syzbot


panic: solock: lock not held

Status: fixed on 2022/09/04 16:17
Reported-by: syzbot+fc6901d63d858d5dd00a@syzkaller.appspotmail.com
Fix commit: 536333f5835e Use pru_send function to check socket splicing compatibility. Only checking socket type is not sufficient as it could splice together unix and inet sockets resulting in crashes. As splicing is about sending, the same send function looks like a good criteria. Reported-by: syzbot+fc6901d63d858d5dd00a@syzkaller.appspotmail.com Reported-by: syzbot+0e026f1bf8b259c6395e@syzkaller.appspotmail.com OK gnezdo@
First crash: 89d, last: 89d

Sample crash report:
panic: solock: lock not held
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*271955  13457      0         0x2          0    0  syz-executor2927269727
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8254949d) at panic+0x161 sys/kern/subr_prf.c:198
rw_assert_wrlock(fffffd806e6e9738) at rw_assert_wrlock+0xb7 sys/kern/kern_rwlock.c:388
somove(fffffd806ceddc90,1) at somove+0x25d sbspace sys/sys/socketvar.h:209 [inline]
somove(fffffd806ceddc90,1) at somove+0x25d sys/kern/uipc_socket.c:1487
sosplice(fffffd806ceddc90,3,0,0) at sosplice+0x502 sys/kern/uipc_socket.c:1346
sosetopt(fffffd806ceddc90,ffff,1023,fffffd8075748f00) at sosetopt+0x7ec
sys_setsockopt(ffff8000ffff8d28,ffff80002174b348,ffff80002174b3a0) at sys_setsockopt+0x1f5 sys/kern/uipc_syscalls.c:1233
syscall(ffff80002174b410) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe63d0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: solock: lock not held
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8254949d) at panic+0x161 sys/kern/subr_prf.c:198
rw_assert_wrlock(fffffd806e6e9738) at rw_assert_wrlock+0xb7 sys/kern/kern_rwlock.c:388
somove(fffffd806ceddc90,1) at somove+0x25d sbspace sys/sys/socketvar.h:209 [inline]
somove(fffffd806ceddc90,1) at somove+0x25d sys/kern/uipc_socket.c:1487
sosplice(fffffd806ceddc90,3,0,0) at sosplice+0x502 sys/kern/uipc_socket.c:1346
sosetopt(fffffd806ceddc90,ffff,1023,fffffd8075748f00) at sosetopt+0x7ec
sys_setsockopt(ffff8000ffff8d28,ffff80002174b348,ffff80002174b3a0) at sys_setsockopt+0x1f5 sys/kern/uipc_syscalls.c:1233
syscall(ffff80002174b410) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe63d0, count: -9
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002174b070
rbx               0xfffffd806db27e70
rdx                            0x3fd
rcx                                0
rax                             0x1d
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x425b64e9ab0ef53b
r11               0x2fe59630fd07f3c0
r12                                0
r13               0xfffffd806e6e9730
r14                                0
r15                              0x1
rip               0xffffffff8101e5c8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80002174b060
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor2927269727) pid=271955 stat=onproc
    flags process=2<EXEC> proc=0
    pri=53, usrpri=53, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff9268,0xffff8000ffff87f8
    process=0xffff8000ffff67e0 user=0xffff800021746000, vmspace=0xfffffd807f015550
    estcpu=3, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  4655  217207      0      0  2     0x14200                sosplice
*13457  271955  72723      0  7         0x2                syz-executor2927269727
 72723  141816  67221      0  3    0x10008a  sigsusp       ksh
 67221  269554  94986      0  3        0x9a  kqread        sshd
 54694  211501      1      0  3    0x100083  ttyin         getty
 94986  373470      1      0  3        0x88  kqread        sshd
 58889  334135  37532     73  3   0x1100090  kqread        syslogd
 37532  191770      1      0  3    0x100082  netio         syslogd
  5947  204274      1      0  3    0x100080  kqread        resolvd
  2551  364905  29348     77  3    0x100092  kqread        dhcpleased
  6086  437420  29348     77  3    0x100092  kqread        dhcpleased
 29348  293629      1      0  3        0x80  kqread        dhcpleased
 25149  212412      0      0  3     0x14200  bored         smr
  5209  151513      0      0  2     0x14200                zerothread
 40870  223450      0      0  3     0x14200  aiodoned      aiodoned
 61676  407395      0      0  3     0x14200  syncer        update
 44274  492729      0      0  3     0x14200  cleaner       cleaner
 63355  240026      0      0  3     0x14200  reaper        reaper
   649  414813      0      0  3     0x14200  pgdaemon      pagedaemon
 32650  455360      0      0  3     0x14200  bored         viomb
 32181  505583      0      0  3  0x40014200  acpi0         acpi0
 77529  495739      0      0  3     0x14200  bored         softnet
 17943  339211      0      0  3     0x14200  bored         softnet
 54514  219560      0      0  3     0x14200  bored         softnet
 57844  150961      0      0  3     0x14200  bored         softnet
 28068  484160      0      0  3     0x14200  bored         systqmp
 77188  513171      0      0  3     0x14200  bored         systq
 24482   85774      0      0  3  0x40014200  bored         softclock
 82156  246005      0      0  3  0x40014200                idle0
     1   86364      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10144   6382K    6413K  78643K     11234        0
            pcb    13      8K       8K  78643K        13        0
         rtable    58      1K       2K  78643K       111        0
         ifaddr    25      7K       7K  78643K        25        0
       counters    19     16K      16K  78643K        19        0
       ioctlops     0      0K       2K  78643K        25        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1166     73K      73K  78643K      1179        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc     1      0K       0K  78643K         1        0
           proc    55     58K      59K  78643K       226        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    25    122K     122K  78643K        25        0
           exec     0      0K       2K  78643K       410        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap    53      3K       5K  78643K      1311        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     3      0K       0K  78643K         3        0
           temp    18   4705K    4769K  78643K      2343        0
         kqueue    11     16K      18K  78643K        24        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       21    0       18     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      144       35    0       20     1     0     1     1     0     8    0
syncache   296        5    0        5     2     1     1     1     0     8    1
tcpcb      768        9    0        5     1     0     1     1     0     8    0
arp         88        2    0        0     1     0     1     1     0     8    0
inpcb      336       26    0       19     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1415    0       38    87     0    87    87     0     8    0
ffsino     240     1415    0       38    81     0    81    81     0     8    0
nchpl      144     1600    0       46    58     0    58    58     0     8    0
uvmvnodes   80     1424    0        0    30     0    30    30     0     8    0
vnodes     216     1424    0        0    80     0    80    80     0     8    0
namei      1024    4155    0     4155     2     1     1     1     0     8    1
kstatmem   264        6    0        0     1     0     1     1     0     8    0
scxspl     216     3661    0     3661     2     1     1     2     0     8    1
plimitpl   152       15    0        9     1     0     1     1     0     8    0
sigapl     424      306    0      276     4     0     4     4     0     8    0
knotepl    120     5703    0     5674     3     1     2     2     0     8    1
kqueuepl   184       20    0       13     1     0     1     1     0     8    0
pipepl     288       83    0       80     2     1     1     1     0     8    0
fdescpl    432      289    0      276     2     0     2     2     0     8    0
filepl     120     1070    0     1014     2     0     2     2     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl    104       64    0       54     1     0     1     1     0     8    0
zombiepl   144      276    0      276     2     1     1     1     0     8    1
processpl  1000     306    0      276     5     1     4     5     0     8    0
procpl     672      306    0      276     3     0     3     3     0     8    0
sosppl     168        2    0        0     1     0     1     1     0     8    0
sockpl     456       82    0       57     4     0     4     4     0     8    0
mcl8k      8192       9    0        9     2     1     1     1     0     8    1
mcl4k      4096       5    0        5     2     1     1     1     0     8    1
mcl2k      2048    5477    0     5439     8     1     7     7     0     8    1
mtagpl      96        4    0        4     1     1     0     1     0     8    0
mbufpl     256    10050    0     9966     7     0     7     7     0     8    1
bufpl      288     1905    0       77   131     0   131   131     0     8    0
anonpl      24    36220    0    34444    15     3    12    13     0   188    1
amapchunkpl 152    2672    0     2584     5     1     4     5     0   158    0
amappl16   200       27    0       26     2     1     1     1     0     8    0
amappl15   192       63    0       59     1     0     1     1     0     8    0
amappl13   176       32    0       31     2     1     1     1     0     8    0
amappl12   168        3    0        3     2     1     1     1     0     8    1
amappl11   160       60    0       47     1     0     1     1     0     8    0
amappl9    144      469    0      467     1     0     1     1     0     8    0
amappl8    136      350    0      349     2     1     1     1     0     8    0
amappl7    128       62    0       55     1     0     1     1     0     8    0
amappl6    120       82    0       76     1     0     1     1     0     8    0
amappl5    112       85    0       76     1     0     1     1     0     8    0
amappl4    104      587    0      567     1     0     1     1     0     8    0
amappl3     96      426    0      403     1     0     1     1     0     8    0
amappl2     88      301    0      274     1     0     1     1     0     8    0
amappl1     80     9059    0     8676    11     2     9     9     0     8    0
amappl      88     1045    0     1009     1     0     1     1     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      289    0      276     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      289    0      276     1     0     1     1     0     8    0
vmmpekpl   168     5992    0     5978     1     0     1     1     0     8    0
vmmpepl    168    25757    0    24976    41     3    38    39     0   357    3
vmsppl     272      288    0      276     2     1     1     2     0     8    0
rwobjpl     24     9281    0     7333    13     0    13    13     0     8    0
pdppl      4096     584    0      552    55    23    32    40     0     8    0
pvpl        32   120098    0   116477    36     3    33    33     0   265    3
pmappl     216      288    0      276     1     0     1     1     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      393    0       31    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8254949d) at panic+0x161 sys/kern/subr_prf.c:198
rw_assert_wrlock(fffffd806e6e9738) at rw_assert_wrlock+0xb7 sys/kern/kern_rwlock.c:388
somove(fffffd806ceddc90,1) at somove+0x25d sbspace sys/sys/socketvar.h:209 [inline]
somove(fffffd806ceddc90,1) at somove+0x25d sys/kern/uipc_socket.c:1487
sosplice(fffffd806ceddc90,3,0,0) at sosplice+0x502 sys/kern/uipc_socket.c:1346
sosetopt(fffffd806ceddc90,ffff,1023,fffffd8075748f00) at sosetopt+0x7ec
sys_setsockopt(ffff8000ffff8d28,ffff80002174b348,ffff80002174b3a0) at sys_setsockopt+0x1f5 sys/kern/uipc_syscalls.c:1233
syscall(ffff80002174b410) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe63d0, count: -9
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8254949d) at panic+0x161 sys/kern/subr_prf.c:198
rw_assert_wrlock(fffffd806e6e9738) at rw_assert_wrlock+0xb7 sys/kern/kern_rwlock.c:388
somove(fffffd806ceddc90,1) at somove+0x25d sbspace sys/sys/socketvar.h:209 [inline]
somove(fffffd806ceddc90,1) at somove+0x25d sys/kern/uipc_socket.c:1487
sosplice(fffffd806ceddc90,3,0,0) at sosplice+0x502 sys/kern/uipc_socket.c:1346
sosetopt(fffffd806ceddc90,ffff,1023,fffffd8075748f00) at sosetopt+0x7ec
sys_setsockopt(ffff8000ffff8d28,ffff80002174b348,ffff80002174b3a0) at sys_setsockopt+0x1f5 sys/kern/uipc_syscalls.c:1233
syscall(ffff80002174b410) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe63d0, count: -9
ddb> 

Crashes (19):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2022/09/04 05:31 openbsd c3a3d6092d41 28811d0a .config log report syz C panic: solock: lock not held
ci-openbsd-main 2022/09/04 15:37 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 15:30 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 15:28 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 14:52 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 14:35 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 14:31 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 13:53 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 13:18 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 11:04 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 10:03 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 09:37 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 09:05 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 08:28 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 08:24 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 08:10 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 07:45 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 06:08 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
ci-openbsd-main 2022/09/04 05:12 openbsd c3a3d6092d41 28811d0a .config log report panic: solock: lock not held
* Struck through repros no longer work on HEAD.