syzbot


uvm_fault: pfi_kif_update

Status: auto-closed as invalid on 2020/01/28 17:38
Reported-by: syzbot+fc363e4e8c90091ba639@syzkaller.appspotmail.com
First crash: 1901d, last: 1774d

Sample crash report:
uvm_fault(0xfffffd807f00bcf0, 0x6703813e, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      pfi_kif_update+0xf6:    movq    0x40(%rax),%rbx
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xfffffd807f00bcf0, 0x6703813e, 0, 1) -> e
pfi_kif_update(ffff800000c29000) at pfi_kif_update+0xf6
end trace frame: 0xffff800022d75140, count: 0
ddb{0}> trace
pfi_kif_update(ffff800000c29000) at pfi_kif_update+0xf6
pfi_detach_ifnet(ffff800000c3c000) at pfi_detach_ifnet+0x4d sys/net/pf_if.c:267
if_detach(ffff800000c3c000) at if_detach+0x15d sys/net/if.c:1114
tun_clone_destroy(ffff800000c3c000) at tun_clone_destroy+0x1c7 sys/net/if_tun.c:278
spec_close(ffff800022d75270) at spec_close+0x311 sys/kern/spec_vnops.c:555
VOP_CLOSE(fffffd8062c55dd8,2,fffffd807f7c6ba0,ffff800020aceca8) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:175
vn_closefile(fffffd8063914ac8,ffff800020aceca8) at vn_closefile+0xd8 vn_close sys/kern/vfs_vnops.c:301 [inline]
vn_closefile(fffffd8063914ac8,ffff800020aceca8) at vn_closefile+0xd8 sys/kern/vfs_vnops.c:613
fdrop(fffffd8063914ac8,ffff800020aceca8) at fdrop+0xc2 sys/kern/kern_descrip.c:1273
closef(fffffd8063914ac8,ffff800020aceca8) at closef+0x11d sys/kern/kern_descrip.c:1257
fdfree(ffff800020aceca8) at fdfree+0x101 sys/kern/kern_descrip.c:1189
exit1(ffff800020aceca8,0,1) at exit1+0x32f sys/kern/kern_exit.c:196
sys_exit(ffff800020aceca8,ffff800022d75500,ffff800022d75550) at sys_exit+0x17 sys/kern/kern_exit.c:94
syscall(ffff800022d755d0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800022d755d0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,1,0,1,0,7f7ffffe0d74) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe0d40, count: -14
ddb{0}> show registers
rdi               0xffff800000c29000
rsi                           0x181c    __ALIGN_SIZE+0x81c
rbp               0xffff800022d75100
rbx               0xffff800000c29000
rdx                                0
rcx                                0
rax                       0x670380fe
r8                0xffffffff81bbd5db    refcnt_rele_wake+0x3b
r9                               0x5
r10                              0x1
r11               0x72876a021e62432b
r12                            0x35a
r13                                0
r14               0xffff800000c29000
r15                                0
rip               0xffffffff81d79a86    pfi_kif_update+0xf6
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff800022d750b0
ss                              0x10
pfi_kif_update+0xf6:    movq    0x40(%rax),%rbx
ddb{0}> show proc
PROC (syz-executor.1) pid=210523 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    pri=32, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff800020acea30,0xffff800020ace7c8
    process=0xffff800020a4b188 user=0xffff800022d70000, vmspace=0xfffffd807f00bcf0
    estcpu=36, cpticks=4, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 88519  493900  42141      0  2           0                syz-executor.0
 88519  482164  42141      0  3   0x4000080  fsleep        syz-executor.0
 88519   74018  42141      0  3   0x4000080  fsleep        syz-executor.0
 88519  366193  42141      0  3   0x4000080  fsleep        syz-executor.0
 88519   24762  42141      0  2   0x4000000                syz-executor.0
 87611  267881  74835      0  3        0x82  nanosleep     syz-executor.1
 42141  475825  74835      0  3        0x82  nanosleep     syz-executor.0
 24377   42733      1      0  3    0x100083  ttyopn        getty
 37553  214020      0      0  3     0x14200  acct          acct
 24840   68590      0      0  3     0x14200  bored         sosplice
 74835  403071   6362      0  3        0x82  thrsleep      syz-fuzzer
 74835  287592   6362      0  3   0x4000082  thrsleep      syz-fuzzer
 74835  450663   6362      0  3   0x4000082  thrsleep      syz-fuzzer
 74835   56153   6362      0  3   0x4000082  thrsleep      syz-fuzzer
 74835  462730   6362      0  3   0x4000082  thrsleep      syz-fuzzer
 74835  188141   6362      0  3   0x4000082  thrsleep      syz-fuzzer
 74835  222574   6362      0  3   0x4000082  thrsleep      syz-fuzzer
 74835  239752   6362      0  3   0x4000082  thrsleep      syz-fuzzer
 74835  110878   6362      0  3   0x4000082  thrsleep      syz-fuzzer
 74835  449122   6362      0  3   0x4000082  kqread        syz-fuzzer
  6362  419102  88696      0  3    0x10008a  pause         ksh
 88696   38771  82128      0  3        0x92  select        sshd
 82128  462003      1      0  3        0x80  select        sshd
 71532  113408  60535     74  3    0x100092  bpf           pflogd
 60535  124745      1      0  3        0x80  netio         pflogd
 31384   82073  49044     73  3    0x100090  kqread        syslogd
 49044   22249      1      0  3    0x100082  netio         syslogd
 43683  233919      1     77  3    0x100090  poll          dhclient
  9215  391391      1      0  3        0x80  poll          dhclient
 68892  238793      0      0  2     0x14200                zerothread
 35082  100991      0      0  3     0x14200  aiodoned      aiodoned
 52226  398371      0      0  3     0x14200  syncer        update
   703  233718      0      0  3     0x14200  cleaner       cleaner
 67406  440967      0      0  7     0x14200                reaper
 57066  500144      0      0  3     0x14200  pgdaemon      pagedaemon
 77226  333889      0      0  3     0x14200  bored         crynlk
 64012  379184      0      0  3     0x14200  bored         crypto
 13413  299774      0      0  3  0x40014200  acpi0         acpi0
 16744  440352      0      0  3  0x40014200                idle1
 11578  506695      0      0  2     0x14200                softnet
 15363  483018      0      0  3     0x14200  bored         systqmp
 69010   35205      0      0  3     0x14200  bored         systq
 65441  200883      0      0  3  0x40014200  bored         softclock
 27474   81993      0      0  3  0x40014200                idle0
 94055  321965      0      0  3     0x14200  bored         smr
     1   76514      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9662   6491K    8170K  78643K     52831        0        0
            pcb    13     12K      14K  78643K      5757        0        0
         rtable   225     20K      21K  78643K     20910        0        0
         ifaddr   146     40K      42K  78643K      4602        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       4K  78643K      2269        0        0
            iov     0      0K      32K  78643K      7078        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1229     77K      77K  78643K     18960        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K       196        0        0
         VM map   130     65K      65K  78643K       198        0        0
            sem    12      0K       1K  78643K      9965        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1808    196K     290K  78643K     12765        0        0
      file desc     6     17K      25K  78643K     22538        0        0
          sigio     0      0K       0K  78643K       190        0        0
           proc    62     63K      95K  78643K      6822        0        0
        subproc    32      2K       2K  78643K      2085        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K      1502        0        0
       in_multi    52      3K       4K  78643K      6287        0        0
    ether_multi     1      0K       0K  78643K       211        0        0
            mrt     0      0K       0K  78643K       760        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys   210    927K     927K  78643K       210        0        0
           exec     0      0K       1K  78643K      3423        0        0
     pfkey data     0      0K       4K  78643K         7        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   311    986K     986K  78643K     74060        0        0
       UVM aobj   130      4K       4K  78643K       130        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       1K  78643K      4102        0        0
            NDP    27      0K       1K  78643K      1872        0        0
           temp   277   3566K    4206K  78643K    542306        0        0
         kqueue     0      0K       0K  78643K       409        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64      420    0      413     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80     4593    0     4591     1     0     1     1     0     8    0
rtentry    112     5280    0     5185     4     1     3     3     0     8    0
unpcb      120    15620    0    15593    38    36     2     2     0     8    0
syncache   264      129    0      129    37    37     0     1     0     8    0
sackhl      24        1    0        1     1     1     0     1     0     8    0
tcpqe       32      213    0      213    29    29     0     1     0     8    0
tcpcb      544    22275    0    22270    88    86     2    13     0     8    1
inpcb      280    50424    0    50412   129   126     3    13     0     8    2
rttmr       72      360    0      359     5     4     1     1     0     8    0
ip6q        72       12    0       12     6     6     0     1     0     8    0
ip6af       40       23    0       23     7     7     0     1     0     8    0
nd6         48      959    0      958    10     9     1     1     0     8    0
pkpcb       40      221    0      221    41    41     0     1     0     8    0
swfcl       56       12    0        0     1     0     1     1     0     8    0
ppxss      1128     617    0      617    38    37     1     1     0     8    1
pffrag     232      416    0      416    58    57     1     1     0   482    1
pffrnode    88      416    0      416    58    57     1     1     0     8    1
pffrent     40    12271    0    12271    58    57     1     1     0     8    1
pfosfp      40      846    0      846     5     5     0     5     0     8    0
pfosfpen   112     1428    0     1428    21    21     0    21     0     8    0
pfstitem    24     1518    0     1438     2     0     2     2     0     8    0
pfstkey    112     1520    0     1440     8     4     4     6     0     8    0
pfstate    328     1520    0     1440    25    18     7    18     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096      22    0       16    15     9     6     6     0     8    0
art_heap4  256    28289    0    27955    68    43    25    28     0     8    1
art_table   32    28311    0    27971     5     1     4     4     0     8    0
art_node    16     5259    0     5199     1     0     1     1     0     8    0
semupl     112        6    0        6     1     1     0     1     0     8    0
semapl     112     9963    0     9953     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128    35458    0    33962    49     0    49    49     0     8    0
ffsino     272    35458    0    33962   100     0   100   100     0     8    0
nchpl      144    80874    0    80405    60    40    20    60     0     8    0
uvmvnodes   72     9013    0        0   164     0   164   164     0     8    0
vnodes     208     9013    0        0   475     0   475   475     0     8    0
namei      1024  298026    0   298026     8     7     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
vcpupl     1984     129    0        1    16     0    16    16     0     8    0
vmpool     552      196    0       68    12     2    10    10     0     8    0
scsiplug    64       19    0       19    13    13     0     1     0     8    0
scxspl     192   216659    0   216659   114   113     1     7     0     8    1
plimitpl   152     1444    0     1436     1     0     1     1     0     8    0
sigapl     432    22385    0    22369     4     2     2     3     0     8    0
futexpl     56   582864    0   582861     4     3     1     1     0     8    0
knotepl    112     5130    0     5111    13    11     2     3     0     8    1
kqueuepl   104     6398    0     6396    13    12     1     4     0     8    0
pipepl     112     9880    0     9859    22    21     1     2     0     8    0
fdescpl    488    22386    0    22369     3     0     3     3     0     8    0
filepl     152   242438    0   242323   156   148     8    14     0     8    3
lockfpl    104     8680    0     8679     1     0     1     1     0     8    0
lockfspl    48     3329    0     3328     1     0     1     1     0     8    0
sessionpl  112      143    0      132     1     0     1     1     0     8    0
pgrppl      48      387    0      376     1     0     1     1     0     8    0
ucredpl     96    34528    0    34518     1     0     1     1     0     8    0
zombiepl   144    22370    0    22369     5     4     1     1     0     8    0
processpl  896    22403    0    22369     5     1     4     5     0     8    0
procpl     632    66913    0    66865    11     6     5     5     0     8    0
srpgc       64      267    0      267    58    58     0     1     0     8    0
sosppl     128      444    0      444    62    61     1     1     0     8    1
sockpl     384    71119    0    71079   257   249     8    23     0     8    2
mcl64k     65536    761    0        0    84    81     3    66     0     8    0
mcl16k     16384     49    0        0     5     2     3     3     0     8    0
mcl12k     12288     57    0        0     2     0     2     2     0     8    0
mcl9k      9216      33    0        0     2     0     2     2     0     8    0
mcl8k      8192      41    0        0     3     0     3     3     0     8    0
mcl4k      4096      42    0        0     4     1     3     3     0     8    0
mcl2k2     2112      12    0        0     1     0     1     1     0     8    0
mcl2k      2048     455    0        0    22    14     8    21     0     8    0
mtagpl      80      283    0        0     4     1     3     3     0     8    0
mbufpl     256     1743    0        0    37     1    36    37     0     8    0
bufpl      256    70716    0    61701   564     0   564   564     0     8    0
anonpl      16  2464661    0  2441221   418   317   101   109     0   124    3
amapchunkpl 152  148172    0   147962   204   193    11    21     0   158    0
amappl16   192   118547    0   117184   613   538    75    79     0     8    5
amappl15   184     3949    0     3942     1     0     1     1     0     8    0
amappl14   176     5915    0     5904     1     0     1     1     0     8    0
amappl13   168     3259    0     3259    15    15     0     1     0     8    0
amappl12   160     2249    0     2247     1     0     1     1     0     8    0
amappl11   152     2417    0     2400     1     0     1     1     0     8    0
amappl10   144     2694    0     2689     1     0     1     1     0     8    0
amappl9    136     4221    0     4218     1     0     1     1     0     8    0
amappl8    128     3759    0     3688     4     1     3     3     0     8    0
amappl7    120     3153    0     3143     1     0     1     1     0     8    0
amappl6    112     2153    0     2138     1     0     1     1     0     8    0
amappl5    104     3352    0     3338     1     0     1     1     0     8    0
amappl4     96    21626    0    21586    10     8     2     2     0     8    1
amappl3     88    10920    0    10913     1     0     1     1     0     8    0
amappl2     80   174656    0   174553     9     6     3     3     0     8    0
amappl1     72   491307    0   490846    25    15    10    20     0     8    0
amappl      80    69508    0    69395     7     4     3     3     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      129    0        0     3     0     3     3     0     8    0
uaddrrnd    24    22582    0    22369     2     0     2     2     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    22582    0    22369     2     0     2     2     0     8    0
vmmpekpl   168   146317    0   146258     4     1     3     3     0     8    0
vmmpepl    168  2826471    0  2823437   744   559   185   188     0   357   50
vmsppl     368    22385    0    22369     2     0     2     2     0     8    0
pdppl      4096   45171    0    45002    26     4    22    22     0     8    0
pvpl        32  6859153    0  6836387   785   583   202   226     0   265    9
pmappl     232    22581    0    22437    11     2     9     9     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112     1033    0      251    24     1    23    23     0     8    0

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/30 17:37 openbsd 7ef8321bb317 5ea87a66 .config console log report ci-openbsd-multicore
2019/10/30 01:02 openbsd 002806ec7d75 5ea87a66 .config console log report ci-openbsd-multicore
2019/09/22 21:02 openbsd 2f346d2b6595 d96e88f3 .config console log report ci-openbsd-multicore
2019/09/18 07:30 openbsd 9e5c34cf1247 13dcda9b .config console log report ci-openbsd-multicore
2019/09/17 13:38 openbsd 6c9a643d349f 13dcda9b .config console log report ci-openbsd-multicore
2019/06/25 21:33 openbsd d18aa00ce719 0a8d1a96 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.