syzbot


uvm_fault: pmap_page_remove

Status: auto-closed as invalid on 2019/12/19 05:38
Reported-by: syzbot+afdd01b0a652da2a5dee@syzkaller.appspotmail.com
First crash: 1930d, last: 1673d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: pmap_page_remove (4) 1 730d 730d 0/3 auto-closed as invalid on 2022/07/20 03:20
openbsd uvm_fault: pmap_page_remove (5) 3 2d23h 132d 0/3 upstream: reported on 2023/12/09 17:23
openbsd uvm_fault: pmap_page_remove (3) 1 798d 798d 0/3 closed as invalid on 2022/02/15 06:33
openbsd uvm_fault: pmap_page_remove (2) 5 1350d 1527d 0/3 auto-closed as invalid on 2020/11/06 07:50

Sample crash report:
uvm_fault(0xffffffff82557cf8, 0x7fbfbfffffa8, 0, 2) -> e
kernel: page fault trap, code=0
Stopped at      pmap_page_remove+0x33d: xchgq   %rax,0(%r12,%rcx,1)
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff82557cf8, 0x7fbfbfffffa8, 0, 2) -> e
pmap_page_remove(fffffd8003d23a80) at pmap_page_remove+0x33d _atomic_swap_64 machine/atomic.h:117 [inline]
pmap_page_remove(fffffd8003d23a80) at pmap_page_remove+0x33d sys/arch/amd64/amd64/pmap.c:1878
end trace frame: 0xffff800014842b70, count: 0
ddb> trace
pmap_page_remove(fffffd8003d23a80) at pmap_page_remove+0x33d _atomic_swap_64 machine/atomic.h:117 [inline]
pmap_page_remove(fffffd8003d23a80) at pmap_page_remove+0x33d sys/arch/amd64/amd64/pmap.c:1878
uvm_anfree(fffffd802f1f4f40) at uvm_anfree+0x4d sys/uvm/uvm_anon.c:104
amap_wipeout(fffffd803dcd4f18) at amap_wipeout+0x16d sys/uvm/uvm_amap.c:457
uvm_unmap_detach(ffff800014842c40,1) at uvm_unmap_detach+0x163 sys/uvm/uvm_map.c:1570
uvm_map_teardown(fffffd803f013ee0) at uvm_map_teardown+0x22c sys/uvm/uvm_map.c:2735
uvmspace_free(fffffd803f013ee0) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3588
uvm_exit(ffff8000148a3458) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297
reaper(ffff8000fffff8b0) at reaper+0x15c sys/kern/kern_exit.c:442
end trace frame: 0x0, count: -8
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff800014842b30
rbx                                0
rdx               0xfffffd8003df5280
rcx                   0x7f8000000000
rax                                0
r8                    0x1ac3c206e000
r9                               0x7
r10               0x98f35c91d9dad9a9
r11               0x9be75d667aeba57e
r12                     0x3fbfffffa8
r13               0xfffffd8038437548
r14               0x800000003f7be000
r15               0xfffffd8003d23c00
rip               0xffffffff810985dd    pmap_page_remove+0x33d
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800014842aa0
ss                              0x10
pmap_page_remove+0x33d: xchgq   %rax,0(%r12,%rcx,1)
ddb> show proc
PROC (reaper) pid=325059 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    pri=86, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffffe9e0,0xffff8000ffff93d8
    process=0xffff8000ffffad88 user=0xffff80001483d000, vmspace=0xffffffff82557cf8
    estcpu=36, cpticks=70, pctcpu=19.45
    user=0, sys=3, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 14307  450339  81727      0  3    0x10008a  pause         sh
 81727    9936  38382      0  3        0x82  wait          syz-executor.0
 87953  258145      0      0  3     0x14200  acct          acct
 98946  467773      0      0  3     0x14200  bored         sosplice
 38382  139421  98515      0  3        0x82  thrsleep      syz-fuzzer
 38382   75898  98515      0  2   0x4000482                syz-fuzzer
 38382  278843  98515      0  3   0x4000082  thrsleep      syz-fuzzer
 38382  119819  98515      0  3   0x4000082  thrsleep      syz-fuzzer
 38382  354330  98515      0  3   0x4000082  wait          syz-fuzzer
 38382  476714  98515      0  3   0x4000082  thrsleep      syz-fuzzer
 38382  451037  98515      0  3   0x4000082  thrsleep      syz-fuzzer
 38382  320907  98515      0  3   0x4000082  thrsleep      syz-fuzzer
 98515  128992  93046      0  3    0x10008a  pause         ksh
 93046   59002  20105      0  3        0x92  select        sshd
 80817  114612      1      0  3    0x100083  ttyin         getty
 20105  326031      1      0  3        0x80  select        sshd
 56756    6207  79998     73  2    0x100010                syslogd
 79998  291483      1      0  3    0x100082  netio         syslogd
 56911  193150      1     77  3    0x100090  poll          dhclient
 88684  401863      1      0  3        0x80  poll          dhclient
 61049    9561      0      0  2     0x14200                zerothread
 40208  500909      0      0  3     0x14200  aiodoned      aiodoned
 44785    4087      0      0  3     0x14200  syncer        update
 15529   37484      0      0  3     0x14200  cleaner       cleaner
*48062  325059      0      0  7     0x14200                reaper
 38129   34823      0      0  3     0x14200  pgdaemon      pagedaemon
 14016   48997      0      0  3     0x14200  bored         crynlk
 62031  512983      0      0  3     0x14200  bored         crypto
 34111  194480      0      0  3  0x40014200  acpi0         acpi0
 85819  522162      0      0  3     0x14200  bored         softnet
 88232  191017      0      0  3     0x14200  bored         systqmp
 15983  215182      0      0  3     0x14200  bored         systq
 42470   33258      0      0  3  0x40014200  bored         softclock
 56306  315996      0      0  3  0x40014200                idle0
 99794    2461      0      0  3     0x14200  bored         smr
     1   38425      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9525   6357K    6999K  78643K     16546        0        0
            pcb    13     10K      12K  78643K       389        0        0
         rtable    77     11K      12K  78643K      1005        0        0
         ifaddr    53     13K      16K  78643K       338        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K       142        0        0
            iov     0      0K      24K  78643K       275        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1211     76K      77K  78643K      3446        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        24        0        0
         VM map     2      0K       0K  78643K         6        0        0
            sem    12      0K       1K  78643K       370        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12645        0        0
      file desc     4      9K      25K  78643K      2597        0        0
          sigio     0      0K       0K  78643K        19        0        0
           proc    50     38K      63K  78643K       929        0        0
        subproc    17      1K       2K  78643K       191        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       221        0        0
       in_multi    12      0K       2K  78643K       180        0        0
    ether_multi     1      0K       0K  78643K        13        0        0
            mrt     0      0K       0K  78643K         6        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys   114    503K     503K  78643K       114        0        0
           exec     0      0K       1K  78643K       480        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   106     22K      30K  78643K      8018        0        0
       UVM aobj   106      6K       6K  78643K       113        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       364        0        0
            NDP    12      0K       0K  78643K       101        0        0
           temp   169   3535K    3634K  78643K     62162        0        0
         kqueue     0      0K       0K  78643K        45        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       24    0       21     1     0     1     1     0     8    0
rtpcb       80      167    0      165     1     0     1     1     0     8    0
rtentry    112      136    0      111     2     0     2     2     0     8    0
unpcb      120     1107    0     1098     1     0     1     1     0     8    0
syncache   264       13    0       13     6     6     0     1     0     8    0
tcpqe       32     3969    0     3969     3     3     0     1     0     8    0
tcpcb      544      690    0      686     1     0     1     1     0     8    0
ipq         40        4    0        4     2     2     0     1     0     8    0
ipqe        40       12    0       12     2     2     0     1     0     8    0
inpcb      280     2152    0     2145    22    21     1    13     0     8    0
rttmr       72        1    0        1     1     1     0     1     0     8    0
nd6         48       20    0       20     1     0     1     1     0     8    1
pkpcb       40       18    0       18     6     6     0     1     0     8    0
swfcl       56        2    0        0     1     0     1     1     0     8    0
ppxss      1128      49    0       49    18    18     0     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      590    0      462    14     0    14    14     0     8    3
art_table   32      591    0      462     2     0     2     2     0     8    0
art_node    16      133    0      110     1     0     1     1     0     8    0
sysvmsgpl   40       30    0       25     2     1     1     1     0     8    0
semupl     112        2    0        2     1     1     0     1     0     8    0
semapl     112      366    0      356     1     0     1     1     0     8    0
shmpl      112      111    0        7     3     0     3     3     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     5331    0     3948    46     0    46    46     0     8    0
ffsino     240     5331    0     3948    83     0    83    83     0     8    0
nchpl      144     9914    0     8299    64     3    61    61     0     8    0
uvmvnodes   72     6938    0        0   127     0   127   127     0     8    0
vnodes     208     6938    0        0   366     0   366   366     0     8    0
namei      1024   33882    0    33882     5     5     0     1     0     8    0
vmpool     520        4    0        4     2     2     0     1     0     8    0
scsiplug    64        4    0        4     2     2     0     1     0     8    0
scxspl     192    34690    0    34690    13    12     1     7     0     8    1
plimitpl   152      205    0      197     1     0     1     1     0     8    0
sigapl     432     2741    0     2728     2     0     2     2     0     8    0
futexpl     56    62051    0    62051     4     4     0     1     0     8    0
knotepl    112     3438    0     3419    14    13     1     2     0     8    0
kqueuepl   104     5181    0     5179     1     0     1     1     0     8    0
pipepl     112     1488    0     1473     8     7     1     2     0     8    0
fdescpl    424     2742    0     2729     2     0     2     2     0     8    0
filepl     120    26596    0    26522    30    27     3    11     0     8    0
lockfpl    104      844    0      843     1     0     1     1     0     8    0
lockfspl    48      277    0      276     1     0     1     1     0     8    0
sessionpl  112       26    0       16     1     0     1     1     0     8    0
pgrppl      48       44    0       34     1     0     1     1     0     8    0
ucredpl     96     2929    0     2921     1     0     1     1     0     8    0
zombiepl   144     2729    0     2726     3     2     1     1     0     8    0
processpl  864     2758    0     2726     4     0     4     4     0     8    0
procpl     632     6953    0     6914    11     7     4     5     0     8    0
sosppl     128       60    0       60    12    12     0     1     0     8    0
sockpl     384     3478    0     3460    29    26     3    21     0     8    0
mcl64k     65536   1090    0     1090   138   138     0    33     0     8    0
mcl16k     16384     18    0       18    14    14     0     1     0     8    0
mcl12k     12288     43    0       43    15    15     0     1     0     8    0
mcl9k      9216      26    0       26    13    13     0     1     0     8    0
mcl8k      8192      73    0       73    16    16     0     1     0     8    0
mcl4k      4096     250    0      250     5     5     0     1     0     8    0
mcl2k2     2112      22    0       22     9     9     0     1     0     8    0
mcl2k      2048   61257    0    61211    18    10     8    13     0     8    0
mtagpl      80      112    0      112     2     1     1     1     0     8    1
mbufpl     256   114287    0   114229    75    66     9    25     0     8    1
bufpl      256    17038    0     9688   460     0   460   460     0     8    0
anonpl      16   307397    0   296130   180   100    80    80     0    62   13
amapchunkpl 152   14425    0    14319    54    48     6    16     0   158    0
amappl16   192    15295    0    14449   154    99    55    56     0     8   11
amappl15   184      975    0      973     2     1     1     1     0     8    0
amappl14   176      594    0      592     2     1     1     1     0     8    0
amappl13   168      790    0      790     3     3     0     1     0     8    0
amappl12   160      297    0      295     1     0     1     1     0     8    0
amappl11   152       70    0       59     1     0     1     1     0     8    0
amappl10   144       12    0        9     1     0     1     1     0     8    0
amappl9    136      881    0      874     1     0     1     1     0     8    0
amappl8    128      467    0      437     2     0     2     2     0     8    0
amappl7    120       78    0       71     1     0     1     1     0     8    0
amappl6    112       82    0       68     1     0     1     1     0     8    0
amappl5    104      521    0      510     1     0     1     1     0     8    0
amappl4     96     2686    0     2659     1     0     1     1     0     8    0
amappl3     88      694    0      689     1     0     1     1     0     8    0
amappl2     80    22015    0    21956     4     2     2     3     0     8    0
amappl1     72    61127    0    60700    27    18     9    20     0     8    0
amappl      80     7280    0     7244     4     2     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      112    0        7     2     0     2     2     0     8    0
uaddrrnd    24     2746    0     2728     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2746    0     2728     1     0     1     1     0     8    0
vmmpekpl   168    21859    0    21831     2     0     2     2     0     8    0
vmmpepl    168   334834    0   332998   346   225   121   131     0   357   30
vmsppl     272     2741    0     2727     4     3     1     2     0     8    0
pdppl      4096    5498    0     5462     6     1     5     6     0     8    0
pvpl        32   991036    0   976676   589   309   280   295     0   265  115
pmappl     200     2745    0     2731     1     0     1     1     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      845    0      260    20     2    18    19     0     8    0

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/20 05:37 openbsd f5f4051615a3 4d3ae0b7 .config console log report ci-openbsd-main
2019/04/07 23:46 openbsd 4253825dbbaa c34fde03 .config console log report ci-openbsd-main
2019/03/23 01:54 openbsd 9c1f1fecff88 028c0951 .config console log report ci-openbsd-main
2019/01/22 08:33 openbsd 8de5712f0412 fd37a550 .config console log report ci-openbsd-multicore
2019/01/14 06:52 openbsd a30f5dcbf70f 2f3438a8 .config console log report ci-openbsd-setuid
2019/01/08 07:10 openbsd e0aa32ff559e 37dd2683 .config console log report ci-openbsd-setuid
2019/01/06 10:44 openbsd 260aa4b1b9f1 94f8adb5 .config console log report ci-openbsd-setuid
* Struck through repros no longer work on HEAD.