syzbot


uvm_fault: hardclock

Status: auto-closed as invalid on 2021/12/07 21:45
Reported-by: syzbot+7c4ae75569717e017164@syzkaller.appspotmail.com
First crash: 1170d, last: 1170d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: hardclock (2) 1 1020d 1020d 0/3 auto-closed as invalid on 2022/05/06 11:22
openbsd uvm_fault: hardclock (3) 1 901d 901d 0/3 auto-obsoleted due to no activity on 2022/09/02 21:31
openbsd uvm_fault: hardclock (4) 1 758d 758d 0/3 auto-obsoleted due to no activity on 2023/01/23 15:58
openbsd uvm_fault: hardclock (5) syz 4 477d 629d 0/3 upstream: reported syz repro on 2023/03/03 14:04

Sample crash report:
kernel: page fault trap, code=0
Stopped at      hardclock+0x102:        movq    0x260(%r15),%r12
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
hardclock(ffff8000237a6930) at hardclock+0x102 sys/kern/kern_clock.c:156
lapic_clockintr(0,0) at lapic_clockintr+0x36 sys/arch/amd64/amd64/lapic.c:454
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x26
_rb_find(ffffffff826fce60,fffffd806fe9d210,ffff8000237a6a48) at _rb_find+0xa2 sys/kern/subr_tree.c:448
uvm_pagelookup(fffffd806fe9d208,16b7000) at uvm_pagelookup+0x44 sys/uvm/uvm_page.c:1199
buf_map(fffffd806fe9d148) at buf_map+0x206 sys/kern/vfs_biomem.c:124
buf_get(0,0,8000009) at buf_get+0x76f sys/kern/vfs_bio.c:1182
geteblk(8000009) at geteblk+0x2c sys/kern/vfs_bio.c:1064
readdisklabel(2902,ffffffff81994ab0,ffff800000b28c00,0) at readdisklabel+0x145 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,10001,2000,ffff80002163d510) at vndopen+0x17a sys/dev/vnd.c:202
spec_open(ffff8000237a6e98) at spec_open+0x3c8 sys/kern/spec_vnops.c:157
VOP_OPEN(fffffd80713ed148,10001,fffffd807f7d7420,ffff80002163d510) at VOP_OPEN+0x73 sys/kern/vfs_vops.c:153
vn_open(ffff8000237a70e8,10001,0) at vn_open+0x467 sys/kern/vfs_vnops.c:183
doopenat(ffff80002163d510,ffffff9c,20000040,10000,0,ffff8000237a72d0) at doopenat+0x26d sys/kern/vfs_syscalls.c:1133
syscall(ffff8000237a7340) at syscall+0x571 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xee11d6f94f0, count: -16
ddb> show registers
rdi                              0x3
rsi                                0
rbp               0xffff8000237a68f0
rbx                              0x6
rdx                                0
rcx                                0
rax               0xffff80002163d510
r8                                 0
r9                                 0
r10                                0
r11               0x6c50b92c62b12bb5
r12                                0
r13               0xffff80002163d510
r14               0xffff8000237a6930
r15                                0
rip               0xffffffff81b2c292    hardclock+0x102
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000237a68c0
ss                              0x10
hardclock+0x102:        movq    0x260(%r15),%r12
ddb> show proc
PROC (kernel: page fault trap, code=0
Faulted in DDB; continuing...
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10106   6363K    6374K  78643K     14003        0
            pcb    13      8K       8K  78643K       112        0
         rtable   106      3K       3K  78643K       204        0
         ifaddr    39     10K      10K  78643K        46        0
       counters    21     16K      16K  78643K        22        0
       ioctlops     0      0K       2K  78643K       421        0
            iov     0      0K       0K  78643K       399        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         5        0
         vnodes  1218     77K      77K  78643K      1460        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       9K  78643K       151        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      0K       0K  78643K       162        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12598        0
      file desc     5     13K      25K  78643K     17417        0
          sigio     0      0K       0K  78643K       416        0
           proc    55     54K      71K  78643K      1241        0
        subproc    32      2K       2K  78643K        51        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    33      2K       2K  78643K        44        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    43    201K     201K  78643K        43        0
           exec     0      0K       2K  78643K       402        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   173     23K      23K  78643K    204167        0
       UVM aobj   131      4K       4K  78643K       131        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     5      0K       0K  78643K        12        0
           temp   101   4201K    4265K  78643K     37827        0
         kqueue    10     14K      14K  78643K        10        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       26    0       23     1     0     1     1     0     8    0
rtentry    112       56    0       12     2     0     2     2     0     8    0
unpcb      120    19138    0    19123     8     7     1     2     0     8    0
syncache   296        4    0        4     1     1     0     1     0     8    0
tcpcb      736       89    0       85     5     4     1     4     0     8    0
arp         88        8    0        2     1     0     1     1     0     8    0
inpcb      304      390    0      383     1     0     1     1     0     8    0
nd6         48        9    0        3     1     0     1     1     0     8    0
kcovpl      48        3    0        1     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      232    0       44    12     0    12    12     0     8    0
art_table   32      233    0       44     2     0     2     2     0     8    0
art_node    16       55    0       15     1     0     1     1     0     8    0
semapl     112      160    0      150     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dirhash: pool(0xffffffff829244f8:dirhash): free list modified: page 0xffff800021670000; item ordinal 0; addr 0xffff800021670c00 (p 0xfffffd807bbde000); offset 0x0=0x0
pool(dirhash): free list modified: page 0xffff800021670000; item ordinal 0; addr 0xffff800021670c00 (p 0xfffffd807bbde000); offset 0x0=0x0
dirhash: pool(0xffffffff829244f8:dirhash): page inconsistency: page 0xffff800021670000; item ordinal 1; addr 0xb2e7c58844833e9f
dino2pl    256    20963    0    19555    91     2    89    89     0     8    0
ffsino     240    20963    0    19555    83     0    83    83     0     8    0
nchpl      144    44054    0    42451    60     0    60    60     0     8    0
uvmvnodes   72     5926    0        0   108     0   108   108     0     8    0
vnodes     224     5926    0        0   349     0   349   349     0     8    0
namei      1024   97199    0    97199     1     0     1     1     0     8    1
namei: pool(0xffffffff828ab9a8:namei): free list modified: page 0xffff800021629000; item ordinal 0; addr 0xffff800021629400 (p 0xfffffd807f7e4000); offset 0x0=0x0
pool(namei): free list modified: page 0xffff800021629000; item ordinal 0; addr 0xffff800021629400 (p 0xfffffd807f7e4000); offset 0x0=0x0
namei: pool(0xffffffff828ab9a8:namei): page inconsistency: page 0xffff800021629000; item ordinal 1; addr 0x5ed4af8fcb39e4d1
scxspl     216   116125    0   116125     9     8     1     8     0     8    1
plimitpl   152       17    0        9     1     0     1     1     0     8    0
sigapl     424    17673    0    17621     6     0     6     6     0     8    0
futexpl     56    81698    0    81698     1     0     1     1     0     8    1
knotepl    112      190    0      152     2     0     2     2     0     8    0
kqueuepl   184      410    0      404     1     0     1     1     0     8    0
pipepl     304       82    0       72     1     0     1     1     0     8    0
fdescpl    432    17629    0    17613     3     1     2     3     0     8    0
filepl     120    52204    0    52093     9     5     4     5     0     8    0
lockfpl    104      680    0      678     1     0     1     1     0     8    0
lockfspl    48      312    0      310     1     0     1     1     0     8    0
sessionpl  144       18    0        8     1     0     1     1     0     8    0
pgrppl      48       18    0        8     1     0     1     1     0     8    0
ucredpl     96      664    0      653     1     0     1     1     0     8    0
zombiepl   144    17621    0    17620     1     0     1     1     0     8    0
processpl  1008   17673    0    17620     7     0     7     7     0     8    0
processpl: pool(0xffffffff828ac328:processpl): page inconsistency: page 0x0; at page head addr 0xffff80002165df90 (p 0xffff80002165c000)
processpl: pool(0xffffffff828ac328:processpl): page inconsistency: page 0x0; at page head addr 0xffff80002164df90 (p 0xffff80002164c000)
procpl     672    35575    0    35516     9     3     6     6     0     8    0
procpl: pool(0xffffffff828ac180:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002167bf90 (p 0xffff80002167a000)
sockpl     448    19554    0    19529    34    30     4     6     0     8    1
mcl64k     65536    360    0      360     6     6     0     1     0     8    0
mcl16k     16384     46    0       46     4     4     0     1     0     8    0
mcl12k     12288    267    0      267    20    20     0     1     0     8    0
mcl9k      9216     715    0      715    17    17     0     1     0     8    0
mcl8k      8192    1267    0     1267    12    12     0     1     0     8    0
mcl4k      4096     727    0      727    25    25     0     1     0     8    0
mcl2k2     2112     186    0      186    10    10     0     1     0     8    0
mcl2k      2048   33789    0    33755    10     5     5     6     0     8    0
mtagpl      96        3    0        3     1     1     0     1     0     8    0
mbufpl     256   149184    0   149023    32    20    12    20     0     8    0
bufpl      280    21013    0    14607   458     0   458   458     0     8    0
anonpl      24  4316080    0  4310301    51    12    39    39     0   188    0
amapchunkpl 152  482133    0   481805    20     6    14    15     0   158    0
amappl16   200    33102    0    32950     9     0     9     9     0     8    0
amappl14   184     8600    0     8599     1     0     1     1     0     8    0
amappl13   176      135    0      134     1     0     1     1     0     8    0
amappl12   168        2    0        0     1     0     1     1     0     8    0
amappl11   160       37    0       27     1     0     1     1     0     8    0
amappl10   152     8704    0     8695     1     0     1     1     0     8    0
amappl9    144       12    0       10     1     0     1     1     0     8    0
amappl8    136      447    0      395     2     0     2     2     0     8    0
amappl7    128       72    0       59     1     0     1     1     0     8    0
amappl6    120      123    0      109     1     0     1     1     0     8    0
amappl5    112    27013    0    26998     1     0     1     1     0     8    0
amappl4    104      592    0      568     1     0     1     1     0     8    0
amappl3     96     1011    0     1008     1     0     1     1     0     8    0
amappl2     88     1370    0     1314     2     0     2     2     0     8    0
amappl1     80   291739    0   291325    12     3     9    12     0     8    0
amappl      88   203844    0   203735     3     0     3     3     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64      130    0        0     3     0     3     3     0     8    0
uaddrrnd    24    17629    0    17613     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    17629    0    17613     1     0     1     1     0     8    0
vmmpekpl   168    78815    0    78786     2     0     2     2     0     8    0
vmmpepl    168  1926851    0  1925486    80    13    67    67     0   357    3
vmsppl     272    17628    0    17613     3     1     2     2     0     8    0
rwobjpl     24   317697    0   316862    14     8     6     6     0     8    0
pdppl      4096   35265    0    35226    63    22    41    45     0     8    2
pvpl        32  6953494    0  6944301   194   116    78   132     0   265    0
pmappl     192    17628    0    17613     1     0     1     1     0     8    0
extentpl    40       58    0       40     1     0     1     1     0     8    0
phpool     112      388    0      133     8     0     8     8     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
hardclock(ffff8000237a6930) at hardclock+0x102 sys/kern/kern_clock.c:156
lapic_clockintr(0,0) at lapic_clockintr+0x36 sys/arch/amd64/amd64/lapic.c:454
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x26
_rb_find(ffffffff826fce60,fffffd806fe9d210,ffff8000237a6a48) at _rb_find+0xa2 sys/kern/subr_tree.c:448
uvm_pagelookup(fffffd806fe9d208,16b7000) at uvm_pagelookup+0x44 sys/uvm/uvm_page.c:1199
buf_map(fffffd806fe9d148) at buf_map+0x206 sys/kern/vfs_biomem.c:124
buf_get(0,0,8000009) at buf_get+0x76f sys/kern/vfs_bio.c:1182
geteblk(8000009) at geteblk+0x2c sys/kern/vfs_bio.c:1064
readdisklabel(2902,ffffffff81994ab0,ffff800000b28c00,0) at readdisklabel+0x145 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,10001,2000,ffff80002163d510) at vndopen+0x17a sys/dev/vnd.c:202
spec_open(ffff8000237a6e98) at spec_open+0x3c8 sys/kern/spec_vnops.c:157
VOP_OPEN(fffffd80713ed148,10001,fffffd807f7d7420,ffff80002163d510) at VOP_OPEN+0x73 sys/kern/vfs_vops.c:153
vn_open(ffff8000237a70e8,10001,0) at vn_open+0x467 sys/kern/vfs_vnops.c:183
doopenat(ffff80002163d510,ffffff9c,20000040,10000,0,ffff8000237a72d0) at doopenat+0x26d sys/kern/vfs_syscalls.c:1133
syscall(ffff8000237a7340) at syscall+0x571 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xee11d6f94f0, count: -16
ddb> machine ddbcpu 1
No such command
ddb> trace
hardclock(ffff8000237a6930) at hardclock+0x102 sys/kern/kern_clock.c:156
lapic_clockintr(0,0) at lapic_clockintr+0x36 sys/arch/amd64/amd64/lapic.c:454
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x26
_rb_find(ffffffff826fce60,fffffd806fe9d210,ffff8000237a6a48) at _rb_find+0xa2 sys/kern/subr_tree.c:448
uvm_pagelookup(fffffd806fe9d208,16b7000) at uvm_pagelookup+0x44 sys/uvm/uvm_page.c:1199
buf_map(fffffd806fe9d148) at buf_map+0x206 sys/kern/vfs_biomem.c:124
buf_get(0,0,8000009) at buf_get+0x76f sys/kern/vfs_bio.c:1182
geteblk(8000009) at geteblk+0x2c sys/kern/vfs_bio.c:1064
readdisklabel(2902,ffffffff81994ab0,ffff800000b28c00,0) at readdisklabel+0x145 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,10001,2000,ffff80002163d510) at vndopen+0x17a sys/dev/vnd.c:202
spec_open(ffff8000237a6e98) at spec_open+0x3c8 sys/kern/spec_vnops.c:157
VOP_OPEN(fffffd80713ed148,10001,fffffd807f7d7420,ffff80002163d510) at VOP_OPEN+0x73 sys/kern/vfs_vops.c:153
vn_open(ffff8000237a70e8,10001,0) at vn_open+0x467 sys/kern/vfs_vnops.c:183
doopenat(ffff80002163d510,ffffff9c,20000040,10000,0,ffff8000237a72d0) at doopenat+0x26d sys/kern/vfs_syscalls.c:1133
syscall(ffff8000237a7340) at syscall+0x571 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xee11d6f94f0, count: -16

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/09/08 21:44 openbsd 413a7a136984 e2776ee4 .config console log report ci-openbsd-main uvm_fault: hardclock
* Struck through repros no longer work on HEAD.