syzbot


panic: uvm_fault_unwire_locked: address not in map

Status: fixed on 2019/01/11 00:09
Reported-by: syzbot+b6a9255faa0605669432@syzkaller.appspotmail.com
Fix commit: Hold a read lock on the map while doing the actual device I/O during in
First crash: 1433d, last: 1433d
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
uvm_fault_unwire_locked: address not in map C 10 1435d 1508d 0/3 closed as dup on 2018/12/26 00:05
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: uvm_fault_unwire_locked: address not in map (2) 7 1271d 1399d 0/3 auto-closed as invalid on 2019/10/25 08:37
openbsd panic: uvm_fault_unwire_locked: address not in map (4) C 6 8d10h 237d 0/3 upstream: reported C repro on 2022/04/04 00:45
openbsd panic: uvm_fault_unwire_locked: address not in map (3) 1 343d 343d 3/3 fixed on 2021/12/22 03:26

Sample crash report:
panic: uvm_fault_unwire_locked: address not in map
Stopped at      db_enter+0xa:   popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*170348     73      0         0x2  0x4000000    0  syz-executor8645
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
uvm_fault_unwire_locked(20070000,20081000,0) at uvm_fault_unwire_locked+0x270
uvm_fault_unwire(10000,ffffff0035596300,10000) at uvm_fault_unwire+0x3b sys/uvm/uvm_fault.c:1314
physio(ffff800014a70948,ffffff00354f4968,ffffff00354f4968,ffff800014a70948,ffff800014a70818) at physio+0x2ba sys/kern/kern_physio.c:183
spec_read(0) at spec_read+0x9d sys/kern/spec_vnops.c:223
VOP_READ(ffff800014a70948,ffffff00354f4968,ffffff00360b32d8,0) at VOP_READ+0x5e sys/kern/vfs_vops.c:247
vn_read(ffffff00360b32d8,ffff800014a32718,84e4633b) at vn_read+0x130 sys/kern/vfs_vnops.c:365
dofilereadv(0,292,ffff800014a32718,ffff800014a70a70,ffff800014a70a88) at dofilereadv+0x14f sys/kern/sys_generic.c:235
sys_readv(ffff800014a70b10,ffff800014a32718,ffff800014a15fd8) at sys_readv+0xce sys/kern/sys_generic.c:182
syscall(0) at syscall+0x3e4
Xsyscall(6,0,43928ffaa0,0,40d4fc2098,40d4fc2090) at Xsyscall+0x128
end of kernel
end trace frame: 0x42de373ca0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> show panic
uvm_fault_unwire_locked: address not in map
ddb> trace
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
uvm_fault_unwire_locked(20070000,20081000,0) at uvm_fault_unwire_locked+0x270
uvm_fault_unwire(10000,ffffff0035596300,10000) at uvm_fault_unwire+0x3b sys/uvm/uvm_fault.c:1314
physio(ffff800014a70948,ffffff00354f4968,ffffff00354f4968,ffff800014a70948,ffff800014a70818) at physio+0x2ba sys/kern/kern_physio.c:183
spec_read(0) at spec_read+0x9d sys/kern/spec_vnops.c:223
VOP_READ(ffff800014a70948,ffffff00354f4968,ffffff00360b32d8,0) at VOP_READ+0x5e sys/kern/vfs_vops.c:247vn_read(ffffff00360b32d8,ffff800014a32718,84e4633b) at vn_read+0x130
dofilereadv(0,292,ffff800014a32718,ffff800014a70a70,ffff800014a70a88) at dofilereadv+0x14f sys/kern/sys_generic.c:235
sys_readv(ffff800014a70b10,ffff800014a32718,ffff800014a15fd8) at sys_readv+0xce sys/kern/sys_generic.c:182syscall(0) at syscall+0x3e4
Xsyscall(6,0,43928ffaa0,0,40d4fc2098,40d4fc2090) at Xsyscall+0x128
end of kernel
end trace frame: 0x42de373ca0, count: -12
ddb> show registers
rdi               0xffffffff81e04f20    kprintf_mutex
rsi                              0x5
rbp               0xffff800014a705c0
rbx               0xffff800014a70660
rdx                            0x3fd
rcx                                0
rax                              0x1
r8                0xffff800014a70590
r9                                 0
r10                                0
r11               0xffffffff813028e0    x86_bus_space_io_read_1
r12                     0x3000000008
r13               0xffff800014a705d0
r14                            0x100
r15               0xffffffff81c4ce55    cy_pio_rec+0x15f13
rip               0xffffffff8126ba8a    db_enter+0xa
cs                               0x8
rflags                         0x202
rsp               0xffff800014a705c0
ss                              0x10
db_enter+0xa:   popq    %rbp
ddb> show proc
PROC (syz-executor8645) pid=170348 stat=onproc
    flags process=2<EXEC> proc=4000000<THREAD>
    pri=17, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800014a32bc8,0xffff800014a324d0
    process=0xffff800014a15fd8 user=0xffff800014a6b000, vmspace=0xffffff003f12c630
    estcpu=0, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
    73  173122  91581      0  3        0x82  nanosleep     syz-executor8645
*   73  170348  91581      0  7   0x4000002                syz-executor8645
    73  320879  91581      0  3   0x4000082  fsleep        syz-executor8645
 91581  482479  95830      0  3    0x10008a  pause         ksh
 95830  213052  31586      0  3        0x92  select        sshd
 43389  150056      1      0  3    0x100083  ttyin         getty
 31586  418132      1      0  3        0x80  select        sshd
 15154   21778  97280     73  3    0x100090  kqread        syslogd
 97280  318896      1      0  3    0x100082  netio         syslogd
 96243  400378      1     77  3    0x100090  poll          dhclient
 65021  235505      1      0  3        0x80  poll          dhclient
 11377  177341      0      0  2     0x14200                zerothread
 64523  184979      0      0  3     0x14200  aiodoned      aiodoned
 34870  343705      0      0  3     0x14200  syncer        update
 99296   35852      0      0  3     0x14200  cleaner       cleaner
 97948  270528      0      0  3     0x14200  reaper        reaper
 13580  278597      0      0  3     0x14200  pgdaemon      pagedaemon
  2826  120954      0      0  3     0x14200  bored         crynlk
 65260  273822      0      0  3     0x14200  bored         crypto
 80372   88901      0      0  3  0x40014200  acpi0         acpi0
 50953  191099      0      0  3     0x14200  bored         softnet
 91896   23881      0      0  3     0x14200  bored         systqmp
 71570   80383      0      0  3     0x14200  bored         systq
  7736   52718      0      0  3  0x40014200  bored         softclock
  4946   92095      0      0  3  0x40014200                idle0
     1   43360      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> 

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2018/12/25 15:28 openbsd d55171694444 8a41a0ad .config log report syz C
ci-openbsd-main 2018/12/25 15:08 openbsd d55171694444 8a41a0ad .config log report
* Struck through repros no longer work on HEAD.