syzbot


uvm_fault: kcov_remote_enter

Status: upstream: reported on 2022/11/30 00:08
Reported-by: syzbot+4273e3d879dea05c8b15@syzkaller.appspotmail.com
First crash: 68d, last: 68d

Sample crash report:
uvm_fault(0xffffffff829bde68, 0xffff800021273000, 0, 2) -> e
kernel: page fault trap, code=0
Stopped at      kcov_remote_enter+0x112:        movq    $0,0(%rcx)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*409120  66134      0           0          0    0  syz-executor.4
kcov_remote_enter(0,ffff8000217347f0) at kcov_remote_enter+0x112 sys/dev/kcov.c:672
timeout_run(ffff800021703b00) at timeout_run+0x80 sys/kern/kern_timeout.c:639
softclock_process_tick_timeout(ffff800021703b00,0) at softclock_process_tick_timeout+0x1ac sys/kern/kern_timeout.c:688
softclock(0) at softclock+0x130 sys/kern/kern_timeout.c:711
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7ffffd4500, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff829bde68, 0xffff800021273000, 0, 2) -> e
ddb> trace
kcov_remote_enter(0,ffff8000217347f0) at kcov_remote_enter+0x112 sys/dev/kcov.c:672
timeout_run(ffff800021703b00) at timeout_run+0x80 sys/kern/kern_timeout.c:639
softclock_process_tick_timeout(ffff800021703b00,0) at softclock_process_tick_timeout+0x1ac sys/kern/kern_timeout.c:688
softclock(0) at softclock+0x130 sys/kern/kern_timeout.c:711
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7ffffd4500, count: -6
ddb> show registers
rdi                              0x4
rsi               0xffff800000685d00
rbp               0xffff800021784f50
rbx                                0
rdx               0xffff80002176ca90
rcx               0xffff800021273000
rax               0xfffffd807035eea0
r8                                 0
r9                                 0
r10               0x8a1cabea21770517
r11               0x5ad3c4af4ac15324
r12               0xffff800021703a40
r13               0xffffffff82937ff0    cpu_info_full_primary+0x1ff0
r14               0xffff8000217347f0
r15                                0
rip               0xffffffff81de0642    kcov_remote_enter+0x112
cs                               0x8
rflags                       0x10297    __ALIGN_SIZE+0xf297
rsp               0xffff800021784f30
ss                                 0
kcov_remote_enter+0x112:        movq    $0,0(%rcx)
ddb> show proc
PROC (syz-executor.4) pid=409120 stat=onproc
    flags process=0 proc=0
    pri=83, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff800021702540,0xffff80002176cfe0
    process=0xffff800029a713b0 user=0xffff800021780000, vmspace=0xfffffd8071102008
    estcpu=36, cpticks=2, pctcpu=0.0
    user=1, sys=0, intr=1
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 28906  179364  71879      0  3        0x80  nanoslp       syz-executor.7
 28906   76619  71879      0  3   0x4000080  fsleep        syz-executor.7
*66134  409120  11167      0  7           0                syz-executor.4
 66134  234614  11167      0  2   0x4000000                syz-executor.4
  7283   36079  30992      0  2           0                syz-executor.5
  7283   67287  30992      0  3   0x4000080  fsleep        syz-executor.5
 80774   59262  72811      0  2           0                syz-executor.3
 80774  462563  72811      0  3   0x4000080  fsleep        syz-executor.3
 72811  308637  10386      0  3        0x82  nanoslp       syz-executor.3
 17723  426795      0      0  3     0x14200  acct          acct
 93525  370949  10386      0  2         0x2                syz-executor.6
 30992   28932  10386      0  3        0x82  nanoslp       syz-executor.5
 16503  477546  10386      0  3        0x82  piperd        syz-executor.0
 12547   27656      0      0  3     0x14200  bored         sosplice
 25073  472188      0      0  3     0x14280  nfsidl        nfsio
 61068  427882      0      0  3     0x14280  nfsidl        nfsio
 94819  105401      0      0  3     0x14280  nfsidl        nfsio
 70691  163970      0      0  3     0x14280  nfsidl        nfsio
 69523  325480      0      0  3     0x14280  nfsidl        nfsio
 56840  294040      0      0  3     0x14280  nfsidl        nfsio
 10123  334622      0      0  3     0x14280  nfsidl        nfsio
 33363  412238      0      0  3     0x14280  nfsidl        nfsio
 75880  281561      0      0  3     0x14280  nfsidl        nfsio
 98328  444411      0      0  3     0x14280  nfsidl        nfsio
 43044  231772      0      0  3     0x14280  nfsidl        nfsio
 77897  353836      0      0  3     0x14280  nfsidl        nfsio
 19813  410633      0      0  3     0x14280  nfsidl        nfsio
 17042  307074      0      0  3     0x14280  nfsidl        nfsio
 65454  375392      0      0  3     0x14280  nfsidl        nfsio
 53229  450254      0      0  3     0x14280  nfsidl        nfsio
 59671  335952      0      0  3     0x14280  nfsidl        nfsio
 90439  126308      0      0  3     0x14280  nfsidl        nfsio
 24382  133348      0      0  3     0x14280  nfsidl        nfsio
  2646  441692      0      0  3     0x14280  nfsidl        nfsio
 71879   67751  10386      0  3        0x82  nanoslp       syz-executor.7
 11167   39493  10386      0  3        0x82  nanoslp       syz-executor.4
 50570   32440  10386      0  2         0x2                syz-executor.2
 82008  242714  10386      0  3        0x82  piperd        syz-executor.1
 10386  196013  71745      0  3        0x82  wait          syz-fuzzer
 10386  489622  71745      0  3   0x4000082  nanoslp       syz-fuzzer
 10386  115581  71745      0  3   0x4000082  wait          syz-fuzzer
 10386  340112  71745      0  3   0x4000082  thrsleep      syz-fuzzer
 10386  302137  71745      0  3   0x4000082  wait          syz-fuzzer
 10386  321090  71745      0  3   0x4000082  thrsleep      syz-fuzzer
 10386   45505  71745      0  3   0x4000082  thrsleep      syz-fuzzer
 10386  337899  71745      0  3   0x4000082  thrsleep      syz-fuzzer
 10386  401689  71745      0  3   0x4000082  wait          syz-fuzzer
 10386  201432  71745      0  3   0x4000082  wait          syz-fuzzer
 10386  413621  71745      0  3   0x4000082  wait          syz-fuzzer
 10386  327345  71745      0  3   0x4000082  wait          syz-fuzzer
 10386  150737  71745      0  3   0x4000082  wait          syz-fuzzer
 10386  370472  71745      0  3   0x4000082  kqread        syz-fuzzer
 71745   12932   3709      0  3    0x10008a  sigsusp       ksh
  3709   39197  42987      0  3        0x9a  kqread        sshd
 46969   47670      1      0  3    0x100083  ttyin         getty
 42987  139503      1      0  3        0x88  kqread        sshd
 59185  313347  28749     73  2   0x1100090                syslogd
 28749  374232      1      0  3    0x100082  netio         syslogd
 26044  512353      1      0  3    0x100080  kqread        resolvd
 30936   63118  37031     77  3    0x100092  kqread        dhcpleased
 14514   29593  37031     77  3    0x100092  kqread        dhcpleased
 37031  192721      1      0  3        0x80  kqread        dhcpleased
 67182  229356      0      0  3     0x14200  bored         smr
 82176  478593      0      0  2     0x14200                zerothread
 76675  181699      0      0  3     0x14200  aiodoned      aiodoned
 48661  190832      0      0  3     0x14200  syncer        update
 57838  195232      0      0  3     0x14200  cleaner       cleaner
 86374  202012      0      0  3     0x14200  reaper        reaper
 82626   53932      0      0  3     0x14200  pgdaemon      pagedaemon
 14727   72612      0      0  3     0x14200  bored         viomb
 77582  376253      0      0  3  0x40014200  acpi0         acpi0
 86342  332842      0      0  3     0x14200  bored         softnet
 80932   70621      0      0  3     0x14200  bored         softnet
 20822  445750      0      0  3     0x14200  bored         softnet
 22125  268950      0      0  3     0x14200  bored         softnet
 47330  431063      0      0  3     0x14200  bored         systqmp
 81706  288172      0      0  3     0x14200  bored         systq
 20869   23451      0      0  3  0x40014200  bored         softclock
 99227  120214      0      0  3  0x40014200                idle0
     1  173430      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10181   6418K    6814K  78643K     12734        0
            pcb    13     15K      20K  78643K       637        0
         rtable   196     14K      16K  78643K       836        0
         ifaddr    67     15K      17K  78643K       190        0
       counters    27     17K      17K  78643K        56        0
       ioctlops     0      0K       4K  78643K       185        0
            iov     0      0K      16K  78643K       148        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1404     88K      88K  78643K      3799        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         8        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      0K       0K  78643K       700        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    14     49K      69K  78643K      1987        0
          sigio     0      0K       0K  78643K         3        0
           proc    58     59K      83K  78643K       918        0
        subproc   104      6K       6K  78643K       208        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       175        0
       in_multi    78      5K       6K  78643K       213        0
    ether_multi     1      0K       0K  78643K         4        0
            mrt     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    49    228K     228K  78643K        49        0
           exec     0      0K       1K  78643K       578        0
     pfkey data     0      0K       0K  78643K         3        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   292    325K     326K  78643K     13668        0
       UVM aobj    98      3K       3K  78643K       101        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        30        0
            NDP    11      0K       1K  78643K        66        0
           temp   124   4694K    5718K  78643K     22024        0
         kqueue    12     18K      22K  78643K       137        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      131    0      128     2     1     1     2     0     8    0
rtentry    112      215    0      130     4     0     4     4     0     8    0
unpcb      144     3158    0     3145    15    11     4     6     0     8    3
syncache   296       13    0       13     4     3     1     1     0     8    1
tcpqe       32      110    0      110     3     2     1     1     0     8    1
tcpcb      776     1981    0     1975    45    37     8    14     0     8    7
arp         88       34    0       18     1     0     1     1     0     8    0
ipq         40        1    0        1     1     1     0     1     0     8    0
ipqe        40        3    0        3     1     1     0     1     0     8    0
inpcb      336     3394    0     3385    53    43    10    21     0     8    8
nd6         48       49    0       31     1     0     1     1     0     8    0
pkpcb       40        3    0        3     1     1     0     1     0     8    0
kcovpl      48       16    0        8     1     0     1     1     0     8    0
ppxss      1160       9    0        9     2     2     0     1     0     8    0
pppxif     1352       6    0        6     1     1     0     1     0     8    0
pfosfp      40       67    0       66     1     0     1     1     0     8    0
pfosfpen   112       67    0       66     1     0     1     1     0     8    0
pfanchor   1280     826    0      649    20     0    20    20     0     8    3
art_heap8  4096       3    0        2     2     1     1     2     0     8    0
art_heap4  256      931    0      569    34    11    23    30     0     8    0
art_table   32      934    0      571     4     0     4     4     0     8    0
art_node    16      214    0      140     1     0     1     1     0     8    0
sysvmsgpl   40       62    0       42     1     0     1     1     0     8    0
semupl     112        6    0        6     1     1     0     1     0     8    0
semapl     112      698    0      688     1     0     1     1     0     8    0
shmpl      112       98    0        3     4     1     3     3     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     4120    0     2682    91     0    91    91     0     8    0
ffsino     240     4120    0     2682    85     0    85    85     0     8    0
nchpl      144     8038    0     6407    63     0    63    63     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   29279    0    29279     2     1     1     2     0     8    1
vcpupl     2048      18    0        0     3     0     3     3     0     8    0
vmpool     536       18    0        0     2     0     2     2     0     8    0
kstatmem   264       68    0       46     2     0     2     2     0     8    0
scxspl     216    19088    0    19088     9     8     1     8     0     8    1
plimitpl   152      204    0      188     1     0     1     1     0     8    0
sigapl     424     2285    0     2222     8     0     8     8     0     8    0
futexpl     64    28407    0    28404     1     0     1     1     0     8    0
knotepl    120    28001    0    27921    15    10     5     8     0     8    2
kqueuepl   184      439    0      431     6     5     1     4     0     8    0
pipepl     288      364    0      336     5     2     3     5     0     8    0
fdescpl    432     2247    0     2222     4     0     4     4     0     8    0
filepl     120    19668    0    19429    27    15    12    15     0     8    4
lockfpl    104      295    0      293     2     1     1     2     0     8    0
lockfspl    48      145    0      143     1     0     1     1     0     8    0
sessionpl  144       31    0       15     1     0     1     1     0     8    0
pgrppl      48       31    0       15     1     0     1     1     0     8    0
ucredpl    104     2138    0     2127     1     0     1     1     0     8    0
zombiepl   144     2222    0     2222     1     0     1     1     0     8    1
processpl  1008    2285    0     2222    10     1     9     9     0     8    0
procpl     672     5028    0     4948    12     3     9     9     0     8    0
sosppl     168       14    0       14     4     4     0     1     0     8    0
sockpl     456     6686    0     6661   146   134    12    34     0     8    8
mcl64k     65536     49    0       49     5     4     1     1     0     8    1
mcl16k     16384    246    0      246     1     0     1     1     0     8    1
mcl12k     12288     38    0       38     5     4     1     1     0     8    1
mcl9k      9216      15    0       15     3     3     0     1     0     8    0
mcl8k      8192      83    0       83     4     3     1     1     0     8    1
mcl4k      4096     210    0      210     1     0     1     1     0     8    1
mcl2k2     2112       7    0        7     4     3     1     1     0     8    1
mcl2k      2048   76105    0    76036    36    26    10    32     0     8    0
mtagpl      96      146    0      123     4     2     2     3     0     8    0
mbufpl     256   142957    0   142684   196   163    33    69     0     8    8
bufpl      288     6554    0      281   449     0   449   449     0     8    0
anonpl      24   443120    0   426829   111     4   107   107     0   188    3
amapchunkpl 152   38287    0    37616    34     4    30    30     0   158    2
amappl16   200     5005    0     4470    34     2    32    32     0     8    3
amappl15   192        5    0        5     1     1     0     1     0     8    0
amappl14   184      175    0      163     2     1     1     2     0     8    0
amappl13   176        3    0        2     1     0     1     1     0     8    0
amappl12   168      492    0      490     1     0     1     1     0     8    0
amappl11   160       48    0       37     1     0     1     1     0     8    0
amappl10   152       36    0       28     1     0     1     1     0     8    0
amappl9    144      946    0      945     1     0     1     1     0     8    0
amappl8    136      164    0      106     2     0     2     2     0     8    0
amappl7    128       52    0       38     1     0     1     1     0     8    0
amappl6    120      340    0      325     2     1     1     2     0     8    0
amappl5    112      101    0       93     1     0     1     1     0     8    0
amappl4    104      788    0      763     2     1     1     2     0     8    0
amappl3     96     5727    0     5678     2     0     2     2     0     8    0
amappl2     88     2765    0     2699     3     1     2     3     0     8    0
amappl1     80    51862    0    51201    21     5    16    21     0     8    0
amappl      88    13288    0    13115     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      100    0        3     2     0     2     2     0     8    0
uaddrrnd    24     2265    0     2222     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2265    0     2222     1     0     1     1     0     8    0
vmmpekpl   168    19598    0    19542     3     0     3     3     0     8    0
vmmpepl    168   210264    0   207839   157    32   125   141     0   357    6
vmsppl     272     2264    0     2222     5     1     4     4     0     8    0
rwobjpl     24    61251    0    53636    47     0    47    47     0     8    0
pdppl      4096    4536    0     4462   208   126    82    82     0     8    8
pvpl        32   939392    0   918039   263    75   188   255     0   265    4
pmappl     216     2264    0     2222     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1186    0      383    24     0    24    24     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
kcov_remote_enter(0,ffff8000217347f0) at kcov_remote_enter+0x112 sys/dev/kcov.c:672
timeout_run(ffff800021703b00) at timeout_run+0x80 sys/kern/kern_timeout.c:639
softclock_process_tick_timeout(ffff800021703b00,0) at softclock_process_tick_timeout+0x1ac sys/kern/kern_timeout.c:688
softclock(0) at softclock+0x130 sys/kern/kern_timeout.c:711
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7ffffd4500, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
kcov_remote_enter(0,ffff8000217347f0) at kcov_remote_enter+0x112 sys/dev/kcov.c:672
timeout_run(ffff800021703b00) at timeout_run+0x80 sys/kern/kern_timeout.c:639
softclock_process_tick_timeout(ffff800021703b00,0) at softclock_process_tick_timeout+0x1ac sys/kern/kern_timeout.c:688
softclock(0) at softclock+0x130 sys/kern/kern_timeout.c:711
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7ffffd4500, count: -6

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-main 2022/11/30 00:07 openbsd 77e4b1bd8000 579a3740 .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: kcov_remote_enter
* Struck through repros no longer work on HEAD.