syzbot


uvm_fault: nd6_ns_output

Status: auto-closed as invalid on 2020/08/19 07:40
Reported-by: syzbot+cf01cd1262c06ec69257@syzkaller.appspotmail.com
First crash: 1434d, last: 1434d

Sample crash report:
uvm_fault(0xffffffff82662d80, 0x8, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      nd6_ns_output+0x337:    movzbl  0(%r15),%ebx
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xffffffff82662d80, 0x8, 0, 1) -> e
nd6_ns_output(ffff8000009d6000,0,ffff800000aa53a8,fffffd80656e6c90,0) at nd6_ns_output+0x337 sys/netinet6/nd6_nbr.c:460
end trace frame: 0xffff800020e27320, count: 0
ddb{0}> trace
nd6_ns_output(ffff8000009d6000,0,ffff800000aa53a8,fffffd80656e6c90,0) at nd6_ns_output+0x337 sys/netinet6/nd6_nbr.c:460
nd6_llinfo_timer(fffffd80688b65b8) at nd6_llinfo_timer+0x276
nd6_timer(ffffffff82694fc0) at nd6_timer+0xa8 sys/netinet6/nd6.c:330
timeout_run(ffffffff82694fc0) at timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:184 [inline]
timeout_run(ffffffff82694fc0) at timeout_run+0xc4 sys/kern/kern_timeout.c:490
softclock_thread(ffff800020e19110) at softclock_thread+0x16a sys/kern/kern_timeout.c:580
end trace frame: 0x0, count: -5
ddb{0}> show registers
rdi                             0x80
rsi                             0x80
rbp               0xffff800020e272c0
rbx                             0x80
rdx                          0x4bdcc    acpi_pdirpa+0x37c34
rcx                                0
rax               0xffffffff811c5c82    nd6_ns_output+0x332
r8                                 0
r9                               0x5
r10                              0x6
r11               0x2e741877013e6f8b
r12               0xfffffd807964d2b8
r13               0xffff800000aa53a8
r14               0xfffffd807964d200
r15                              0x8
rip               0xffffffff811c5c87    nd6_ns_output+0x337
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800020e271d0
ss                              0x10
nd6_ns_output+0x337:    movzbl  0(%r15),%ebx
ddb{0}> show proc
PROC (softclock) pid=124776 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
    pri=0, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800020e195f0,0xffff800020e189d0
    process=0xffff800020e1a000 user=0xffff800020e22000, vmspace=0xffffffff82662d80
    estcpu=0, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 13686   94012      0      0  3     0x14200  bored         sosplice
 89296   36682  63336      0  2       0x482                syz-executor.1
 96814  276610  63336      0  7         0x3                syz-executor.0
 63336  263815  53768      0  3        0x82  thrsleep      syz-fuzzer
 63336  369270  53768      0  3   0x4000082  thrsleep      syz-fuzzer
 63336  244206  53768      0  3   0x4000082  thrsleep      syz-fuzzer
 63336   35691  53768      0  3   0x4000082  thrsleep      syz-fuzzer
 63336  270943  53768      0  3   0x4000082  thrsleep      syz-fuzzer
 63336  145314  53768      0  3   0x4000082  thrsleep      syz-fuzzer
 63336  430809  53768      0  3   0x4000082  thrsleep      syz-fuzzer
 63336  355307  53768      0  3   0x4000082  kqread        syz-fuzzer
 63336   66193  53768      0  3   0x4000082  thrsleep      syz-fuzzer
 63336  457622  53768      0  3   0x4000082  thrsleep      syz-fuzzer
 53768  333334   8460      0  3    0x10008a  pause         ksh
  8460  218114  41060      0  3        0x92  select        sshd
 87237  214958      1      0  3    0x100083  ttyin         getty
 41060  316649      1      0  3        0x80  select        sshd
 74258  467034  55110     74  3    0x100092  bpf           pflogd
 55110  383487      1      0  3        0x80  netio         pflogd
 38765  152925  34904     73  3    0x100090  kqread        syslogd
 34904  507469      1      0  3    0x100082  netio         syslogd
 81076  436265      1     77  3    0x100090  poll          dhclient
 45043  436841      1      0  3        0x80  poll          dhclient
 14205  208565      0      0  3     0x14200  bored         smr
 28053  472578      0      0  3     0x14200  pgzero        zerothread
 66775   18582      0      0  3     0x14200  aiodoned      aiodoned
 16659  468995      0      0  3     0x14200  syncer        update
  3289  185938      0      0  3     0x14200  cleaner       cleaner
   699  332753      0      0  3     0x14200  reaper        reaper
 10153  480033      0      0  3     0x14200  pgdaemon      pagedaemon
 69371   19765      0      0  3     0x14200  bored         crynlk
 22218  286004      0      0  3     0x14200  bored         crypto
 76579  320585      0      0  3  0x40014200  acpi0         acpi0
 39148  158118      0      0  3  0x40014200                idle1
 28976  303931      0      0  3     0x14200  bored         softnet
  5280   52552      0      0  3     0x14200  bored         systqmp
 74600  371146      0      0  3     0x14200  bored         systq
*26423  124776      0      0  7  0x40014200                softclock
 85587  422094      0      0  3  0x40014200                idle0
     1  332231      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 26423 (softclock) thread 0xffff800020e19110 (124776)
exclusive rwlock netlock r = 0 (0xffffffff824965b8)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  nd6_timer+0x31 sys/netinet6/nd6.c:326
#2  timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:184 [inline]
#2  timeout_run+0xc4 sys/kern/kern_timeout.c:490
#3  softclock_thread+0x16a sys/kern/kern_timeout.c:580
#4  proc_trampoline+0x1c
shared rwlock timeout r = 0 (0xffffffff8253b068)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  timeout_run+0xb9 sys/kern/kern_timeout.c:489
#2  softclock_thread+0x16a sys/kern/kern_timeout.c:580
#3  proc_trampoline+0x1c
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff82648e48)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  __mp_acquire_count+0x51 sys/kern/kern_lock.c:227
#2  mi_switch+0x392 sys/kern/sched_bsd.c:435
#3  sleep_finish+0x113 sys/kern/kern_synch.c:418
#4  softclock_thread+0x103 sys/kern/kern_timeout.c:575
#5  proc_trampoline+0x1c
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9519   6478K    6800K  78643K     11257        0
            pcb    13      8K       8K  78643K        83        0
         rtable   107     12K      12K  78643K       335        0
         ifaddr    68     13K      14K  78643K       117        0
       counters    43     33K      34K  78643K        57        0
       ioctlops     0      0K       4K  78643K      1482        0
            iov     0      0K      16K  78643K        46        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1224     77K      77K  78643K      1414        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         9        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       1K  78643K        27        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1824    197K     290K  78643K     13058        0
      file desc     4      9K      25K  78643K       289        0
          sigio     0      0K       0K  78643K        44        0
           proc    61     63K      95K  78643K       475        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        23        0
       in_multi    43      2K       2K  78643K       108        0
    ether_multi     1      0K       0K  78643K        13        0
            mrt     0      0K       0K  78643K         3        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    43    201K     201K  78643K        43        0
           exec     0      0K       1K  78643K       237        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   119     55K      71K  78643K      1898        0
       UVM aobj    18      2K       2K  78643K        18        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       1K  78643K        49        0
            NDP    11      0K       0K  78643K        27        0
           temp   122   3045K    3110K  78643K      4158        0
         kqueue     4      5K      12K  78643K        25        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        7    0        1     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       45    0       43     1     0     1     1     0     8    0
rtentry    112       70    0       28     2     0     2     2     0     8    0
unpcb      120      271    0      261     1     0     1     1     0     8    0
syncache   264        9    0        9     3     2     1     1     0     8    1
tcpqe       32       71    0       71     2     1     1     1     0     8    1
tcpcb      544      141    0      136     1     0     1     1     0     8    0
inpcb      280      359    0      350     3     1     2     2     0     8    1
rttmr       72        1    0        1     1     0     1     1     0     8    1
nd6         48       12    0        7     1     0     1     1     0     8    0
ppxss      1128       2    0        2     2     1     1     1     0     8    1
pffrag     232        5    0        4     1     0     1     1     0   482    0
pffrnode    88        5    0        4     1     0     1     1     0     8    0
pffrent     40       53    0       52     1     0     1     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       39    0        5     1     0     1     1     0     8    0
pfstkey    112       39    0        5     1     0     1     1     0     8    0
pfstate    328       39    0        5     3     0     3     3     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      330    0      138    13     1    12    13     0     8    0
art_table   32      332    0      138     2     0     2     2     0     8    0
art_node    16       69    0       31     1     0     1     1     0     8    0
sysvmsgpl   40        6    0        6     1     0     1     1     0     8    1
semapl     112       23    0       13     1     0     1     1     0     8    0
shmpl      112       16    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1927    0      522    89     0    89    89     0     8    0
ffsino     272     1927    0      522    94     0    94    94     0     8    0
nchpl      144     2651    0     1038    60     0    60    60     0     8    0
uvmvnodes   72     2112    0        0    39     0    39    39     0     8    0
vnodes     208     2112    0        0   112     0   112   112     0     8    0
namei      1024    7420    0     7420     2     1     1     1     0     8    1
percpumem   16       39    0        7     1     0     1     1     0     8    0
vcpupl     1984       3    0        0     1     0     1     1     0     8    0
vmpool     560        5    0        2     1     0     1     1     0     8    0
scxspl     192     7455    0     7455     8     7     1     6     0     8    1
plimitpl   152       35    0       27     1     0     1     1     0     8    0
sigapl     424      505    0      474     4     0     4     4     0     8    0
futexpl     56     5288    0     5288     2     1     1     1     0     8    1
knotepl    112       78    0       59     1     0     1     1     0     8    0
kqueuepl   144       56    0       53     1     0     1     1     0     8    0
pipelkpl    48      121    0      111     1     0     1     1     0     8    0
pipepl     120      242    0      223     1     0     1     1     0     8    0
fdescpl    496      489    0      474     3     0     3     3     0     8    0
filepl     152     3144    0     3044     5     0     5     5     0     8    1
lockfpl    104       66    0       65     1     0     1     1     0     8    0
lockfspl    48       27    0       26     1     0     1     1     0     8    0
sessionpl  112       18    0        7     1     0     1     1     0     8    0
pgrppl      48       20    0        9     1     0     1     1     0     8    0
ucredpl     96      293    0      284     1     0     1     1     0     8    0
zombiepl   144      474    0      472     1     0     1     1     0     8    0
processpl  984      505    0      472     5     0     5     5     0     8    0
procpl     624     1121    0     1079     4     0     4     4     0     8    0
sosppl     128        2    0        2     1     0     1     1     0     8    1
sockpl     400      682    0      662     6     2     4     4     0     8    1
mcl64k     65536     11    0        0     2     0     2     2     0     8    0
mcl12k     12288      3    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096       6    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     203    0        0    25     0    25    25     0     8    0
mtagpl      80       59    0        0     2     0     2     2     0     8    0
mbufpl     256      508    0        0    31     0    31    31     0     8    0
bufpl      280     4299    0      135   298     0   298   298     0     8    0
anonpl      16    55609    0    41800    60     3    57    57     0   124    1
amapchunkpl 152    2712    0     2583    10     4     6    10     0   158    0
amappl16   192     1948    0     1208    40     1    39    39     0     8    1
amappl15   184      125    0      122     1     0     1     1     0     8    0
amappl14   176      160    0      154     1     0     1     1     0     8    0
amappl13   168      161    0      159     1     0     1     1     0     8    0
amappl12   160        9    0        6     2     1     1     1     0     8    0
amappl11   152       51    0       36     1     0     1     1     0     8    0
amappl10   144       14    0       10     1     0     1     1     0     8    0
amappl9    136      387    0      386     1     0     1     1     0     8    0
amappl8    128      347    0      318     1     0     1     1     0     8    0
amappl7    120      116    0      105     1     0     1     1     0     8    0
amappl6    112       21    0       20     1     0     1     1     0     8    0
amappl5    104      253    0      238     1     0     1     1     0     8    0
amappl4     96      629    0      596     1     0     1     1     0     8    0
amappl3     88      250    0      242     1     0     1     1     0     8    0
amappl2     80     3042    0     2979     2     0     2     2     0     8    0
amappl1     72    20537    0    20106    23    13    10    18     0     8    0
amappl      80     1372    0     1328     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       17    0        0     1     0     1     1     0     8    0
uaddrrnd    24      494    0      476     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      494    0      476     1     0     1     1     0     8    0
vmmpekpl   168     7672    0     7640     2     0     2     2     0     8    0
vmmpepl    168    66080    0    64286   108    19    89   104     0   357    3
vmsppl     368      493    0      476     2     0     2     2     0     8    0
pdppl      4096     996    0      955     6     0     6     6     0     8    0
pvpl        32   192686    0   175820   152     7   145   145     0   265    7
pmappl     232      493    0      476     2     0     2     2     0     8    0
extentpl    40       53    0       36     1     0     1     1     0     8    0
phpool     112      286    0        7     8     0     8     8     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
nd6_ns_output(ffff8000009d6000,0,ffff800000aa53a8,fffffd80656e6c90,0) at nd6_ns_output+0x337 sys/netinet6/nd6_nbr.c:460
nd6_llinfo_timer(fffffd80688b65b8) at nd6_llinfo_timer+0x276
nd6_timer(ffffffff82694fc0) at nd6_timer+0xa8 sys/netinet6/nd6.c:330
timeout_run(ffffffff82694fc0) at timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:184 [inline]
timeout_run(ffffffff82694fc0) at timeout_run+0xc4 sys/kern/kern_timeout.c:490
softclock_thread(ffff800020e19110) at softclock_thread+0x16a sys/kern/kern_timeout.c:580
end trace frame: 0x0, count: -5
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff800020e00ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff82648c40) at __mp_lock+0x127 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82648c40) at __mp_lock+0x127 sys/kern/kern_lock.c:147
ktrstruct(ffff800020e6d868,ffffffff821edde6,ffff800020f6b3e8,10) at ktrstruct+0xee
sys_clock_gettime(ffff800020e6d868,ffff800020f6b450,ffff800020f6b4a0) at sys_clock_gettime+0xfb sys/kern/kern_time.c:171
syscall(ffff800020f6b520) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020f6b520) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff2890, count: -8

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/21 07:39 openbsd cec60a45d9fd c61086ab .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.