syzbot


uvm_fault: memcpy (5)

Status: upstream: reported C repro on 2022/10/08 21:10
Reported-by: syzbot+ebd31a2d814e8ac4260b@syzkaller.appspotmail.com
First crash: 116d, last: 3d23h
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: memcpy C 460 1403d 1423d 3/3 fixed on 2019/03/31 22:33
openbsd uvm_fault: memcpy (2) syz 2168 992d 1240d 0/3 closed as invalid on 2020/05/18 08:51
openbsd uvm_fault: memcpy (4) 2 335d 404d 0/3 auto-closed as invalid on 2022/06/01 18:10
openbsd uvm_fault: memcpy (3) 26 927d 985d 0/3 auto-closed as invalid on 2020/10/17 21:23
Last patch testing requests:
Created Duration User Patch Repo Result
2023/01/16 21:32 9m retest repro openbsd error

Sample crash report:
uvm_fault(0xffffffff82a04be0, 0xffff8000120e1f00, 0, 2) -> d
kernel: page fault trap, code=0
Stopped at      memcpy+0x15:    repe movsq      (%rsi),%es:(%rdi)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*448911  99695      0           0          0    0  syz-executor4185014107
memcpy() at memcpy+0x15
ufs_inactive(ffff8000217757b8) at ufs_inactive+0x25f sys/ufs/ufs/ufs_inode.c:110
VOP_INACTIVE(fffffd807e2f5ce8,ffff8000217047f0) at VOP_INACTIVE+0xb7 sys/kern/vfs_vops.c:489
vput(fffffd807e2f5ce8) at vput+0xa3 sys/kern/vfs_subr.c:779
ufs_remove(ffff8000217758b8) at ufs_remove+0x145 sys/ufs/ufs/ufs_vnops.c:606
VOP_REMOVE(fffffd807e2f5040,fffffd807e2f5ce8,ffff800021775998) at VOP_REMOVE+0x118 sys/kern/vfs_vops.c:333
dounlinkat(ffff8000217047f0,ffffff9c,7f7ffffc1c80,0) at dounlinkat+0x10c sys/kern/vfs_syscalls.c:1884
syscall(ffff800021775b10) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2130, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff82a04be0, 0xffff8000120e1f00, 0, 2) -> d
ddb> trace
memcpy() at memcpy+0x15
ufs_inactive(ffff8000217757b8) at ufs_inactive+0x25f sys/ufs/ufs/ufs_inode.c:110
VOP_INACTIVE(fffffd807e2f5ce8,ffff8000217047f0) at VOP_INACTIVE+0xb7 sys/kern/vfs_vops.c:489
vput(fffffd807e2f5ce8) at vput+0xa3 sys/kern/vfs_subr.c:779
ufs_remove(ffff8000217758b8) at ufs_remove+0x145 sys/ufs/ufs/ufs_vnops.c:606
VOP_REMOVE(fffffd807e2f5040,fffffd807e2f5ce8,ffff800021775998) at VOP_REMOVE+0x118 sys/kern/vfs_vops.c:333
dounlinkat(ffff8000217047f0,ffffff9c,7f7ffffc1c80,0) at dounlinkat+0x10c sys/kern/vfs_syscalls.c:1884
syscall(ffff800021775b10) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2130, count: -9
ddb> show registers
rdi               0xffff8000120e1f00
rsi               0xfffffd8068a46300
rbp               0xffff800021775740
rbx                              0x2
rdx                            0x100
rcx                             0x20
rax                            0x83c
r8                0xffffffffffffffff
r9                               0x5
r10               0xce60d2f0ae9dbdcb
r11               0xffff8000120e1f00
r12               0xfffffd8068999b48
r13               0xfffffd806c6a2a38
r14                                0
r15               0xffff8000006b6800
rip               0xffffffff813f8645    memcpy+0x15
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff8000217756d8
ss                              0x10
memcpy+0x15:    repe movsq      (%rsi),%es:(%rdi)
ddb> show proc
PROC (syz-executor4185014107) pid=448911 stat=onproc
    flags process=0 proc=0
    pri=17, usrpri=69, nice=20
    forw=0xffffffffffffffff, list=0xffff8000217042b0,0xffff800021711cf0
    process=0xffff8000216f0410 user=0xffff800021770000, vmspace=0xfffffd806cc4a9a0
    estcpu=36, cpticks=3, pctcpu=0.16
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 21150  165994  17061      0  2           0                syz-executor4185014107
 74494  342389  74142      0  2           0                syz-executor4185014107
 76371    2864  72577      0  2           0                syz-executor4185014107
 17061  509937  38804      0  2           0                syz-executor4185014107
*99695  448911  38804      0  7           0                syz-executor4185014107
 72577  208837  38804      0  2       0x480                syz-executor4185014107
 68697   27636  38804      0  2           0                syz-executor4185014107
 19852  183046  38804      0  2           0                syz-executor4185014107
  7013  185156  38804      0  2           0                syz-executor4185014107
 87483  420019  38804      0  2           0                syz-executor4185014107
 74142  504624  38804      0  2       0x480                syz-executor4185014107
 38804  329949  51215      0  3        0x82  nanoslp       syz-executor4185014107
 51215  314668  72601      0  3    0x10008a  sigsusp       ksh
 72601   74522   3328      0  3        0x9a  kqread        sshd
 62521  215196      1      0  3    0x100083  ttyin         getty
  3328  111567      1      0  3        0x88  kqread        sshd
 46375  109891  10355     73  3   0x1100090  kqread        syslogd
 10355  157488      1      0  3    0x100082  netio         syslogd
  9210  494230      1      0  3    0x100080  kqread        resolvd
 43728  272703  32178     77  3    0x100092  kqread        dhcpleased
 88024  489907  32178     77  3    0x100092  kqread        dhcpleased
 32178  209807      1      0  3        0x80  kqread        dhcpleased
 56175  108971      0      0  3     0x14200  bored         smr
 85519  485684      0      0  2     0x14200                zerothread
 68134  415600      0      0  3     0x14200  aiodoned      aiodoned
 87649  204325      0      0  3     0x14200  syncer        update
 65580  282775      0      0  3     0x14200  cleaner       cleaner
 28590   40757      0      0  3     0x14200  reaper        reaper
 48616  417236      0      0  3     0x14200  pgdaemon      pagedaemon
 66653  342990      0      0  3     0x14200  bored         viomb
  4524   65377      0      0  3  0x40014200  acpi0         acpi0
 35834  263589      0      0  3     0x14200  bored         softnet
 10914  260404      0      0  3     0x14200  bored         softnet
 19761  244709      0      0  3     0x14200  bored         softnet
 78357  105276      0      0  3     0x14200  bored         softnet
 16696  285134      0      0  3     0x14200  bored         systqmp
 67461  382485      0      0  3     0x14200  bored         systq
 73072  268931      0      0  3  0x40014200  bored         softclock
 57361  429543      0      0  3  0x40014200                idle0
     1   40768      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10147   6383K    6414K  78643K     11237        0
            pcb    13      8K       8K  78643K        13        0
         rtable    58      1K       2K  78643K       109        0
         ifaddr    25      7K       7K  78643K        25        0
       counters    19     16K      16K  78643K        19        0
       ioctlops     0      0K       2K  78643K        25        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1166     73K      73K  78643K      1180        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc     1      0K       0K  78643K         1        0
           proc    55     58K      59K  78643K       226        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    25    122K     122K  78643K        25        0
           exec     0      0K       2K  78643K       406        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap    82      4K       5K  78643K     12236        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     3      0K       0K  78643K         3        0
           temp    18   4709K    4773K  78643K     24399        0
         kqueue    11     16K      18K  78643K        24        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       20    0       17     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      144       33    0       20     1     0     1     1     0     8    0
syncache   296        5    0        5     2     2     0     1     0     8    0
tcpcb      768        8    0        5     1     0     1     1     0     8    0
arp         88        2    0        0     1     0     1     1     0     8    0
inpcb      336       25    0       19     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256    23248    0    17918   334     0   334   334     0     8    0
ffsino     240    23248    0    17918   314     0   314   314     0     8    0
nchpl      144    45252    0    43679    59     0    59    59     0     8    0
uvmvnodes   80     6259    0        0   128     0   128   128     0     8    0
vnodes     216     6259    0        0   348     0   348   348     0     8    0
namei      1024  102395    0   102394     4     2     2     2     0     8    1
kstatmem   264        6    0        0     1     0     1     1     0     8    0
scxspl     216   111286    0   111285    26    18     8     8     0     8    7
plimitpl   152       15    0        9     1     0     1     1     0     8    0
sigapl     424    11224    0    11184     6     0     6     6     0     8    0
knotepl    120    96880    0    96851     3     2     1     2     0     8    0
kqueuepl   184       20    0       13     1     0     1     1     0     8    0
pipepl     288       82    0       79     2     1     1     1     0     8    0
fdescpl    432    11208    0    11184     5     1     4     4     0     8    1
filepl     120    33824    0    33764     2     0     2     2     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl    104       68    0       57     1     0     1     1     0     8    0
zombiepl   144    11184    0    11184     2     1     1     1     0     8    1
processpl  1000   11224    0    11184     7     1     6     6     0     8    0
procpl     672    11224    0    11184     4     0     4     4     0     8    0
sockpl     456       78    0       56     3     0     3     3     0     8    0
mcl8k      8192       9    0        9     2     2     0     1     0     8    0
mcl4k      4096       5    0        5     2     2     0     1     0     8    0
mcl2k      2048   16133    0    16095     9     3     6     7     0     8    0
mtagpl      96        4    0        4     1     1     0     1     0     8    0
mbufpl     256    56953    0    56871     7     0     7     7     0     8    0
bufpl      288    24252    0    17962   450     0   450   450     0     8    0
anonpl      24   117376    0   114811    19     3    16    16     0   188    0
amapchunkpl 152   13580    0    13451     7     1     6     6     0   158    0
amappl16   200    10945    0    10935     2     1     1     1     0     8    0
amappl15   192       68    0       61     1     0     1     1     0     8    0
amappl13   176       34    0       32     1     0     1     1     0     8    0
amappl12   168        3    0        3     2     2     0     1     0     8    0
amappl11   160       38    0       28     1     0     1     1     0     8    0
amappl10   152        1    0        1     1     1     0     1     0     8    0
amappl9    144      928    0      928     2     2     0     1     0     8    0
amappl8    136      364    0      360     1     0     1     1     0     8    0
amappl7    128       64    0       57     1     0     1     1     0     8    0
amappl6    120      107    0       94     1     0     1     1     0     8    0
amappl5    112       99    0       83     1     0     1     1     0     8    0
amappl4    104      580    0      560     1     0     1     1     0     8    0
amappl3     96    11326    0    11295     1     0     1     1     0     8    0
amappl2     88      333    0      291     3     2     1     2     0     8    0
amappl1     80    64012    0    63485    15     3    12    12     0     8    0
amappl      88    11961    0    11907     2     0     2     2     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24    11208    0    11184     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    11208    0    11184     1     0     1     1     0     8    0
vmmpekpl   168    30831    0    30815     1     0     1     1     0     8    0
vmmpepl    168   365676    0   364408    71    10    61    61     0   357    5
vmsppl     272    11207    0    11184     3     1     2     2     0     8    0
rwobjpl     24    25946    0    18998    42     0    42    42     0     8    0
pdppl      4096   22422    0    22368   130    72    58    64     0     8    4
pvpl        32   636060    0   630894    51     8    43    43     0   265    0
pmappl     216    11207    0    11184     2     0     2     2     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1271    0       85    34     0    34    34     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
memcpy() at memcpy+0x15
ufs_inactive(ffff8000217757b8) at ufs_inactive+0x25f sys/ufs/ufs/ufs_inode.c:110
VOP_INACTIVE(fffffd807e2f5ce8,ffff8000217047f0) at VOP_INACTIVE+0xb7 sys/kern/vfs_vops.c:489
vput(fffffd807e2f5ce8) at vput+0xa3 sys/kern/vfs_subr.c:779
ufs_remove(ffff8000217758b8) at ufs_remove+0x145 sys/ufs/ufs/ufs_vnops.c:606
VOP_REMOVE(fffffd807e2f5040,fffffd807e2f5ce8,ffff800021775998) at VOP_REMOVE+0x118 sys/kern/vfs_vops.c:333
dounlinkat(ffff8000217047f0,ffffff9c,7f7ffffc1c80,0) at dounlinkat+0x10c sys/kern/vfs_syscalls.c:1884
syscall(ffff800021775b10) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2130, count: -9
ddb> machine ddbcpu 1
No such command
ddb> trace
memcpy() at memcpy+0x15
ufs_inactive(ffff8000217757b8) at ufs_inactive+0x25f sys/ufs/ufs/ufs_inode.c:110
VOP_INACTIVE(fffffd807e2f5ce8,ffff8000217047f0) at VOP_INACTIVE+0xb7 sys/kern/vfs_vops.c:489
vput(fffffd807e2f5ce8) at vput+0xa3 sys/kern/vfs_subr.c:779
ufs_remove(ffff8000217758b8) at ufs_remove+0x145 sys/ufs/ufs/ufs_vnops.c:606
VOP_REMOVE(fffffd807e2f5040,fffffd807e2f5ce8,ffff800021775998) at VOP_REMOVE+0x118 sys/kern/vfs_vops.c:333
dounlinkat(ffff8000217047f0,ffffff9c,7f7ffffc1c80,0) at dounlinkat+0x10c sys/kern/vfs_syscalls.c:1884
syscall(ffff800021775b10) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2130, count: -9

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-main 2022/10/08 21:10 openbsd 5cb1d9dce18f aea5da89 .config console log report syz C [disk image] [bsd.gdb] [kernel image] uvm_fault: memcpy
ci-openbsd-main 2023/01/29 13:16 openbsd 7173161c5823 b68fb8d6 .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memcpy
* Struck through repros no longer work on HEAD.