syzbot


kernel panic: [kernel] Unknown mbox type -ADDR!

Status: closed as invalid on 2018/07/18 15:55
Reported-by: syzbot+d3ae8f99157a6c13fad9@syzkaller.appspotmail.com
First crash: 2320d, last: 2320d

Sample crash report:
kernel panic at kern/src/ns/qio.c:1356, from core 3: [kernel] Unknown mbox type -1321122336!
19:46:54 executing program 1:
mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0)
mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2)
r0 = openat$net_tcp_1_err(0xffffffffffffff9c, &(0x7f0000000000)='/net/tcp/1/err\x00', 0xf, 0x3, 0x0)
wstat(&(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000000080)=""/205, 0xcd, 0x0)
r1 = openat$net_icmpv6_stats(0xffffffffffffff9c, &(0x7f0000000180)='/net/icmpv6/stats\x00', 0x12, 0x1, 0x0)
openat$net_tcp_0_remote(0xffffffffffffff9c, &(0x7f00000001c0)='/net/tcp/0/remote\x00', 0x12, 0x1, 0x0)
openat$dev_consctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/consctl\x00', 0xd, 0x3, 0x0)
rename(&(0x7f0000000240)='./file0\x00', 0x8, &(0x7f0000000280)='./file0\x00', 0x8)
openat$net_ether0_0_ctl(0xffffffffffffff9c, &(0x7f00000002c0)='/net/ether0/0/ctl\x00', 0x12, 0x3, 0x0)
openat$net_ipifc_1_listen(0xffffffffffffff9c, &(0x7f0000000300)='/net/ipifc/1/listen\x00', 0x14, 0x3, 0x0)
mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000001)
mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x3000003)
r2 = proc_create(&(0x7f0000000340)='./file0\x00', 0x8, &(0x7f0000000380)='/dev/consctl\x00', 0xd, 0x0)
fchdir(r2, r1)
llseek(r0, 0x101, 0x5d44, &(0x7f00000003c0), 0x2)
openat$net_ether0_ifstats(0xffffffffffffff9c, &(0x7f0000000400)='/net/ether0/ifstats\x00', 0x14, 0x1, 0x0)
openat$net_tcp_1_data(0xffffffffffffff9c, &(0x7f0000000440)='/net/tcp/1/data\x00', 0x10, 0x3, 0x0)
lstat(&(0x7f0000000480)='./file0\x00', 0x8, &(0x7f00000004c0))
lstat(&(0x7f0000000540)='./file0\x00', 0x8, &(0x7f0000000580))
r3 = openat$net_icmpv6_stats(0xffffffffffffff9c, &(0x7f0000000600)='/net/icmpv6/stats\x00', 0x12, 0x1, 0x0)
openat$prof_empty(0xffffffffffffff9c, &(0x7f0000000640)='/prof/.empty\x00', 0xd, 0x3, 0x0)
fcntl$F_SETFD(r3, 0x2, 0x1)
send_event(&(0x7f0000000700)={&(0x7f0000000680)="e04541b1ec19ab49a3d2a164ad1668989312bf1d63b210b08c92bfb9a68c9d09c8b243ead938e5379c176e48629e4760731855fadcb02326fad8e20136cd6130bbaefdc371b1c18a1f43c3aea4c550f0", 0x5, 0x1, 0x6, 0x4, 0xffff}, &(0x7f0000000780)={0x0, 0xfff, 0x40, &(0x7f0000000740)="87fc095b6d71e86e6fd97790920d83a3e1", 0xc8ab}, 0x3ff)
llseek(r0, 0x401, 0x6, &(0x7f00000007c0), 0x1)
fcntl$F_SETFL(r0, 0x4, 0x800)
assertion failed: BLEN(b) <= len - sofar
Stack Backtrace on Core 3:
#01 [<0xffffffffc200a3b7>] in backtrace at src/kdebug.c:219
#02 [<0xffffffffc2009b7c>] in _panic at src/init.c:266
#03 [<0xffffffffc203a0e9>] in read_all_blocks at src/ns/qio.c:1356
#04 [<0xffffffffc203c7f4>] in qread at src/ns/qio.c:1439
#05 [<0xffffffffc2027025>] in netifread at src/net/netif.c:299
#06 [<0xffffffffc20765ec>] in etherread at drivers/dev/ether.c:217
#07 [<0xffffffffc203f733>] in rread at src/ns/sysfile.c:763
#08 [<0xffffffffc203f8db>] in sysread at src/ns/sysfile.c:821
#09 [<0xffffffffc2055ca1>] in sys_read at src/syscall.c:1779
#10 [<0xffffffffc2059149>] in syscall at src/syscall.c:2528
#11 [<0xffffffffc2059304>] in run_local_syscall at src/syscall.c:2563
#12 [<0xffffffffc2059839>] in prep_syscalls at src/syscall.c:2583
#13 [<0xffffffffc20aaf1a>] in sysenter_callwrapper at arch/x86/trap.c:859
19:47:00 executing program 6:
r0 = openat$proc_self_core(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/core\x00', 0x10, 0x1, 0x0)
openat$dev_stdin(0xffffffffffffff9c, &(0x7f0000000040)='/dev/stdin\x00', 0xb, 0x3, 0x0)
openat$net_ether0_ifstats(0xffffffffffffff9c, &(0x7f0000000080)='/net/ether0/ifstats\x00', 0x14, 0x1, 0x0)
r1 = openat$net_ipifc_1_listen(0xffffffffffffff9c, &(0x7f00000000c0)='/net/ipifc/1/listen\x00', 0x14, 0x3, 0x0)
abort_sysc_fd(r1)
openat$net_ether0_stats(0xffffffffffffff9c, &(0x7f0000000100)='/net/ether0/stats\x00', 0x12, 0x1, 0x0)
openat$net_udp_0_local(0xffffffffffffff9c, &(0x7f0000000140)='/net/udp/0/local\x00', 0x11, 0x1, 0x0)
openat$dev_sysname(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sysname\x00', 0xd, 0x3, 0x0)
tcgetattr(r0, &(0x7f00000001c0))
openat$net_tcp_stats(0xffffffffffffff9c, &(0x7f0000000200)='/net/tcp/stats\x00', 0xf, 0x1, 0x0)
openat$net_icmpv6_clone(0xffffffffffffff9c, &(0x7f0000000240)='/net/icmpv6/clone\x00', 0x12, 0x3, 0x0)
openat$dev_bintime(0xffffffffffffff9c, &(0x7f0000000280)='/dev/bintime\x00', 0xd, 0x3, 0x0)
openat$proc_self_wait(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/wait\x00', 0x10, 0x1, 0x0)
openat$net_tcp_1_local(0xffffffffffffff9c, &(0x7f0000000300)='/net/tcp/1/local\x00', 0x11, 0x1, 0x0)
openat$proc_self_strace_traceset(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/strace_traceset\x00', 0x1b, 0x3, 0x0)
openat$net_tcp_1_data(0xffffffffffffff9c, &(0x7f0000000380)='/net/tcp/1/data\x00', 0x10, 0x3, 0x0)
openat$net_ether0_1_data(0xffffffffffffff9c, &(0x7f00000003c0)='/net/ether0/1/data\x00', 0x13, 0x3, 0x0)
r2 = openat$net_ether0_0_data(0xffffffffffffff9c, &(0x7f0000000400)='/net/ether0/0/data\x00', 0x13, 0x3, 0x0)
fcntl$F_SETFD(r1, 0x2, 0x1)
openat$dev_capuse(0xffffffffffffff9c, &(0x7f0000000440)='/dev/capuse\x00', 0xc, 0x3, 0x0)
openat$net_udp_0_status(0xffffffffffffff9c, &(0x7f0000000480)='/net/udp/0/status\x00', 0x12, 0x1, 0x0)
read(r2, &(0x7f00000004c0)=""/36, 0x24)
openat$net_ipifc_1_err(0xffffffffffffff9c, &(0x7f0000000500)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
openat$proc_self_noteid(0xffffffffffffff9c, &(0x7f0000000540)='/proc/self/noteid\x00', 0x12, 0x3, 0x0)
openat$net_tcp_2_data(0xffffffffffffff9c, &(0x7f0000000580)='/net/tcp/2/data\x00', 0x10, 0x3, 0x0)
openat$net_udp_0_local(0xffffffffffffff9c, &(0x7f00000005c0)='/net/udp/0/local\x00', 0x11, 0x1, 0x0)
19:47:00 executing program 5:
r0 = openat$dev_swap(0xffffffffffffff9c, &(0x7f0000000080)='/dev/swap\x00', 0xa3, 0x3, 0x0)
tcgetattr(r0, &(0x7f0000000000))
openat$dev_time(0xffffffffffffff9c, &(0x7f0000000040)='/dev/time\x00', 0xa, 0x3, 0x0)
19:47:00 executing program 0:
openat$net_ether0_2_type(0xffffffffffffff9c, &(0x7f0000000000)='/net/ether0/2/type\x00', 0x13, 0x1, 0x0)
openat$net_ipifc_0_remote(0xffffffffffffff9c, &(0x7f00000000c0)='/net/ipifc/0/remote\x00', 0x0, 0x1, 0x0)
19:47:00 executing program 7:
mprotect(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000000)
openat$net_tcp_0_status(0xffffffffffffff9c, &(0x7f0000000080)='/net/tcp/0/status\x00', 0x12, 0x1, 0x0)
19:47:00 executing program 2:
r0 = openat$net_icmpv6_stats(0xffffffffffffff9c, &(0x7f0000000000)='/net/icmpv6/stats\x00', 0x12, 0x1, 0x0)
r1 = openat$net_ipifc_1_remote(0xffffffffffffff9c, &(0x7f0000000040)='/net/ipifc/1/remote\x00', 0x14, 0x1, 0x0)
r2 = openat$net_ether0_1_data(0xffffffffffffff9c, &(0x7f0000000080)='/net/ether0/1/data\x00', 0x13, 0x3, 0x0)
close(r1)
fcntl$F_GETFL(r0, 0x3)
openat$dev_caphash(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/caphash\x00', 0xd, 0x3, 0x0)
openat$proc_self_note(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/note\x00', 0x10, 0x1, 0x0)
openat$net_icmpv6_stats(0xffffffffffffff9c, &(0x7f0000000140)='/net/icmpv6/stats\x00', 0x12, 0x1, 0x0)
openat$proc_self_note(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/note\x00', 0x10, 0x1, 0x0)
openat$dev_bintime(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/bintime\x00', 0xd, 0x3, 0x0)
openat$dev_stdout(0xffffffffffffff9c, &(0x7f0000000200)='/dev/stdout\x00', 0xc, 0x3, 0x0)
openat$proc_self_text(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/text\x00', 0x10, 0x1, 0x0)
openat$net_udp_0_remote(0xffffffffffffff9c, &(0x7f0000000280)='/net/udp/0/remote\x00', 0x12, 0x1, 0x0)
openat$net_icmpv6_clone(0xffffffffffffff9c, &(0x7f00000002c0)='/net/icmpv6/clone\x00', 0x12, 0x3, 0x0)
openat$dev_stdout(0xffffffffffffff9c, &(0x7f0000000300)='/dev/stdout\x00', 0xc, 0x3, 0x0)
openat$net_tcp_2_remote(0xffffffffffffff9c, &(0x7f0000000340)='/net/tcp/2/remote\x00', 0x12, 0x1, 0x0)
openat(r2, &(0x7f0000000380)='./file0\x00', 0x8, 0x100240, 0x8)
openat$net_tcp_1_listen(0xffffffffffffff9c, &(0x7f00000003c0)='/net/tcp/1/listen\x00', 0x12, 0x3, 0x0)
openat$proc_self_strace_traceset(0xffffffffffffff9c, &(0x7f0000000400)='/proc/self/strace_traceset\x00', 0x1b, 0x3, 0x0)
mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000002, 0x11, 0xffffffffffffffff, 0x7)
19:47:00 executing program 3:
r0 = openat$net_ipifc_1_data(0xffffffffffffff9c, &(0x7f0000000200)='/net/ipifc/1/data\x00', 0x12, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
19:47:00 executing program 4:
r0 = openat$net_ether0_clone(0xffffffffffffff9c, &(0x7f0000000000)='/net/ether0/clone\x00', 0x12, 0x3, 0x0)
openat(r0, &(0x7f0000000080)='./file0\x00', 0x8, 0x44, 0x0)
19:47:00 executing program 1:
mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0)
mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2)
r0 = openat$net_tcp_1_err(0xffffffffffffff9c, &(0x7f0000000000)='/net/tcp/1/err\x00', 0xf, 0x3, 0x0)
wstat(&(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000000080)=""/205, 0xcd, 0x0)
r1 = openat$net_icmpv6_stats(0xffffffffffffff9c, &(0x7f0000000180)='/net/icmpv6/stats\x00', 0x12, 0x1, 0x0)
openat$net_tcp_0_remote(0xffffffffffffff9c, &(0x7f00000001c0)='/net/tcp/0/remote\x00', 0x12, 0x1, 0x0)
openat$dev_consctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/consctl\x00', 0xd, 0x3, 0x0)
rename(&(0x7f0000000240)='./file0\x00', 0x8, &(0x7f0000000280)='./file0\x00', 0x8)
openat$net_ether0_0_ctl(0xffffffffffffff9c, &(0x7f00000002c0)='/net/ether0/0/ctl\x00', 0x12, 0x3, 0x0)
openat$net_ipifc_1_listen(0xffffffffffffff9c, &(0x7f0000000300)='/net/ipifc/1/listen\x00', 0x14, 0x3, 0x0)
mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000001)
mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x3000003)
r2 = proc_create(&(0x7f0000000340)='./file0\x00', 0x8, &(0x7f0000000380)='/dev/consctl\x00', 0xd, 0x0)
fchdir(r2, r1)
llseek(r0, 0x101, 0x5d44, &(0x7f00000003c0), 0x2)
openat$net_ether0_ifstats(0xffffffffffffff9c, &(0x7f0000000400)='/net/ether0/ifstats\x00', 0x14, 0x1, 0x0)
openat$net_tcp_1_data(0xffffffffffffff9c, &(0x7f0000000440)='/net/tcp/1/data\x00', 0x10, 0x3, 0x0)
lstat(&(0x7f0000000480)='./file0\x00', 0x8, &(0x7f00000004c0))
lstat(&(0x7f0000000540)='./file0\x00', 0x8, &(0x7f0000000580))
r3 = openat$net_icmpv6_stats(0xffffffffffffff9c, &(0x7f0000000600)='/net/icmpv6/stats\x00', 0x12, 0x1, 0x0)
openat$prof_empty(0xffffffffffffff9c, &(0x7f0000000640)='/prof/.empty\x00', 0xd, 0x3, 0x0)
fcntl$F_SETFD(r3, 0x2, 0x1)
send_event(&(0x7f0000000700)={&(0x7f0000000680)="e04541b1ec19ab49a3d2a164ad1668989312bf1d63b210b08c92bfb9a68c9d09c8b243ead938e5379c176e48629e4760731855fadcb02326fad8e20136cd6130bbaefdc371b1c18a1f43c3aea4c550f0", 0x5, 0x1, 0x6, 0x4, 0xffff}, &(0x7f0000000780)={0x0, 0xfff, 0x40, &(0x7f0000000740)="87fc095b6d71e86e6fd97790920d83a3e1", 0xc8ab}, 0x3ff)
llseek(r0, 0x401, 0x6, &(0x7f00000007c0), 0x1)
fcntl$F_SETFL(r0, 0x4, 0x800)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/16 19:47 akaros 93b9607ebeff 13761366 .config console log report ci-akaros-main
* Struck through repros no longer work on HEAD.