syzbot


uvm_fault: memcpy (4)

Status: auto-closed as invalid on 2022/06/01 18:10
Reported-by: syzbot+856014902288cda60ad9@syzkaller.appspotmail.com
First crash: 902d, last: 833d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: memcpy C 460 1901d 1921d 3/3 fixed on 2019/03/31 22:33
openbsd uvm_fault: memcpy (5) C 6 88d 614d 0/3 upstream: reported C repro on 2022/10/08 21:10
openbsd uvm_fault: memcpy (2) syz 2168 1490d 1738d 0/3 closed as invalid on 2020/05/18 08:51
openbsd uvm_fault: memcpy (3) 26 1425d 1483d 0/3 auto-closed as invalid on 2020/10/17 21:23

Sample crash report:
uvm_fault(0xffffffff82999dc0, 0xffff800019fa1200, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      memcpy+0x15:    repe movsq      (%rsi),%es:(%rdi)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*130774  35697      0           0  0x4000000    0  syz-executor.4
memcpy() at memcpy+0x15
ffs_inode_alloc(fffffd805de54f08,1f84,fffffd807f7d88a0,ffff800024907158) at ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394
ufs_makeinode(1f84,fffffd8067dc0860,ffff800024907370,ffff8000249073a0) at ufs_makeinode+0xae sys/ufs/ufs/ufs_vnops.c:1830
ufs_mknod(ffff800024907210) at ufs_mknod+0x4e sys/ufs/ufs/ufs_vnops.c:172
VOP_MKNOD(fffffd8067dc0860,ffff800024907370,ffff8000249073a0,ffff8000249072a0) at VOP_MKNOD+0xbf sys/kern/vfs_vops.c:121
domknodat(ffff80002166d260,ffffff9c,20000040,de761f86,0) at domknodat+0x326 sys/kern/vfs_syscalls.c:1630
syscall(ffff800024907540) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x400ef1a6d90, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff82999dc0, 0xffff800019fa1200, 0, 1) -> d
ddb> trace
memcpy() at memcpy+0x15
ffs_inode_alloc(fffffd805de54f08,1f84,fffffd807f7d88a0,ffff800024907158) at ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394
ufs_makeinode(1f84,fffffd8067dc0860,ffff800024907370,ffff8000249073a0) at ufs_makeinode+0xae sys/ufs/ufs/ufs_vnops.c:1830
ufs_mknod(ffff800024907210) at ufs_mknod+0x4e sys/ufs/ufs/ufs_vnops.c:172
VOP_MKNOD(fffffd8067dc0860,ffff800024907370,ffff8000249073a0,ffff8000249072a0) at VOP_MKNOD+0xbf sys/kern/vfs_vops.c:121
domknodat(ffff80002166d260,ffffff9c,20000040,de761f86,0) at domknodat+0x326 sys/kern/vfs_syscalls.c:1630
syscall(ffff800024907540) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x400ef1a6d90, count: -8
ddb> show registers
rdi               0xfffffd8072b0ba00
rsi               0xffff800019fa1200
rbp               0xffff800024906f80
rbx               0xfffffd80659ca6d8
rdx                            0x100
rcx                             0x20
rax                            0x32d
r8                0xffffffffffffffff
r9                0xfffffd807f7d88a0
r10                0x776d8b6f1ec9b20
r11               0xfffffd8072b0ba00
r12               0xffff8000006dd000
r13               0xffff8000006b9800
r14                                0
r15               0xfffffd806f3fbc30
rip               0xffffffff810ef5e5    memcpy+0x15
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff800024906ef8
ss                              0x10
memcpy+0x15:    repe movsq      (%rsi),%es:(%rdi)
ddb> show proc
PROC (syz-executor.4) pid=130774 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=77, usrpri=77, nice=20
    forw=0xffffffffffffffff, list=0xffff80002166c000,0xffffffff829cd110
    process=0xffff800024ad0800 user=0xffff800024902000, vmspace=0xfffffd8067c60000
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 35697  411128  22531      0  2           0                syz-executor.4
*35697  130774  22531      0  7   0x4000000                syz-executor.4
 75413  400011  59081      0  2           0                syz-executor.2
 75413  293143  59081      0  2   0x4000000                syz-executor.2
 75413  191140  59081      0  2   0x4000000                syz-executor.2
 24909  407019  57223      0  2           0                syz-executor.5
 24909   56939  57223      0  2   0x4000000                syz-executor.5
 28898  273533  31909      0  2           0                syz-executor.1
 28898  197215  31909      0  3   0x4000080  fsleep        syz-executor.1
 88275   25642  86293      0  2           0                syz-executor.6
 88275  237794  86293      0  3   0x4000080  fsleep        syz-executor.6
 88275  350670  86293      0  3   0x4000080  fsleep        syz-executor.6
 88275  206802  86293      0  3   0x4000080  fsleep        syz-executor.6
 51455  328217  93380      0  2           0                syz-executor.7
 51455  146049  93380      0  3   0x4000080  ttyout        syz-executor.7
 51455  340191  93380      0  3   0x4000080  fsleep        syz-executor.7
 89921  186035  49496      0  2           0                syz-executor.3
 89921  288467  49496      0  3   0x4000080  fsleep        syz-executor.3
 22531  227207  99639      0  3        0x82  nanoslp       syz-executor.4
 59081  462473  99639      0  3        0x82  nanoslp       syz-executor.2
 86293  465444  99639      0  3        0x82  nanoslp       syz-executor.6
 73212    6124  99639      0  2         0x2                syz-executor.0
 31909  196834  99639      0  3        0x82  nanoslp       syz-executor.1
 93380  260260  99639      0  3        0x82  nanoslp       syz-executor.7
 49496  215601  99639      0  3        0x82  nanoslp       syz-executor.3
 57223  445043  99639      0  3        0x82  nanoslp       syz-executor.5
 22590  317767      1      0  3    0x100083  ttyin         getty
 71269  503563      0      0  3     0x14280  nfsidl        nfsio
 62405  311709      0      0  3     0x14280  nfsidl        nfsio
 63689  221855      0      0  3     0x14280  nfsidl        nfsio
 38970  160282      0      0  3     0x14280  nfsidl        nfsio
 35042  164393      0      0  3     0x14280  nfsidl        nfsio
 83267   58204      0      0  3     0x14280  nfsidl        nfsio
 59661   44323      0      0  3     0x14280  nfsidl        nfsio
 77595  436539      0      0  3     0x14280  nfsidl        nfsio
 73799  192598      0      0  3     0x14280  nfsidl        nfsio
 63029  464094      0      0  3     0x14280  nfsidl        nfsio
 61956  162350      0      0  3     0x14280  nfsidl        nfsio
  4804  145921      0      0  3     0x14280  nfsidl        nfsio
 31447  318988      0      0  3     0x14280  nfsidl        nfsio
 59257  306915      0      0  3     0x14280  nfsidl        nfsio
 18561  249164      0      0  3     0x14280  nfsidl        nfsio
 73443  393285      0      0  3     0x14280  nfsidl        nfsio
 52224  298790      0      0  3     0x14280  nfsidl        nfsio
 66278    2772      0      0  3     0x14280  nfsidl        nfsio
 42227  250747      0      0  3     0x14280  nfsidl        nfsio
 35494  416647      0      0  3     0x14280  nfsidl        nfsio
 45329  129201      0      0  3     0x14200  bored         sosplice
 99639  303175  63716      0  3        0x82  kqread        syz-fuzzer
 99639  157093  63716      0  3   0x4000082  thrsleep      syz-fuzzer
 99639   78065  63716      0  3   0x4000082  thrsleep      syz-fuzzer
 99639  373479  63716      0  3   0x4000082  thrsleep      syz-fuzzer
 99639  375908  63716      0  3   0x4000082  thrsleep      syz-fuzzer
 99639  423145  63716      0  3   0x4000082  thrsleep      syz-fuzzer
 99639  298837  63716      0  3   0x4000082  thrsleep      syz-fuzzer
 99639  213016  63716      0  3   0x4000082  thrsleep      syz-fuzzer
 63716  483041  41928      0  3    0x10008a  sigsusp       ksh
 41928  249447  35292      0  3        0x9a  kqread        sshd
 35292   83326      1      0  3        0x88  kqread        sshd
 84797  249537  28702     73  2   0x1100010                syslogd
 28702  107544      1      0  3    0x100082  netio         syslogd
 18208   97261      1      0  3    0x100080  kqread        resolvd
 81398  427503  87928     77  3    0x100092  kqread        dhcpleased
 58140  411490  87928     77  3    0x100092  kqread        dhcpleased
 87928  104641      1      0  3        0x80  kqread        dhcpleased
 29094  432966      0      0  3     0x14200  bored         smr
 66071  195157      0      0  2     0x14200                zerothread
 70417  180438      0      0  3     0x14200  aiodoned      aiodoned
 52521   84533      0      0  3     0x14200  syncer        update
 18557  499378      0      0  3     0x14200  cleaner       cleaner
  4528  301458      0      0  3     0x14200  reaper        reaper
 65025  371045      0      0  3     0x14200  pgdaemon      pagedaemon
 11861  229677      0      0  3     0x14200  bored         viomb
 33349   96604      0      0  3  0x40014200  acpi0         acpi0
 42865  444158      0      0  3     0x14200  bored         softnet
  9512  129239      0      0  3     0x14200  bored         systqmp
 80102  370682      0      0  3     0x14200  bored         systq
  9631  435379      0      0  3  0x40014200  bored         softclock
 55718  227061      0      0  3  0x40014200                idle0
     1  389206      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10708   6459K    7365K  78643K     39440        0
            pcb    13     14K      16K  78643K      1137        0
         rtable   197     13K      15K  78643K      2515        0
         ifaddr    87     20K      23K  78643K       786        0
         sysctl     2      0K       0K  78643K         4        0
       counters    25     17K      17K  78643K       124        0
       ioctlops     0      0K       4K  78643K      4190        0
            iov     0      0K      44K  78643K       539        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1364     85K      86K  78643K      8463        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K        57        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      1K       1K  78643K        12        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    17     61K      82K  78643K      6676        0
          sigio     0      0K       0K  78643K       109        0
           proc    65     55K      87K  78643K      2204        0
        subproc   104      6K       6K  78643K       823        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       651        0
       in_multi    57      3K       6K  78643K       992        0
    ether_multi     1      0K       0K  78643K       100        0
            mrt     1      0K       0K  78643K        27        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   253   1129K    1129K  78643K       253        0
           exec     0      0K       2K  78643K      2517        0
     pfkey data     0      0K       2K  78643K         3        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   473    709K    1105K  78643K     78871        0
       UVM aobj   131      4K       4K  78643K       131        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K       405        0
            NDP    10      0K       2K  78643K       250        0
           temp   133   4723K    4982K  78643K    152601        0
         kqueue    12     18K      28K  78643K       489        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      523    0      520     5     4     1     3     0     8    0
rtentry    112      786    0      716     4     1     3     4     0     8    0
unpcb      136     5317    0     5304    63    58     5     9     0     8    4
syncache   296       20    0       20     6     6     0     1     0     8    0
sackhl      24        1    0        1     1     1     0     1     0     8    0
tcpqe       32       11    0       11     4     4     0     1     0     8    0
tcpcb      736     2507    0     2503    80    73     7    13     0     8    6
arp         88      141    0      128     1     0     1     1     0     8    0
ipq         40        7    0        7     2     2     0     1     0     8    0
ipqe        40       19    0       19     2     2     0     1     0     8    0
inpcb      304     7295    0     7287   103    98     5    19     0     8    4
rttmr       72        3    0        3     1     1     0     1     0     8    0
ip6q        72       56    0       55     2     1     1     1     0     8    0
ip6af       40      109    0      108     2     1     1     1     0     8    0
nd6         48      212    0      196     1     0     1     1     0     8    0
pkpcb       40       75    0       75     3     3     0     1     0     8    0
kcovpl      48       63    0       55     1     0     1     1     0     8    0
ppxss      1152      12    0       12     4     4     0     1     0     8    0
pfstscr     40        7    0        7     2     2     0     1     0     8    0
pfrktable  1344      86    0       71     2     0     2     2     0     8    0
pftag       88        7    0        0     1     0     1     1     0     8    0
pfstitem    24       11    0        9     1     0     1     1     0     8    0
pfstkey    112       23    0       21     2     1     1     1     0     8    0
pfstate    320       13    0       12     2     1     1     1     0     8    0
pfrule     1360    1387    0     1102    27     3    24    24     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     3122    0     2847    48    23    25    30     0     8    0
art_table   32     3123    0     2847     5     1     4     4     0     8    0
art_node    16      785    0      725     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        0     1     0     1     1     0     8    0
semapl     112       10    0        0     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     9624    0     8170    92     0    92    92     0     8    0
ffsino     240     9624    0     8170    86     0    86    86     0     8    0
nchpl      144    18191    0    16568    63     0    63    63     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     224     5926    0        0   349     0   349   349     0     8    0
namei      1024   73071    0    73069     8     7     1     2     0     8    0
vcpupl     1984      46    0        0     6     0     6     6     0     8    0
vmpool     528       62    0       16     4     0     4     4     0     8    0
pfiaddrpl  120       37    0       18     1     0     1     1     0     8    0
scsiplug    72        7    0        7     1     1     0     1     0     8    0
scxspl     216    59611    0    59611    25    24     1     8     0     8    1
plimitpl   152     1081    0     1066     1     0     1     1     0     8    0
sigapl     424     6865    0     6803    10     2     8     8     0     8    0
futexpl     64    62865    0    62859     5     4     1     1     0     8    0
knotepl    120    61641    0    61561    17    13     4    10     0     8    0
kqueuepl   184     1177    0     1168    10     9     1     4     0     8    0
pipepl     304     1841    0     1813    48    43     5    10     0     8    2
fdescpl    432     6831    0     6803     4     0     4     4     0     8    0
filepl     120    52488    0    52186    91    80    11    19     0     8    1
lockfpl    104    11009    0    11007    25    24     1     4     0     8    0
lockfspl    48     5151    0     5149     3     2     1     2     0     8    0
sessionpl  144       79    0       63     1     0     1     1     0     8    0
pgrppl      48      100    0       84     1     0     1     1     0     8    0
ucredpl     96     6280    0     6267     1     0     1     1     0     8    0
zombiepl   144     6803    0     6803     1     0     1     1     0     8    1
processpl  1000    6865    0     6803     8     0     8     8     0     8    0
procpl     672    16298    0    16218    25    17     8     9     0     8    0
sosppl     168       38    0       38     7     7     0     1     0     8    0
sockpl     448    13279    0    13255   301   291    10    44     0     8    7
mcl64k     65536    231    0      231    19    19     0     1     0     8    0
mcl16k     16384     62    0       62    12    12     0     1     0     8    0
mcl12k     12288    189    0      189    22    21     1     1     0     8    1
mcl9k      9216      92    0       92    19    19     0     1     0     8    0
mcl8k      8192     469    0      469    20    19     1     1     0     8    1
mcl4k      4096     733    0      733    16    15     1     1     0     8    1
mcl2k2     2112      59    0       59    19    19     0     1     0     8    0
mcl2k      2048   89030    0    88950    33    21    12    18     0     8    0
mtagpl      96     5963    0     5366    40    24    16    25     0     8    0
mbufpl     256   192806    0   192023   133    81    52    79     0     8    0
bufpl      288    15794    0     9386   459     0   459   459     0     8    0
anonpl      24  1910968    0  1886381   268   119   149   167     0   188    0
amapchunkpl 152  217377    0   216502   372   261   111   350     0   158   75
amappl16   200    21448    0    20234   162    98    64    64     0     8    0
amappl15   192     1084    0     1079     1     0     1     1     0     8    0
amappl14   184      999    0      987     1     0     1     1     0     8    0
amappl13   176     1403    0     1398     1     0     1     1     0     8    0
amappl12   168      921    0      916     2     1     1     1     0     8    0
amappl11   160      526    0      515     1     0     1     1     0     8    0
amappl10   152      676    0      674     1     0     1     1     0     8    0
amappl9    144     1115    0     1112     1     0     1     1     0     8    0
amappl8    136     2639    0     2544     4     0     4     4     0     8    0
amappl7    128     1347    0     1336     1     0     1     1     0     8    0
amappl6    120     1034    0     1006     2     1     1     2     0     8    0
amappl5    112     5644    0     5631     1     0     1     1     0     8    0
amappl4    104     3368    0     3329     3     1     2     2     0     8    0
amappl3     96     1943    0     1928     1     0     1     1     0     8    0
amappl2     88     2567    0     2513     3     1     2     3     0     8    0
amappl1     80   122858    0   122261    20     7    13    18     0     8    0
amappl      88    77439    0    77136     8     0     8     8     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      130    0        0     3     0     3     3     0     8    0
uaddrrnd    24     6893    0     6819     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     6893    0     6819     1     0     1     1     0     8    0
vmmpekpl   168    53268    0    53208     4     0     4     4     0     8    0
vmmpepl    168   650568    0   647259   333   189   144   161     0   357    0
vmsppl     272     6892    0     6819     8     3     5     5     0     8    0
rwobjpl     24   154922    0   146589    51     0    51    51     0     8    0
pdppl      4096   13792    0    13684   624   514   110   110     0     8    2
pvpl        32  3348375    0  3319616   462   230   232   274     0   265    0
pmappl     216     6892    0     6819     5     0     5     5     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112     1973    0     1083    26     0    26    26     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
memcpy() at memcpy+0x15
ffs_inode_alloc(fffffd805de54f08,1f84,fffffd807f7d88a0,ffff800024907158) at ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394
ufs_makeinode(1f84,fffffd8067dc0860,ffff800024907370,ffff8000249073a0) at ufs_makeinode+0xae sys/ufs/ufs/ufs_vnops.c:1830
ufs_mknod(ffff800024907210) at ufs_mknod+0x4e sys/ufs/ufs/ufs_vnops.c:172
VOP_MKNOD(fffffd8067dc0860,ffff800024907370,ffff8000249073a0,ffff8000249072a0) at VOP_MKNOD+0xbf sys/kern/vfs_vops.c:121
domknodat(ffff80002166d260,ffffff9c,20000040,de761f86,0) at domknodat+0x326 sys/kern/vfs_syscalls.c:1630
syscall(ffff800024907540) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x400ef1a6d90, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
memcpy() at memcpy+0x15
ffs_inode_alloc(fffffd805de54f08,1f84,fffffd807f7d88a0,ffff800024907158) at ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394
ufs_makeinode(1f84,fffffd8067dc0860,ffff800024907370,ffff8000249073a0) at ufs_makeinode+0xae sys/ufs/ufs/ufs_vnops.c:1830
ufs_mknod(ffff800024907210) at ufs_mknod+0x4e sys/ufs/ufs/ufs_vnops.c:172
VOP_MKNOD(fffffd8067dc0860,ffff800024907370,ffff8000249073a0,ffff8000249072a0) at VOP_MKNOD+0xbf sys/kern/vfs_vops.c:121
domknodat(ffff80002166d260,ffffff9c,20000040,de761f86,0) at domknodat+0x326 sys/kern/vfs_syscalls.c:1630
syscall(ffff800024907540) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x400ef1a6d90, count: -8

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/03/03 18:10 openbsd a26a77a095e7 45a13a73 .config console log report ci-openbsd-main uvm_fault: memcpy
2021/12/24 21:03 openbsd 9d2191b71eea 6caa12e4 .config console log report ci-openbsd-main uvm_fault: memcpy
* Struck through repros no longer work on HEAD.