syzbot


uvm_fault: sysctl_diskinit

Status: fixed on 2021/12/23 05:51
Reported-by: syzbot+807423f6868bbfb836bc@syzkaller.appspotmail.com
Fix commit: 278923c07fda While malloc sleeps, the disk list could change during sysctl. Then allocated memory could be too short for the list of disks. Retry allocating enough space until it did not change. The disk list and duid memory are protected by kernel lock. Use asserts to mark this explicitly. Reported-by: syzbot+807423f6868bbfb836bc@syzkaller.appspotmail.com OK anton@ mpi@
First crash: 855d, last: 855d

Sample crash report:
uvm_fault(0xfffffd8068c11aa0, 0x2f, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      sysctl_diskinit+0x80:   movq    0x30(%rbx),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*487949  39802      0           0  0x4000000    0  syz-executor.0
sysctl_diskinit(1,ffffffff82756910) at sysctl_diskinit+0x80 sys/kern/kern_sysctl.c:2143
hw_sysctl(ffff8000216ed454,1,0,ffff8000216ed488,0,0,d6a5cf73bdeaf3e0) at hw_sysctl+0x61a sys/kern/kern_sysctl.c:706
sys_sysctl(ffff8000216d3ce8,ffff8000216ed4f8,ffff8000216ed550) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:250
syscall(ffff8000216ed5c0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xec237694f0, count: 10
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd8068c11aa0, 0x2f, 0, 1) -> e
ddb> trace
sysctl_diskinit(1,ffffffff82756910) at sysctl_diskinit+0x80 sys/kern/kern_sysctl.c:2143
hw_sysctl(ffff8000216ed454,1,0,ffff8000216ed488,0,0,d6a5cf73bdeaf3e0) at hw_sysctl+0x61a sys/kern/kern_sysctl.c:706
sys_sysctl(ffff8000216d3ce8,ffff8000216ed4f8,ffff8000216ed550) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:250
syscall(ffff8000216ed5c0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xec237694f0, count: -5
ddb> show registers
rdi               0xffff800023100000
rsi                             0x1c
rbp               0xffff8000216ed390
rbx               0xffffffffffffffff
rdx               0xffff800023100000
rcx                             0x1b
rax               0xffffffff812d5066    sysctl_diskinit+0xb6
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xdc47733255ca48af
r11                0x4f5ea5432132c0b
r12                             0x2b
r13                                0
r14               0xffff8000006b3024
r15                              0x1
rip               0xffffffff812d5030    sysctl_diskinit+0x80
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000216ed340
ss                              0x10
sysctl_diskinit+0x80:   movq    0x30(%rbx),%r14
ddb> show proc
PROC (syz-executor.0) pid=487949 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=86, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff8000216d2d28,0xffffffff82860290
    process=0xffff800024b80fd8 user=0xffff8000216e8000, vmspace=0xfffffd8068c11aa0
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 39802    9358   6741      0  2           0                syz-executor.0
*39802  487949   6741      0  7   0x4000000                syz-executor.0
  6741   34948  80871      0  3        0x82  nanoslp       syz-executor.0
 67027    4328  80871      0  2         0x2                syz-executor.1
 18969  394341      0      0  3     0x14200  acct          acct
 13125   75753      0      0  3     0x14200  bored         sosplice
 91253  459408      0      0  3     0x14280  nfsidl        nfsio
  9984   46451      0      0  3     0x14280  nfsidl        nfsio
 37728  121934      0      0  3     0x14280  nfsidl        nfsio
 36704  445375      0      0  3     0x14280  nfsidl        nfsio
 33179  475640      0      0  3     0x14280  nfsidl        nfsio
 24527  186083      0      0  3     0x14280  nfsidl        nfsio
 32102  433486      0      0  3     0x14280  nfsidl        nfsio
 63889  148801      0      0  3     0x14280  nfsidl        nfsio
 73990  280138      0      0  3     0x14280  nfsidl        nfsio
 34707  445580      0      0  3     0x14280  nfsidl        nfsio
 53572   50587      0      0  3     0x14280  nfsidl        nfsio
 31365  496218      0      0  3     0x14280  nfsidl        nfsio
 81093  225377      0      0  3     0x14280  nfsidl        nfsio
 78678   97451      0      0  3     0x14280  nfsidl        nfsio
 73872  412808      0      0  3     0x14280  nfsidl        nfsio
 25641  191032      0      0  3     0x14280  nfsidl        nfsio
 67506  257031      0      0  3     0x14280  nfsidl        nfsio
 21970  266003      0      0  3     0x14280  nfsidl        nfsio
 29699  261539      0      0  3     0x14280  nfsidl        nfsio
 91168  194471      0      0  3     0x14280  nfsidl        nfsio
 80871   96022    736      0  3        0x82  thrsleep      syz-fuzzer
 80871  241763    736      0  3   0x4000082  nanoslp       syz-fuzzer
 80871  147324    736      0  3   0x4000082  thrsleep      syz-fuzzer
 80871  506176    736      0  3   0x4000082  thrsleep      syz-fuzzer
 80871  408049    736      0  3   0x4000082  thrsleep      syz-fuzzer
 80871   29082    736      0  3   0x4000082  kqread        syz-fuzzer
   736  313662  85813      0  3    0x10008a  sigsusp       ksh
 85813  384847  10573      0  3        0x9a  kqread        sshd
 68731  419303      1      0  3    0x100083  ttyin         getty
 10573  194876      1      0  3        0x88  kqread        sshd
 36630  141191  22160     73  3    0x100090  kqread        syslogd
 22160  145792      1      0  3    0x100082  netio         syslogd
 44795  466220      1      0  3    0x100080  kqread        resolvd
 64281  345796  77092     77  3    0x100092  kqread        dhcpleased
 27935  348410  77092     77  3    0x100092  kqread        dhcpleased
 77092   20720      1      0  3        0x80  kqread        dhcpleased
 55090  493920      0      0  3     0x14200  bored         smr
 15263  131650      0      0  2     0x14200                zerothread
 32299  245987      0      0  3     0x14200  aiodoned      aiodoned
 86805   37188      0      0  3     0x14200  syncer        update
 72889  513102      0      0  3     0x14200  cleaner       cleaner
 80765  361937      0      0  3     0x14200  reaper        reaper
  5613  293039      0      0  3     0x14200  pgdaemon      pagedaemon
 18808  214379      0      0  3     0x14200  bored         viomb
 49073  500983      0      0  3  0x40014200  acpi0         acpi0
 56678  212817      0      0  3     0x14200  bored         softnet
 65184  467875      0      0  3     0x14200  bored         systqmp
 95015  106142      0      0  3     0x14200  bored         systq
 29558  408848      0      0  3  0x40014200  bored         softclock
 84755  152086      0      0  3  0x40014200                idle0
     1  383846      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10144   6390K    6843K  78643K     15870        0
            pcb    13     16K      18K  78643K      1280        0
         rtable   157     26K      27K  78643K      3832        0
         ifaddr    66     18K      19K  78643K       981        0
       counters    21     16K      16K  78643K       110        0
       ioctlops     0      0K       4K  78643K       894        0
            iov     0      0K      16K  78643K       409        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1306     82K      82K  78643K      3898        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K        27        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      0K       0K  78643K       580        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12598        0
      file desc     5     13K      25K  78643K      4108        0
          sigio     0      0K       0K  78643K        11        0
           proc    59     55K      63K  78643K      1455        0
        subproc    26      1K       1K  78643K       510        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       234        0
       in_multi    39      2K       2K  78643K       681        0
    ether_multi     1      0K       0K  78643K        98        0
            mrt     1      0K       0K  78643K        28        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   229   1023K    1023K  78643K       229        0
           exec     0      0K       2K  78643K      1702        0
     pfkey data     0      0K       1K  78643K         4        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   273    421K     422K  78643K     49589        0
       UVM aobj    81      3K       3K  78643K        81        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K       314        0
            NDP     6      0K       0K  78643K       181        0
           temp    85   4198K    6223K  78643K     58293        0
         kqueue    12     18K      24K  78643K       184        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      397    0      394     5     4     1     3     0     8    0
rtentry    112      510    0      473     4     2     2     2     0     8    0
unpcb      128     2553    0     2540    29    27     2     5     0     8    1
syncache   296       21    0       21     8     8     0     1     0     8    0
tcpqe       32       55    0       55     6     6     0     1     0     8    0
tcpcb      736     1522    0     1516    68    61     7    10     0     8    6
arp         88       82    0       76     1     0     1     1     0     8    0
ipq         40       10    0       10     4     4     0     1     0     8    0
ipqe        40      153    0      153     4     4     0     1     0     8    0
inpcb      304     4863    0     4854    89    78    11    16     0     8   10
rttmr       72       11    0       11     4     4     0     1     0     8    0
nd6         48      128    0      122     1     0     1     1     0     8    0
pkpcb       40       21    0       21     4     3     1     1     0     8    1
kcovpl      48       39    0       37     1     0     1     1     0     8    0
ppxss      1152      41    0       41     2     2     0     1     0     8    0
pfstscr     40        7    0        6     1     0     1     1     0     8    0
pfrktable  1344    1173    0     1144     4     1     3     3     0     8    0
pftag       88      104    0       96     1     0     1     1     0     8    0
pfstitem    24        5    0        3     1     0     1     1     0     8    0
pfstkey    112       24    0       22     1     0     1     1     0     8    0
pfstate    320       12    0       11     1     0     1     1     0     8    0
pfrule     1360     456    0      372    11     3     8     8     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     2107    0     1920    24    12    12    14     0     8    0
art_table   32     2108    0     1920     2     0     2     2     0     8    0
art_node    16      509    0      479     1     0     1     1     0     8    0
sysvmsgpl   40       57    0       45     2     1     1     1     0     8    0
semupl     112        3    0        3     1     1     0     1     0     8    0
semapl     112      578    0      568     1     0     1     1     0     8    0
shmpl      112       78    0        0     3     0     3     3     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     7858    0     6449    89     0    89    89     0     8    0
ffsino     240     7858    0     6449    84     0    84    84     0     8    0
nchpl      144    13303    0    11711    60     0    60    60     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     224     5926    0        0   349     0   349   349     0     8    0
namei      1024   49692    0    49692     3     2     1     1     0     8    1
vcpupl     1984      28    0        0     4     0     4     4     0     8    0
vmpool     528       40    0       12     2     0     2     2     0     8    0
pfiaddrpl  120      456    0      401     2     0     2     2     0     8    0
scxspl     216    48170    0    48170    13    10     3     8     0     8    3
plimitpl   152      615    0      607     1     0     1     1     0     8    0
sigapl     424     4250    0     4199     6     0     6     6     0     8    0
futexpl     64    39255    0    39255     5     4     1     1     0     8    1
knotepl    112    31243    0    31200     2     0     2     2     0     8    0
kqueuepl   184     1303    0     1295    20    19     1     4     0     8    0
pipepl     304      814    0      804    15    13     2     6     0     8    1
fdescpl    432     4213    0     4197     8     6     2     3     0     8    0
filepl     120    32660    0    32559    55    47     8    10     0     8    4
lockfpl    104     1108    0     1106     2     1     1     2     0     8    0
lockfspl    48      333    0      331     1     0     1     1     0     8    0
sessionpl  144       54    0       44     1     0     1     1     0     8    0
pgrppl      48       57    0       47     1     0     1     1     0     8    0
ucredpl     96     5116    0     5105     1     0     1     1     0     8    0
zombiepl   144     4199    0     4199     1     0     1     1     0     8    1
processpl  1000    4250    0     4199     8     1     7     7     0     8    0
procpl     672    10763    0    10706    16    10     6     7     0     8    0
sosppl     168       12    0       12     4     4     0     1     0     8    0
sockpl     448     7838    0     7813   178   160    18    25     0     8   15
mcl64k     65536    159    0      159    15    14     1     1     0     8    1
mcl16k     16384     62    0       62    12    12     0     1     0     8    0
mcl12k     12288     91    0       91    15    14     1     1     0     8    1
mcl9k      9216      92    0       92    13    12     1     1     0     8    1
mcl8k      8192     438    0      438    10     9     1     1     0     8    1
mcl4k      4096     655    0      655    11    10     1     1     0     8    1
mcl2k2     2112      45    0       45    11    11     0     1     0     8    0
mcl2k      2048   83807    0    83764    24    16     8    11     0     8    0
mtagpl      96      617    0      617    10     9     1     4     0     8    1
mbufpl     256   164399    0   164210    80    63    17    31     0     8    1
bufpl      288    13387    0     6988   458     0   458   458     0     8    0
anonpl      24  1147414    0  1129868   159    51   108   126     0   188    0
amapchunkpl 152  122279    0   121687    82    57    25    38     0   158    2
amappl16   200     9331    0     8707    55    21    34    45     0     8    1
amappl15   192      412    0      405     1     0     1     1     0     8    0
amappl14   184      449    0      446     1     0     1     1     0     8    0
amappl13   176      434    0      433     1     0     1     1     0     8    0
amappl12   168      330    0      329     1     0     1     1     0     8    0
amappl11   160     1014    0      998     1     0     1     1     0     8    0
amappl10   152      618    0      615     1     0     1     1     0     8    0
amappl9    144      317    0      314     1     0     1     1     0     8    0
amappl8    136     1775    0     1736     2     0     2     2     0     8    0
amappl7    128     1046    0     1041     1     0     1     1     0     8    0
amappl6    120      290    0      282     1     0     1     1     0     8    0
amappl5    112     3664    0     3646     1     0     1     1     0     8    0
amappl4    104     3058    0     3034     1     0     1     1     0     8    0
amappl3     96      905    0      887     1     0     1     1     0     8    0
amappl2     88     4953    0     4912     2     0     2     2     0     8    0
amappl1     80    74217    0    73804    21    11    10    12     0     8    0
amappl      88    47994    0    47827     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       80    0        0     2     0     2     2     0     8    0
uaddrrnd    24     4253    0     4209     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     4253    0     4209     1     0     1     1     0     8    0
vmmpekpl   168    32189    0    32161     2     0     2     2     0     8    0
vmmpepl    168   400734    0   398924   274   166   108   112     0   357   22
vmsppl     272     4252    0     4209     4     1     3     3     0     8    0
rwobjpl     24    95712    0    88350    45     0    45    45     0     8    0
pdppl      4096    8512    0     8446   106    38    68    68     0     8    2
pvpl        32  2118805    0  2097855   329   156   173   227     0   265    4
pmappl     216     4252    0     4209     4     1     3     3     0     8    0
extentpl    40       57    0       38     1     0     1     1     0     8    0
phpool     112     1184    0      403    23     0    23    23     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
sysctl_diskinit(1,ffffffff82756910) at sysctl_diskinit+0x80 sys/kern/kern_sysctl.c:2143
hw_sysctl(ffff8000216ed454,1,0,ffff8000216ed488,0,0,d6a5cf73bdeaf3e0) at hw_sysctl+0x61a sys/kern/kern_sysctl.c:706
sys_sysctl(ffff8000216d3ce8,ffff8000216ed4f8,ffff8000216ed550) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:250
syscall(ffff8000216ed5c0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xec237694f0, count: -5
ddb> machine ddbcpu 1
No such command
ddb> trace
sysctl_diskinit(1,ffffffff82756910) at sysctl_diskinit+0x80 sys/kern/kern_sysctl.c:2143
hw_sysctl(ffff8000216ed454,1,0,ffff8000216ed488,0,0,d6a5cf73bdeaf3e0) at hw_sysctl+0x61a sys/kern/kern_sysctl.c:706
sys_sysctl(ffff8000216d3ce8,ffff8000216ed4f8,ffff8000216ed550) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:250
syscall(ffff8000216ed5c0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xec237694f0, count: -5

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/16 22:58 openbsd 0eeaa5490dc5 8dd6a5e3 .config console log report ci-openbsd-main uvm_fault: sysctl_diskinit
* Struck through repros no longer work on HEAD.