syzbot


uvm_fault: memcpy (2)

Status: closed as invalid on 2020/05/18 08:51
Reported-by: syzbot+52e49339d58cab010015@syzkaller.appspotmail.com
First crash: 1688d, last: 1440d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: memcpy C 460 1851d 1871d 3/3 fixed on 2019/03/31 22:33
openbsd uvm_fault: memcpy (5) C 6 38d 564d 0/3 upstream: reported C repro on 2022/10/08 21:10
openbsd uvm_fault: memcpy (4) 2 783d 852d 0/3 auto-closed as invalid on 2022/06/01 18:10
openbsd uvm_fault: memcpy (3) 26 1375d 1433d 0/3 auto-closed as invalid on 2020/10/17 21:23

Sample crash report:
login: uvm_fault(0xffffffff82540280, 0xffff800000a6c000, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      memcpy+0x15:    repe movsq      (%rsi),%es:(%rdi)
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff82540280, 0xffff800000a6c000, 0, 1) -> e
memcpy(fffffd803320de00,18,f8,ffff800000a6bf78,2,fffffd803320de00) at memcpy+0x15
end trace frame: 0xffff800014926300, count: 0
ddb> trace
memcpy(fffffd803320de00,18,f8,ffff800000a6bf78,2,fffffd803320de00) at memcpy+0x15
rtm_msg1(c,ffff800014926318) at rtm_msg1+0x1b2 sys/net/rtsock.c:1421
rtm_addr(c,ffff800000a6bf00) at rtm_addr+0x9b sys/net/rtsock.c:1609
rt_ifa_add(ffff800000a6bf00,240404,ffff800000a6bf58,0) at rt_ifa_add+0x2db sys/net/route.c:1142
rt_ifa_addlocal(ffff800000a6bf00) at rt_ifa_addlocal+0x149 sys/net/route.c:1242
in_ifinit(ffff800000a63800,ffff800000a6bf00,ffff800014926830,1) at in_ifinit+0x1cf sys/netinet/in.c:614
in_ioctl_change_ifaddr(8040691a,ffff800014926820,ffff800000a63800,1) at in_ioctl_change_ifaddr+0x5de sys/netinet/in.c:452
in_ioctl(8040691a,ffff800014926820,ffff800000a63800,1) at in_ioctl+0x205 sys/netinet/in.c:234
ifioctl(fffffd80363e6908,8040691a,ffff800014926820,ffff8000ffff8008) at ifioctl+0xb34 sys/net/if.c:2202
sys_ioctl(ffff8000ffff8008,ffff800014926938,ffff800014926980) at sys_ioctl+0x5b9
syscall(ffff800014926a00) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,ffffffffffffff36,0,3,c12bd92c010) at Xsyscall+0x128
end of kernel
end trace frame: 0xc15ba2be2b0, count: -12
ddb> show registers
rdi               0xfffffd803320d630
rsi               0xffff800000a6c000
rbp               0xffff800014926290
rbx                                0
rdx                             0x80
rcx                              0xe
rax                   0x7d80327a1630
r8                               0x2
r9                               0x1
r10               0xa7619c2f42558e9a
r11               0xfffffd803320d620
r12                             0x80
r13                             0x80
r14               0xffff800000a6bff0
r15               0xfffffd803320d600
rip               0xffffffff81d2ad25    memcpy+0x15
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff8000149261c8
ss                              0x10
memcpy+0x15:    repe movsq      (%rsi),%es:(%rdi)
ddb> show proc
PROC (syz-executor.0) pid=358281 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=50, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff8c60,0xffffffff8257f3f8
    process=0xffff8000148a2378 user=0xffff800014921000, vmspace=0xfffffd803f013440
    estcpu=7, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 66304  347340  21552      0  2           0                syz-executor.0
*66304  358281  21552      0  7   0x4000000                syz-executor.0
 21552   58028  35285      0  3        0x82  nanosleep     syz-executor.0
 35285  327490  52390      0  3        0x82  thrsleep      syz-execprog
 35285   32190  52390      0  3   0x4000082  thrsleep      syz-execprog
 35285  114780  52390      0  3   0x4000082  thrsleep      syz-execprog
 35285  470408  52390      0  3   0x4000082  thrsleep      syz-execprog
 35285  377474  52390      0  3   0x4000082  kqread        syz-execprog
 35285  135389  52390      0  3   0x4000082  thrsleep      syz-execprog
 35285  459758  52390      0  3   0x4000082  thrsleep      syz-execprog
 52390  137389   6060      0  3    0x10008a  pause         ksh
  6060  179354  70829      0  3        0x92  select        sshd
 43296  179015      1      0  3    0x100083  ttyin         getty
 70829  160828      1      0  3        0x80  select        sshd
 51314  257615  25745     73  3    0x100090  kqread        syslogd
 25745  401255      1      0  3    0x100082  netio         syslogd
 70316  509020      1     77  3    0x100090  poll          dhclient
 59141  255052      1      0  3        0x80  poll          dhclient
 97421  329530      0      0  2     0x14200                zerothread
 14201  157619      0      0  3     0x14200  aiodoned      aiodoned
 15170   56676      0      0  3     0x14200  syncer        update
 74958  181228      0      0  3     0x14200  cleaner       cleaner
 37853  174076      0      0  3     0x14200  reaper        reaper
 90151  390970      0      0  3     0x14200  pgdaemon      pagedaemon
 97626  128648      0      0  3     0x14200  bored         crynlk
 77209   64769      0      0  3     0x14200  bored         crypto
 50857   41930      0      0  3  0x40014200  acpi0         acpi0
 72480  491311      0      0  2     0x14200                softnet
  1448    4202      0      0  3     0x14200  bored         systqmp
 52795   53453      0      0  3     0x14200  bored         systq
 58117  406681      0      0  3  0x40014200  bored         softclock
 57233  295512      0      0  3  0x40014200                idle0
 33687  425990      0      0  3     0x14200  bored         smr
     1  486869      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9433   6309K    6309K  78643K     10526        0        0
            pcb    14      8K       8K  78643K        28        0        0
         rtable    85      2K       2K  78643K       203        0        0
         ifaddr    29      8K       8K  78643K        37        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K        14        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1180     74K      74K  78643K      1185        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       1K  78643K         2        0        0
         VM map     2      0K       0K  78643K         2        0        0
            sem     2      0K       0K  78643K         2        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12645        0        0
      file desc     3      8K      12K  78643K        22        0        0
           proc    47     38K      54K  78643K       307        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
       in_multi    22      1K       1K  78643K        22        0        0
    ether_multi     1      0K       0K  78643K         1        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    18     79K      79K  78643K        18        0        0
           exec     0      0K       1K  78643K       172        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    67     11K      11K  78643K       854        0        0
       UVM aobj     2      2K       2K  78643K         2        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
            NDP     6      0K       0K  78643K         6        0        0
           temp    39   3517K    3581K  78643K      3066        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       13    0        8     1     0     1     1     0     8    0
rtpcb       80       17    0       15     1     0     1     1     0     8    0
rtentry    112       51    0       17     2     0     2     2     0     8    1
unpcb      120       27    0       19     1     0     1     1     0     8    0
syncache   264        5    0        5     2     1     1     1     0     8    1
tcpcb      544       17    0       13     1     0     1     1     0     8    0
inpcb      280       53    0       44     1     0     1     1     0     8    0
nd6         48        2    0        0     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      221    0       48    11     0    11    11     0     8    0
art_table   32      222    0       48     2     0     2     2     0     8    0
art_node    16       50    0       19     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1417    0       23    45     0    45    45     0     8    0
ffsino     240     1417    0       23    83     0    83    83     0     8    1
nchpl      144     1661    0       57    60     0    60    60     0     8    0
uvmvnodes   72     1426    0        0    26     0    26    26     0     8    0
vnodes     208     1426    0        0    76     0    76    76     0     8    0
namei      1024    3855    0     3855     3     2     1     1     0     8    1
scxspl     192     4154    0     4154     9     8     1     7     0     8    1
plimitpl   152       14    0        8     1     0     1     1     0     8    0
sigapl     432      201    0      189     2     0     2     2     0     8    0
futexpl     56      193    0      193     1     0     1     1     0     8    1
knotepl    112       39    0       28     1     0     1     1     0     8    0
kqueuepl   104        2    0        0     1     0     1     1     0     8    0
pipepl     112      138    0      125     3     2     1     1     0     8    0
fdescpl    424      202    0      189     2     0     2     2     0     8    0
filepl     120     1007    0      951     2     0     2     2     0     8    0
lockfpl    104        5    0        4     1     0     1     1     0     8    0
lockfspl    48        3    0        2     1     0     1     1     0     8    0
sessionpl  112       18    0        9     1     0     1     1     0     8    0
pgrppl      48       18    0        9     1     0     1     1     0     8    0
ucredpl     96       47    0       40     1     0     1     1     0     8    0
zombiepl   144      189    0      189     3     2     1     1     0     8    1
processpl  864      216    0      189     4     0     4     4     0     8    0
procpl     632      227    0      193     3     0     3     3     0     8    0
sockpl     384       97    0       78     3     0     3     3     0     8    1
mcl4k      4096      10    0       10     2     1     1     1     0     8    1
mcl2k      2048    5471    0     5443     6     2     4     6     0     8    0
mtagpl      80        2    0        2     1     1     0     1     0     8    0
mbufpl     256     9684    0     9625     8     2     6     6     0     8    1
bufpl      256     5789    0     1331   279     0   279   279     0     8    0
anonpl      16    20411    0    18775    15     2    13    13     0    62    5
amapchunkpl 152     755    0      693     5     0     5     5     0   158    2
amappl16   192      152    0      110     3     0     3     3     0     8    0
amappl14   176       22    0       21     3     2     1     1     0     8    0
amappl13   168        6    0        4     2     1     1     1     0     8    0
amappl12   160        6    0        4     2     1     1     1     0     8    0
amappl11   152       46    0       35     1     0     1     1     0     8    0
amappl10   144       12    0       10     2     1     1     1     0     8    0
amappl9    136      415    0      409     1     0     1     1     0     8    0
amappl8    128      112    0      102     1     0     1     1     0     8    0
amappl7    120       29    0       27     1     0     1     1     0     8    0
amappl6    112       73    0       63     1     0     1     1     0     8    0
amappl5    104      134    0      125     1     0     1     1     0     8    0
amappl4     96      430    0      407     1     0     1     1     0     8    0
amappl3     88      115    0      110     1     0     1     1     0     8    0
amappl2     80      892    0      827     5     2     3     3     0     8    1
amappl1     72    13463    0    13056    27    10    17    20     0     8    8
amappl      80      428    0      401     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      202    0      189     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      202    0      189     1     0     1     1     0     8    0
vmmpekpl   168     6191    0     6176     1     0     1     1     0     8    0
vmmpepl    168    29307    0    28385    98    21    77    77     0   357   36
vmsppl     272      201    0      189     1     0     1     1     0     8    0
pdppl      4096     410    0      378     5     0     5     5     0     8    0
pvpl        32   103966    0   100042   119     6   113   113     0   265   80
pmappl     200      201    0      189     1     0     1     1     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      405    0        9    12     0    12    12     0     8    0
ddb> 

Crashes (2168):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/20 02:43 openbsd f5f4051615a3 4d3ae0b7 .config console log report syz ci-openbsd-main
2020/05/16 08:31 openbsd e3568ce26f9d 37bccd4e .config console log report ci-openbsd-multicore
2020/05/12 05:10 openbsd 4af36d075b7a 9eb09c40 .config console log report ci-openbsd-main
2020/05/06 22:07 openbsd 7237aa572037 4618eb2d .config console log report ci-openbsd-multicore
2020/05/06 00:54 openbsd 3870d38bfcbb 35b8eb30 .config console log report ci-openbsd-multicore
2020/05/02 11:40 openbsd 60e65ff7501f 58da4c35 .config console log report ci-openbsd-main
2020/04/30 03:08 openbsd 577c7898896a 2dd552a5 .config console log report ci-openbsd-main
2020/04/24 08:40 openbsd 93a238137442 03d97a1b .config console log report ci-openbsd-multicore
2020/04/20 19:21 openbsd 8d4ffaea7cde 347a5dc3 .config console log report ci-openbsd-main
2020/04/14 01:58 openbsd 040343ae18e7 7c54686a .config console log report ci-openbsd-multicore
2020/04/04 10:22 openbsd 1d562564f893 d9ed075d .config console log report ci-openbsd-multicore
2020/03/17 22:27 openbsd e8bf146742fb 97bc55ce .config console log report ci-openbsd-main
2020/03/17 04:02 openbsd f1533240957e 749688d2 .config console log report ci-openbsd-multicore
2020/03/12 13:58 openbsd b6d7e0c74f46 d850e9d0 .config console log report ci-openbsd-main
2020/03/04 00:54 openbsd b244f117c338 1f73b64b .config console log report ci-openbsd-multicore
2020/03/01 04:55 openbsd 04b4eeba543c c88c7b75 .config console log report ci-openbsd-multicore
2020/02/25 00:40 openbsd 4331a4ca76ac 59b57593 .config console log report ci-openbsd-multicore
2020/02/22 12:56 openbsd d607b6a56e77 2c36e7a7 .config console log report ci-openbsd-multicore
2020/02/20 19:49 openbsd b5c62e15268c 81230308 .config console log report ci-openbsd-multicore
2020/02/13 21:42 openbsd f1dacf2550c1 e6247653 .config console log report ci-openbsd-main
2020/02/08 08:47 openbsd 3a92740d5dea 06150bf1 .config console log report ci-openbsd-multicore
2020/02/08 07:38 openbsd 3a92740d5dea 06150bf1 .config console log report ci-openbsd-main
2020/02/07 15:56 openbsd 5185a7002a54 06150bf1 .config console log report ci-openbsd-multicore
2020/02/02 17:24 openbsd c88ab7ef5f5d 93e5e335 .config console log report ci-openbsd-main
2020/01/28 08:22 openbsd 2403824a60c7 56cd6c9b .config console log report ci-openbsd-multicore
2020/01/22 01:51 openbsd 09e8f7802c96 8eda0b95 .config console log report ci-openbsd-main
2020/01/17 20:25 openbsd b6410ec9e88e 3de7aabb .config console log report ci-openbsd-multicore
2020/01/15 18:58 openbsd baa66dbe09e9 069a5a44 .config console log report ci-openbsd-main
2020/01/14 05:02 openbsd dd25ef17a06a 32881205 .config console log report ci-openbsd-multicore
2020/01/14 03:37 openbsd dd25ef17a06a 32881205 .config console log report ci-openbsd-multicore
2020/01/13 04:15 openbsd be3ccdcb25df 53faa9fe .config console log report ci-openbsd-multicore
2020/01/12 13:42 openbsd 2194ba32eb07 31290a45 .config console log report ci-openbsd-multicore
2020/01/08 18:27 openbsd bdf9247d5599 ddc3e859 .config console log report ci-openbsd-multicore
2020/01/01 06:09 openbsd 54f904eb1e23 25a0186e .config console log report ci-openbsd-main
2019/12/31 16:25 openbsd dd030f8b9c09 25a0186e .config console log report ci-openbsd-main
2019/12/28 01:14 openbsd 32c195e0069f be5c2c81 .config console log report ci-openbsd-main
2019/12/26 07:03 openbsd 4b157101db52 be5c2c81 .config console log report ci-openbsd-multicore
2019/12/24 15:30 openbsd e22febffa296 be5c2c81 .config console log report ci-openbsd-main
2019/12/23 10:37 openbsd ae3c87c923d8 be5c2c81 .config console log report ci-openbsd-main
2019/12/23 04:20 openbsd 9371c6ae886a 8b967267 .config console log report ci-openbsd-multicore
2019/12/19 21:52 openbsd aff390a7af92 36650b4b .config console log report ci-openbsd-main
2019/12/18 05:07 openbsd e749f6f89611 64ca0a37 .config console log report ci-openbsd-multicore
2019/12/16 03:32 openbsd e749f6f89611 eef6e580 .config console log report ci-openbsd-multicore
2019/12/14 18:41 openbsd d03f881babcb eef6e580 .config console log report ci-openbsd-main
2019/12/12 11:32 openbsd 90d98d514722 d973f528 .config console log report ci-openbsd-multicore
2019/12/07 12:23 openbsd 05538f07cdcd 85f26751 .config console log report ci-openbsd-multicore
2019/12/06 17:31 openbsd 45d8925ef193 ba97c611 .config console log report ci-openbsd-multicore
2019/12/06 16:27 openbsd 45d8925ef193 ba97c611 .config console log report ci-openbsd-main
2019/12/01 13:33 openbsd de4d173916c8 a76bf83f .config console log report ci-openbsd-main
2019/11/27 08:11 openbsd 9d3278277eb2 1048481f .config console log report ci-openbsd-main
2019/09/10 20:33 openbsd 4f5a6e711025 a60cb4cd .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.