syzbot


uvm_fault: in6_purgeaddr

Status: auto-closed as invalid on 2020/01/06 23:18
Reported-by: syzbot+11d4213f257f1dfb54f6@syzkaller.appspotmail.com
First crash: 1881d, last: 1841d

Sample crash report:
uvm_fault(0xfffffd803f014440, 0x867c31ce248, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      in6_purgeaddr+0x135:    movq    0x8(%r12),%r13
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xfffffd803f014440, 0x867c31ce248, 0, 1) -> e
in6_purgeaddr(ffff800000aae300) at in6_purgeaddr+0x135 sys/netinet6/in6.c:914
end trace frame: 0xffff800017780e10, count: 0
ddb> trace
in6_purgeaddr(ffff800000aae300) at in6_purgeaddr+0x135 sys/netinet6/in6.c:914
in6_ifdetach(ffff800000ab3800) at in6_ifdetach+0x74 sys/netinet6/in6_ifattach.c:422
if_setrdomain(ffff800000ab3800,18) at if_setrdomain+0x1a2 sys/net/if.c:1893
ifioctl(fffffd80363dcc08,8020699f,ffff800017780f60,ffff8000ffff2290) at ifioctl+0x12db sys/net/if.c:2151
sys_ioctl(ffff8000ffff2290,ffff800017781078,ffff8000177810c0) at sys_ioctl+0x5b9
syscall(ffff800017781140) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,ffffffffffffff36,0,3,f037d62a010) at Xsyscall+0x128
end of kernel
end trace frame: 0xf05cfa58ad0, count: -7
ddb> show registers
rdi               0xffffffff820e5371    rtfree+0x51
rsi                          0x332c7    acpi_pdirpa+0x1f12f
rbp               0xffff800017780da0
rbx                                0
rdx                          0x332c8    acpi_pdirpa+0x1f130
rcx               0xffff80001573f000
rax                              0x3
r8                               0x1
r9                               0x1
r10               0xaf2ba9790230322b
r11               0xdb2f24ca7de75aef
r12                    0x867c31ce240
r13                                0
r14               0xffff800000aae300
r15               0xffff800000ab3800
rip               0xffffffff8118f7c5    in6_purgeaddr+0x135
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff800017780d30
ss                              0x10
in6_purgeaddr+0x135:    movq    0x8(%r12),%r13
ddb> show proc
PROC (syz-executor.0) pid=322015 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=81, usrpri=81, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff2508,0xffffffff8258bb98
    process=0xffff8000ffff70f0 user=0xffff80001777c000, vmspace=0xfffffd803f014440
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 77494  163157   8720      0  2           0                syz-executor.0
*77494  322015   8720      0  7   0x4000000                syz-executor.0
 41661  430189  48924      0  2           0                syz-executor.1
 41661  168618  48924      0  3   0x4000080  select        syz-executor.1
  8720  160644  69962      0  3        0x82  nanosleep     syz-executor.0
 48924  338010  69962      0  3        0x82  nanosleep     syz-executor.1
 36836   93998      0      0  3     0x14200  bored         sosplice
 69962     308  51762      0  3        0x82  thrsleep      syz-fuzzer
 69962    5467  51762      0  3   0x4000082  thrsleep      syz-fuzzer
 69962  176231  51762      0  3   0x4000082  thrsleep      syz-fuzzer
 69962  121455  51762      0  3   0x4000082  thrsleep      syz-fuzzer
 69962   68756  51762      0  3   0x4000082  thrsleep      syz-fuzzer
 69962  362185  51762      0  3   0x4000082  kqread        syz-fuzzer
 69962  115685  51762      0  3   0x4000082  thrsleep      syz-fuzzer
 69962  194796  51762      0  3   0x4000082  thrsleep      syz-fuzzer
 51762  446070  86920      0  3    0x10008a  pause         ksh
 86920  242228  35356      0  3        0x92  select        sshd
 50526  259507      1      0  3    0x100083  ttyin         getty
 35356   83995      1      0  3        0x80  select        sshd
 55388  437250  22556     73  3    0x100090  kqread        syslogd
 22556  162402      1      0  3    0x100082  netio         syslogd
 11041  229909      1     77  2    0x100090                dhclient
 40691  265097      1      0  3        0x80  poll          dhclient
 99567  367152      0      0  2     0x14200                zerothread
 99686   14818      0      0  3     0x14200  aiodoned      aiodoned
 17186   46431      0      0  3     0x14200  syncer        update
 30149  390174      0      0  3     0x14200  cleaner       cleaner
  7385  165469      0      0  3     0x14200  reaper        reaper
 11751  144817      0      0  3     0x14200  pgdaemon      pagedaemon
 73240  455426      0      0  3     0x14200  bored         crynlk
 95721  300547      0      0  3     0x14200  bored         crypto
   762  380165      0      0  3  0x40014200  acpi0         acpi0
 70482  470357      0      0  3     0x14200  bored         softnet
 91321  186113      0      0  2     0x14200                systqmp
 72197  210164      0      0  3     0x14200  bored         systq
 48365  490007      0      0  3  0x40014200  bored         softclock
 13897  312400      0      0  3  0x40014200                idle0
 40298  476797      0      0  3     0x14200  bored         smr
     1  520118      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9554   6361K    7588K  78643K     14620        0        0
            pcb    14      8K       8K  78643K       171        0        0
         rtable    90      4K       5K  78643K       657        0        0
         ifaddr    76     15K      16K  78643K       184        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K        64        0        0
            iov     0      0K      16K  78643K       198        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1235     78K      78K  78643K      2378        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     3      5K       5K  78643K        14        0        0
         VM map    14      3K       3K  78643K        14        0        0
            sem    12      1K       1K  78643K       166        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12645        0        0
      file desc     6     17K      25K  78643K       727        0        0
          sigio     0      0K       0K  78643K        20        0        0
           proc    48     38K      54K  78643K       557        0        0
        subproc    32      2K       2K  78643K        85        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K        50        0        0
       in_multi    19      1K       2K  78643K        99        0        0
    ether_multi     1      0K       0K  78643K         6        0        0
            mrt     1      0K       0K  78643K         5        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    54    238K     238K  78643K        54        0        0
           exec     0      0K       1K  78643K       292        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   126    119K     125K  78643K      2727        0        0
       UVM aobj    49      4K       4K  78643K        49        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       156        0        0
            NDP    19      0K       0K  78643K        56        0        0
           temp   182   3544K    4179K  78643K     28990        0        0
         kqueue     0      0K       0K  78643K         5        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       24    0       20     1     0     1     1     0     8    0
rtpcb       80      116    0      114     1     0     1     1     0     8    0
rtentry    112      123    0       91     2     0     2     2     0     8    0
unpcb      120      418    0      410     1     0     1     1     0     8    0
syncache   264        6    0        6     3     3     0     1     0     8    0
tcpqe       32       55    0       55     3     3     0     1     0     8    0
tcpcb      544      304    0      300     2     1     1     2     0     8    0
ipq         40        6    0        6     2     2     0     1     0     8    0
ipqe        40       98    0       98     2     2     0     1     0     8    0
inpcb      280      849    0      840     6     4     2     3     0     8    1
rttmr       72        2    0        1     2     1     1     1     0     8    0
nd6         48       15    0       13     1     0     1     1     0     8    0
swfcl       56        2    0        0     1     0     1     1     0     8    0
ppxss      1128      15    0       15     4     3     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      541    0      287    23     6    17    17     0     8    0
art_table   32      542    0      287     3     0     3     3     0     8    0
art_node    16      122    0       87     1     0     1     1     0     8    0
sysvmsgpl   40       30    0       14     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      162    0      152     1     0     1     1     0     8    0
shmpl      112       47    0        0     2     0     2     2     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     2534    0     1134    46     0    46    46     0     8    0
ffsino     240     2534    0     1134    83     0    83    83     0     8    0
nchpl      144     4074    0     3640    60    40    20    60     0     8    0
uvmvnodes   72     3547    0        0    65     0    65    65     0     8    0
vnodes     208     3547    0        0   187     0   187   187     0     8    0
namei      1024   12725    0    12725     2     1     1     1     0     8    1
vcpupl     1984      12    0        0     2     0     2     2     0     8    0
vmpool     520       12    0        0     1     0     1     1     0     8    0
scxspl     192    11781    0    11781    10     8     2     7     0     8    2
plimitpl   152       69    0       62     1     0     1     1     0     8    0
sigapl     432      888    0      874     2     0     2     2     0     8    0
futexpl     56    22848    0    22848     2     1     1     1     0     8    1
knotepl    112      227    0      208     3     2     1     3     0     8    0
kqueuepl   104      242    0      240     1     0     1     1     0     8    0
pipepl     112      652    0      633     3     1     2     2     0     8    1
fdescpl    424      889    0      874     2     0     2     2     0     8    0
filepl     120     7667    0     7569     8     3     5     6     0     8    2
lockfpl    104      259    0      258     1     0     1     1     0     8    0
lockfspl    48       90    0       89     1     0     1     1     0     8    0
sessionpl  112       20    0       10     1     0     1     1     0     8    0
pgrppl      48       28    0       18     1     0     1     1     0     8    0
ucredpl     96      833    0      826     1     0     1     1     0     8    0
zombiepl   144      874    0      874     1     0     1     1     0     8    1
processpl  864      904    0      874     4     0     4     4     0     8    0
procpl     632     1838    0     1799     4     0     4     4     0     8    0
sosppl     128       18    0       18     6     5     1     1     0     8    1
sockpl     384     1424    0     1405     9     6     3     5     0     8    1
mcl64k     65536    310    0      310    30    29     1    29     0     8    1
mcl16k     16384      8    0        8     5     4     1     1     0     8    1
mcl12k     12288     18    0       18     3     2     1     1     0     8    1
mcl9k      9216      14    0       14     2     1     1     1     0     8    1
mcl8k      8192      40    0       40     3     2     1     1     0     8    1
mcl4k      4096      99    0       99     3     2     1     1     0     8    1
mcl2k2     2112      10    0       10     3     2     1     1     0     8    1
mcl2k      2048   64932    0    64886    14     7     7    12     0     8    0
mtagpl      80       51    0       42     2     1     1     1     0     8    0
mbufpl     256   109617    0   109502    33    23    10    21     0     8    0
bufpl      256     9378    0     3326   380     1   379   379     0     8    0
anonpl      16   135774    0   114930   119    18   101   101     0    62   16
amapchunkpl 152    5326    0     5158    40     8    32    32     0   158   25
amappl16   192     5793    0     4631   101    35    66    69     0     8    7
amappl15   184       63    0       63     1     1     0     1     0     8    0
amappl14   176       64    0       59     1     0     1     1     0     8    0
amappl13   168        4    0        2     1     0     1     1     0     8    0
amappl12   160        8    0        8     2     2     0     1     0     8    0
amappl11   152      503    0      487     1     0     1     1     0     8    0
amappl10   144      176    0      174     1     0     1     1     0     8    0
amappl9    136      598    0      595     1     0     1     1     0     8    0
amappl8    128      193    0      160     3     1     2     2     0     8    0
amappl7    120      222    0      217     1     0     1     1     0     8    0
amappl6    112      485    0      472     1     0     1     1     0     8    0
amappl5    104      170    0      159     1     0     1     1     0     8    0
amappl4     96     1118    0     1086     1     0     1     1     0     8    0
amappl3     88      136    0      131     1     0     1     1     0     8    0
amappl2     80     6241    0     6165     3     1     2     3     0     8    0
amappl1     72    25672    0    25251    26    17     9    20     0     8    0
amappl      80     2148    0     2093     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64       48    0        0     1     0     1     1     0     8    0
uaddrrnd    24      901    0      874     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      901    0      874     1     0     1     1     0     8    0
vmmpekpl   168     9949    0     9917     2     0     2     2     0     8    0
vmmpepl    168   115558    0   113185   168    54   114   142     0   357   10
vmsppl     272      888    0      874     2     1     1     2     0     8    0
pdppl      4096    1808    0     1760     8     1     7     7     0     8    0
pvpl        32   351223    0   327430   313    33   280   280     0   265   87
pmappl     200      900    0      874     2     0     2     2     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      594    0       80    15     0    15    15     0     8    0

Crashes (1423):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/07 23:07 openbsd b50d7ae0ca56 efb49b4d .config console log report ci-openbsd-main
2019/11/07 20:22 openbsd b50d7ae0ca56 efb49b4d .config console log report ci-openbsd-main
2019/11/07 19:56 openbsd b50d7ae0ca56 efb49b4d .config console log report ci-openbsd-main
2019/11/07 18:41 openbsd b50d7ae0ca56 efb49b4d .config console log report ci-openbsd-multicore
2019/11/07 17:40 openbsd b50d7ae0ca56 efb49b4d .config console log report ci-openbsd-multicore
2019/11/07 16:13 openbsd b50d7ae0ca56 efb49b4d .config console log report ci-openbsd-main
2019/11/07 14:49 openbsd b50d7ae0ca56 efb49b4d .config console log report ci-openbsd-multicore
2019/11/07 12:46 openbsd b50d7ae0ca56 efb49b4d .config console log report ci-openbsd-multicore
2019/11/07 11:21 openbsd 36a555e043b4 d797d201 .config console log report ci-openbsd-main
2019/11/07 10:23 openbsd 36a555e043b4 d797d201 .config console log report ci-openbsd-multicore
2019/11/07 08:22 openbsd 36a555e043b4 d797d201 .config console log report ci-openbsd-multicore
2019/11/07 06:39 openbsd 36a555e043b4 d797d201 .config console log report ci-openbsd-multicore
2019/11/07 05:34 openbsd 36a555e043b4 d797d201 .config console log report ci-openbsd-main
2019/11/07 04:16 openbsd 36a555e043b4 d797d201 .config console log report ci-openbsd-main
2019/11/07 01:34 openbsd 36a555e043b4 d797d201 .config console log report ci-openbsd-multicore
2019/11/06 23:50 openbsd 71d558da6271 da505f84 .config console log report ci-openbsd-main
2019/11/06 20:24 openbsd 71d558da6271 da505f84 .config console log report ci-openbsd-multicore
2019/11/06 19:03 openbsd 71d558da6271 da505f84 .config console log report ci-openbsd-main
2019/11/06 16:35 openbsd 71d558da6271 da505f84 .config console log report ci-openbsd-multicore
2019/11/06 15:23 openbsd 71d558da6271 da505f84 .config console log report ci-openbsd-multicore
2019/11/06 13:49 openbsd 71d558da6271 da505f84 .config console log report ci-openbsd-main
2019/11/06 12:46 openbsd 71d558da6271 da505f84 .config console log report ci-openbsd-multicore
2019/11/06 10:34 openbsd 38dc29e6b4c8 bc2c6e45 .config console log report ci-openbsd-multicore
2019/11/06 09:09 openbsd 38dc29e6b4c8 bc2c6e45 .config console log report ci-openbsd-multicore
2019/11/06 07:44 openbsd 38dc29e6b4c8 bc2c6e45 .config console log report ci-openbsd-multicore
2019/11/06 06:27 openbsd 38dc29e6b4c8 bc2c6e45 .config console log report ci-openbsd-multicore
2019/11/06 05:09 openbsd 38dc29e6b4c8 bc2c6e45 .config console log report ci-openbsd-main
2019/11/06 02:56 openbsd 38dc29e6b4c8 bc2c6e45 .config console log report ci-openbsd-main
2019/11/05 23:53 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-multicore
2019/11/05 23:32 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-multicore
2019/11/05 22:21 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-main
2019/11/05 18:52 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-multicore
2019/11/05 17:49 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-main
2019/11/05 16:24 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-multicore
2019/11/05 15:10 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-main
2019/11/05 14:44 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-multicore
2019/11/05 13:43 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-main
2019/11/05 12:28 openbsd 1f857ec20594 0f3ec414 .config console log report ci-openbsd-multicore
2019/11/05 11:09 openbsd 67035d4b95d6 76630fc9 .config console log report ci-openbsd-multicore
2019/11/05 09:36 openbsd 67035d4b95d6 76630fc9 .config console log report ci-openbsd-multicore
2019/11/05 07:49 openbsd 67035d4b95d6 76630fc9 .config console log report ci-openbsd-multicore
2019/11/05 05:52 openbsd 67035d4b95d6 76630fc9 .config console log report ci-openbsd-main
2019/11/05 05:31 openbsd 67035d4b95d6 76630fc9 .config console log report ci-openbsd-multicore
2019/09/28 06:12 openbsd 81b7b661bdbb d8074e0b .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.