syzbot


assert "ifp != NULL" failed in if_ether.c (2)

Status: auto-closed as invalid on 2020/05/01 00:10
Reported-by: syzbot+2086419f74f5ee3cd8c9@syzkaller.appspotmail.com
First crash: 1575d, last: 1575d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "ifp != NULL" failed in if_ether.c (3) 2 1381d 1386d 0/3 auto-closed as invalid on 2020/11/10 23:30
openbsd assert "ifp != NULL" failed in if_ether.c (5) 181 166d 561d 0/3 auto-obsoleted due to no activity on 2024/01/30 04:10
openbsd assert "ifp != NULL" failed in if_ether.c 208 1662d 1716d 0/3 auto-closed as invalid on 2020/01/05 03:09
openbsd assert "ifp != NULL" failed in if_ether.c (4) 2 855d 900d 0/3 auto-closed as invalid on 2022/04/21 04:41

Sample crash report:
panic: kernel diagnostic assertion "ifp != NULL" failed: file "/syzkaller/managers/main/kernel/sys/netinet/if_ether.c", line 718
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*407876  74048      0     0x14000 0x40000200    0  softclock
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff821aee52) at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff82204d9d,ffffffff8221ff31,2ce,ffffffff8218c4b4) at __assert+0x2b sys/kern/subr_prf.c:154
arp_rtrequest(fffffd806b7ee468,fffffd806b7ee468,28) at arp_rtrequest
arptimer(ffffffff82526f70) at arptimer+0x95 sys/netinet/if_ether.c:120
softclock_thread(ffff80001d2f2110) at softclock_thread+0x155 timeout_run sys/kern/kern_timeout.c:490 [inline]
softclock_thread(ffff80001d2f2110) at softclock_thread+0x155 sys/kern/kern_timeout.c:578
end trace frame: 0x0, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel diagnostic assertion "ifp != NULL" failed: file "/syzkaller/managers/main/kernel/sys/netinet/if_ether.c", line 718
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff821aee52) at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff82204d9d,ffffffff8221ff31,2ce,ffffffff8218c4b4) at __assert+0x2b sys/kern/subr_prf.c:154
arp_rtrequest(fffffd806b7ee468,fffffd806b7ee468,28) at arp_rtrequest
arptimer(ffffffff82526f70) at arptimer+0x95 sys/netinet/if_ether.c:120
softclock_thread(ffff80001d2f2110) at softclock_thread+0x155 timeout_run sys/kern/kern_timeout.c:490 [inline]
softclock_thread(ffff80001d2f2110) at softclock_thread+0x155 sys/kern/kern_timeout.c:578
end trace frame: 0x0, count: -6
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80001d30c770
rbx               0xffff80001d30c820
rdx                              0x2
rcx                                0
rax                                0
r8                0xffff80001d30c730
r9                               0x1
r10                                0
r11               0xfaa80fcd21680f2e
r12                     0x3000000008
r13               0xffff80001d30c780
r14                            0x100
r15                              0x1
rip               0xffffffff81ed2688    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80001d30c760
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (softclock) pid=407876 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
    pri=0, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff80001d2f2380,0xffff80001d2f1eb0
    process=0xffff8000ffffe380 user=0xffff80001d307000, vmspace=0xffffffff82554400
    estcpu=0, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 66700  371122  16129      0  3        0x82  piperd        syz-executor.0
 46868  339087  16129      0  3        0x82  piperd        syz-executor.1
 16129  100156  23146      0  3        0x82  thrsleep      syz-fuzzer
 16129  427874  23146      0  3   0x4000082  thrsleep      syz-fuzzer
 16129  286842  23146      0  3   0x4000082  thrsleep      syz-fuzzer
 16129  308561  23146      0  3   0x4000082  thrsleep      syz-fuzzer
 16129  127384  23146      0  3   0x4000082  kqread        syz-fuzzer
 16129  114854  23146      0  3   0x4000082  thrsleep      syz-fuzzer
 16129  286013  23146      0  3   0x4000082  thrsleep      syz-fuzzer
 16129  128045  23146      0  3   0x4000082  thrsleep      syz-fuzzer
 23146  435829  85439      0  3    0x10008a  pause         ksh
 85439  343759  27488      0  3        0x92  select        sshd
 87567  418833      1      0  3    0x100083  ttyin         getty
 27488  274394      1      0  3        0x80  select        sshd
  1109  284151  50255     73  3    0x100090  kqread        syslogd
 50255    7000      1      0  3    0x100082  netio         syslogd
 53862  224256      1     77  3    0x100090  poll          dhclient
  9992  487097      1      0  3        0x80  poll          dhclient
 87513  323347      0      0  3     0x14200  pgzero        zerothread
 82439   60545      0      0  3     0x14200  aiodoned      aiodoned
 53445   51894      0      0  3     0x14200  syncer        update
 17235  199080      0      0  3     0x14200  cleaner       cleaner
 78827  440296      0      0  3     0x14200  reaper        reaper
 86564  458497      0      0  3     0x14200  pgdaemon      pagedaemon
 35601  105981      0      0  3     0x14200  bored         crynlk
 73718  444939      0      0  3     0x14200  bored         crypto
 55617  506274      0      0  3  0x40014200  acpi0         acpi0
 69381  331345      0      0  3     0x14200  bored         softnet
 91016  462874      0      0  3     0x14200  bored         systqmp
 78332  488177      0      0  3     0x14200  bored         systq
*74048  407876      0      0  7  0x40014200                softclock
 31171  339350      0      0  3  0x40014200                idle0
  5084  449107      0      0  3     0x14200  bored         smr
     1  151981      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9467   6331K    6592K  78643K     10787        0
            pcb    13      8K       8K  78643K        37        0
         rtable   126      3K       4K  78643K       344        0
         ifaddr    51     11K      12K  78643K        75        0
       counters    21     16K      16K  78643K        23        0
       ioctlops     0      0K       2K  78643K        25        0
            iov     0      0K      12K  78643K        17        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1218     77K      77K  78643K      1310        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         5        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      1K       1K  78643K        22        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1794    195K     288K  78643K     12646        0
      file desc     4      9K      25K  78643K       802        0
          sigio     0      0K       0K  78643K         2        0
           proc    50     38K      63K  78643K       423        0
        subproc    32      2K       2K  78643K        51        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        37        0
       in_multi    40      2K       2K  78643K        62        0
    ether_multi     1      0K       0K  78643K         5        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    55    254K     254K  78643K        55        0
           exec     0      0K       1K  78643K       215        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   115     54K      54K  78643K      2668        0
       UVM aobj    14      2K       2K  78643K        16        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        20        0
            NDP     7      0K       0K  78643K        15        0
           temp   109   3013K    3078K  78643K      6624        0
         kqueue     3      4K      12K  78643K        14        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       16    0        6     1     0     1     1     0     8    0
rtpcb       80       43    0       41     1     0     1     1     0     8    0
rtentry    112       78    0       25     2     0     2     2     0     8    0
unpcb      120      267    0      258     2     1     1     2     0     8    0
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpcb      544      275    0      271     1     0     1     1     0     8    0
inpcb      280     1336    0     1329     3     2     1     2     0     8    0
nd6         48        6    0        2     1     0     1     1     0     8    0
pkpcb       40        2    0        2     1     1     0     1     0     8    0
art_heap8  4096       3    0        1     2     0     2     2     0     8    0
art_heap4  256      300    0       69    15     0    15    15     0     8    0
art_table   32      303    0       70     2     0     2     2     0     8    0
art_node    16       77    0       29     1     0     1     1     0     8    0
semupl     112        2    0        2     1     1     0     1     0     8    0
semapl     112       20    0       10     1     0     1     1     0     8    0
shmpl      112       14    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     2302    0      893    46     0    46    46     0     8    0
ffsino     240     2302    0      893    84     0    84    84     0     8    0
nchpl      144     3754    0     2159    60     0    60    60     0     8    0
uvmvnodes   72     2415    0        0    44     0    44    44     0     8    0
vnodes     208     2415    0        0   128     0   128   128     0     8    0
namei      1024    9134    0     9134     1     1     0     1     0     8    0
vcpupl     1984       3    0        0     1     0     1     1     0     8    0
vmpool     528        3    0        0     1     0     1     1     0     8    0
scxspl     192    11507    0    11507    12    11     1     1     0     8    1
plimitpl   152       25    0       18     1     0     1     1     0     8    0
sigapl     432      970    0      958     2     0     2     2     0     8    0
futexpl     56    11159    0    11159     1     1     0     1     0     8    0
knotepl    112       79    0       60     1     0     1     1     0     8    0
kqueuepl   104       34    0       32     1     0     1     1     0     8    0
pipelkpl    16      205    0      195     1     0     1     1     0     8    0
pipepl     120      410    0      391     1     0     1     1     0     8    0
fdescpl    432      971    0      958     2     0     2     2     0     8    0
filepl     120     5084    0     4989     5     2     3     5     0     8    0
lockfpl    104      418    0      417     1     0     1     1     0     8    0
lockfspl    48       83    0       82     1     0     1     1     0     8    0
sessionpl  112       18    0        8     1     0     1     1     0     8    0
pgrppl      48       20    0       10     1     0     1     1     0     8    0
ucredpl     96      233    0      226     1     0     1     1     0     8    0
zombiepl   144      958    0      958     1     1     0     1     0     8    0
processpl  896      985    0      958     4     0     4     4     0     8    0
procpl     624     1777    0     1743     5     2     3     4     0     8    0
sockpl     400     1648    0     1630     6     3     3     6     0     8    0
mcl64k     65536      6    0        6     2     2     0     1     0     8    0
mcl16k     16384      1    0        1     1     1     0     1     0     8    0
mcl12k     12288      8    0        8     2     2     0     1     0     8    0
mcl9k      9216       3    0        3     1     1     0     1     0     8    0
mcl8k      8192      53    0       53     1     1     0     1     0     8    0
mcl4k      4096     234    0      229     2     1     1     1     0     8    0
mcl2k2     2112       1    0        1     1     1     0     1     0     8    0
mcl2k      2048   63009    0    62960    18    11     7    13     0     8    0
mtagpl      80       12    0        2     2     1     1     1     0     8    0
mbufpl     256   104337    0   104041    29    10    19    20     0     8    0
bufpl      280     6092    0      684   387     0   387   387     0     8    0
anonpl      16    90064    0    75690    68     2    66    66     0   107    0
amapchunkpl 152    3873    0     3723     9     2     7     8     0   158    0
amappl16   192     4138    0     3256    47     2    45    46     0     8    0
amappl15   184       61    0       56     1     0     1     1     0     8    0
amappl14   176      124    0      118     1     0     1     1     0     8    0
amappl13   168        7    0        7     1     1     0     1     0     8    0
amappl12   160       12    0       10     2     1     1     1     0     8    0
amappl11   152      730    0      718     1     0     1     1     0     8    0
amappl10   144       16    0       14     1     0     1     1     0     8    0
amappl9    136      580    0      576     1     0     1     1     0     8    0
amappl8    128      124    0      103     1     0     1     1     0     8    0
amappl7    120      102    0       91     1     0     1     1     0     8    0
amappl6    112      724    0      718     1     0     1     1     0     8    0
amappl5    104      149    0      140     1     0     1     1     0     8    0
amappl4     96     1098    0     1071     1     0     1     1     0     8    0
amappl3     88      302    0      291     1     0     1     1     0     8    0
amappl2     80     6966    0     6904     3     1     2     3     0     8    0
amappl1     72    26772    0    26361    26    16    10    20     0     8    0
amappl      80     2168    0     2121     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       15    0        2     1     0     1     1     0     8    0
uaddrrnd    24      974    0      958     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      974    0      958     1     0     1     1     0     8    0
vmmpekpl   168     8619    0     8594     2     0     2     2     0     8    0
vmmpepl    168   119498    0   117617   141    54    87   120     0   357    0
vmsppl     272      973    0      958     2     0     2     2     0     8    0
pdppl      4096    1954    0     1919     6     1     5     6     0     8    0
pvpl        32   266738    0   249669   163     9   154   162     0   265    0
pmappl     200      973    0      958     1     0     1     1     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      180    0       35     5     0     5     5     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/01 00:09 openbsd 3c2d073562ae c30117b2 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.