syzbot


panic: ufs_rename: lost dir entry

Status: upstream: reported C repro on 2020/02/14 02:31
Reported-by: syzbot+f94777020f021fc5d7b3@syzkaller.appspotmail.com
First crash: 1081d, last: 1d08h

Sample crash report:
panic: ufs_rename: lost dir entry
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 96676  61019      0           0  0x4000000    0  syz-executor1813180494
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82738384) at panic+0x161 sys/kern/subr_prf.c:198
ufs_rename(ffff800021712878) at ufs_rename+0x1649 sys/ufs/ufs/ufs_vnops.c:909
VOP_RENAME(fffffd807efd0438,fffffd806c4d55f8,ffff800021712a48,fffffd806c4d50e8,fffffd806c4d5e68,ffff800021712998) at VOP_RENAME+0xf0 sys/kern/vfs_vops.c:370
dorenameat(ffff8000ffff0590,3,20000180,5,200001c0) at dorenameat+0x29c sys/kern/vfs_syscalls.c:3033
syscall(ffff800021712be0) at syscall+0x4e6 sys/arch/amd64/amd64/trap.c:626
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x50e3a524f00, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: ufs_rename: lost dir entry
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82738384) at panic+0x161 sys/kern/subr_prf.c:198
ufs_rename(ffff800021712878) at ufs_rename+0x1649 sys/ufs/ufs/ufs_vnops.c:909
VOP_RENAME(fffffd807efd0438,fffffd806c4d55f8,ffff800021712a48,fffffd806c4d50e8,fffffd806c4d5e68,ffff800021712998) at VOP_RENAME+0xf0 sys/kern/vfs_vops.c:370
dorenameat(ffff8000ffff0590,3,20000180,5,200001c0) at dorenameat+0x29c sys/kern/vfs_syscalls.c:3033
syscall(ffff800021712be0) at syscall+0x4e6 sys/arch/amd64/amd64/trap.c:626
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x50e3a524f00, count: -7
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800021712610
rbx               0xfffffd806c4d5880
rdx                            0x3fd
rcx                                0
rax                             0x22
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x4fc827db2164cdc7
r11               0x3c885a8e6457cbbe
r12                                0
r13               0xfffffd806c4d4008
r14                                0
r15                              0x1
rip               0xffffffff81817ba8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800021712600
ss                                 0
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor1813180494) pid=96676 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=32, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff0b00,0xffff8000ffff02e8
    process=0xffff8000fffeefc0 user=0xffff80002170d000, vmspace=0xfffffd806c903560
    estcpu=0, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 33743   26177  81376      0  2           0                syz-executor1813180494
 66850  235119  71948      0  2           0                syz-executor1813180494
 59845  328275  33721      0  2           0                syz-executor1813180494
 59845  173909  33721      0  3   0x4000080  fsleep        syz-executor1813180494
 56195   26879  14533      0  2           0                syz-executor1813180494
 79582  420329  96339      0  2           0                syz-executor1813180494
 79582  309641  96339      0  3   0x4000080  fsleep        syz-executor1813180494
 47477  209193  89927      0  2           0                syz-executor1813180494
 47477  457406  89927      0  2   0x4000000                syz-executor1813180494
 47477  522293  89927      0  2   0x4000000                syz-executor1813180494
 47477  282460  89927      0  2   0x4000000                syz-executor1813180494
   423  295976  74445      0  2           0                syz-executor1813180494
   423  447459  74445      0  3   0x4000080  fsleep        syz-executor1813180494
   423  358648  74445      0  2   0x4000000                syz-executor1813180494
   423  232027  74445      0  2   0x4000000                syz-executor1813180494
 61019   35464  68864      0  2           0                syz-executor1813180494
 61019  518023  68864      0  2   0x4000000                syz-executor1813180494
 61019  136225  68864      0  3   0x4000080  fsleep        syz-executor1813180494
*61019   96676  68864      0  7   0x4000000                syz-executor1813180494
 14533  314382  28426      0  3        0x80  nanoslp       syz-executor1813180494
 71948   83383  28426      0  3        0x80  nanoslp       syz-executor1813180494
 96339  466127  28426      0  3        0x80  nanoslp       syz-executor1813180494
 33721  446963  28426      0  3        0x80  nanoslp       syz-executor1813180494
 81376  452394  28426      0  3        0x80  nanoslp       syz-executor1813180494
 89927  183708  28426      0  3        0x80  nanoslp       syz-executor1813180494
 74445  425330  28426      0  3        0x80  nanoslp       syz-executor1813180494
 68864  382823  28426      0  3        0x80  nanoslp       syz-executor1813180494
 28426  145762  18903      0  3        0x82  nanoslp       syz-executor1813180494
 18903  404125  84857      0  3    0x10008a  sigsusp       ksh
 84857  309726  41481      0  2        0x12                sshd
  4516   33854      1      0  3    0x100083  ttyin         getty
 41481  243022      1      0  3        0x88  kqread        sshd
 73908  498552  22333     73  3   0x1100090  kqread        syslogd
 22333  270782      1      0  3    0x100082  netio         syslogd
 89869  392577      1      0  3    0x100080  kqread        resolvd
 26270   71882  53981     77  3    0x100092  kqread        dhcpleased
 90479   93697  53981     77  3    0x100092  kqread        dhcpleased
 53981  390113      1      0  3        0x80  kqread        dhcpleased
 73568  470899      0      0  3     0x14200  bored         smr
 47966  508000      0      0  2     0x14200                zerothread
 43868  242586      0      0  3     0x14200  aiodoned      aiodoned
 75877  312996      0      0  3     0x14200  syncer        update
  6619  228218      0      0  3     0x14200  cleaner       cleaner
 87011  355308      0      0  3     0x14200  reaper        reaper
 90412  228028      0      0  3     0x14200  pgdaemon      pagedaemon
 57709  143897      0      0  3     0x14200  bored         viomb
 19493   30063      0      0  3  0x40014200  acpi0         acpi0
 46901  358132      0      0  3     0x14200  bored         softnet
 14796  118981      0      0  3     0x14200  bored         softnet
 46857   66642      0      0  3     0x14200  bored         softnet
 17067  511649      0      0  3     0x14200  bored         softnet
  5898  294632      0      0  3     0x14200  bored         systqmp
 20384  269323      0      0  3     0x14200  bored         systq
  6725  513779      0      0  3  0x40014200  bored         softclock
 13224  102922      0      0  3  0x40014200                idle0
     1  170905      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10155   6383K    6414K  78643K     11245        0
            pcb    13      8K       8K  78643K        13        0
         rtable    58      1K       2K  78643K       109        0
         ifaddr    23     11K      11K  78643K        23        0
       counters    20     16K      16K  78643K        20        0
       ioctlops     0      0K       2K  78643K        19        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1167     73K      73K  78643K      1180        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc     1      0K       0K  78643K         1        0
           proc    55     58K      59K  78643K       239        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    25    122K     122K  78643K        25        0
           exec     0      0K       1K  78643K       241        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   135      6K       6K  78643K      1570        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     3      0K       0K  78643K         3        0
           temp    18   5753K    5817K  78643K      2688        0
         kqueue    11     16K      18K  78643K        24        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       20    0       17     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      144       33    0       20     1     0     1     1     0     8    0
syncache   296        5    0        5     2     1     1     1     0     8    1
tcpqe       32      127    0      127     1     1     0     1     0     8    0
tcpcb      776        8    0        5     1     0     1     1     0     8    0
arp         88        2    0        0     1     0     1     1     0     8    0
inpcb      336       25    0       19     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       97    0        0     7     0     7     7     0     8    0
art_table   32       98    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1451    0       54    88     0    88    88     0     8    0
ffsino     240     1451    0       54    83     0    83    83     0     8    0
nchpl      144     1679    0      123    59     0    59    59     0     8    0
uvmvnodes   80     1460    0        0    30     0    30    30     0     8    0
vnodes     216     1460    0        0    82     0    82    82     0     8    0
namei      1024    4720    0     4716     4     1     3     3     0     8    1
kstatmem   264        6    0        0     1     0     1     1     0     8    0
scxspl     216     5025    0     5025    10     9     1     8     0     8    1
plimitpl   152       16    0       10     1     0     1     1     0     8    0
sigapl     424      329    0      284     6     0     6     6     0     8    0
futexpl     64       75    0       71     1     0     1     1     0     8    0
knotepl    120     4474    0     4444     3     1     2     2     0     8    1
kqueuepl   184       20    0       13     1     0     1     1     0     8    0
pipepl     288       83    0       80     2     1     1     1     0     8    0
fdescpl    432      313    0      284     4     0     4     4     0     8    0
filepl     120     1162    0     1099     3     0     3     3     0     8    1
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl    104       66    0       56     1     0     1     1     0     8    0
zombiepl   144      284    0      284     2     1     1     1     0     8    1
processpl  1008     329    0      284     7     1     6     6     0     8    0
procpl     696      361    0      305     7     1     6     6     0     8    0
sockpl     456       78    0       56     4     1     3     4     0     8    0
mcl8k      8192       9    0        9     2     1     1     1     0     8    1
mcl4k      4096       5    0        5     2     1     1     1     0     8    1
mcl2k      2048   11142    0    11088    34    22    12    31     0     8    4
mtagpl      96        4    0        4     1     1     0     1     0     8    0
mbufpl     256    18505    0    18408    19     9    10    19     0     8    2
bufpl      288     2425    0       88   167     0   167   167     0     8    0
anonpl      24    99941    0    96846    33    13    20    24     0   188    1
amapchunkpl 152    4587    0     4376    10     1     9     9     0   158    0
amappl16   200     1925    0     1905     7     5     2     5     0     8    0
amappl15   192        6    0        6     1     1     0     1     0     8    0
amappl14   184       91    0       82     1     0     1     1     0     8    0
amappl13   176        5    0        5     1     1     0     1     0     8    0
amappl12   168      299    0      298     2     1     1     1     0     8    0
amappl11   160       48    0       38     1     0     1     1     0     8    0
amappl10   152       13    0       13     1     1     0     1     0     8    0
amappl9    144      958    0      958     2     1     1     1     0     8    1
amappl8    136       19    0       18     2     1     1     1     0     8    0
amappl7    128      107    0       80     1     0     1     1     0     8    0
amappl6    120       80    0       73     1     0     1     1     0     8    0
amappl5    112       69    0       63     1     0     1     1     0     8    0
amappl4    104      355    0      334     1     0     1     1     0     8    0
amappl3     96      470    0      416     2     0     2     2     0     8    0
amappl2     88      489    0      441     2     0     2     2     0     8    0
amappl1     80     9478    0     8825    16     2    14    14     0     8    0
amappl      88     1269    0     1184     2     0     2     2     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      313    0      284     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      313    0      284     1     0     1     1     0     8    0
vmmpekpl   168     6910    0     6896     1     0     1     1     0     8    0
vmmpepl    168    31029    0    29274    84     7    77    77     0   357    0
vmsppl     272      312    0      284     3     1     2     2     0     8    0
rwobjpl     24    12817    0    10544    15     1    14    14     0     8    0
pdppl      4096     632    0      568    86    22    64    64     0     8    0
pvpl        32   188487    0   182251    70    19    51    52     0   265    0
pmappl     216      312    0      284     2     0     2     2     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      505    0       60    13     0    13    13     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82738384) at panic+0x161 sys/kern/subr_prf.c:198
ufs_rename(ffff800021712878) at ufs_rename+0x1649 sys/ufs/ufs/ufs_vnops.c:909
VOP_RENAME(fffffd807efd0438,fffffd806c4d55f8,ffff800021712a48,fffffd806c4d50e8,fffffd806c4d5e68,ffff800021712998) at VOP_RENAME+0xf0 sys/kern/vfs_vops.c:370
dorenameat(ffff8000ffff0590,3,20000180,5,200001c0) at dorenameat+0x29c sys/kern/vfs_syscalls.c:3033
syscall(ffff800021712be0) at syscall+0x4e6 sys/arch/amd64/amd64/trap.c:626
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x50e3a524f00, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82738384) at panic+0x161 sys/kern/subr_prf.c:198
ufs_rename(ffff800021712878) at ufs_rename+0x1649 sys/ufs/ufs/ufs_vnops.c:909
VOP_RENAME(fffffd807efd0438,fffffd806c4d55f8,ffff800021712a48,fffffd806c4d50e8,fffffd806c4d5e68,ffff800021712998) at VOP_RENAME+0xf0 sys/kern/vfs_vops.c:370
dorenameat(ffff8000ffff0590,3,20000180,5,200001c0) at dorenameat+0x29c sys/kern/vfs_syscalls.c:3033
syscall(ffff800021712be0) at syscall+0x4e6 sys/arch/amd64/amd64/trap.c:626
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x50e3a524f00, count: -7
ddb> 

Crashes (38):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-main 2023/01/21 15:39 openbsd 8b8fb239a1ab cc0f9968 .config console log report syz C [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/10/06 18:22 openbsd 8471a84120a0 131b38ac .config console log report syz C [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/06/27 19:41 openbsd 2322beb42253 ef82eb2c .config console log report syz C panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/03/17 00:25 openbsd f1075cc4acbf 46cc3b21 .config console log report syz C panic: ufs_rename: lost dir entry
ci-openbsd-setuid 2022/02/15 07:45 openbsd 685b342a2af1 8b9ca619 .config console log report syz panic: ufs_rename: lost dir entry
ci-openbsd-multicore 2021/12/28 22:12 openbsd 8bad472766c2 76c8cf06 .config console log report syz panic: ufs_rename: lost dir entry
ci-openbsd-setuid 2020/02/14 04:07 openbsd c9200921909a 5d7b90f1 .config console log report syz
ci-openbsd-main 2023/01/29 01:02 openbsd b7211c5dd361 b68fb8d6 .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2023/01/26 17:22 openbsd 81f2740f0a58 651c142c .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2023/01/26 11:30 openbsd 81f2740f0a58 651c142c .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2023/01/21 15:19 openbsd 8b8fb239a1ab cc0f9968 .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2023/01/10 18:54 openbsd cc6f004eb9e6 48bc529a .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/12/30 01:27 openbsd d48e5b0496b6 44712fbc .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/12/27 15:15 openbsd b71341ac0994 44712fbc .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/12/27 13:03 openbsd b71341ac0994 44712fbc .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/12/25 03:33 openbsd 406273279adf 9da18ae8 .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/11/21 22:16 openbsd 1b7ab755026f ed183554 .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/11/17 12:58 openbsd 5822070f8470 3a127a31 .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/11/02 14:11 openbsd f11c99e6d0b5 43f72c2d .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/10/08 14:38 openbsd 5cb1d9dce18f aea5da89 .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/10/06 17:59 openbsd 8471a84120a0 131b38ac .config console log report [disk image] [bsd.gdb] [kernel image] panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/10/01 03:01 openbsd 7cc6a6639df7 feb56351 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/08/21 18:24 openbsd 53fadfdcf4c1 26a13b38 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/08/10 00:26 openbsd 9170c2da45e8 c2a623d6 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/07/12 13:23 openbsd bf955257b2e4 da3d6955 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/06/27 19:14 openbsd 2322beb42253 ef82eb2c .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/06/24 13:57 openbsd 7aef5fd99b1d a5dbd430 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/04/14 01:18 openbsd 382703046427 b17b2923 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/03/21 18:08 openbsd 4ff57d1d979c e2d91b1d .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-main 2022/03/16 23:57 openbsd f1075cc4acbf 46cc3b21 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-setuid 2022/02/15 05:44 openbsd 685b342a2af1 8b9ca619 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-multicore 2022/01/31 17:20 openbsd d11a561f9e66 a491ad2d .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-multicore 2021/12/29 04:30 openbsd 8bad472766c2 76c8cf06 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-multicore 2021/12/29 04:17 openbsd 8bad472766c2 76c8cf06 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-multicore 2021/12/29 03:37 openbsd 8bad472766c2 76c8cf06 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-multicore 2021/12/28 20:26 openbsd 8bad472766c2 76c8cf06 .config console log report panic: ufs_rename: lost dir entry
ci-openbsd-setuid 2020/07/08 20:28 openbsd 638aa2bc5640 bae5742c .config console log report
ci-openbsd-setuid 2020/02/14 02:30 openbsd c9200921909a 5d7b90f1 .config console log report
* Struck through repros no longer work on HEAD.