syzbot


uvm_fault

Status: auto-closed as invalid on 2020/01/15 14:32
Reported-by: syzbot+cccc0469607ef90bf324@syzkaller.appspotmail.com
First crash: 1669d, last: 1654d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault (2) syz 1 1414d 1414d 3/3 fixed on 2020/08/05 06:16
openbsd uvm_fault (3) 1 5d21h 5d21h 0/3 upstream: reported on 2024/04/22 10:44

Sample crash report:
���jV���������`plv[4㟏Q���jV���������`plv[4㟏Quvm_fault(0xffffffff8250bb50, 0xfffffd803798b1d8, 0, 4) -> e
kernel: page fault trap, code=0
Stopped at      0xfffffd803798b1d8:     xchgl   %eax,%esi
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff8250bb50, 0xfffffd803798b1d8, 0, 4) -> e
fffffd803798b1d8(b,ffff8000169a9b88,83,ffff8000169a9c28,0,b) at 0xfffffd803798b1d8
end trace frame: 0xffff8000169a9c80, count: 0
ddb> trace
fffffd803798b1d8(b,ffff8000169a9b88,83,ffff8000169a9c28,0,b) at 0xfffffd803798b1d8
rt_match(fffffd803aec8c88,0,1,0) at rt_match+0xbe rt_clone sys/net/route.c:266 [inline]
rt_match(fffffd803aec8c88,0,1,0) at rt_match+0xbe sys/net/route.c:242
in_pcbselsrc(ffff8000169a9d00,fffffd8035f74d20,fffffd803aec8c08) at in_pcbselsrc+0x219 sys/netinet/in_pcb.c:934
in_pcbconnect(fffffd803aec8c08,fffffd8035f74d00) at in_pcbconnect+0x107 sys/netinet/in_pcb.c:492
udp_usrreq(fffffd802ef8e4e0,4,0,fffffd8035f74d00,0,ffff800014932508) at udp_usrreq+0x560
sys_connect(ffff800014932508,ffff8000169a9e88,ffff8000169a9ed0) at sys_connect+0x3df sys/kern/uipc_syscalls.c:388
syscall(ffff8000169a9f50) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,fffffffffffffed2,0,3,6c3eb4d5010) at Xsyscall+0x128
end of kernel
end trace frame: 0x6c6097656f0, count: -8
ddb> show registers
rdi               0xffff800000ac8800
rsi                              0xb
rbp               0xffff8000169a9b70
rbx               0xfffffd8039440158
rdx               0xfffffd8039440158
rcx               0xffff800014934000
rax               0xffff800014934000
r8                             0x100
r9                               0x7
r10               0x5d87b6071ab6fd30
r11               0xfffffd803798b1d8
r12               0xfffffd8039440158
r13               0xffff8000169a9b88
r14               0xffff8000169a9c28
r15               0xffff80000005b480
rip               0xfffffd803798b1d8
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000169a9a78
ss                              0x10
0xfffffd803798b1d8:     xchgl   %eax,%esi
ddb> show proc
PROC (syz-executor.1) pid=44889 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=73, usrpri=73, nice=20
    forw=0xffffffffffffffff, list=0xffff800014933160,0xffffffff82591198
    process=0xffff8000148a3458 user=0xffff8000169a5000, vmspace=0xfffffd803f014550
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 70831  275677  82067      0  2           0                syz-executor.1
*70831   44889  82067      0  7   0x4000000                syz-executor.1
 73660   58934  78716      0  2         0x2                syz-executor.0
 50833  508101      1      0  3    0x100083  ttyin         getty
 82067  374210  78716      0  2       0x482                syz-executor.1
 63699   71382      0      0  3     0x14200  acct          acct
 27194  300974      0      0  3     0x14200  bored         sosplice
 78716   47296  95868      0  3        0x82  thrsleep      syz-fuzzer
 78716  468523  95868      0  2   0x4000482                syz-fuzzer
 78716  520779  95868      0  3   0x4000082  thrsleep      syz-fuzzer
 78716  489241  95868      0  3   0x4000082  thrsleep      syz-fuzzer
 78716  425798  95868      0  3   0x4000082  kqread        syz-fuzzer
 78716  197457  95868      0  3   0x4000082  thrsleep      syz-fuzzer
 78716  477045  95868      0  3   0x4000082  thrsleep      syz-fuzzer
 78716  464463  95868      0  3   0x4000082  thrsleep      syz-fuzzer
 95868  132201  42564      0  3    0x10008a  pause         ksh
 42564  219721  55752      0  3        0x92  select        sshd
 55752  220507      1      0  3        0x80  select        sshd
 58023  192805  58898     73  2    0x100090                syslogd
 58898  354877      1      0  3    0x100082  netio         syslogd
   801  512617      1     77  3    0x100090  poll          dhclient
   827   91803      1      0  3        0x80  poll          dhclient
 29946  396691      0      0  2     0x14200                zerothread
 63804  304803      0      0  3     0x14200  aiodoned      aiodoned
 57622  243925      0      0  3     0x14200  syncer        update
  4512  423996      0      0  3     0x14200  cleaner       cleaner
 62039  368701      0      0  3     0x14200  reaper        reaper
 85641  199590      0      0  3     0x14200  pgdaemon      pagedaemon
 36584   18534      0      0  3     0x14200  bored         crynlk
  3093  124508      0      0  3     0x14200  bored         crypto
 29720  284400      0      0  3  0x40014200  acpi0         acpi0
 42283   24023      0      0  3     0x14200  bored         softnet
 35944  265902      0      0  3     0x14200  bored         systqmp
 76865  361585      0      0  3     0x14200  bored         systq
 39688   84571      0      0  2  0x40014200                softclock
 12151  303000      0      0  3  0x40014200                idle0
   997  348905      0      0  2     0x14200                smr
     1  412246      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9583   7202K    7674K  78643K     18546        0        0
            pcb    13     12K      14K  78643K       654        0        0
         rtable   118      8K       8K  78643K      1912        0        0
         ifaddr    88     20K      22K  78643K       586        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K       266        0        0
            iov     0      0K      32K  78643K      1157        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1208     76K      77K  78643K      4451        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        58        0        0
         VM map    39      9K       9K  78643K        48        0        0
            sem    12      0K       1K  78643K      1294        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12645        0        0
      file desc     5     13K      25K  78643K      3092        0        0
          sigio     0      0K       0K  78643K        64        0        0
           proc    49     38K      63K  78643K      1249        0        0
        subproc    32      2K       2K  78643K       306        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       287        0        0
       in_multi    26      1K       2K  78643K       323        0        0
    ether_multi     1      0K       0K  78643K        41        0        0
            mrt     1      0K       0K  78643K        44        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys   108    477K     477K  78643K       108        0        0
           exec     0      0K       1K  78643K       800        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   169    331K     335K  78643K      8761        0        0
       UVM aobj   130      4K       4K  78643K       132        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       657        0        0
            NDP    20      0K       0K  78643K       177        0        0
           temp   226   3544K    4184K  78643K    162051        0        0
         kqueue     0      0K       0K  78643K        37        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       57    0       50     1     0     1     1     0     8    0
rtpcb       80      337    0      335     1     0     1     1     0     8    0
rtentry    112      318    0      274     2     0     2     2     0     8    0
unpcb      120     7748    0     7738    14    13     1     2     0     8    0
syncache   264       29    0       29    12    12     0     1     0     8    0
tcpqe       32      225    0      225     8     8     0     1     0     8    0
tcpcb      544     1611    0     1607    19    18     1    15     0     8    0
ipq         40       39    0       38    14    13     1     1     0     8    0
ipqe        40      980    0      979    14    13     1     1     0     8    0
inpcb      280     4130    0     4120    29    27     2    13     0     8    1
rttmr       72       15    0       14     7     6     1     1     0     8    0
ip6q        72        2    0        2     2     2     0     1     0     8    0
ip6af       40        4    0        4     2     2     0     1     0     8    0
nd6         48       33    0       31     1     0     1     1     0     8    0
pkpcb       40       19    0       19     8     7     1     1     0     8    1
swfcl       56        9    0        0     1     0     1     1     0     8    0
ppxss      1128      59    0       59    14    13     1     1     0     8    1
art_heap8  4096      11    0       10     6     5     1     3     0     8    0
art_heap4  256     1345    0     1123    28    14    14    16     0     8    0
art_table   32     1356    0     1133     2     0     2     2     0     8    0
art_node    16      317    0      276     1     0     1     1     0     8    0
sysvmsgpl   40       44    0       30     1     0     1     1     0     8    0
semupl     112        3    0        3     1     1     0     1     0     8    0
semapl     112     1288    0     1278     1     0     1     1     0     8    0
shmpl      112      130    0        2     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     6164    0     4765    46     0    46    46     0     8    0
ffsino     240     6164    0     4765    83     0    83    83     0     8    0
nchpl      144    11086    0    10585    61    40    21    61     0     8    0
uvmvnodes   72     7630    0        0   139     0   139   139     0     8    0
vnodes     208     7630    0        0   402     0   402   402     0     8    0
namei      1024   40206    0    40206     3     2     1     1     0     8    1
vcpupl     1984      37    0        0     5     0     5     5     0     8    0
vmpool     520       46    0        9     3     0     3     3     0     8    0
scsiplug    64        2    0        2     1     1     0     1     0     8    0
scxspl     192    44843    0    44843    26    24     2     7     0     8    2
plimitpl   152      293    0      286     1     0     1     1     0     8    0
sigapl     432     3217    0     3204     2     0     2     2     0     8    0
futexpl     56   100063    0   100063     3     2     1     1     0     8    1
knotepl    112      937    0      918     4     3     1     3     0     8    0
kqueuepl   104     1002    0     1000     4     3     1     4     0     8    0
pipepl     112     2704    0     2685    11    10     1     2     0     8    0
fdescpl    424     3218    0     3204     2     0     2     2     0     8    0
filepl     120    33854    0    33757    30    26     4    11     0     8    0
lockfpl    104     1408    0     1406     1     0     1     1     0     8    0
lockfspl    48      443    0      441     1     0     1     1     0     8    0
sessionpl  112       35    0       25     1     0     1     1     0     8    0
pgrppl      48       71    0       61     1     0     1     1     0     8    0
ucredpl     96     4260    0     4253     1     0     1     1     0     8    0
zombiepl   144     3204    0     3204     1     0     1     1     0     8    1
processpl  864     3234    0     3204     4     0     4     4     0     8    0
procpl     632     7129    0     7091     4     0     4     4     0     8    0
sosppl     128       48    0       48    11    11     0     1     0     8    0
sockpl     384    12284    0    12264    54    49     5    21     0     8    2
mcl64k     65536   1833    0     1833   132   103    29    64     0     8   29
mcl16k     16384     54    0       54    13    13     0     1     0     8    0
mcl12k     12288     82    0       82    11    10     1     1     0     8    1
mcl9k      9216      64    0       64    11    11     0     1     0     8    0
mcl8k      8192     175    0      175     4     3     1     1     0     8    1
mcl4k      4096     322    0      322     4     3     1     1     0     8    1
mcl2k2     2112      21    0       21    13    12     1     1     0     8    1
mcl2k      2048   74127    0    74077    21    14     7    16     0     8    0
mtagpl      80      178    0      171     5     4     1     1     0     8    0
mbufpl     256   151039    0   150921   145   128    17    41     0     8    8
bufpl      256    21571    0    13938   478     0   478   478     0     8    0
anonpl      16   451795    0   432729   211   102   109   109     0    62   27
amapchunkpl 152   18545    0    18389    73    53    20    20     0   158   11
amappl16   192    22245    0    21140   210   132    78    78     0     8   22
amappl15   184      274    0      274     5     4     1     1     0     8    1
amappl14   176      352    0      349     1     0     1     1     0     8    0
amappl13   168       45    0       45     3     3     0     1     0     8    0
amappl12   160      105    0      102     1     0     1     1     0     8    0
amappl11   152     1237    0     1222     1     0     1     1     0     8    0
amappl10   144       13    0       12     1     0     1     1     0     8    0
amappl9    136     1258    0     1252     1     0     1     1     0     8    0
amappl8    128      825    0      790     3     1     2     2     0     8    0
amappl7    120      117    0      110     1     0     1     1     0     8    0
amappl6    112     1239    0     1228     1     0     1     1     0     8    0
amappl5    104      402    0      392     1     0     1     1     0     8    0
amappl4     96     3421    0     3389     1     0     1     1     0     8    0
amappl3     88      602    0      592     1     0     1     1     0     8    0
amappl2     80    24310    0    24241     3     1     2     3     0     8    0
amappl1     72    68391    0    67991    25    16     9    20     0     8    0
amappl      80     7677    0     7612     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      131    0        2     3     0     3     3     0     8    0
uaddrrnd    24     3264    0     3204     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3264    0     3204     1     0     1     1     0     8    0
vmmpekpl   168    24988    0    24954     2     0     2     2     0     8    0
vmmpepl    168   401087    0   398836   313   176   137   140     0   357   32
vmsppl     272     3217    0     3204     3     2     1     2     0     8    0
pdppl      4096    6534    0     6463    14     4    10    10     0     8    0
pvpl        32  1189620    0  1167362   435   188   247   317     0   265   60
pmappl     200     3263    0     3213     3     0     3     3     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      958    0      311    23     2    21    21     0     8    0

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/17 14:32 openbsd 018bdca7fb8b 8c88c9c1 .config console log report ci-openbsd-main
2019/10/16 07:03 openbsd 19120e8f37ae d4ea592f .config console log report ci-openbsd-multicore
2019/10/14 16:38 openbsd 0bd8f65804ca a6aef847 .config console log report ci-openbsd-main
2019/10/14 03:10 openbsd cfc53b516f65 2f661ec4 .config console log report ci-openbsd-multicore
2019/10/13 21:24 openbsd 1701c8faa8ab 2f661ec4 .config console log report ci-openbsd-multicore
2019/10/11 03:47 openbsd 9db0ea45749c 1a3bad90 .config console log report ci-openbsd-main
2019/10/10 09:25 openbsd bb3393dc10c6 c4b9981b .config console log report ci-openbsd-main
2019/10/06 00:37 openbsd 2b2159bad083 f3f7d9c8 .config console log report ci-openbsd-main
2019/10/02 23:45 openbsd c722278fddec 2e29b534 .config console log report ci-openbsd-multicore
2019/10/02 17:44 openbsd 65ab43f212c4 2e29b534 .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.