syzbot


uvm_fault: in4_cksum

Status: auto-closed as invalid on 2020/04/24 10:38
Reported-by: syzbot+1c23705cf70049367f35@syzkaller.appspotmail.com
First crash: 1551d, last: 1551d

Sample crash report:
uvm_fault(0xffffffff825831b0, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      in4_cksum+0x2ed:        movzwl  0(%r13),%eax
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff825831b0, 0x0, 0, 1) -> e
in4_cksum(fffffd805bd02f00,0,14,4006) at in4_cksum+0x2ed sys/netinet/in4_cksum.c:173
end trace frame: 0xffff80001d31d6e0, count: 0
ddb> trace
in4_cksum(fffffd805bd02f00,0,14,4006) at in4_cksum+0x2ed sys/netinet/in4_cksum.c:173
in_delayed_cksum(fffffd805bd02f00) at in_delayed_cksum+0x4b sys/netinet/ip_output.c:1753
in_proto_cksum_out(fffffd805bd02f00,ffff800000677800) at in_proto_cksum_out+0x321 sys/netinet/ip_output.c:1812
ip_output(fffffd805bd02f00,0,fffffd805e5584d0,800,0,fffffd805e558460) at ip_output+0xe9d sys/netinet/ip_output.c:449
tcp_output(ffff8000009ef320) at tcp_output+0x2514 sys/netinet/tcp_output.c:1040
tcp_input(ffff80001d31dd78,ffff80001d31dd84,6,2) at tcp_input+0x337c sys/netinet/tcp_input.c:2024
ip_deliver(ffff80001d31dd78,ffff80001d31dd84,6,2) at ip_deliver+0x2e3 sys/netinet/ip_input.c:668
ip_ours(ffff80001d31dd78,ffff80001d31dd84,2,0) at ip_ours+0x4fe sys/netinet/ip_input.c:563
ip_input_if(ffff80001d31dd78,ffff80001d31dd84,4,0,ffff800000677800) at ip_input_if+0x571
ipv4_input(ffff800000677800,fffffd8064fd9c00) at ipv4_input+0x48 sys/netinet/ip_input.c:215
if_input_local(ffff800000677800,fffffd8064fd9c00,2) at if_input_local+0xf9 sys/net/if.c:776
loinput(ffff800000677800,fffffd8064fd9c00,0) at loinput+0x4f sys/net/if_loop.c:239
if_input_process(ffff800000677800,ffff80001d31dec8) at if_input_process+0xf8 if_ih_input sys/net/if.c:909 [inline]
if_input_process(ffff800000677800,ffff80001d31dec8) at if_input_process+0xf8 sys/net/if.c:943
ifiq_process(ffff800000677bb8) at ifiq_process+0x80 sys/net/ifq.c:607
taskq_thread(ffff80000002a080) at taskq_thread+0x52 sys/kern/kern_task.c:370
end trace frame: 0x0, count: -15
ddb> show registers
rdi                       0xffffffff
rsi                           0x3fc6    __ALIGN_SIZE+0x2fc6
rbp               0xffff80001d31d680
rbx                           0x3fc6    __ALIGN_SIZE+0x2fc6
rdx                             0x14
rcx                          0x5878d    acpi_pdirpa+0x445f5
rax                           0x3fe0    __ALIGN_SIZE+0x2fe0
r8                               0x2
r9                               0x1
r10               0x4822c02ec940c259
r11               0x48aa9879692eb3ab
r12                           0x3fa6    __ALIGN_SIZE+0x2fa6
r13                                0
r14                                0
r15                          0x725a6    acpi_pdirpa+0x5e40e
rip               0xffffffff81da442d    in4_cksum+0x2ed
cs                               0x8
rflags                       0x10207    __ALIGN_SIZE+0xf207
rsp               0xffff80001d31d5f0
ss                              0x10
in4_cksum+0x2ed:        movzwl  0(%r13),%eax
ddb> show proc
PROC (softnet) pid=502163 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    pri=32, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff80001d2f1750,0xffff80001d2f1280
    process=0xffff8000ffffe000 user=0xffff80001d319000, vmspace=0xffffffff825831b0
    estcpu=0, cpticks=0, pctcpu=0.6
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 68894  410432      0      0  3     0x14200  bored         sosplice
 14102  393778      1      0  3    0x100083  ttyin         getty
 14730  505650   8647      0  3        0x82  nanosleep     syz-executor.0
 88051   37550   8647      0  3        0x82  piperd        syz-executor.1
  8647  136992  15743      0  3        0x82  thrsleep      syz-fuzzer
  8647  452938  15743      0  3   0x4000082  thrsleep      syz-fuzzer
  8647  504498  15743      0  3   0x4000082  thrsleep      syz-fuzzer
  8647  165619  15743      0  3   0x4000082  thrsleep      syz-fuzzer
  8647  385029  15743      0  3   0x4000082  kqread        syz-fuzzer
  8647  194431  15743      0  3   0x4000082  thrsleep      syz-fuzzer
  8647   22360  15743      0  3   0x4000082  thrsleep      syz-fuzzer
 15743   57368  52508      0  3    0x10008a  pause         ksh
 52508  237220  37502      0  3        0x92  select        sshd
 37502  499009      1      0  3        0x80  select        sshd
 52500  133844  83889     73  3    0x100090  kqread        syslogd
 83889  320708      1      0  3    0x100082  netio         syslogd
 41195  251682      1     77  3    0x100090  poll          dhclient
 58596  517354      1      0  3        0x80  poll          dhclient
 86130  161086      0      0  2     0x14200                zerothread
  9480   81032      0      0  3     0x14200  aiodoned      aiodoned
 80960    9416      0      0  3     0x14200  syncer        update
 99304  155400      0      0  3     0x14200  cleaner       cleaner
 10314   86382      0      0  3     0x14200  reaper        reaper
 46000  249718      0      0  3     0x14200  pgdaemon      pagedaemon
 63572   41054      0      0  3     0x14200  bored         crynlk
 82682  212933      0      0  3     0x14200  bored         crypto
 17703  208520      0      0  3  0x40014200  acpi0         acpi0
*39221  502163      0      0  7     0x14200                softnet
 33323  409046      0      0  3     0x14200  bored         systqmp
 14492  263328      0      0  3     0x14200  bored         systq
 25711  426495      0      0  3  0x40014200  bored         softclock
 97447  335309      0      0  3  0x40014200                idle0
 34440  454359      0      0  3     0x14200  bored         smr
     1  304297      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9489   6340K    7489K  78643K     11953        0
            pcb    13     10K      12K  78643K        81        0
         rtable   107      3K       3K  78643K       264        0
         ifaddr    77     16K      17K  78643K       115        0
       counters    21     16K      17K  78643K        27        0
       ioctlops     0      0K       2K  78643K        26        0
            iov     0      0K      12K  78643K        37        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1232     77K      78K  78643K      1546        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K        10        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      1K       1K  78643K        19        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1794    195K     288K  78643K     12646        0
      file desc     4      9K      25K  78643K       256        0
          sigio     0      0K       0K  78643K         6        0
           proc    49     38K      54K  78643K       394        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        41        0
       in_multi    83      3K       3K  78643K       112        0
    ether_multi     1      0K       0K  78643K         9        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    61    281K     281K  78643K        61        0
           exec     0      0K       1K  78643K       202        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   111     54K      55K  78643K      1535        0
       UVM aobj    30      7K       7K  78643K        32        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        52        0
            NDP    10      0K       0K  78643K        20        0
           temp   109   3010K    3074K  78643K     13402        0
         kqueue     3      4K      16K  78643K        30        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        7    0        1     1     0     1     1     0     8    0
rtpcb       80       37    0       35     1     0     1     1     0     8    0
rtentry    112       49    0        4     2     0     2     2     0     8    0
unpcb      120      161    0      153     1     0     1     1     0     8    0
syncache   264        8    0        8     3     2     1     1     0     8    1
tcpqe       32       74    0       74     3     2     1     1     0     8    1
tcpcb      544      475    0      464    13    11     2    12     0     8    1
inpcb      280      685    0      674    10     8     2     9     0     8    1
nd6         48        4    0        0     1     0     1     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      224    0        2    14     0    14    14     0     8    0
art_table   32      226    0        2     2     0     2     2     0     8    0
art_node    16       48    0        7     1     0     1     1     0     8    0
sysvmsgpl   40       49    0       35     2     1     1     1     0     8    0
semapl     112       15    0        5     1     0     1     1     0     8    0
shmpl      112       30    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1754    0      351    46     0    46    46     0     8    0
ffsino     240     1754    0      351    83     0    83    83     0     8    0
nchpl      144     2311    0      713    60     0    60    60     0     8    0
uvmvnodes   72     2084    0        0    38     0    38    38     0     8    0
vnodes     208     2084    0        0   110     0   110   110     0     8    0
namei      1024    6420    0     6420     1     0     1     1     0     8    1
vcpupl     1984       4    0        0     1     0     1     1     0     8    0
vmpool     528        4    0        0     1     0     1     1     0     8    0
scsiplug    64        2    0        2     1     0     1     1     0     8    1
scxspl     192     6840    0     6840     1     0     1     1     0     8    1
plimitpl   152       33    0       26     1     0     1     1     0     8    0
sigapl     432      428    0      416     2     0     2     2     0     8    0
futexpl     56     7041    0     7041     1     0     1     1     0     8    1
knotepl    112       82    0       63     1     0     1     1     0     8    0
kqueuepl   104      335    0      333     4     3     1     4     0     8    0
pipelkpl    16      117    0      107     1     0     1     1     0     8    0
pipepl     120      234    0      215     1     0     1     1     0     8    0
fdescpl    432      429    0      416     2     0     2     2     0     8    0
filepl     120     3419    0     3324    11     7     4    11     0     8    0
lockfpl    104      109    0      108     1     0     1     1     0     8    0
lockfspl    48       28    0       27     1     0     1     1     0     8    0
sessionpl  112       18    0        8     1     0     1     1     0     8    0
pgrppl      48       24    0       14     1     0     1     1     0     8    0
ucredpl     96      386    0      379     2     1     1     2     0     8    0
zombiepl   144      416    0      415     1     0     1     1     0     8    0
processpl  896      444    0      415     4     0     4     4     0     8    0
procpl     624      788    0      753     5     1     4     4     0     8    0
sosppl     128        2    0        2     1     1     0     1     0     8    0
sockpl     400      887    0      867    16    11     5    14     0     8    2
mcl64k     65536    307    0      305    32    31     1    32     0     8    0
mcl16k     16384      4    0        4     2     1     1     1     0     8    1
mcl12k     12288      6    0        6     2     1     1     1     0     8    1
mcl9k      9216       6    0        6     2     1     1     1     0     8    1
mcl8k      8192       9    0        9     1     0     1     1     0     8    1
mcl4k      4096      50    0       49     2     1     1     1     0     8    0
mcl2k2     2112       3    0        3     2     1     1     1     0     8    1
mcl2k      2048   64532    0    64490    16     9     7    13     0     8    1
mtagpl      80       31    0        2     2     1     1     1     0     8    0
mbufpl     256   110942    0   110748    49    27    22    36     0     8    8
bufpl      280     4559    0      178   313     0   313   313     0     8    0
anonpl      16    60580    0    44081    83     9    74    82     0   107    7
amapchunkpl 152    2058    0     1920    11     4     7    11     0   158    0
amappl16   192     2392    0     1492    62    16    46    58     0     8    0
amappl15   184       51    0       47     1     0     1     1     0     8    0
amappl14   176      139    0      136     1     0     1     1     0     8    0
amappl13   168      113    0      112     2     1     1     1     0     8    0
amappl12   160        6    0        6     1     1     0     1     0     8    0
amappl11   152       46    0       35     1     0     1     1     0     8    0
amappl10   144       13    0       10     1     0     1     1     0     8    0
amappl9    136      541    0      537     1     0     1     1     0     8    0
amappl8    128      114    0       93     1     0     1     1     0     8    0
amappl7    120       91    0       81     1     0     1     1     0     8    0
amappl6    112       52    0       47     1     0     1     1     0     8    0
amappl5    104      205    0      195     1     0     1     1     0     8    0
amappl4     96      644    0      617     1     0     1     1     0     8    0
amappl3     88      238    0      230     1     0     1     1     0     8    0
amappl2     80     2774    0     2712     3     1     2     3     0     8    0
amappl1     72    17515    0    17111    26    16    10    20     0     8    0
amappl      80     1032    0      987     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       31    0        2     1     0     1     1     0     8    0
uaddrrnd    24      433    0      416     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      433    0      416     1     0     1     1     0     8    0
vmmpekpl   168     6806    0     6781     2     0     2     2     0     8    0
vmmpepl    168    59097    0    57211   117    22    95   112     0   357    5
vmsppl     272      432    0      416     3     1     2     2     0     8    0
pdppl      4096     872    0      836     7     1     6     6     0     8    0
pvpl        32   180107    0   160680   193     9   184   192     0   265   24
pmappl     200      432    0      416     1     0     1     1     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      251    0       96     6     1     5     6     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/25 10:38 openbsd 61e8dc34fbac 2e95ab33 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.