syzbot


protection_fault: pool_do_put (2)

Status: upstream: reported on 2022/09/14 11:13
Reported-by: syzbot+42c2ce1cdca7b10e2f95@syzkaller.appspotmail.com
First crash: 145d, last: 16d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: pool_do_put 1 304d 304d 0/3 auto-closed as invalid on 2022/07/07 15:19

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      pool_do_put+0x115:      movq    0x8(%rbx),%rbx
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
pool_do_put(ffffffff82dc1f50,fffffd8066224d88) at pool_do_put+0x115
pool_put(ffffffff82dc1f50,fffffd8066224d88) at pool_put+0x8b sys/kern/subr_pool.c:799
soclose(fffffd8066224d88,0) at soclose+0x4ba sys/kern/uipc_socket.c:432
soo_close(fffffd80645feab0,ffff8000212c90a8) at soo_close+0x40
fdrop(fffffd80645feab0,ffff8000212c90a8) at fdrop+0xc7 sys/kern/kern_descrip.c:1274
closef(fffffd80645feab0,ffff8000212c90a8) at closef+0x11c sys/kern/kern_descrip.c:1258
fdfree(ffff8000212c90a8) at fdfree+0xe4 sys/kern/kern_descrip.c:1190
exit1(ffff8000212c90a8,0,0,1) at exit1+0x37d sys/kern/kern_exit.c:196
sys_exit(ffff8000212c90a8,ffff8000212b5320,ffff8000212b5370) at sys_exit+0x16 sys/kern/kern_exit.c:89
syscall(ffff8000212b53f0) at syscall+0x555 mi_syscall sys/sys/syscall_mi.h:113 [inline]
syscall(ffff8000212b53f0) at syscall+0x555 sys/arch/amd64/amd64/trap.c:626
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffffb7d0, count: -11
ddb{0}> show registers
rdi                                0
rsi               0xfffffd8066224400
rbp               0xffff8000212b5090
rbx               0xa2485f67ee4bf4cd
rdx                                0
rcx                                0
rax               0xffff8000212c90a8
r8                                 0
r9                                 0
r10               0x1a43971a0c846138
r11               0x4d57e6ed154ea694
r12               0xfffffd8066224d88
r13                0xff6b097e706e34c
r14               0xffffffff82dc1f50    socket_pool
r15               0xfffffd8066224f90
rip               0xffffffff81563405    pool_do_put+0x115
cs                               0x8
rflags                       0x10216    __ALIGN_SIZE+0xf216
rsp               0xffff8000212b4fe0
ss                              0x10
pool_do_put+0x115:      movq    0x8(%rbx),%rbx
ddb{0}> show proc
PROC (syz-executor.6) pid=218987 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    pri=32, usrpri=83, nice=20
    forw=0xffffffffffffffff, list=0xffff800021228848,0xffffffff82c5b330
    process=0xffff800027bb1d68 user=0xffff8000212b0000, vmspace=0xfffffd807effacf0
    estcpu=33, cpticks=0, pctcpu=0.1
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 24256  431808  64120      0  3        0x82  piperd        syz-executor.3
 84609  330798  64120      0  3        0x82  piperd        syz-executor.0
 84647  348839  64120      0  3        0x82  piperd        syz-executor.1
 28018  475515  64120      0  3        0x82  piperd        syz-executor.2
 84301  512598  64120      0  3        0x82  nanoslp       syz-executor.6
 38258  119416  64120      0  3         0x3  kernel: protection fault trap, code=0
Faulted in DDB; continuing...
ddb{0}> show all locks
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10225   6477K    7966K  78643K     16876        0
            pcb    13     12K      14K  78643K      2241        0
         rtable   166      6K       8K  78643K       802        0
         ifaddr    74     24K      26K  78643K       334        0
         sysctl     2      0K       0K  78643K         2        0
       counters    58     35K      36K  78643K       208        0
       ioctlops     0      0K       4K  78643K      2049        0
            iov     0      0K      32K  78643K       382        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1522     95K      95K  78643K      4005        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       9K  78643K        36        0
         VM map     2      1K       1K  78643K         2        0
            sem    11      1K       1K  78643K        14        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    11     37K      85K  78643K      4727        0
          sigio     0      0K       0K  78643K       288        0
           proc    70     91K     115K  78643K       900        0
        subproc   104      6K       6K  78643K       208        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       327        0
       in_multi    70      4K       6K  78643K       245        0
    ether_multi     2      0K       0K  78643K       101        0
            mrt     2      0K       0K  78643K       723        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   169    758K     758K  78643K       169        0
           exec     0      0K       1K  78643K      1023        0
     pfkey data     0      0K       0K  78643K         2        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   322     86K      87K  78643K     34348        0
       UVM aobj   131      4K       4K  78643K       131        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K       104        0
            NDP    13      0K       1K  78643K       103        0
           temp   133   5778K    6802K  78643K     27721        0
         kqueue    12     18K      26K  78643K       273        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120      381    0      378     8     7     1     5     0     8    0
rtentry    112      241    0      171     4     0     4     4     0     8    0
unpcb      144     5634    0     5592    53    47     6     9     0     8    3
syncache   296       15    0       15     6     6     0     1     0     8    0
tcpqe       32      426    0      426     4     4     0     1     0     8    0
tcpcb      776     2414    0     2410    69    62     7     8     0     8    6
arp        120       37    0       23     1     0     1     1     0     8    0
inpcb      368     6183    0     6176    92    85     7    19     0     8    6
nd6         48       53    0       39     1     0     1     1     0     8    0
pkpcb       40       42    0       42     3     3     0     1     0     8    0
kcovpl      48       16    0        8     1     0     1     1     0     8    0
mppekey    1024       4    0        4     2     2     0     1     0     8    0
ppxss      1256      43    0       43    10     9     1     1     0     8    1
pppxif     1456      19    0       19     6     6     0     1     0     8    0
pfstscr     40       10    0        9     2     1     1     1     0     8    0
pffrag     232        4    0        4     3     3     0     1     0   482    0
pffrnode    88        4    0        4     3     3     0     1     0     8    0
pffrent     40       40    0       40     3     3     0     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1280     273    0      137    16     3    13    16     0     8    0
pfstitem    24       39    0       36     1     0     1     1     0     8    0
pfstkey    128       45    0       42     1     0     1     1     0     8    0
pfstate    384       42    0       39     3     2     1     3     0     8    0
pfrule     1344      21    0       20     2     1     1     2     0     8    0
rttmr      136        6    0        6     2     2     0     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1040    0      710    36    14    22    29     0     8    0
art_table   32     1041    0      710     4     0     4     4     0     8    0
art_node    16      240    0      178     1     0     1     1     0     8    0
sysvmsgpl   40      138    0      101     1     0     1     1     0     8    0
semapl     112        9    0        0     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     7162    0     5714    91     0    91    91     0     8    0
ffsino     272     7162    0     5714    97     0    97    97     0     8    0
nchpl      144    13724    0    12091    63     0    63    63     0     8    0
uvmvnodes   80     9503    0        0   194     0   194   194     0     8    0
vnodes     216     9503    0        0   528     0   528   528     0     8    0
namei      1024   48645    0    48645     3     2     1     2     0     8    1
percpumem   16      117    0       75     1     0     1     1     0     8    0
vmpool     696       17    0       17     3     3     0     1     0     8    0
kstatmem   264      138    0      112     2     0     2     2     0     8    0
scsiplug    72        2    0        2     1     1     0     1     0     8    0
scxspl     216    42924    0    42924    21    18     3     8     0     8    3
plimitpl   152      662    0      646     1     0     1     1     0     8    0
sigapl     424     5040    0     4977     9     1     8     8     0     8    0
futexpl     64    39748    0    39748     3     2     1     1     0     8    1
knotepl    120      544    0        0    17     0    17    17     0     8    0
kqueuepl   216      912    0      904    20    19     1     8     0     8    0
pipepl     320      863    0      835    26    23     3     8     0     8    0
fdescpl    496     5002    0     4978     5     1     4     5     0     8    0
filepl     152    36295    0    36029    86    71    15    22     0     8    4
lockfpl    104      651    0      649     1     0     1     1     0     8    0
lockfspl    48      254    0      252     1     0     1     1     0     8    0
sessionpl  144       32    0       15     1     0     1     1     0     8    0
pgrppl      48      178    0      161     1     0     1     1     0     8    0
ucredpl    104     2713    0     2701     1     0     1     1     0     8    0
zombiepl   144     4979    0     4977     2     1     1     1     0     8    0
processpl  1072    5040    0     4977     5     0     5     5     0     8    0
procpl     696    13676    0    13597    19     9    10    10     0     8    1
srpgc       96       12    0       12     6     6     0     1     0     8    0
sosppl     168       39    0       39     5     5     0     1     0     8    0
sockpl     488    12246    0    12193   245   233    12    29     0     8    3
sockpl: pool(0xffffffff82dc1f50:sockpl): free list modified: page 0xfffffd8066224000; item ordinal 4; addr 0xfffffd80662249bb (p 0xfffffd8066224000); offset 0x0=0x24a37c3bea29b73d
pool(sockpl): free list modified: page 0xfffffd8066224000; item ordinal 4; addr 0xfffffd80662249bb (p 0xfffffd8066224000); offset 0x0=0xadbeefde
sockpl: pool(0xffffffff82dc1f50:sockpl): page inconsistency: page 0xfffffd8066224000; item ordinal 5; addr 0xa2485f67ee4bf4cd
mcl64k     65536     18    0        0     3     0     3     3     0     8    0
mcl16k     16384     17    0        0     3     1     2     3     0     8    0
mcl12k     12288     17    0        0     2     0     2     2     0     8    0
mcl9k      9216      10    0        0     1     0     1     1     0     8    0
mcl8k      8192      17    0        0     3     0     3     3     0     8    0
mcl4k      4096      25    0        0     3     0     3     3     0     8    0
mcl2k2     2112       6    0        0     1     0     1     1     0     8    0
mcl2k      2048     326    0        0    37     5    32    37     0     8    0
mtagpl      96      345    0        0     7     0     7     7     0     8    0
mbufpl     256     1883    0        0   117     0   117   117     0     8    0
bufpl      288    11393    0     5071   452     0   452   452     0     8    0
anonpl      24  1014018    0   997865   199    86   113   183     0   186    0
amapchunkpl 152   96385    0    95670    64    27    37    62     0   158    0
amappl16   200     8305    0     7820    47    20    27    32     0     8    0
amappl15   192       30    0       28     1     0     1     1     0     8    0
amappl14   184      189    0      176     2     1     1     2     0     8    0
amappl13   176        6    0        5     1     0     1     1     0     8    0
amappl12   168      513    0      510     1     0     1     1     0     8    0
amappl11   160       51    0       37     1     0     1     1     0     8    0
amappl10   152       40    0       30     1     0     1     1     0     8    0
amappl9    144      981    0      981    10    10     0     1     0     8    0
amappl8    136      296    0      221     3     0     3     3     0     8    0
amappl7    128      172    0      146     2     0     2     2     0     8    0
amappl6    120      233    0      217     1     0     1     1     0     8    0
amappl5    112      223    0      213     1     0     1     1     0     8    0
amappl4    104      635    0      598     2     0     2     2     0     8    0
amappl3     96    14661    0    14614     2     0     2     2     0     8    0
amappl2     88     5504    0     5428     3     1     2     3     0     8    0
amappl1     80   116034    0   115331    24     6    18    23     0     8    0
amappl      88    33678    0    33497     6     0     6     6     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      130    0        0     3     0     3     3     0     8    0
uaddrrnd    24     5019    0     4995     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     5019    0     4995     1     0     1     1     0     8    0
vmmpekpl   168    41293    0    41211     4     0     4     4     0     8    0
vmmpepl    168   457370    0   454934   192    56   136   156     0   357    0
vmsppl     368     5018    0     4995     4     1     3     4     0     8    0
rwobjpl     56   131257    0   119974   168     7   161   161     0     8    0
pdppl      4096   10045    0     9990   325   256    69    79     0     8   14
pvpl        32  2014023    0  1992413   379   181   198   323     0   265    0
pmappl     248     5018    0     4995     3     1     2     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1285    0      377    27     0    27    27     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
pool_do_put(ffffffff82dc1f50,fffffd8066224d88) at pool_do_put+0x115
pool_put(ffffffff82dc1f50,fffffd8066224d88) at pool_put+0x8b sys/kern/subr_pool.c:799
soclose(fffffd8066224d88,0) at soclose+0x4ba sys/kern/uipc_socket.c:432
soo_close(fffffd80645feab0,ffff8000212c90a8) at soo_close+0x40
fdrop(fffffd80645feab0,ffff8000212c90a8) at fdrop+0xc7 sys/kern/kern_descrip.c:1274
closef(fffffd80645feab0,ffff8000212c90a8) at closef+0x11c sys/kern/kern_descrip.c:1258
fdfree(ffff8000212c90a8) at fdfree+0xe4 sys/kern/kern_descrip.c:1190
exit1(ffff8000212c90a8,0,0,1) at exit1+0x37d sys/kern/kern_exit.c:196
sys_exit(ffff8000212c90a8,ffff8000212b5320,ffff8000212b5370) at sys_exit+0x16 sys/kern/kern_exit.c:89
syscall(ffff8000212b53f0) at syscall+0x555 mi_syscall sys/sys/syscall_mi.h:113 [inline]
syscall(ffff8000212b53f0) at syscall+0x555 sys/arch/amd64/amd64/trap.c:626
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffffb7d0, count: -11
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff800020d68ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff82dc4530) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82dc4530) at __mp_lock+0x122 sys/kern/kern_lock.c:147
reaper(ffff8000211bcae8) at reaper+0x160 sys/kern/kern_exit.c:436
end trace frame: 0x0, count: -5

Crashes (6):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-multicore 2023/01/21 14:17 openbsd 8b8fb239a1ab cc0f9968 .config console log report [disk image] [bsd.gdb] [kernel image] protection_fault: pool_do_put
ci-openbsd-multicore 2023/01/10 04:14 openbsd 86a45bbd35a5 48bc529a .config console log report [disk image] [bsd.gdb] [kernel image] protection_fault: pool_do_put
ci-openbsd-main 2022/12/15 05:41 openbsd b03cfb739ae1 6f9c033e .config console log report [disk image] [bsd.gdb] [kernel image] protection_fault: pool_do_put
ci-openbsd-main 2022/11/05 03:45 openbsd c39877f08d26 6d752409 .config console log report [disk image] [bsd.gdb] [kernel image] protection_fault: pool_do_put
ci-openbsd-multicore 2022/10/04 10:37 openbsd 80411f110b5f 3fe4fea8 .config console log report [disk image] [bsd.gdb] [kernel image] protection_fault: pool_do_put
ci-openbsd-main 2022/09/14 11:13 openbsd 24c9f630e126 b884348d .config console log report [disk image] [bsd.gdb] [kernel image] protection_fault: pool_do_put
* Struck through repros no longer work on HEAD.