syzbot


uvm_fault: uvm_map_clean

Status: auto-closed as invalid on 2020/08/05 16:08
Reported-by: syzbot+4557b0d636641e38522b@syzkaller.appspotmail.com
First crash: 1421d, last: 1421d

Sample crash report:
uvm_fault(0xffffffff8253edf0, 0xfffffd0000000048, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      uvm_map_clean+0x44a:    movl    0x48(%r15),%ebx
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
kernel page fault
uvm_fault(0xffffffff8253edf0, 0xfffffd0000000048, 0, 1) -> e
uvm_map_clean(fffffd806e954178,c002cca000,c003138000,8) at uvm_map_clean+0x44a sys/uvm/uvm_map.c:4677
end trace frame: 0xffff800020f43460, count: 0
ddb{1}> trace
uvm_map_clean(fffffd806e954178,c002cca000,c003138000,8) at uvm_map_clean+0x44a sys/uvm/uvm_map.c:4677
syscall(ffff800020f43470) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020f43470) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc00004feb8, count: -3
ddb{1}> show registers
rdi                             0x11
rsi                             0x10
rbp               0xffff800020f43390
rbx                     0xc002d7c000
rdx                              0x7
rcx                                0
rax               0xfffffd80650aa000
r8                0xffffffff815a1263    uvm_map_clean+0x483
r9                               0x5
r10               0x184c6023d21b710f
r11               0xcfac7ccd6c814b0f
r12                     0xc003138000
r13                     0xc002d7c000
r14               0xfffffd80650aa000
r15               0xfffffd0000000000
rip               0xffffffff815a122a    uvm_map_clean+0x44a
cs                               0x8
rflags                       0x10286    __ALIGN_SIZE+0xf286
rsp               0xffff800020f432d0
ss                              0x10
uvm_map_clean+0x44a:    movl    0x48(%r15),%ebx
ddb{1}> show proc
PROC (syz-fuzzer) pid=178812 stat=onproc
    flags process=2<EXEC,8ORPHAN> proc=4000000<THREAD>
    pri=86, usrpri=51, nice=20
    forw=0xffffffffffffffff, list=0xffff800020ed1d50,0xffff800020e6ceb8
    process=0xffff800020ec9728 user=0xffff800020f3e000, vmspace=0xfffffd806e954178
    estcpu=1, cpticks=6, pctcpu=0.2
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 81089  175303  79498      0  7        0x10                syz-executor.0
 81089  411118  79498      0  3   0x4000090  fifow         syz-executor.0
 81089  109066  79498      0  3   0x4000090  fsleep        syz-executor.0
 81089  154319  79498      0  3   0x4000090  fifow         syz-executor.0
 81089  416687  79498      0  3   0x4000090  fifow         syz-executor.0
 81089  446265  79498      0  3   0x4000090  fsleep        syz-executor.0
 16409   36352      1      0  3    0x100083  ttyin         getty
 39470  387130      0      0  3     0x14200  bored         sosplice
 79498  234589  33331      0  3        0x82  nanosleep     syz-executor.0
 33331   99473  61265      0  3        0x82  thrsleep      syz-fuzzer
 33331   95824  61265      0  3   0x4000082  nanosleep     syz-fuzzer
 33331   97492  61265      0  3   0x4000082  kqread        syz-fuzzer
 33331   84567  61265      0  3   0x4000082  thrsleep      syz-fuzzer
 33331  184054  61265      0  3   0x4000082  thrsleep      syz-fuzzer
*33331  178812  61265      0  7   0x4000002                syz-fuzzer
 33331  385736  61265      0  3   0x4000082  thrsleep      syz-fuzzer
 33331  352873  61265      0  3   0x4000082  thrsleep      syz-fuzzer
 33331   46603  61265      0  3   0x4000082  thrsleep      syz-fuzzer
 33331  234823  61265      0  3   0x4000082  thrsleep      syz-fuzzer
 61265  376716  22148      0  3    0x10008a  pause         ksh
 22148   51877  51271      0  3        0x92  select        sshd
 51271  433487      1      0  3        0x80  select        sshd
 65066  240054   1625     74  3    0x100092  bpf           pflogd
  1625  179963      1      0  3        0x80  netio         pflogd
 21657  139722  48279     73  3    0x100090  kqread        syslogd
 48279  289533      1      0  3    0x100082  netio         syslogd
 17495  495008      1     77  3    0x100090  poll          dhclient
 87304   74984      1      0  3        0x80  poll          dhclient
 18199  197003      0      0  3     0x14200  bored         smr
  3164  111320      0      0  2     0x14200                zerothread
 23267   53152      0      0  3     0x14200  aiodoned      aiodoned
 70008  150433      0      0  3     0x14200  syncer        update
 78367  340052      0      0  3     0x14200  cleaner       cleaner
 72006  230201      0      0  3     0x14200  reaper        reaper
 27581    7050      0      0  3     0x14200  pgdaemon      pagedaemon
 19428  146702      0      0  3     0x14200  bored         crynlk
 49592   26952      0      0  3     0x14200  bored         crypto
  8932  251241      0      0  3  0x40014200  acpi0         acpi0
 60734   17507      0      0  3  0x40014200                idle1
 82160  289644      0      0  3     0x14200  bored         softnet
 26377   50462      0      0  3     0x14200  bored         systqmp
 37476  506352      0      0  3     0x14200  bored         systq
 16121  436710      0      0  3  0x40014200  bored         softclock
 35097   22269      0      0  3  0x40014200                idle0
     1  266331      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 33331 (syz-fuzzer) thread 0xffff800020e6cc38 (178812)
shared rwlock vmmaplk r = 0 (0xfffffd806e954190)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  uvm_map_clean+0xe2 vm_map_lock_read_ln sys/uvm/uvm_map.c:5467 [inline]
#1  uvm_map_clean+0xe2 sys/uvm/uvm_map.c:4628
#2  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#2  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#3  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff8266c1b0)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  syscall+0x400 mi_syscall sys/sys/syscall_mi.h:93 [inline]
#1  syscall+0x400 sys/arch/amd64/amd64/trap.c:570
#2  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9523   6425K    6819K  78643K     11119        0
            pcb    14      8K       8K  78643K       124        0
         rtable    82      3K       4K  78643K       301        0
         ifaddr    74     14K      16K  78643K       125        0
       counters    41     33K      34K  78643K        55        0
       ioctlops     0      0K       4K  78643K      1491        0
            iov     0      0K      28K  78643K       155        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1219     77K      77K  78643K      1385        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         3        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       1K  78643K        38        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1809    196K     290K  78643K     12766        0
      file desc     4      9K      25K  78643K       350        0
          sigio     0      0K       0K  78643K         9        0
           proc    63     63K      83K  78643K       501        0
        subproc    16      1K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        35        0
       in_multi    55      2K       3K  78643K       125        0
    ether_multi     1      0K       0K  78643K        14        0
            mrt     1      0K       0K  78643K         7        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    55    254K     254K  78643K        55        0
           exec     0      0K       1K  78643K       236        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   124     63K      71K  78643K      2198        0
       UVM aobj    14      2K       2K  78643K        24        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        85        0
            NDP    12      0K       0K  78643K        25        0
           temp    89   3038K    3107K  78643K     11839        0
         kqueue     3      4K      12K  78643K        36        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        8    0        3     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       30    0       28     1     0     1     1     0     8    0
rtentry    112       61    0       30     2     0     2     2     0     8    0
unpcb      120      150    0      138     1     0     1     1     0     8    0
syncache   264        7    0        7     3     2     1     1     0     8    1
sackhl      24        2    0        2     1     1     0     1     0     8    0
tcpqe       32      959    0      959     2     1     1     1     0     8    1
tcpcb      544      158    0      153     1     0     1     1     0     8    0
inpcb      280      665    0      655     5     3     2     2     0     8    1
rttmr       72        3    0        3     2     2     0     1     0     8    0
nd6         48        9    0        8     1     0     1     1     0     8    0
ppxss      1128       1    0        1     1     1     0     1     0     8    0
pffrag     232        3    0        3     1     1     0     1     0   482    0
pffrnode    88        3    0        3     1     1     0     1     0     8    0
pffrent     40       49    0       49     1     1     0     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       47    0       24     1     0     1     1     0     8    0
pfstkey    112       47    0       24     1     0     1     1     0     8    0
pfstate    328       47    0       24     3     0     3     3     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      246    0      117    13     1    12    12     0     8    2
art_table   32      247    0      117     2     0     2     2     0     8    0
art_node    16       60    0       31     1     0     1     1     0     8    0
sysvmsgpl   40       14    0       14     2     2     0     1     0     8    0
semupl     112        4    0        4     1     1     0     1     0     8    0
semapl     112       34    0       24     1     0     1     1     0     8    0
shmpl      112       22    0       10     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1940    0      537    89     0    89    89     0     8    0
ffsino     272     1940    0      537    95     0    95    95     0     8    0
nchpl      144     2665    0     1075    60     0    60    60     0     8    0
uvmvnodes   72     2086    0        0    38     0    38    38     0     8    0
vnodes     208     2086    0        0   110     0   110   110     0     8    0
namei      1024    7313    0     7313     3     2     1     1     0     8    1
percpumem   16       38    0        7     1     0     1     1     0     8    0
vcpupl     1984       5    0        0     1     0     1     1     0     8    0
vmpool     560        7    0        2     1     0     1     1     0     8    0
scsiplug    64        2    0        2     1     1     0     1     0     8    0
scxspl     192     7327    0     7327    10     9     1     7     0     8    1
plimitpl   152       41    0       34     1     0     1     1     0     8    0
sigapl     424      567    0      536     4     0     4     4     0     8    0
futexpl     56     5979    0     5977     3     2     1     1     0     8    0
knotepl    112      103    0       90     1     0     1     1     0     8    0
kqueuepl   144       72    0       70     1     0     1     1     0     8    0
pipelkpl    48      352    0      344     1     0     1     1     0     8    0
pipepl     120      704    0      689     1     0     1     1     0     8    0
fdescpl    496      551    0      536     3     0     3     3     0     8    0
filepl     152     3804    0     3723     6     1     5     5     0     8    0
lockfpl    104      236    0      235     1     0     1     1     0     8    0
lockfspl    48       65    0       64     1     0     1     1     0     8    0
sessionpl  112       19    0        9     1     0     1     1     0     8    0
pgrppl      48       19    0        9     1     0     1     1     0     8    0
ucredpl     96      294    0      283     1     0     1     1     0     8    0
zombiepl   144      536    0      536     3     2     1     1     0     8    1
processpl  984      567    0      536     6     1     5     5     0     8    0
procpl     624     1402    0     1357     5     1     4     5     0     8    0
sosppl     128        2    0        2     2     2     0     1     0     8    0
sockpl     400      845    0      822     7     4     3     4     0     8    0
mcl64k     65536    264    0        0    33     2    31    33     0     8    1
mcl12k     12288      7    0        0     1     0     1     1     0     8    0
mcl9k      9216       7    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096       5    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     177    0        0    22     0    22    22     0     8    0
mtagpl      80       27    0        0     1     0     1     1     0     8    0
mbufpl     256      411    0        0    24     0    24    24     0     8    0
bufpl      280     4024    0      135   278     0   278   278     0     8    0
anonpl      16    63149    0    48586    75    15    60    69     0   124    0
amapchunkpl 152    3434    0     3290    21    13     8    20     0   158    0
amappl16   192     2413    0     1623    51    11    40    47     0     8    0
amappl15   184      161    0      158     1     0     1     1     0     8    0
amappl14   176       24    0       20     1     0     1     1     0     8    0
amappl13   168       25    0       24     1     0     1     1     0     8    0
amappl12   160      172    0      169     2     1     1     1     0     8    0
amappl11   152       57    0       42     1     0     1     1     0     8    0
amappl10   144      174    0      170     1     0     1     1     0     8    0
amappl9    136      382    0      380     1     0     1     1     0     8    0
amappl8    128      369    0      331     2     0     2     2     0     8    0
amappl7    120      277    0      264     1     0     1     1     0     8    0
amappl6    112       28    0       23     2     1     1     1     0     8    0
amappl5    104      466    0      447     1     0     1     1     0     8    0
amappl4     96      494    0      463     1     0     1     1     0     8    0
amappl3     88      120    0      114     1     0     1     1     0     8    0
amappl2     80     3633    0     3562     2     0     2     2     0     8    0
amappl1     72    21958    0    21529    23    13    10    18     0     8    0
amappl      80     1655    0     1607     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       23    0       10     1     0     1     1     0     8    0
uaddrrnd    24      558    0      538     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      558    0      538     1     0     1     1     0     8    0
vmmpekpl   168     9084    0     9053     2     0     2     2     0     8    0
vmmpepl    168    73654    0    71761   116    25    91   101     0   357    5
vmsppl     368      557    0      538     2     0     2     2     0     8    0
pdppl      4096    1124    0     1081     7     1     6     7     0     8    0
pvpl        32   211546    0   193912   169    19   150   169     0   265    5
pmappl     232      557    0      538     2     0     2     2     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      311    0       14     9     0     9     9     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff82523ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff8266bfa8) at __mp_lock+0x127 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff8266bfa8) at __mp_lock+0x127 sys/kern/kern_lock.c:147
softintr_dispatch(0) at softintr_dispatch+0x4e sys/arch/amd64/amd64/softintr.c:89
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7ffffbbda0, count: -6
ddb{0}> machine ddbcpu 1
Stopped at      uvm_map_clean+0x44a:    movl    0x48(%r15),%ebx
ddb{1}> trace
uvm_map_clean(fffffd806e954178,c002cca000,c003138000,8) at uvm_map_clean+0x44a sys/uvm/uvm_map.c:4677
syscall(ffff800020f43470) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020f43470) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc00004feb8, count: -3

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/07 16:07 openbsd 99490db6b06d 98cbd87b .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.