syzbot


protection_fault: sblock

Status: upstream: reported syz repro on 2021/12/31 23:44
Reported-by: syzbot+602f1c467b574ffb3d9d@syzkaller.appspotmail.com
First crash: 394d, last: 214d
Last patch testing requests:
Created Duration User Patch Repo Result
2023/01/15 14:32 8m retest repro openbsd error
2022/10/07 13:30 15m retest repro openbsd report log

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      sblock+0x4a:    movq    0x8(%rax),%rax
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
sblock(fffffd806e52b710,fffffd806e52b7a8,1) at sblock+0x4a soassertlocked sys/kern/uipc_socket2.c:323 [inline]
sblock(fffffd806e52b710,fffffd806e52b7a8,1) at sblock+0x4a sys/kern/uipc_socket2.c:378
soreceive(fffffd806e52b710,0,ffff80002172d878,0,0,ffff80002172d78c,d50d58f415e1f532) at soreceive+0x203 sys/kern/uipc_socket.c:776
fifo_read(ffff80002172d7e0) at fifo_read+0xcb sys/miscfs/fifofs/fifo_vnops.c:260
VOP_READ(fffffd806ad14478,ffff80002172d878,64,fffffd807f7d8780) at VOP_READ+0xbf sys/kern/vfs_vops.c:227
vn_rdwr(0,fffffd806ad14478,ffff800008943500,1002,0,1,b29ce688c93c242c,ffff8000006b3000,fffffd80708ea5e0,0) at vn_rdwr+0x105
vndstrategy(fffffd80708ea5e0) at vndstrategy+0x3b3 sys/dev/vnd.c:342
physio(ffffffff81b097c0,2902,8000,ffffffff81193e20,ffff80002172dce8) at physio+0x289 sys/kern/kern_physio.c:163
spec_read(ffff80002172db40) at spec_read+0xec sys/kern/spec_vnops.c:222
VOP_READ(fffffd806ed62bc8,ffff80002172dce8,0,fffffd807f7d88a0) at VOP_READ+0xbf sys/kern/vfs_vops.c:227
vn_read(fffffd806d018e28,ffff80002172dce8,0) at vn_read+0x121 sys/kern/vfs_vnops.c:375
dofilereadv(ffff80002165dce0,4,ffff80002172dce8,0,ffff80002172dde0) at dofilereadv+0x19e sys/kern/sys_generic.c:252
sys_read(ffff80002165dce0,ffff80002172dd88,ffff80002172dde0) at sys_read+0x83 sys/kern/sys_generic.c:172
syscall(ffff80002172de50) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x246e8578f70, count: -14
ddb> show registers
rdi                                0
rsi                             0x40
rbp               0xffff80002172d660
rbx                              0x1
rdx                              0x1
rcx               0xffff80002165dce4
rax               0x40afdfe4b41281f8
r8                             0x400
r9                                 0
r10               0xeb767bfafa06e58c
r11               0x78b64149214d8c1a
r12                                0
r13                              0x1
r14               0xfffffd806e52b7f8
r15               0xfffffd806e52b710
rip               0xffffffff8213f77a    sblock+0x4a
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002172d600
ss                              0x10
sblock+0x4a:    movq    0x8(%rax),%rax
ddb> show proc
PROC (syz-executor.2) pid=339973 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=24, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff80002165da40,0xffff80002165ca90
    process=0xffff80002166ebd8 user=0xffff800021728000, vmspace=0xfffffd806af59560
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  3220   10113   9167      0  2           0                syz-executor.0
 75198  236080  30024      0  2           0                syz-executor.3
 75198  292750  30024      0  2   0x4000000                syz-executor.3
 31333  512444  51194      0  2           0                syz-executor.1
 31333  349823  51194      0  2   0x4000000                syz-executor.1
 15527  311584  38643      0  2           0                syz-executor.2
*15527  339973  38643      0  7   0x4000000                syz-executor.2
 15527   73347  38643      0  3   0x4000080  fsleep        syz-executor.2
 30024  428016  77017      0  2       0x482                syz-executor.3
 38643  208369  77017      0  2       0x482                syz-executor.2
 51194  132667  77017      0  2       0x482                syz-executor.1
  9167  292169  77017      0  2       0x482                syz-executor.0
 77017  356402   2404      0  3        0x82  kqread        syz-execprog
 77017   27397   2404      0  2   0x4000482                syz-execprog
 77017  359130   2404      0  3   0x4000082  thrsleep      syz-execprog
 77017  304134   2404      0  3   0x4000082  thrsleep      syz-execprog
 77017    1812   2404      0  3   0x4000082  thrsleep      syz-execprog
 77017  305282   2404      0  3   0x4000082  thrsleep      syz-execprog
  2404  517055  75247      0  3    0x10008a  sigsusp       ksh
 75247   27671  23046      0  3        0x9a  poll          sshd
 95443  468751      1      0  3    0x100083  ttyin         getty
 23046  455818      1      0  3        0x88  poll          sshd
 24646  242902  34592     73  2    0x100010                syslogd
 34592  396542      1      0  3    0x100082  netio         syslogd
 56175  332448      1      0  3    0x100080  kqread        resolvd
 31908  232566  34650     77  3    0x100092  kqread        dhcpleased
 66713  511616  34650     77  3    0x100092  kqread        dhcpleased
 34650   57041      1      0  3        0x80  kqread        dhcpleased
 65100   49579      0      0  3     0x14200  bored         smr
 64221   39312      0      0  2     0x14200                zerothread
 65383  103619      0      0  3     0x14200  aiodoned      aiodoned
 30028  284373      0      0  3     0x14200  syncer        update
 42180  100238      0      0  3     0x14200  cleaner       cleaner
 67375  332711      0      0  3     0x14200  reaper        reaper
 92243  365898      0      0  3     0x14200  pgdaemon      pagedaemon
 49363  386136      0      0  3     0x14200  bored         viomb
 12411  488430      0      0  3  0x40014200  acpi0         acpi0
 39600  297311      0      0  3     0x14200  bored         softnet
 34478     563      0      0  3     0x14200  bored         systqmp
 91400  358779      0      0  3     0x14200  bored         systq
 72614  449475      0      0  3  0x40014200  bored         softclock
 91773   62802      0      0  3  0x40014200                idle0
     1  277340      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10138   6390K    6412K  78643K     11879        0
            pcb    13      8K       8K  78643K        13        0
         rtable   150      4K       4K  78643K       234        0
         ifaddr    53     12K      12K  78643K        53        0
       counters    23     16K      16K  78643K        23        0
       ioctlops     0      0K       2K  78643K        29        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1178     74K      74K  78643K      3620        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12598        0
      file desc    10     33K      49K  78643K      2506        0
           proc    55     54K      71K  78643K       337        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    55      3K       3K  78643K        55        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    25    122K     122K  78643K        25        0
           exec     0      0K       2K  78643K       427        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   180     38K      39K  78643K     38560        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     7      0K       1K  78643K        15        0
           temp    36   4178K    4243K  78643K      9486        0
         kqueue    10     14K      14K  78643K        10        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       28    0       25     1     0     1     1     0     8    0
rtentry    112       67    0        1     2     0     2     2     0     8    0
unpcb      136     4905    0     4892     1     0     1     1     0     8    0
syncache   296        5    0        5     2     2     0     1     0     8    0
tcpcb      736        7    0        4     1     0     1     1     0     8    0
arp         88       10    0        0     1     0     1     1     0     8    0
inpcb      304       38    0       32     1     0     1     1     0     8    0
nd6         48       12    0        0     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      277    0        0    18     0    18    18     0     8    0
art_table   32      278    0        0     3     0     3     3     0     8    0
art_node    16       66    0        6     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     8740    0     7333    89     0    89    89     0     8    0
ffsino     240     8740    0     7333    84     0    84    84     0     8    0
nchpl      144    11405    0     9791    61     0    61    61     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     224     5926    0        0   349     0   349   349     0     8    0
namei      1024   32117    0    32117     2     1     1     1     0     8    1
scxspl     216    26976    0    26976    33    32     1     8     0     8    1
plimitpl   152       19    0        9     1     0     1     1     0     8    0
sigapl     424     2728    0     2694     5     1     4     5     0     8    0
futexpl     64    31751    0    31750     1     0     1     1     0     8    0
knotepl    112      204    0      156     2     0     2     2     0     8    0
kqueuepl   184        6    0        0     1     0     1     1     0     8    0
pipepl     304       89    0       73     3     1     2     2     0     8    0
fdescpl    432     2715    0     2694     3     0     3     3     0     8    0
filepl     120    13337    0    13243     4     0     4     4     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       21    0        9     1     0     1     1     0     8    0
pgrppl      48       21    0        9     1     0     1     1     0     8    0
ucredpl     96      719    0      709     1     0     1     1     0     8    0
zombiepl   144     2694    0     2694     2     1     1     1     0     8    1
processpl  1000    2728    0     2694     5     0     5     5     0     8    0
procpl     672    10539    0    10496     5     0     5     5     0     8    1
sockpl     448     4971    0     4949     4     0     4     4     0     8    1
mcl8k      8192       9    0        9     2     2     0     1     0     8    0
mcl4k      4096       5    0        5     2     2     0     1     0     8    0
mcl2k      2048    5404    0     5368     7     2     5     6     0     8    0
mtagpl      96        4    0        4     1     1     0     1     0     8    0
mbufpl     256    90470    0    90259    18     0    18    18     0     8    0
bufpl      288     7951    0     1534   459     0   459   459     0     8    0
anonpl      24   834758    0   829575    45     8    37    38     0   188    0
amapchunkpl 152   93785    0    93385    21     2    19    20     0   158    1
amappl16   200     5094    0     5002     5     0     5     5     0     8    0
amappl15   192      647    0      644     1     0     1     1     0     8    0
amappl14   184       10    0        5     1     0     1     1     0     8    0
amappl13   176       40    0       39     2     1     1     1     0     8    0
amappl12   168      625    0      621     2     1     1     1     0     8    0
amappl11   160      668    0      656     1     0     1     1     0     8    0
amappl10   152       45    0       39     1     0     1     1     0     8    0
amappl9    144      429    0      425     1     0     1     1     0     8    0
amappl8    136      915    0      896     2     1     1     1     0     8    0
amappl7    128      658    0      651     1     0     1     1     0     8    0
amappl6    120      145    0      132     1     0     1     1     0     8    0
amappl5    112     2030    0     2016     1     0     1     1     0     8    0
amappl4    104     1191    0     1172     1     0     1     1     0     8    0
amappl3     96      752    0      735     1     0     1     1     0     8    0
amappl2     88      959    0      918     2     0     2     2     0     8    0
amappl1     80    59079    0    58613    15     4    11    12     0     8    0
amappl      88    38256    0    38114     4     0     4     4     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24     2715    0     2694     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2715    0     2694     1     0     1     1     0     8    0
vmmpekpl   168    28443    0    28423     2     0     2     2     0     8    0
vmmpepl    168   233630    0   232211    72     6    66    66     0   357    3
vmsppl     272     2714    0     2694     3     1     2     2     0     8    0
rwobjpl     24    76947    0    70224    41     0    41    41     0     8    0
pdppl      4096    5436    0     5388    80    32    48    56     0     8    0
pvpl        32  1324753    0  1316324   157    81    76   137     0   265    0
pmappl     216     2714    0     2694     2     0     2     2     0     8    0
extentpl    40       57    0       38     1     0     1     1     0     8    0
phpool     112      776    0       42    21     0    21    21     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
sblock(fffffd806e52b710,fffffd806e52b7a8,1) at sblock+0x4a soassertlocked sys/kern/uipc_socket2.c:323 [inline]
sblock(fffffd806e52b710,fffffd806e52b7a8,1) at sblock+0x4a sys/kern/uipc_socket2.c:378
soreceive(fffffd806e52b710,0,ffff80002172d878,0,0,ffff80002172d78c,d50d58f415e1f532) at soreceive+0x203 sys/kern/uipc_socket.c:776
fifo_read(ffff80002172d7e0) at fifo_read+0xcb sys/miscfs/fifofs/fifo_vnops.c:260
VOP_READ(fffffd806ad14478,ffff80002172d878,64,fffffd807f7d8780) at VOP_READ+0xbf sys/kern/vfs_vops.c:227
vn_rdwr(0,fffffd806ad14478,ffff800008943500,1002,0,1,b29ce688c93c242c,ffff8000006b3000,fffffd80708ea5e0,0) at vn_rdwr+0x105
vndstrategy(fffffd80708ea5e0) at vndstrategy+0x3b3 sys/dev/vnd.c:342
physio(ffffffff81b097c0,2902,8000,ffffffff81193e20,ffff80002172dce8) at physio+0x289 sys/kern/kern_physio.c:163
spec_read(ffff80002172db40) at spec_read+0xec sys/kern/spec_vnops.c:222
VOP_READ(fffffd806ed62bc8,ffff80002172dce8,0,fffffd807f7d88a0) at VOP_READ+0xbf sys/kern/vfs_vops.c:227
vn_read(fffffd806d018e28,ffff80002172dce8,0) at vn_read+0x121 sys/kern/vfs_vnops.c:375
dofilereadv(ffff80002165dce0,4,ffff80002172dce8,0,ffff80002172dde0) at dofilereadv+0x19e sys/kern/sys_generic.c:252
sys_read(ffff80002165dce0,ffff80002172dd88,ffff80002172dde0) at sys_read+0x83 sys/kern/sys_generic.c:172
syscall(ffff80002172de50) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x246e8578f70, count: -14
ddb> machine ddbcpu 1
No such command
ddb> trace
sblock(fffffd806e52b710,fffffd806e52b7a8,1) at sblock+0x4a soassertlocked sys/kern/uipc_socket2.c:323 [inline]
sblock(fffffd806e52b710,fffffd806e52b7a8,1) at sblock+0x4a sys/kern/uipc_socket2.c:378
soreceive(fffffd806e52b710,0,ffff80002172d878,0,0,ffff80002172d78c,d50d58f415e1f532) at soreceive+0x203 sys/kern/uipc_socket.c:776
fifo_read(ffff80002172d7e0) at fifo_read+0xcb sys/miscfs/fifofs/fifo_vnops.c:260
VOP_READ(fffffd806ad14478,ffff80002172d878,64,fffffd807f7d8780) at VOP_READ+0xbf sys/kern/vfs_vops.c:227
vn_rdwr(0,fffffd806ad14478,ffff800008943500,1002,0,1,b29ce688c93c242c,ffff8000006b3000,fffffd80708ea5e0,0) at vn_rdwr+0x105
vndstrategy(fffffd80708ea5e0) at vndstrategy+0x3b3 sys/dev/vnd.c:342
physio(ffffffff81b097c0,2902,8000,ffffffff81193e20,ffff80002172dce8) at physio+0x289 sys/kern/kern_physio.c:163
spec_read(ffff80002172db40) at spec_read+0xec sys/kern/spec_vnops.c:222
VOP_READ(fffffd806ed62bc8,ffff80002172dce8,0,fffffd807f7d88a0) at VOP_READ+0xbf sys/kern/vfs_vops.c:227
vn_read(fffffd806d018e28,ffff80002172dce8,0) at vn_read+0x121 sys/kern/vfs_vnops.c:375
dofilereadv(ffff80002165dce0,4,ffff80002172dce8,0,ffff80002172dde0) at dofilereadv+0x19e sys/kern/sys_generic.c:252
sys_read(ffff80002165dce0,ffff80002172dd88,ffff80002172dde0) at sys_read+0x83 sys/kern/sys_generic.c:172
syscall(ffff80002172de50) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x246e8578f70, count: -14

Crashes (38):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-main 2022/01/01 06:54 openbsd 86dca86fec42 e1768e9c .config console log report syz protection_fault: sblock
ci-openbsd-multicore 2022/06/29 12:46 openbsd acb1415e3c0a 1434eec0 .config console log report protection_fault: sblock
ci-openbsd-main 2022/06/29 05:05 openbsd 37c734d33dee 496a8536 .config console log report protection_fault: sblock
ci-openbsd-main 2022/06/26 13:30 openbsd 1fd6e0f27a1b a371c43c .config console log report protection_fault: sblock
ci-openbsd-main 2022/06/15 18:09 openbsd 162559e745f7 1719ee24 .config console log report protection_fault: sblock
ci-openbsd-main 2022/06/12 14:03 openbsd a97778adc736 0d5abf15 .config console log report protection_fault: sblock
ci-openbsd-main 2022/05/28 22:54 openbsd d5ba50197496 a46af346 .config console log report protection_fault: sblock
ci-openbsd-main 2022/05/21 01:20 openbsd 20dbc0c1b0a8 bd37ad7e .config console log report protection_fault: sblock
ci-openbsd-main 2022/05/19 20:25 openbsd f9b15afb6ca0 cb1ac2e7 .config console log report protection_fault: sblock
ci-openbsd-main 2022/05/19 18:46 openbsd f9b15afb6ca0 cb1ac2e7 .config console log report protection_fault: sblock
ci-openbsd-main 2022/05/09 01:20 openbsd 826d76ee2b1d e60b1103 .config console log report protection_fault: sblock
ci-openbsd-main 2022/05/08 17:53 openbsd 826d76ee2b1d e60b1103 .config console log report protection_fault: sblock
ci-openbsd-main 2022/05/07 22:56 openbsd a7a028b08355 e60b1103 .config console log report protection_fault: sblock
ci-openbsd-main 2022/04/28 18:15 openbsd 3df256674017 e9076525 .config console log report protection_fault: sblock
ci-openbsd-main 2022/04/27 21:24 openbsd 54a3c02af713 8a1f1f07 .config console log report protection_fault: sblock
ci-openbsd-main 2022/04/27 03:01 openbsd 33096be15849 1fa34c1b .config console log report protection_fault: sblock
ci-openbsd-main 2022/04/25 23:14 openbsd 5d61b5229a4b 152baedd .config console log report protection_fault: sblock
ci-openbsd-main 2022/04/18 10:48 openbsd 9633a73fdbe9 8bcc32a6 .config console log report protection_fault: sblock
ci-openbsd-multicore 2022/04/16 10:24 openbsd 054e417d8819 8bcc32a6 .config console log report protection_fault: sblock
ci-openbsd-main 2022/04/06 02:47 openbsd b544ba164e86 0127c10f .config console log report protection_fault: sblock
ci-openbsd-main 2022/03/17 14:44 openbsd 140ae54c8a57 dfa9a8ed .config console log report protection_fault: sblock
ci-openbsd-main 2022/03/05 22:15 openbsd 36bd84834be1 7bdd8b2c .config console log report protection_fault: sblock
ci-openbsd-main 2022/03/02 16:34 openbsd fbbcf6cd7f4e 45a13a73 .config console log report protection_fault: sblock
ci-openbsd-main 2022/02/28 16:45 openbsd 57490d470724 45a13a73 .config console log report protection_fault: sblock
ci-openbsd-main 2022/02/21 10:23 openbsd d057e1047482 3cd800e4 .config console log report protection_fault: sblock
ci-openbsd-main 2022/02/15 00:31 openbsd 685b342a2af1 8b9ca619 .config console log report protection_fault: sblock
ci-openbsd-main 2022/02/13 13:55 openbsd 3abbdc7602e0 8b9ca619 .config console log report protection_fault: sblock
ci-openbsd-main 2022/02/11 19:09 openbsd d94933457f02 8b9ca619 .config console log report protection_fault: sblock
ci-openbsd-multicore 2022/02/07 01:44 openbsd f05e79799977 a7dab638 .config console log report protection_fault: sblock
ci-openbsd-main 2022/01/24 07:05 openbsd 7ba5db230c0f 214351e1 .config console log report protection_fault: sblock
ci-openbsd-main 2022/01/24 06:54 openbsd 7ba5db230c0f 214351e1 .config console log report protection_fault: sblock
ci-openbsd-main 2022/01/19 16:39 openbsd 99460583ddad 0620189b .config console log report protection_fault: sblock
ci-openbsd-multicore 2022/01/18 18:29 openbsd ba7d956b15f0 731a2d23 .config console log report protection_fault: sblock
ci-openbsd-main 2022/01/14 10:19 openbsd a0e2ca3ce324 b8d780ab .config console log report protection_fault: sblock
ci-openbsd-main 2022/01/13 11:59 openbsd faa1737afaee 44d1319a .config console log report protection_fault: sblock
ci-openbsd-multicore 2022/01/12 13:47 openbsd 7b05f821b4fe 44d1319a .config console log report protection_fault: sblock
ci-openbsd-main 2022/01/10 03:51 openbsd c010faf502fa 2ca0d385 .config console log report protection_fault: sblock
ci-openbsd-main 2021/12/31 23:43 openbsd 86dca86fec42 e1768e9c .config console log report protection_fault: sblock
* Struck through repros no longer work on HEAD.