syzbot


uvm_fault: syscall

Status: auto-closed as invalid on 2020/05/13 08:21
Reported-by: syzbot+ce19634f034451129db2@syzkaller.appspotmail.com
First crash: 1746d, last: 1746d

Sample crash report:
uvm_fault(0xfffffd806bc0a880, 0x70, 0, 2) -> e
kernel: page fault trap, code=0
Stopped at      syscall+0x558:  movq    %rax,0x70(%rbx)
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xfffffd806bc0a880, 0x70, 0, 2) -> e
syscall(ffff80001d3f6060) at syscall+0x558 sys/arch/amd64/amd64/trap.c:574
end trace frame: 0xffff80001d3f60e0, count: 0
ddb> trace
syscall(ffff80001d3f6060) at syscall+0x558 sys/arch/amd64/amd64/trap.c:574
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc002b47e98, count: -2
ddb> show registers
rdi                                0
rsi               0xffffffff824505f0    __sancov_gen_cov_switch_values.48
rbp               0xffff80001d3f6050
rbx                                0
rdx                              0x3
rcx                                0
rax                              0x1
r8                    0x7f7fffffc000
r9                               0x5
r10                                0
r11               0x54656fde8f8e3471
r12                             0x48
r13                            0x480
r14               0xffff80001d34a388
r15                                0
rip               0xffffffff8123b058    syscall+0x558
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80001d3f5f90
ss                              0x10
syscall+0x558:  movq    %rax,0x70(%rbx)
ddb> show proc
PROC (syz-fuzzer) pid=337722 stat=onproc
    flags process=2<EXEC> proc=4000000<THREAD>
    pri=24, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff80001d3494e8,0xffff80001d34a608
    process=0xffff80001d39e000 user=0xffff80001d3f1000, vmspace=0xfffffd806bc0a880
    estcpu=0, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 65347  325991      0      0  3     0x14200  acct          acct
 29376  317001      0      0  3     0x14200  bored         sosplice
 31065  365507  69543      0  2       0x482                syz-executor.0
 73498  403882  69543      0  2         0x2                syz-executor.1
 69543  184653  16291      0  3        0x82  thrsleep      syz-fuzzer
 69543  323335  16291      0  3   0x4000082  thrsleep      syz-fuzzer
 69543  317037  16291      0  3   0x4000082  thrsleep      syz-fuzzer
 69543  142986  16291      0  3   0x4000082  thrsleep      syz-fuzzer
 69543  209689  16291      0  3   0x4000082  thrsleep      syz-fuzzer
 69543  367548  16291      0  3   0x4000082  thrsleep      syz-fuzzer
 69543  455133  16291      0  3   0x4000082  thrsleep      syz-fuzzer
*69543  337722  16291      0  7   0x4000002                syz-fuzzer
 16291      64  68017      0  3    0x10008a  pause         ksh
 68017  505298  92147      0  3        0x92  select        sshd
 81566   92057      1      0  3    0x100083  ttyin         getty
 92147  215436      1      0  3        0x80  select        sshd
 87847  389841  70210     73  3    0x100090  kqread        syslogd
 70210  401567      1      0  3    0x100082  netio         syslogd
 60398  235717      1     77  3    0x100090  poll          dhclient
 18023  387813      1      0  3        0x80  poll          dhclient
 75135  302985      0      0  3     0x14200  pgzero        zerothread
 94843   67128      0      0  3     0x14200  aiodoned      aiodoned
 87879  257424      0      0  3     0x14200  syncer        update
 18987  420387      0      0  3     0x14200  cleaner       cleaner
 82659  223158      0      0  3     0x14200  reaper        reaper
 75253  104768      0      0  3     0x14200  pgdaemon      pagedaemon
 25795   64780      0      0  3     0x14200  bored         crynlk
 46600   13449      0      0  3     0x14200  bored         crypto
 16905  261804      0      0  3  0x40014200  acpi0         acpi0
 43500  165700      0      0  3     0x14200  bored         softnet
 43861   41927      0      0  3     0x14200  bored         systqmp
 81665   82253      0      0  3     0x14200  bored         systq
    61   18118      0      0  3  0x40014200  bored         softclock
 71222   21386      0      0  3  0x40014200                idle0
 58754  185490      0      0  3     0x14200  bored         smr
     1  394465      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9475   6455K    6590K  78643K     10808        0
            pcb    13      8K       8K  78643K        29        0
         rtable   118      4K       4K  78643K       224        0
         ifaddr    53     12K      12K  78643K        69        0
       counters    21     16K      16K  78643K        23        0
       ioctlops     0      0K       2K  78643K        25        0
            iov     0      0K      12K  78643K        16        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1214     76K      77K  78643K      1299        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         4        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      0K       0K  78643K       150        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1794    195K     288K  78643K     12646        0
      file desc     4      9K      25K  78643K       144        0
           proc    49     38K      63K  78643K       382        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        19        0
       in_multi    47      2K       3K  78643K        52        0
    ether_multi     1      0K       0K  78643K         2        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    43    201K     201K  78643K        43        0
           exec     0      0K       1K  78643K       209        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   102     21K      37K  78643K      1215        0
       UVM aobj    56      2K       2K  78643K        58        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K         9        0
            NDP     7      0K       0K  78643K        13        0
           temp    74   3004K    3068K  78643K      4544        0
         kqueue     3      4K      14K  78643K        23        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        7    0        0     1     0     1     1     0     8    0
rtpcb       80       23    0       21     1     0     1     1     0     8    0
rtentry    112       50    0        1     2     0     2     2     0     8    0
unpcb      120      105    0       97     1     0     1     1     0     8    0
syncache   264        6    0        6     2     1     1     1     0     8    1
tcpqe       32       64    0       64     1     1     0     1     0     8    0
tcpcb      544       58    0       54     2     0     2     2     0     8    1
ipq         40        4    0        4     1     0     1     1     0     8    1
ipqe        40      180    0      180     1     0     1     1     0     8    1
inpcb      280      283    0      275     2     0     2     2     0     8    1
nd6         48        6    0        0     1     0     1     1     0     8    0
ppxss      1128       1    0        1     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      237    0        0    15     0    15    15     0     8    0
art_table   32      238    0        0     2     0     2     2     0     8    0
art_node    16       49    0        4     1     0     1     1     0     8    0
sysvmsgpl   40        2    0        2     1     0     1     1     0     8    1
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl     112      148    0      138     1     0     1     1     0     8    0
shmpl      112       56    0        2     2     0     2     2     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1616    0      218    46     0    46    46     0     8    0
ffsino     240     1616    0      218    83     0    83    83     0     8    0
nchpl      144     2014    0      404    60     0    60    60     0     8    0
uvmvnodes   72     1710    0        0    32     0    32    32     0     8    0
vnodes     208     1710    0        0    90     0    90    90     0     8    0
namei      1024    5268    0     5268     1     0     1     1     0     8    1
scsiplug    64        1    0        1     1     1     0     1     0     8    0
scxspl     192     6160    0     6160     1     0     1     1     0     8    1
plimitpl   152       29    0       22     1     0     1     1     0     8    0
sigapl     432      315    0      303     2     0     2     2     0     8    0
futexpl     56     4580    0     4580     1     0     1     1     0     8    1
knotepl    112       82    0       63     1     0     1     1     0     8    0
kqueuepl   104       38    0       36     1     0     1     1     0     8    0
pipelkpl    16      103    0       93     1     0     1     1     0     8    0
pipepl     120      206    0      187     2     1     1     2     0     8    0
fdescpl    432      316    0      303     2     0     2     2     0     8    0
filepl     120     2116    0     2021     4     0     4     4     0     8    1
lockfpl    104       42    0       41     1     0     1     1     0     8    0
lockfspl    48       18    0       17     1     0     1     1     0     8    0
sessionpl  112       17    0        7     1     0     1     1     0     8    0
pgrppl      48       19    0        9     1     0     1     1     0     8    0
ucredpl     96      249    0      242     1     0     1     1     0     8    0
zombiepl   144      303    0      302     1     0     1     1     0     8    0
processpl  896      332    0      302     4     0     4     4     0     8    0
procpl     624      490    0      453     4     0     4     4     0     8    0
sosppl     128        6    0        6     1     0     1     1     0     8    1
sockpl     400      411    0      394     5     0     5     5     0     8    3
mcl64k     65536     26    0       26     1     0     1     1     0     8    1
mcl16k     16384      3    0        3     2     1     1     1     0     8    1
mcl12k     12288      4    0        4     1     0     1     1     0     8    1
mcl9k      9216       2    0        2     1     0     1     1     0     8    1
mcl8k      8192       7    0        7     1     0     1     1     0     8    1
mcl4k      4096      36    0       36     2     1     1     1     0     8    1
mcl2k2     2112       1    0        1     1     1     0     1     0     8    0
mcl2k      2048   63928    0    63879    15     5    10    13     0     8    3
mtagpl      80       18    0        4     2     1     1     1     0     8    0
mbufpl     256   103104    0   102982    23     5    18    22     0     8    8
bufpl      280     4720    0      181   325     0   325   325     0     8    0
anonpl      16    48304    0    32264    77     1    76    76     0   107   11
amapchunkpl 152    1776    0     1648    20     1    19    19     0   158   13
amappl16   192     1699    0      820    53     4    49    53     0     8    4
amappl15   184       61    0       55     1     0     1     1     0     8    0
amappl14   176       79    0       76     1     0     1     1     0     8    0
amappl12   160       11    0       11     1     1     0     1     0     8    0
amappl11   152       48    0       37     1     0     1     1     0     8    0
amappl10   144       74    0       71     1     0     1     1     0     8    0
amappl9    136      560    0      557     1     0     1     1     0     8    0
amappl8    128      114    0       93     1     0     1     1     0     8    0
amappl7    120      150    0      139     1     0     1     1     0     8    0
amappl6    112       54    0       49     1     0     1     1     0     8    0
amappl5    104      142    0      132     1     0     1     1     0     8    0
amappl4     96      534    0      508     1     0     1     1     0     8    0
amappl3     88      172    0      164     1     0     1     1     0     8    0
amappl2     80     1749    0     1688     3     1     2     3     0     8    0
amappl1     72    15361    0    14954    26    17     9    20     0     8    0
amappl      80      714    0      676     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       57    0        2     1     0     1     1     0     8    0
uaddrrnd    24      316    0      303     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      316    0      303     1     0     1     1     0     8    0
vmmpekpl   168     6202    0     6176     2     0     2     2     0     8    0
vmmpepl    168    45589    0    43729   113     7   106   108     0   357   19
vmsppl     272      315    0      303     2     1     1     2     0     8    0
pdppl      4096     638    0      606     6     1     5     6     0     8    0
pvpl        32   154593    0   135594   180     0   180   180     0   265   25
pmappl     200      315    0      303     1     0     1     1     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      168    0       16     5     0     5     5     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/13 08:20 openbsd 4f72d6edf4ac 84f4fc8a .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.