syzbot


panic: rw_enter: netlock locking against myself

Status: fixed on 2020/04/12 23:58
Reported-by: syzbot+7c805a09545d997b924d@syzkaller.appspotmail.com
Fix commit: 27427a72e313 In sosplice(), temporarily release the socket lock before calling FRELE() as the last reference could be dropped which in turn will cause soclose() to be called where the socket lock is unconditionally acquired. Note that this is only a problem for sockets protected by the non-recursive NET_LOCK() right now.
First crash: 967d, last: 967d
Patch testing requests:
Created Duration User Patch Repo Result
2020/04/11 19:38 17m anton@basename.se https://github.com/mptre/openbsd-src sosplice OK

Sample crash report:
login: panic: rw_enter: netlock locking against myself
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 494976  39781      0           0  0x4000000    0  syz-executor.0
*397038  39781      0           0  0x4000000    1K syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff822277f7) at panic+0x15c sys/kern/subr_prf.c:207
rw_enter(ffffffff825310b8,1) at rw_enter+0x518 sys/kern/kern_rwlock.c:173
solock(fffffd806bdedc90) at solock+0x5a sys/kern/uipc_socket2.c:282
soclose(fffffd806bdedc90,0) at soclose+0x2f sys/kern/uipc_socket.c:290
soo_close(fffffd806d1894d0,ffff800020ec64f8) at soo_close+0x40
fdrop(fffffd806d1894d0,ffff800020ec64f8) at fdrop+0xc2 sys/kern/kern_descrip.c:1276
sosplice(fffffd806eb64c88,3,0,0) at sosplice+0x475
sosetopt(fffffd806eb64c88,ffff,1023,fffffd8070ca4600) at sosetopt+0x830
sys_setsockopt(ffff800020ec64f8,ffff800020f85348,ffff800020f85390) at sys_setsockopt+0x215 sys/kern/uipc_syscalls.c:965
syscall(ffff800020f85410) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020f85410) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x381ca3863e0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
rw_enter: netlock locking against myself
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff822277f7) at panic+0x15c sys/kern/subr_prf.c:207
rw_enter(ffffffff825310b8,1) at rw_enter+0x518 sys/kern/kern_rwlock.c:173
solock(fffffd806bdedc90) at solock+0x5a sys/kern/uipc_socket2.c:282
soclose(fffffd806bdedc90,0) at soclose+0x2f sys/kern/uipc_socket.c:290
soo_close(fffffd806d1894d0,ffff800020ec64f8) at soo_close+0x40
fdrop(fffffd806d1894d0,ffff800020ec64f8) at fdrop+0xc2 sys/kern/kern_descrip.c:1276
sosplice(fffffd806eb64c88,3,0,0) at sosplice+0x475
sosetopt(fffffd806eb64c88,ffff,1023,fffffd8070ca4600) at sosetopt+0x830
sys_setsockopt(ffff800020ec64f8,ffff800020f85348,ffff800020f85390) at sys_setsockopt+0x215 sys/kern/uipc_syscalls.c:965
syscall(ffff800020f85410) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020f85410) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x381ca3863e0, count: -12
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020f84f50
rbx               0xffff800020f85000
rdx                             0x8b
rcx                              0x2
rax                              0x1
r8                0xffffffff8178384f    kprintf+0x16f
r9                               0x1
r10               0x4274c828e8ea3f95
r11               0xdceaf1e9746fcff5
r12                     0x3000000008
r13               0xffff800020f84f60
r14                            0x100
r15                              0x1
rip               0xffffffff819f29d8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020f84f40
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.0) pid=397038 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=32, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff800020ec6768,0xffff800020ec7618
    process=0xffff800020e923f8 user=0xffff800020f80000, vmspace=0xfffffd807efff2e0
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 18043  112462  58225      0  2           0                syz-executor.1
 18043   69652  58225      0  3   0x4000000  biowait       syz-executor.1
 39781  125522  97715      0  2           0                syz-executor.0
 39781  494976  97715      0  7   0x4000000                syz-executor.0
*39781  397038  97715      0  7   0x4000000                syz-executor.0
 73628  109003      0      0  3     0x14200  bored         sosplice
 58225  146735  37483      0  3        0x82  nanosleep     syz-executor.1
 97715   21782  37483      0  3        0x82  nanosleep     syz-executor.0
 37483  465442  86486      0  3        0x82  thrsleep      syz-execprog
 37483  252417  86486      0  3   0x4000082  thrsleep      syz-execprog
 37483  490186  86486      0  3   0x4000082  thrsleep      syz-execprog
 37483  162708  86486      0  3   0x4000082  thrsleep      syz-execprog
 37483  172525  86486      0  3   0x4000082  thrsleep      syz-execprog
 37483  168708  86486      0  3   0x4000082  kqread        syz-execprog
 37483  236979  86486      0  3   0x4000082  thrsleep      syz-execprog
 37483   10766  86486      0  3   0x4000082  thrsleep      syz-execprog
 37483  414489  86486      0  3   0x4000082  thrsleep      syz-execprog
 86486   18340  34670      0  3    0x10008a  pause         ksh
 34670  275753  76058      0  3        0x92  select        sshd
 91621  152391      1      0  3    0x100083  ttyin         getty
 76058  344672      1      0  3        0x80  select        sshd
 92666  448396  47579     74  3    0x100092  bpf           pflogd
 47579   25173      1      0  3        0x80  netio         pflogd
 97733  482092   7739     73  3    0x100090  kqread        syslogd
  7739  273638      1      0  3    0x100082  netio         syslogd
 65424  171159      1     77  3    0x100090  poll          dhclient
  8263  222079      1      0  3        0x80  poll          dhclient
 40252  148762      0      0  3     0x14200  bored         smr
 77488  389073      0      0  2     0x14200                zerothread
 57064   43438      0      0  3     0x14200  aiodoned      aiodoned
 32801  371001      0      0  3     0x14200  syncer        update
 12474  502643      0      0  3     0x14200  cleaner       cleaner
 83231  215732      0      0  3     0x14200  reaper        reaper
 61647   37901      0      0  3     0x14200  pgdaemon      pagedaemon
 60611  216570      0      0  3     0x14200  bored         crynlk
 62037  278992      0      0  3     0x14200  bored         crypto
 77208  519643      0      0  3  0x40014200  acpi0         acpi0
 65680  484914      0      0  3  0x40014200                idle1
 65305  365760      0      0  3     0x14200  bored         softnet
 75049  460865      0      0  3     0x14200  bored         systqmp
  8321  362535      0      0  3     0x14200  bored         systq
 58785  159793      0      0  3  0x40014200  bored         softclock
 99628   68122      0      0  3  0x40014200                idle0
     1   29600      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 18043 (syz-executor.1) thread 0xffff800020ec7608 (69652)
exclusive rrwlock inode r = 0 (0xfffffd806bdeeb40)
#0  witness_lock+0x4c5 sys/kern/subr_witness.c:1164
#1  rw_enter+0x453 sys/kern/kern_rwlock.c:311
#2  rrw_enter+0x88 sys/kern/kern_rwlock.c:462
#3  ufs_ihashins+0x45 sys/ufs/ufs/ufs_ihash.c:140
#4  ffs_vget+0x13e sys/ufs/ffs/ffs_vfsops.c:1358
#5  ffs_inode_alloc+0x1cf sys/ufs/ffs/ffs_alloc.c:392
#6  ufs_makeinode+0xaa sys/ufs/ufs/ufs_vnops.c:1830
#7  ufs_mknod+0x4e sys/ufs/ufs/ufs_vnops.c:172
#8  VOP_MKNOD+0xc6 sys/kern/vfs_vops.c:134
#9  domknodat+0x31e sys/kern/vfs_syscalls.c:1633
#10 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#10 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806bdeea30)
#0  witness_lock+0x4c5 sys/kern/subr_witness.c:1164
#1  rw_enter+0x453 sys/kern/kern_rwlock.c:311
#2  rrw_enter+0x88 sys/kern/kern_rwlock.c:462
#3  VOP_LOCK+0x4b sys/kern/vfs_vops.c:603
#4  vn_lock+0x81 sys/kern/vfs_vnops.c:575
#5  vfs_lookup+0xe6 sys/kern/vfs_lookup.c:419
#6  namei+0x63c sys/kern/vfs_lookup.c:249
#7  domknodat+0x92 sys/kern/vfs_syscalls.c:1585
#8  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#8  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#9  Xsyscall+0x128
Process 39781 (syz-executor.0) thread 0xffff800020ec64f8 (397038)
exclusive rwlock netlock r = 0 (0xffffffff825310c8)
#0  witness_lock+0x4c5 sys/kern/subr_witness.c:1164
#1  solock+0x5a sys/kern/uipc_socket2.c:282
#2  sys_setsockopt+0x1fa sys/kern/uipc_syscalls.c:964
#3  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#3  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#4  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff826739f0)
#0  witness_lock+0x4c5 sys/kern/subr_witness.c:1164
#1  syscall+0x400 mi_syscall sys/sys/syscall_mi.h:93 [inline]
#1  syscall+0x400 sys/arch/amd64/amd64/trap.c:570
#2  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9471   6398K    6398K  78643K     10562        0
            pcb    13      8K       8K  78643K        15        0
         rtable   105      3K       3K  78643K       199        0
         ifaddr    44     10K      10K  78643K        45        0
       counters    43     33K      33K  78643K        43        0
       ioctlops     0      0K       4K  78643K      1469        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1185     75K      75K  78643K      2305        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      1K       1K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1809    196K     290K  78643K     12766        0
      file desc     5     16K      24K  78643K       396        0
           proc    59     63K      95K  78643K       438        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    33      2K       2K  78643K        33        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    19     95K      95K  78643K        19        0
           exec     0      0K       1K  78643K       210        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    83     20K      20K  78643K      2116        0
       UVM aobj     2      2K       2K  78643K         2        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     6      0K       0K  78643K        10        0
           temp    33   3033K    3097K  78643K      2736        0
         kqueue     3      4K       4K  78643K         3        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        6    0        0     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       19    0       17     1     0     1     1     0     8    0
rtentry    112       45    0        1     2     0     2     2     0     8    0
unpcb      120       29    0       19     1     0     1     1     0     8    0
syncache   264        5    0        5     2     2     0     1     0     8    0
tcpcb      544        8    0        5     1     0     1     1     0     8    0
inpcb      280     1485    0     1476     1     0     1     1     0     8    0
nd6         48        6    0        0     1     0     1     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       11    0        2     1     0     1     1     0     8    0
pfstkey    112       11    0        2     1     0     1     1     0     8    0
pfstate    328       11    0        2     1     0     1     1     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      188    0        0    12     0    12    12     0     8    0
art_table   32      189    0        0     2     0     2     2     0     8    0
art_node    16       44    0        4     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     2567    0     1157    46     0    46    46     0     8    0
ffsino     272     2567    0     1157    95     0    95    95     0     8    0
nchpl      144     3150    0     1530    61     0    61    61     0     8    0
uvmvnodes   72     3279    0        0    60     0    60    60     0     8    0
vnodes     208     3279    0        0   173     0   173   173     0     8    0
namei      1024    7847    0     7846     2     1     1     1     0     8    0
percpumem   16       32    0        0     1     0     1     1     0     8    0
scxspl     192     7928    0     7927     9     8     1     7     0     8    0
plimitpl   152       16    0        8     1     0     1     1     0     8    0
sigapl     424      617    0      584     4     0     4     4     0     8    0
futexpl     56     2498    0     2498     1     0     1     1     0     8    1
knotepl    112       51    0       34     1     0     1     1     0     8    0
kqueuepl   144        2    0        0     1     0     1     1     0     8    0
pipelkpl    48       78    0       68     2     1     1     1     0     8    0
pipepl     120      156    0      137     2     1     1     1     0     8    0
fdescpl    496      601    0      584     3     0     3     3     0     8    0
filepl     152     3664    0     3593     3     0     3     3     0     8    0
lockfpl    104        5    0        4     1     0     1     1     0     8    0
lockfspl    48        3    0        2     1     0     1     1     0     8    0
sessionpl  112       20    0        9     1     0     1     1     0     8    0
pgrppl      48       20    0        9     1     0     1     1     0     8    0
ucredpl     96       52    0       43     1     0     1     1     0     8    0
zombiepl   144      584    0      584     2     1     1     1     0     8    1
processpl  984      617    0      584     5     0     5     5     0     8    0
procpl     624     1371    0     1327     4     0     4     4     0     8    0
sosppl     128      721    0      719     1     0     1     1     0     8    0
sockpl     400     1533    0     1512     3     0     3     3     0     8    0
mcl4k      4096       3    0        0     1     0     1     1     0     8    0
mcl2k      2048      56    0        0     7     0     7     7     0     8    0
mtagpl      80        1    0        0     1     0     1     1     0     8    0
mbufpl     256      145    0        0     8     0     8     8     0     8    0
bufpl      280     4115    0      174   282     0   282   282     0     8    0
anonpl      16    43273    0    41129    15     2    13    13     0   124    4
amapchunkpl 152    2907    0     2831     6     0     6     6     0   158    2
amappl16   192     1867    0     1792     4     0     4     4     0     8    0
amappl15   184        1    0        1     1     1     0     1     0     8    0
amappl14   176        7    0        5     2     1     1     1     0     8    0
amappl13   168       26    0       25     2     1     1     1     0     8    0
amappl12   160      191    0      187     2     1     1     1     0     8    0
amappl11   152       88    0       68     2     0     2     2     0     8    1
amappl10   144       15    0       13     1     0     1     1     0     8    0
amappl9    136      235    0      232     1     0     1     1     0     8    0
amappl8    128      290    0      280     1     0     1     1     0     8    0
amappl7    120      129    0      117     1     0     1     1     0     8    0
amappl6    112       27    0       21     1     0     1     1     0     8    0
amappl5    104      676    0      659     1     0     1     1     0     8    0
amappl4     96      529    0      500     2     0     2     2     0     8    1
amappl3     88      111    0      106     1     0     1     1     0     8    0
amappl2     80     3870    0     3794     4     1     3     3     0     8    1
amappl1     72    23171    0    22708    26     8    18    20     0     8    8
amappl      80     1612    0     1577     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      601    0      584     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      601    0      584     1     0     1     1     0     8    0
vmmpekpl   168     9206    0     9182     2     0     2     2     0     8    0
vmmpepl    168    63224    0    62070    94    14    80    80     0   357   29
vmsppl     368      600    0      584     2     0     2     2     0     8    0
pdppl      4096    1210    0     1168     6     0     6     6     0     8    0
pvpl        32   168813    0   164099   121     6   115   115     0   265   76
pmappl     232      600    0      584     2     0     2     2     0     8    1
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      149    0        4     5     0     5     5     0     8    0
ddb{1}> 

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2020/04/09 09:46 openbsd c220f9cfaf99 a8c6a3f8 .config log report syz
ci-openbsd-multicore 2020/04/09 09:33 openbsd c220f9cfaf99 a8c6a3f8 .config log report
* Struck through repros no longer work on HEAD.