0
sockpl     448       75    0       53     3     0     3     3     0     8    0
mcl8k      8192       9    0        9     2     2     0     1     0     8    0
mcl4k      4096       5    0        5     2     2     0     1     0     8    0
mcl2k      2048    7220    0     7192     6     2     4     6     0     8    0
mtagpl      96        3    0        3     1     1     0     1     0     8    0
mbufpl     256    21453    0    21387     7     2     5     6     0     8    0
bufpl      288   218542    0   212253   450     0   450   450     0     8    0
anonpl      24   869827    0   868050    16     3    13    13     0   188    2
amapchunkpl 152    5742    0     5658     5     1     4     5     0   158    0
amappl16   200    54233    0    54227     2     0     2     2     0     8    1
amappl13   176       32    0       31     2     1     1     1     0     8    0
amappl12   168        5    0        4     1     0     1     1     0     8    0
amappl11   160       60    0       47     1     0     1     1     0     8    0
amappl10   152        1    0        1     1     1     0     1     0     8    0
amappl9    144      483    0      481     1     0     1     1     0     8    0
amappl8    136      333    0      332     2     1     1     1     0     8    0
amappl7    128       48    0       45     1     0     1     1     0     8    0
amappl6    120       93    0       83     1     0     1     1     0     8    0
amappl5    112     3266    0     3257     1     0     1     1     0     8    0
amappl4    104      565    0      546     1     0     1     1     0     8    0
amappl3     96      353    0      334     1     0     1     1     0     8    0
amappl2     88      417    0      379     1     0     1     1     0     8    0
amappl1     80    21480    0    21110    11     2     9     9     0     8    0
amappl      88     4190    0     4153     1     0     1     1     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24     3464    0     3450     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3464    0     3450     1     0     1     1     0     8    0
vmmpekpl   168    12340    0    12329     1     0     1     1     0     8    0
vmmpepl    168   130048    0   129259    44     8    36    38     0   357    0
vmsppl     272     3463    0     3450     2     1     1     2     0     8    0
rwobjpl     24    63240    0    61298    13     0    13    13     0     8    0
pdppl      4096    6934    0     6900    52    18    34    40     0     8    0
pvpl        32  1024070    0  1020431    39     7    32    33     0   265    2
pmappl     216     3463    0     3450     1     0     1     1     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112      710    0       30    20     0    20    20     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
ffs_indirtrunc(fffffd806d731c30,fffffffffffffff4,204740,ffffffffffffffff,0,ffff80002164f178) at ffs_indirtrunc+0x583 sys/ufs/ffs/ffs_inode.c:535
ffs_truncate(fffffd806d731c30,0,0,fffffd807f7d79c0) at ffs_truncate+0xfd5 sys/ufs/ffs/ffs_inode.c:337
ufs_setattr(ffff80002164f350) at ufs_setattr+0x6c1 sys/ufs/ufs/ufs_vnops.c:408
VOP_SETATTR(fffffd806d9df930,ffff80002164f3d0,fffffd807f7d79c0,ffff8000ffff87e8) at VOP_SETATTR+0xd0 sys/kern/vfs_vops.c:210
vn_open(ffff80002164f5a8,70f,0) at vn_open+0x431 sys/kern/vfs_vnops.c:180
doopenat(ffff8000ffff87e8,ffffff9c,20000040,70e,0,ffff80002164f790) at doopenat+0x26a sys/kern/vfs_syscalls.c:1131
syscall(ffff80002164f800) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbed50, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
ffs_indirtrunc(fffffd806d731c30,fffffffffffffff4,204740,ffffffffffffffff,0,ffff80002164f178) at ffs_indirtrunc+0x583 sys/ufs/ffs/ffs_inode.c:535
ffs_truncate(fffffd806d731c30,0,0,fffffd807f7d79c0) at ffs_truncate+0xfd5 sys/ufs/ffs/ffs_inode.c:337
ufs_setattr(ffff80002164f350) at ufs_setattr+0x6c1 sys/ufs/ufs/ufs_vnops.c:408
VOP_SETATTR(fffffd806d9df930,ffff80002164f3d0,fffffd807f7d79c0,ffff8000ffff87e8) at VOP_SETATTR+0xd0 sys/kern/vfs_vops.c:210
vn_open(ffff80002164f5a8,70f,0) at vn_open+0x431 sys/kern/vfs_vnops.c:180
doopenat(ffff8000ffff87e8,ffffff9c,20000040,70e,0,ffff80002164f790) at doopenat+0x26a sys/kern/vfs_syscalls.c:1131
syscall(ffff80002164f800) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbed50, count: -8

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-main 2022/06/19 16:26 openbsd 75a44452e183 8f633d84 .config console log report syz C uvm_fault: ffs_indirtrunc
ci-openbsd-main 2022/11/21 06:27 openbsd 11064cccbc3a 5bb70014 .config console log report syz [disk image] [bsd.gdb] [kernel image] uvm_fault: ffs_indirtrunc
ci-openbsd-main 2022/10/08 08:35 openbsd c45c688b6d76 aea5da89 .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: ffs_indirtrunc
* Struck through repros no longer work on HEAD.