syzbot


uvm_fault: wsmux_detach_sc

Status: fixed on 2019/02/19 05:10
Reported-by: syzbot+03f7377a9848d7d008c9@syzkaller.appspotmail.com
Fix commit: 0c0bf6318018 Serialize access to the list of attached child devices belonging to a wsmux. When invoking wsevsrc_* functions on a attached child device, underlying driver can sleep; this introduces a race where another thread is able to modify the list leading to all kinds of corruptions.
First crash: 1396d, last: 1385d
duplicates (2):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
uvm_fault: wsmux_do_ioctl (3) C 2 1384d 1392d 0/3 closed as dup on 2019/02/10 09:16
uvm_fault: wsmux_mux_close 1 1406d 1406d 0/3 closed as dup on 2019/02/08 09:54

Sample crash report:
uvm_fault(0xfffffd807f00d708, 0x9f, 0, 2) -> e
kernel: page fault trap, code=0
Stopped at      wsmux_detach_sc+0xcc:   movq    %rcx,0(%rax)
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xfffffd807f00d708, 0x9f, 0, 2) -> e
wsmux_detach_sc(ffff80000064dc00) at wsmux_detach_sc+204
end trace frame: 0xffff800020c4d440, count: 0
ddb{0}> trace
wsmux_detach_sc(ffff80000064dc00) at wsmux_detach_sc+204
wsmouseopen(4400,11,2000,ffff800020b42720) at wsmouseopen+233
spec_open(ffff800020c4d4c0) at spec_open+535
VOP_OPEN(fffffd8079f255a8,11,fffffd807f7c7c00,ffff800020b42720) at VOP_OPEN+118
vn_open(ffff800020c4d6b0,11,20) at vn_open+1222
doopenat(ffff800020b42720,ffffff9c,20000100,10,20,ffff800020c4d8f0) at doopenat+702
syscall(ffff800020c4d9a0) at syscall+1452
Xsyscall(6,0,ffffffffffffffa9,0,3,2adf008c0d8) at Xsyscall+296
end of kernel
end trace frame: 0x2b0c6b6e810, count: -8
ddb{0}> show registers
rdi                                0
rsi                                0
rbp             18446603336770966496
rbx                                0
rdx             18446744071594831341    substchar+87448
rcx             18446744073709551615
rax                              159
r8              18446744071593365349    setrunnable+149
r9                                 5
r10              4684198052002171014
r11             12183042518257316167
r12             18446603336221355448
r13                             5984    __ALIGN_SIZE+1888
r14             18446603336227806208
r15                                1
rip             18446744071589157356    wsmux_detach_sc+204
cs                                 8
rflags                         66182    __ALIGN_SIZE+62086
rsp             18446603336770966448
ss                                16
wsmux_detach_sc+204:    movq    %rcx,0(%rax)
ddb{0}> show proc
PROC (syz-executor.0) pid=384617 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=0, usrpri=79, nice=20
    forw=0xffffffffffffffff, list=0xffff800020b439e0,0xffffffff8230d660
    process=0xffff800020b44010 user=0xffff800020c48000, vmspace=0xfffffd807f00d708
    estcpu=29, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}> 

Crashes (10):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2019/02/12 19:52 openbsd 9a16e8505bdc 6ecc6d0f .config log report syz
ci-openbsd-multicore 2019/02/10 01:14 openbsd 4071f8002cf2 d75f7686 .config log report syz
ci-openbsd-multicore 2019/02/16 16:56 openbsd f4f0873d2d98 f42dee6d .config log report
ci-openbsd-multicore 2019/02/15 19:14 openbsd 64a70754a42c f6f233c0 .config log report
ci-openbsd-multicore 2019/02/12 19:21 openbsd 9a16e8505bdc 6ecc6d0f .config log report
ci-openbsd-multicore 2019/02/10 00:56 openbsd 4071f8002cf2 d75f7686 .config log report
ci-openbsd-multicore 2019/02/09 23:20 openbsd 4071f8002cf2 d75f7686 .config log report
ci-openbsd-multicore 2019/02/08 13:25 openbsd e11291e4b0ca aa4feb03 .config log report
ci-openbsd-multicore 2019/02/05 15:22 openbsd 6e31582a5a78 d672172c .config log report
ci-openbsd-multicore 2019/02/05 07:14 openbsd 6e31582a5a78 d672172c .config log report
* Struck through repros no longer work on HEAD.