syzbot


panic: malloc: allocation too large, type = 2, size = ADDRp5an12ic9:LINE

Status: closed as dup on 2019/08/31 08:53
Reported-by: syzbot+4cde2a25432e2a51dd22@syzkaller.appspotmail.com
First crash: 1671d, last: 1671d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
panic: malloc: allocation too large, type = 2, size = ADDR (2) C 16842 1660d 1678d

Sample crash report:
panic: malloc: allocation too large, type = 2, size = 184467440737095p5an12ic9:6 
ke
rnel diagnostic assertion "!_kernel_lock_held()" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_fork.c", line 690
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 376410  10139      0           0  0x4000000    0  syz-executor.1
*261399  94384      0           0  0x4000000    1  syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff8220282e,ffffffff821f0ad1,2b2,ffffffff821d1b09) at __assert+0x2b sys/kern/subr_prf.c:154
proc_trampoline_mp() at proc_trampoline_mp+0x123
end trace frame: 0x0, count: 11
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
malloc: allocation too large, type = 2, size = 18446744073709551296

ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff8220282e,ffffffff821f0ad1,2b2,ffffffff821d1b09) at __assert+0x2b sys/kern/subr_prf.c:154
proc_trampoline_mp() at proc_trampoline_mp+0x123
end trace frame: 0x0, count: -4
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020b55590
rbx               0xffff800020b55640
rdx               0xffff800020ab0780
rcx                                0
rax                                0
r8                0xffffffff8216e5cf    kprintf+0x16f
r9                               0x1
r10                             0x25
r11               0x59c57b7c37ae7790
r12                     0x3000000008
r13               0xffff800020b555a0
r14                            0x104
r15                              0x1
rip               0xffffffff81f247d8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020b55580
ss                                 0
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.0) pid=261399 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=71, usrpri=71, nice=20
    forw=0xffffffffffffffff, list=0xffff800020ab0290,0xffff800020ab0ef8
    process=0xffff800020adc700 user=0xffff800020b50000, vmspace=0xfffffd807f00c5c0
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 10139  361198  89468      0  2           0                syz-executor.1
 10139  376410  89468      0  7   0x4000000                syz-executor.1
 94384  344909  45509      0  2           0                syz-executor.0
*94384  261399  45509      0  7   0x4000000                syz-executor.0
 45509  291558  78440      0  3        0x82  nanosleep     syz-executor.0
 89468    8150  78440      0  3        0x82  nanosleep     syz-executor.1
   644  248378      0      0  3     0x14200  acct          acct
 78522  117844      0      0  3     0x14200  bored         sosplice
 78440  445329  95111      0  3        0x82  thrsleep      syz-fuzzer
 78440  145657  95111      0  3   0x4000082  nanosleep     syz-fuzzer
 78440  413307  95111      0  3   0x4000082  thrsleep      syz-fuzzer
 78440  195856  95111      0  3   0x4000082  thrsleep      syz-fuzzer
 78440  474951  95111      0  3   0x4000082  thrsleep      syz-fuzzer
 78440  235348  95111      0  3   0x4000082  thrsleep      syz-fuzzer
 78440  201439  95111      0  3   0x4000082  thrsleep      syz-fuzzer
 78440   99480  95111      0  3   0x4000082  kqread        syz-fuzzer
 78440  358326  95111      0  3   0x4000082  thrsleep      syz-fuzzer
 78440  507113  95111      0  3   0x4000082  thrsleep      syz-fuzzer
 95111  292688  22113      0  3    0x10008a  pause         ksh
 22113  447775  21071      0  3        0x92  select        sshd
 60571  161566      1      0  3    0x100083  ttyin         getty
 21071    4340      1      0  3        0x80  select        sshd
 66888    4955  28465     74  3    0x100092  bpf           pflogd
 28465  292502      1      0  3        0x80  netio         pflogd
 41647  511196   5339     73  3    0x100090  kqread        syslogd
  5339  351468      1      0  3    0x100082  netio         syslogd
 69702  170319      1     77  3    0x100090  poll          dhclient
 99051   78609      1      0  3        0x80  poll          dhclient
 89166   12164      0      0  2     0x14200                zerothread
 58758  516979      0      0  3     0x14200  aiodoned      aiodoned
 83784  237007      0      0  3     0x14200  syncer        update
 66584  475551      0      0  3     0x14200  cleaner       cleaner
 76367  353251      0      0  3     0x14200  reaper        reaper
 66025   96001      0      0  3     0x14200  pgdaemon      pagedaemon
 63136   11336      0      0  3     0x14200  bored         crynlk
 25503  199370      0      0  3     0x14200  bored         crypto
 20042   92062      0      0  3  0x40014200  acpi0         acpi0
 61719  310695      0      0  3  0x40014200                idle1
 42709    9532      0      0  3     0x14200  bored         softnet
 17134  446112      0      0  3     0x14200  bored         systqmp
  4754  522877      0      0  3     0x14200  bored         systq
 69888   88256      0      0  3  0x40014200  bored         softclock
 60755   42815      0      0  3  0x40014200                idle0
 81455  381394      0      0  3     0x14200  bored         smr
     1  120715      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 10139 (syz-executor.1) thread 0xffff800020ab0ee8 (376410)
shared rwlock vmlistlock r = 0 (0xffff80000066f478)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  vm_get_info+0x39 sys/arch/amd64/amd64/vmm.c:3712
#2  VOP_IOCTL+0x88 sys/kern/vfs_vops.c:291
#3  vn_ioctl+0xb7 sys/kern/vfs_vnops.c:524
#4  sys_ioctl+0x5b9
#5  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#5  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#6  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82620168)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  syscall+0x400 mi_syscall sys/sys/syscall_mi.h:83 [inline]
#1  syscall+0x400 sys/arch/amd64/amd64/trap.c:555
#2  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9572   6653K    7364K  78643K     18582        0        0
            pcb    13      8K       8K  78643K       397        0        0
         rtable   109      4K       4K  78643K      1099        0        0
         ifaddr    69     16K      16K  78643K       408        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       4K  78643K      1638        0        0
            iov     0      0K      32K  78643K       279        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1214     76K      77K  78643K      3992        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        36        0        0
         VM map     2      1K       1K  78643K         4        0        0
            sem    12      1K       1K  78643K       129        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1809    196K     290K  78643K     12843        0        0
      file desc     6     17K      25K  78643K      3043        0        0
          sigio     0      0K       0K  78643K        39        0        0
           proc    62     63K      95K  78643K      1014        0        0
        subproc    32      2K       2K  78643K       176        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       301        0        0
       in_multi    33      2K       2K  78643K       202        0        0
    ether_multi     1      0K       0K  78643K        16        0        0
            mrt     0      0K       0K  78643K        14        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    78    344K     344K  78643K        78        0        0
           exec     0      0K       1K  78643K       540        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   107     22K      26K  78643K     10697        0        0
       UVM aobj   108      3K       3K  78643K       109        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       372        0        0
            NDP    15      0K       0K  78643K       121        0        0
           temp   193   3556K    3632K  78643K     31015        0        0
         kqueue     0      0K       0K  78643K        11        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       23    0       17     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80      156    0      154     1     0     1     1     0     8    0
rtentry    112      132    0       88     2     0     2     2     0     8    0
unpcb      120      917    0      907     1     0     1     1     0     8    0
syncache   264        4    0        4     1     1     0     1     0     8    0
sackhl      24        2    0        2     2     1     1     1     0     8    1
tcpqe       32     7328    0     7328     3     3     0     2     0     8    0
tcpcb      544      621    0      617     1     0     1     1     0     8    0
inpcb      280     1777    0     1770     2     1     1     2     0     8    0
rttmr       72        2    0        2     2     2     0     1     0     8    0
nd6         48       20    0       16     1     0     1     1     0     8    0
pkpcb       40        7    0        7     3     3     0     1     0     8    0
swfcl       56        2    0        0     1     0     1     1     0     8    0
ppxss      1128      57    0       57    10     9     1     1     0     8    1
pffrag     232        2    0        2     2     2     0     1     0   482    0
pffrnode    88        2    0        2     2     2     0     1     0     8    0
pffrent     40        4    0        4     2     2     0     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       99    0       83     1     0     1     1     0     8    0
pfstkey    112       99    0       83     1     0     1     1     0     8    0
pfstate    328       99    0       83     3     0     3     3     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      572    0      354    14     0    14    14     0     8    0
art_table   32      573    0      354     2     0     2     2     0     8    0
art_node    16      127    0       87     1     0     1     1     0     8    0
sysvmsgpl   40       11    0        6     1     0     1     1     0     8    0
semupl     112        2    0        2     1     1     0     1     0     8    0
semapl     112      125    0      115     1     0     1     1     0     8    0
shmpl      112      107    0        1     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     6072    0     4671    46     0    46    46     0     8    0
ffsino     272     6072    0     4671    95     1    94    95     0     8    0
nchpl      144    10484    0     8882    61     0    61    61     0     8    0
uvmvnodes   72     6009    0        0   110     0   110   110     0     8    0
vnodes     208     6009    0        0   317     0   317   317     0     8    0
namei      1024   33313    0    33313     3     2     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
vmpool     552        2    0        2     1     1     0     1     0     8    0
scsiplug    64        6    0        6     5     5     0     1     0     8    0
scxspl     192    30833    0    30833    21    20     1     7     0     8    1
plimitpl   152      264    0      256     1     0     1     1     0     8    0
sigapl     432     3219    0     3203     3     1     2     3     0     8    0
futexpl     56    39268    0    39268     1     0     1     1     0     8    1
knotepl    112      704    0      685     1     0     1     1     0     8    0
kqueuepl   104      642    0      640     1     0     1     1     0     8    0
pipepl     112     1690    0     1669     2     1     1     2     0     8    0
fdescpl    488     3220    0     3203     3     0     3     3     0     8    0
filepl     152    18853    0    18746     8     3     5     6     0     8    0
lockfpl    104     1083    0     1082     1     0     1     1     0     8    0
lockfspl    48      357    0      356     1     0     1     1     0     8    0
sessionpl  112       26    0       15     1     0     1     1     0     8    0
pgrppl      48       63    0       52     1     0     1     1     0     8    0
ucredpl     96     3271    0     3262     1     0     1     1     0     8    0
zombiepl   144     3203    0     3203     3     2     1     1     0     8    1
processpl  896     3237    0     3203     4     0     4     4     0     8    0
procpl     632     9530    0     9485    10     5     5     5     0     8    1
srpgc       64       18    0       18     8     8     0     1     0     8    0
sosppl     128       29    0       29    12    11     1     1     0     8    1
sockpl     384     2884    0     2865     6     3     3     4     0     8    1
mcl64k     65536    269    0        0    34    10    24    34     0     8    1
mcl16k     16384      6    0        0     1     0     1     1     0     8    0
mcl12k     12288     17    0        0     2     0     2     2     0     8    0
mcl9k      9216      10    0        0     1     0     1     1     0     8    0
mcl8k      8192       5    0        0     1     0     1     1     0     8    0
mcl4k      4096      13    0        0     2     0     2     2     0     8    0
mcl2k2     2112       7    0        0     1     0     1     1     0     8    0
mcl2k      2048     235    0        0    29     8    21    29     0     8    0
mtagpl      80       35    0        0     1     0     1     1     0     8    0
mbufpl     256      471    0        0    23     0    23    23     0     8    0
bufpl      256    16704    0     9656   441     0   441   441     0     8    0
anonpl      16   308180    0   295581   140    72    68    70     0   124   13
amapchunkpl 152   18684    0    18579    27    17    10    10     0   158    5
amappl16   192    16049    0    15333   135    91    44    49     0     8    8
amappl15   184      102    0      102     2     2     0     1     0     8    0
amappl14   176     1111    0     1105     1     0     1     1     0     8    0
amappl13   168      431    0      431     1     1     0     1     0     8    0
amappl12   160      205    0      203     2     1     1     1     0     8    0
amappl11   152      587    0      572     1     0     1     1     0     8    0
amappl10   144       20    0       17     1     0     1     1     0     8    0
amappl9    136     1406    0     1397     1     0     1     1     0     8    0
amappl8    128      967    0      936     2     0     2     2     0     8    0
amappl7    120       76    0       70     1     0     1     1     0     8    0
amappl6    112      590    0      578     1     0     1     1     0     8    0
amappl5    104      422    0      407     1     0     1     1     0     8    0
amappl4     96     3207    0     3176     1     0     1     1     0     8    0
amappl3     88     1113    0     1107     1     0     1     1     0     8    0
amappl2     80    24863    0    24782     3     1     2     3     0     8    0
amappl1     72    78548    0    78096    27    16    11    20     0     8    0
amappl      80     9904    0     9867     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      108    0        1     2     0     2     2     0     8    0
uaddrrnd    24     3222    0     3203     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3222    0     3203     1     0     1     1     0     8    0
vmmpekpl   168    26124    0    26084     2     0     2     2     0     8    0
vmmpepl    168   395038    0   393085   231   136    95   111     0   357    8
vmsppl     368     3219    0     3203     2     0     2     2     0     8    0
pdppl      4096    6451    0     6410     7     1     6     6     0     8    0
pvpl        32   849123    0   833271   284   119   165   170     0   265   36
pmappl     232     3221    0     3205     3     2     1     2     0     8    0
extentpl    40       38    0       22     1     0     1     1     0     8    0
phpool     112      661    0       25    19     0    19    19     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/30 21:48 openbsd 704010f9f112 9adfa876 .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.