syzbot


panic: witness_warn

Status: closed as dup on 2019/01/29 06:51
Reported-by: syzbot+8d2433a7145f5483e36f@syzkaller.appspotmail.com
First crash: 1919d, last: 1914d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
witness: userret: returning with the following locks held: C 315 1704d 1914d

Sample crash report:
panic: witness_warn
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*481291  95567      0           0  0x4000000    1  syz-executor7038
  59723  17099      0           0      0x480    0  syz-executor7038
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x16c sys/kern/subr_prf.c:208
witness_warn(81f79b33cdaa2370,0,ffff800020be4010) at witness_warn+0x6e0 witness_debugger sys/kern/subr_witness.c:2546 [inline]
witness_warn(81f79b33cdaa2370,0,ffff800020be4010) at witness_warn+0x6e0 sys/kern/subr_witness.c:1462
userret(1bfc2da9ada39d3) at userret+0x361 sys/kern/kern_sig.c:1899
syscall(9050693ec4aa6ae2) at syscall+0x680 mi_syscall_return sys/sys/syscall_mi.h:122 [inline]
syscall(9050693ec4aa6ae2) at syscall+0x680 sys/arch/amd64/amd64/trap.c:605
Xsyscall(6,5,d337b5bf0c8,0,d337b5bf0a8,d337b5bf0a0) at Xsyscall+0x128
end of kernel
end trace frame: 0xd35bbe9e250, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> show panic
witness_warn
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x16c sys/kern/subr_prf.c:208
witness_warn(81f79b33cdaa2370,0,ffff800020be4010) at witness_warn+0x6e0 witness_debugger sys/kern/subr_witness.c:2546 [inline]
witness_warn(81f79b33cdaa2370,0,ffff800020be4010) at witness_warn+0x6e0 sys/kern/subr_witness.c:1462
userret(1bfc2da9ada39d3) at userret+0x361 sys/kern/kern_sig.c:1899
syscall(9050693ec4aa6ae2) at syscall+0x680 mi_syscall_return sys/sys/syscall_mi.h:122 [inline]
syscall(9050693ec4aa6ae2) at syscall+0x680 sys/arch/amd64/amd64/trap.c:605
Xsyscall(6,5,d337b5bf0c8,0,d337b5bf0a8,d337b5bf0a0) at Xsyscall+0x128
end of kernel
end trace frame: 0xd35bbe9e250, count: -6
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020c17420
rbx               0xffff800020c174c0
rdx               0xffffffff81ec7fae    cmd0646_9_tim_udma+0x14d39
rcx                            0x201
rax                              0x1
r8                0xffffffff81ba5254    kprintf+0x174
r9                               0x1
r10               0xaaffac73f45a8dcc
r11               0x3dbb57dc8bf3f35e
r12                     0x3000000008
r13               0xffff800020c17430
r14                            0x100
r15                              0x1
rip               0xffffffff817aed68    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020c17410
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor7038) pid=481291 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=32, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff800020be52d0,0xffff800020be4278
    process=0xffff800020b5b3b8 user=0xffff800020c12000, vmspace=0xfffffd806e926b48
    estcpu=36, cpticks=2, pctcpu=0.0
    user=0, sys=2, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 89725  214206  54088      0  2       0x480                syz-executor7038
 89725  316849  54088      0  3   0x4000080  fsleep        syz-executor7038
 89725  486760  54088      0  3   0x4000080  fsleep        syz-executor7038
 89725  302636  54088      0  3   0x4000080  fsleep        syz-executor7038
 95567  465868  17099      0  2       0x480                syz-executor7038
*95567  481291  17099      0  7   0x4000000                syz-executor7038
 95567  205148  17099      0  3   0x4000080  fsleep        syz-executor7038
 95567  511450  17099      0  3   0x4000080  fsleep        syz-executor7038
 17099   59723  40524      0  7       0x480                syz-executor7038
 54088  425072  40524      0  3        0x80  nanosleep     syz-executor7038
 40524  161525  68064      0  3        0x82  nanosleep     syz-executor7038
 68064  470302  47027      0  3    0x10008a  pause         ksh
 47027  436661  84331      0  3        0x92  select        sshd
 76749  432849      1      0  3    0x100083  ttyin         getty
 84331   74446      1      0  3        0x80  select        sshd
 88372  105675  90966     73  3    0x100010  ffs_fsync     syslogd
 90966  499849      1      0  3    0x100082  netio         syslogd
 88289   67195      1     77  3    0x100090  poll          dhclient
 60143  492744      1      0  3        0x80  poll          dhclient
 10721  115300      0      0  3     0x14200  pgzero        zerothread
 96706   96821      0      0  3     0x14200  aiodoned      aiodoned
 64274  249592      0      0  3     0x14200  syncer        update
  8961  473051      0      0  3     0x14200  cleaner       cleaner
 54997  428744      0      0  3     0x14200  reaper        reaper
 26141   39159      0      0  3     0x14200  pgdaemon      pagedaemon
  6620  206485      0      0  3     0x14200  bored         crynlk
 62537  372329      0      0  3     0x14200  bored         crypto
 43884  372509      0      0  3  0x40014200  acpi0         acpi0
 62850  365876      0      0  3  0x40014200                idle1
 49850  416449      0      0  3     0x14200  bored         softnet
 36340   16409      0      0  3     0x14200  bored         systqmp
 67116  243476      0      0  3     0x14200  bored         systq
 24412  109081      0      0  3  0x40014200  bored         softclock
 54352  520107      0      0  3  0x40014200                idle0
     1   84678      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper

Crashes (26):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/25 12:15 openbsd 6f9e9be94f66 b5d78bce .config console log report syz C ci-openbsd-setuid
2019/01/24 10:56 openbsd f1baa6d0b1f2 ce1ccf97 .config console log report syz C ci-openbsd-setuid
2019/01/28 16:19 openbsd c41c16f02568 1602ad52 .config console log report syz ci-openbsd-multicore
2019/01/25 12:44 openbsd 6f9e9be94f66 b5d78bce .config console log report syz ci-openbsd-multicore
2019/01/25 06:17 openbsd 6be7898a800b fea4b504 .config console log report syz ci-openbsd-multicore
2019/01/25 03:45 openbsd 6be7898a800b fea4b504 .config console log report syz ci-openbsd-multicore
2019/01/24 08:10 openbsd f1baa6d0b1f2 ce1ccf97 .config console log report syz ci-openbsd-setuid
2019/01/28 18:49 openbsd c41c16f02568 1602ad52 .config console log report ci-openbsd-multicore
2019/01/28 18:24 openbsd c41c16f02568 1602ad52 .config console log report ci-openbsd-setuid
2019/01/28 10:18 openbsd c41c16f02568 1602ad52 .config console log report ci-openbsd-setuid
2019/01/27 17:00 openbsd 269c2856b78e c73f090a .config console log report ci-openbsd-multicore
2019/01/27 12:54 openbsd 269c2856b78e c73f090a .config console log report ci-openbsd-setuid
2019/01/27 12:18 openbsd 269c2856b78e c73f090a .config console log report ci-openbsd-multicore
2019/01/27 08:24 openbsd fdee2cadce4b c73f090a .config console log report ci-openbsd-multicore
2019/01/27 06:39 openbsd fdee2cadce4b c73f090a .config console log report ci-openbsd-multicore
2019/01/26 21:34 openbsd fdee2cadce4b c73f090a .config console log report ci-openbsd-setuid
2019/01/26 12:00 openbsd 9c41f50dd00d 66ff894e .config console log report ci-openbsd-multicore
2019/01/26 09:23 openbsd 9c41f50dd00d 66ff894e .config console log report ci-openbsd-setuid
2019/01/26 04:15 openbsd e051af97f77d ebf7a37c .config console log report ci-openbsd-setuid
2019/01/26 00:53 openbsd e051af97f77d ebf7a37c .config console log report ci-openbsd-multicore
2019/01/25 16:51 openbsd 6f9e9be94f66 b5d78bce .config console log report ci-openbsd-setuid
2019/01/25 05:09 openbsd 6be7898a800b fea4b504 .config console log report ci-openbsd-setuid
2019/01/25 05:01 openbsd 6be7898a800b fea4b504 .config console log report ci-openbsd-setuid
2019/01/25 04:38 openbsd 6be7898a800b fea4b504 .config console log report ci-openbsd-setuid
2019/01/25 00:01 openbsd 6be7898a800b fea4b504 .config console log report ci-openbsd-multicore
2019/01/24 07:49 openbsd f1baa6d0b1f2 ce1ccf97 .config console log report ci-openbsd-setuid
* Struck through repros no longer work on HEAD.