syzbot


panic: m_zero: M_READONLY

Status: fixed on 2019/01/08 00:18
Reported-by: syzbot+c578107d70008715d41f@syzkaller.appspotmail.com
Fix commit: It is possible to call m_zero with a read-only cluster. In that case just
First crash: 1940d, last: 1939d

Sample crash report:
login: panic: m_zero: M_READONLY
Stopped at      db_enter+0xa:   popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
m_free(ffffff006d632b00) at m_free+0x17a sys/kern/uipc_mbuf.c:1267
m_freem(ffffffff) at m_freem+0x2d sys/kern/uipc_mbuf.c:525
vio_txeof(ffff800000173290) at vio_txeof+0x104 sys/dev/pv/if_vio.c:1140
vio_tx_intr(ffff800000173110) at vio_tx_intr+0x25 sys/dev/pv/if_vio.c:1116
intr_handler(0,ffff80000064d280) at intr_handler+0x6b sys/arch/amd64/amd64/intr.c:529
Xintr_ioapic_edge20_untramp(0,0,1388,0,ffff800000022a00,ffff800000022a00) at Xintr_ioapic_edge20_untramp+0x19f
acpicpu_idle() at acpicpu_idle+0x251 sys/dev/acpi/acpicpu.c:1187
sched_idle(0) at sched_idle+0x374 sys/kern/kern_sched.c:177
end trace frame: 0x0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> show panic
m_zero: M_READONLY
ddb{0}> trace
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
m_free(ffffff006d632b00) at m_free+0x17a sys/kern/uipc_mbuf.c:1267
m_freem(ffffffff) at m_freem+0x2d sys/kern/uipc_mbuf.c:525
vio_txeof(ffff800000173290) at vio_txeof+0x104 sys/dev/pv/if_vio.c:1140
vio_tx_intr(ffff800000173110) at vio_tx_intr+0x25 sys/dev/pv/if_vio.c:1116
intr_handler(0,ffff80000064d280) at intr_handler+0x6b sys/arch/amd64/amd64/intr.c:529
Xintr_ioapic_edge20_untramp(0,0,1388,0,ffff800000022a00,ffff800000022a00) at Xintr_ioapic_edge20_untramp+0x19f
acpicpu_idle() at acpicpu_idle+0x251 sys/dev/acpi/acpicpu.c:1187
sched_idle(0) at sched_idle+0x374 sys/kern/kern_sched.c:177
end trace frame: 0x0, count: -10
ddb{0}> show registers
rdi               0xffffffff81e323f0    kprintf_mutex
rsi                              0x5
rbp               0xffff8000210391e0
rbx               0xffff800021039280
rdx                            0x3fd
rcx                                0
rax                              0x1
r8                0xffff8000210391b0
r9                                 0
r10                                0
r11               0xffffff006ee56c70
r12                     0x3000000008
r13               0xffff8000210391f0
r14                            0x100
r15               0xffffffff81bed177    apollo_pio_rec+0x6e0d
rip               0xffffffff811b599a    db_enter+0xa
cs                               0x8
rflags                         0x202
rsp               0xffff8000210391e0
ss                              0x10
db_enter+0xa:   popq    %rbp
ddb{0}> show proc
PROC (idle0) pid=363638 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
    pri=0, usrpri=60, nice=20
    forw=0x9647fc485d43f271, list=0xffff8000210319c8,0xffff8000210312d0
    process=0xffff800021032fc8 user=0xffff800021034000, vmspace=0xffffffff81ee0e58
    estcpu=10, cpticks=42, pctcpu=15.84
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 35409  225926   1297      0  3        0x82  nanosleep     syz-executor3385
  1297  216120  38812      0  3    0x10008a  pause         ksh
 38812  113021  60312      0  3        0x92  select        sshd
 80119  439021      1      0  3    0x100083  ttyin         getty
 60312   78105      1      0  3        0x80  select        sshd
 93729  240715  80566     73  3    0x100090  kqread        syslogd
 80566  355707      1      0  3    0x100082  netio         syslogd
 56552  309071      1     77  3    0x100090  poll          dhclient
 21394  165464      1      0  3        0x80  poll          dhclient
 54833  506270      0      0  3     0x14200  pgzero        zerothread
 17091  299971      0      0  3     0x14200  aiodoned      aiodoned
 48397  461218      0      0  3     0x14200  syncer        update
 19301   82229      0      0  3     0x14200  cleaner       cleaner
 10792  188620      0      0  3     0x14200  reaper        reaper
 80033  162513      0      0  3     0x14200  pgdaemon      pagedaemon
 75501  468094      0      0  3     0x14200  bored         crynlk
 35533  423539      0      0  3     0x14200  bored         crypto
 75201  268160      0      0  3  0x40014200  acpi0         acpi0
 67561  284554      0      0  7  0x40014200                idle1
 47483   80162      0      0  3     0x14200  bored         softnet
 82786  148819      0      0  3     0x14200  bored         systqmp
 41914  105710      0      0  3     0x14200  bored         systq
 26025  275892      0      0  3  0x40014200  bored         softclock
*83616  363638      0      0  7  0x40014200                idle0
     1  202268      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> 

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/02 14:53 openbsd 3756733c7afe f0491811 .config console log report syz C ci-openbsd-setuid
2019/01/02 18:08 openbsd 3756733c7afe f0491811 .config console log report ci-openbsd-setuid
2019/01/02 14:31 openbsd 3756733c7afe f0491811 .config console log report ci-openbsd-setuid
* Struck through repros no longer work on HEAD.