syzbot


uvm_fault: pool_do_get (2)

Status: auto-obsoleted due to no activity on 2023/01/14 12:52
Reported-by: syzbot+7b94a5def0e335a03646@syzkaller.appspotmail.com
First crash: 135d, last: 112d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: pool_do_get 1 335d 335d 0/3 auto-closed as invalid on 2022/06/05 15:40

Sample crash report:
uvm_fault(0xfffffd806badcbc0, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      pool_do_get+0x2c7:      movq    0(%rax),%rax
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*355747  94364      0           0  0x4000000    0  syz-executor.3
pool_do_get(ffffffff82a00088,9,ffff800029a43968) at pool_do_get+0x2c7 pool_update_curpage sys/kern/subr_pool.c:1059 [inline]
pool_do_get(ffffffff82a00088,9,ffff800029a43968) at pool_do_get+0x2c7 sys/kern/subr_pool.c:765
pool_get(ffffffff82a00088,9) at pool_get+0xb3 sys/kern/subr_pool.c:582
socreate(1,ffff800029a43a40,5,0) at socreate+0xa8 soalloc sys/kern/uipc_socket.c:147 [inline]
socreate(1,ffff800029a43a40,5,0) at socreate+0xa8 sys/kern/uipc_socket.c:178
sys_socketpair(ffff8000216f0000,ffff800029a43ad8,ffff800029a43b30) at sys_socketpair+0x6e sys/kern/uipc_syscalls.c:471
syscall(ffff800029a43ba0) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xadb7230ffd0, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd806badcbc0, 0x0, 0, 1) -> e
ddb> trace
pool_do_get(ffffffff82a00088,9,ffff800029a43968) at pool_do_get+0x2c7 pool_update_curpage sys/kern/subr_pool.c:1059 [inline]
pool_do_get(ffffffff82a00088,9,ffff800029a43968) at pool_do_get+0x2c7 sys/kern/subr_pool.c:765
pool_get(ffffffff82a00088,9) at pool_get+0xb3 sys/kern/subr_pool.c:582
socreate(1,ffff800029a43a40,5,0) at socreate+0xa8 soalloc sys/kern/uipc_socket.c:147 [inline]
socreate(1,ffff800029a43a40,5,0) at socreate+0xa8 sys/kern/uipc_socket.c:178
sys_socketpair(ffff8000216f0000,ffff800029a43ad8,ffff800029a43b30) at sys_socketpair+0x6e sys/kern/uipc_syscalls.c:471
syscall(ffff800029a43ba0) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xadb7230ffd0, count: -6
ddb> show registers
rdi                              0x8
rsi               0xffffffff82a000d0    socket_pool+0x48
rbp               0xffff800029a43910
rbx                              0x8
rdx                                0
rcx               0xffffffff82a000c8    socket_pool+0x40
rax                                0
r8                0xffffffff8101eb00    uvm_map_inentry_pc
r9                              0x1d
r10                                0
r11               0xaa395a6e59ce4479
r12                              0x8
r13               0xfffffd806f023398
r14               0xffffffff82a00088    socket_pool
r15               0xfffffd806f023f90
rip               0xffffffff8252bc17    pool_do_get+0x2c7
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800029a43890
ss                              0x10
pool_do_get+0x2c7:      movq    0(%rax),%rax
ddb> show proc
PROC (syz-executor.3) pid=355747 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=32, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff8000216f17a0,0xffff80002179ed40
    process=0xffff80002178efd0 user=0xffff800029a3e000, vmspace=0xfffffd806badcbc0
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 45993  292856  52238      0  3        0x80  nanoslp       syz-executor.2
 45993  269849  52238      0  3   0x4000080  fsleep        syz-executor.2
 94364  155406  93828      0  2           0                syz-executor.3
*94364  355747  93828      0  7   0x4000000                syz-executor.3
 21709  195736  85985      0  3        0x82  nanoslp       syz-executor.1
 73448  191942      1      0  3    0x100083  ttyin         getty
   942  363806  85985      0  3        0x82  nanoslp       syz-executor.5
 18647  178749  85985      0  2         0x2                syz-executor.4
 51757  234160  85985      0  2         0x2                syz-executor.6
 93828  182532  85985      0  3        0x82  nanoslp       syz-executor.3
 80357  157638  85985      0  2         0x2                syz-executor.0
  9761  405386  85985      0  3        0x82  nanoslp       syz-executor.7
 52238    7640  85985      0  3        0x82  nanoslp       syz-executor.2
 90616  130906      0      0  3     0x14200  bored         sosplice
 85985  489265  24462      0  3        0x82  thrsleep      syz-fuzzer
 85985  378510  24462      0  3   0x4000082  nanoslp       syz-fuzzer
 85985  484239  24462      0  3   0x4000082  wait          syz-fuzzer
 85985  463155  24462      0  3   0x4000082  wait          syz-fuzzer
 85985  481785  24462      0  3   0x4000082  thrsleep      syz-fuzzer
 85985  116789  24462      0  3   0x4000082  wait          syz-fuzzer
 85985  221731  24462      0  3   0x4000082  kqread        syz-fuzzer
 85985   25137  24462      0  3   0x4000082  thrsleep      syz-fuzzer
 85985   27856  24462      0  3   0x4000082  thrsleep      syz-fuzzer
 85985  326072  24462      0  3   0x4000082  wait          syz-fuzzer
 85985  395807  24462      0  3   0x4000082  wait          syz-fuzzer
 85985  257009  24462      0  3   0x4000082  wait          syz-fuzzer
 85985  502501  24462      0  3   0x4000082  wait          syz-fuzzer
 85985  140217  24462      0  3   0x4000082  wait          syz-fuzzer
 24462  269752  98800      0  3    0x10008a  sigsusp       ksh
 98800  195949   5584      0  3        0x9a  kqread        sshd
  5584  303194      1      0  3        0x88  kqread        sshd
  5520  244128  20068     73  3   0x1100090  kqread        syslogd
 20068  430675      1      0  3    0x100082  netio         syslogd
 97173  436235      1      0  3    0x100080  kqread        resolvd
  5370  418756  64774     77  3    0x100092  kqread        dhcpleased
  6636  342245  64774     77  3    0x100092  kqread        dhcpleased
 64774  336033      1      0  3        0x80  kqread        dhcpleased
 20497  292879      0      0  3     0x14200  bored         smr
 98805   58319      0      0  2     0x14200                zerothread
 40421  267153      0      0  3     0x14200  aiodoned      aiodoned
 19129  117000      0      0  3     0x14200  syncer        update
 40932  247336      0      0  3     0x14200  cleaner       cleaner
 80841  332466      0      0  3     0x14200  reaper        reaper
 57897  513984      0      0  3     0x14200  pgdaemon      pagedaemon
 51186  283046      0      0  3     0x14200  bored         viomb
  4347  478877      0      0  3  0x40014200  acpi0         acpi0
 89649  319027      0      0  3     0x14200  bored         softnet
 71982   79760      0      0  3     0x14200  bored         softnet
 18510  230574      0      0  3     0x14200  bored         softnet
 12066  193094      0      0  3     0x14200  bored         softnet
 10359   41162      0      0  3     0x14200  bored         systqmp
 54270  148364      0      0  3     0x14200  bored         systq
 83463  305184      0      0  3  0x40014200  bored         softclock
 34994  473907      0      0  3  0x40014200                idle0
     1  126411      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10205   6408K    7387K  78643K     22052        0
            pcb    17     14K      19K  78643K      4209        0
         rtable   250     18K      20K  78643K      1679        0
         ifaddr   122     28K      28K  78643K       788        0
         sysctl     2      0K       0K  78643K         2        0
       counters    27     17K      17K  78643K       107        0
       ioctlops     0      0K       4K  78643K      8900        0
            iov     0      0K      16K  78643K       467        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1400     87K      88K  78643K      5319        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K      17K  78643K        46        0
         VM map     2      0K       0K  78643K         2        0
            sem    10      0K       0K  78643K        10        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    12     41K      73K  78643K     13629        0
          sigio     0      0K       0K  78643K       148        0
           proc    60     59K      83K  78643K      1309        0
        subproc   104      6K       6K  78643K       468        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       327        0
       in_multi    86      5K       6K  78643K       533        0
    ether_multi     1      0K       0K  78643K        19        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   205    917K     917K  78643K       205        0
           exec     0      0K       2K  78643K      2386        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   304     86K     100K  78643K     69863        0
       UVM aobj    22      2K       2K  78643K        22        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        83        0
            NDP    12      0K       2K  78643K       176        0
           temp   128   4726K    5750K  78643K     52072        0
         kqueue    12     18K      34K  78643K      1959        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      253    0      250     3     2     1     2     0     8    0
rtentry    112      454    0      360     4     1     3     4     0     8    0
unpcb      144     7290    0     7275    50    49     1    10     0     8    0
syncache   296      206    0      206    14    14     0     1     0     8    0
tcpqe       32       46    0       46     8     8     0     1     0     8    0
tcpcb      768     8010    0     7997   181   173     8    22     0     8    6
arp         88       78    0       59     1     0     1     1     0     8    0
ipq         40        3    0        3     2     2     0     1     0     8    0
ipqe        40       43    0       43     2     2     0     1     0     8    0
inpcb      336    13122    0    13106   149   142     7    18     0     8    5
nd6         48      122    0       99     1     0     1     1     0     8    0
pkpcb       40        4    0        4     1     1     0     1     0     8    0
kcovpl      48       36    0       28     1     0     1     1     0     8    0
ppxss      1160      52    0       52     5     5     0     1     0     8    0
pfstscr     40       59    0       57     2     1     1     1     0     8    0
pfrktable  1344     168    0      148     4     2     2     2     0     8    0
pfanchor   1280      12    0        0     1     0     1     1     0     8    0
pftag       88        9    0        4     1     0     1     1     0     8    0
pfqueue    264        1    0        1     1     1     0     1     0     8    0
pfstitem    24        8    0        4     1     0     1     1     0     8    0
pfstkey    120      106    0      102     2     1     1     1     0     8    0
pfstate    336       55    0       53     2     1     1     1     0     8    0
pfrule     1360    1637    0     1267    31     0    31    31     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1848    0     1440    47    21    26    29     0     8    0
art_table   32     1849    0     1440     4     0     4     4     0     8    0
art_node    16      453    0      369     1     0     1     1     0     8    0
sysvmsgpl   40       40    0       40     1     1     0     1     0     8    0
semupl     112        7    0        7     2     2     0     1     0     8    0
semapl     112        8    0        0     1     0     1     1     0     8    0
shmpl      112       19    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256    16412    0    14973    91     0    91    91     0     8    0
ffsino     240    16412    0    14973    86     0    86    86     0     8    0
nchpl      144    36000    0    34370    63     1    62    63     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024  105288    0   105285    15    14     1     2     0     8    0
vcpupl     2048      19    0        5     3     0     3     3     0     8    0
vmpool     536       35    0       21     2     0     2     2     0     8    0
pfiaddrpl  120       77    0       23     2     0     2     2     0     8    0
kstatmem   264      184    0      160     2     0     2     2     0     8    0
scxspl     216   109653    0   109653    11    10     1     8     0     8    1
plimitpl   152      349    0      334     1     0     1     1     0     8    0
sigapl     424    13858    0    13815     7     1     6     6     0     8    0
futexpl     64   104330    0   104329    11    10     1     1     0     8    0
knotepl    120   189354    0   189274    33    30     3    10     0     8    0
kqueuepl   184     2591    0     2583     8     7     1     4     0     8    0
pipepl     288     3492    0     3464    46    43     3    10     0     8    0
fdescpl    432    13841    0    13818     5     1     4     4     0     8    0
filepl     120    79234    0    78989    86    76    10    17     0     8    0
lockfpl    104     1608    0     1606     4     3     1     2     0     8    0
lockfspl    48      469    0      467     1     0     1     1     0     8    0
sessionpl  144       54    0       38     1     0     1     1     0     8    0
pgrppl      48     1024    0     1008     1     0     1     1     0     8    0
ucredpl    104     5467    0     5457     1     0     1     1     0     8    0
zombiepl   144    13818    0    13815     2     1     1     1     0     8    0
processpl  1000   13858    0    13815     8     2     6     7     0     8    0
procpl     672    30917    0    30859    25    19     6     7     0     8    0
sosppl     168      111    0      111     3     3     0     1     0     8    0
sockpl     456    20681    0    20650   500   489    11    32     0     8    7
sockpl: pool(0xffffffff82a00088:sockpl): page inconsistency: page 0x0; at page head addr 0xfffffd8064c32f90 (p 0xfffffd8064c32000)
mcl64k     65536    253    0      253    26    25     1     1     0     8    1
mcl16k     16384     79    0       79    19    19     0     1     0     8    0
mcl12k     12288    273    0      273    23    22     1     1     0     8    1
mcl9k      9216      88    0       88    19    18     1     1     0     8    1
mcl8k      8192     379    0      379    25    25     0     1     0     8    0
mcl4k      4096     846    0      846    18    17     1     1     0     8    1
mcl2k2     2112      65    0       65    19    19     0     1     0     8    0
mcl2k      2048   46618    0    46508    85    69    16    20     0     8    0
mtagpl      96      571    0      381    12     6     6     6     0     8    0
mbufpl     256   178806    0   178404   172   142    30    72     0     8    0
bufpl      288    20400    0    13994   458     0   458   458     0     8    0
anonpl      24  2328325    0  2318070   178   109    69   100     0   188    0
amapchunkpl 152  202822    0   202338    87    65    22    41     0   158    1
amappl16   200    31311    0    30996    61    43    18    31     0     8    1
amappl15   192     2111    0     2100     1     0     1     1     0     8    0
amappl14   184     1679    0     1670     1     0     1     1     0     8    0
amappl13   176      628    0      626     1     0     1     1     0     8    0
amappl12   168     2941    0     2936     1     0     1     1     0     8    0
amappl11   160     1971    0     1958     1     0     1     1     0     8    0
amappl10   152     1478    0     1474     1     0     1     1     0     8    0
amappl9    144      997    0      986     1     0     1     1     0     8    0
amappl8    136     4248    0     4129     5     0     5     5     0     8    0
amappl7    128     3197    0     3173     1     0     1     1     0     8    0
amappl6    120      512    0      495     2     1     1     2     0     8    0
amappl5    112    11639    0    11628     1     0     1     1     0     8    0
amappl4    104     4684    0     4648     2     1     1     2     0     8    0
amappl3     96    40770    0    40728     2     0     2     2     0     8    0
amappl2     88    15817    0    15756     3     1     2     3     0     8    0
amappl1     80   318397    0   317758    27    11    16    21     0     8    0
amappl      88    68849    0    68703     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       21    0        0     1     0     1     1     0     8    0
uaddrrnd    24    13876    0    13839     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    13876    0    13839     1     0     1     1     0     8    0
vmmpekpl   168    91407    0    91349     3     0     3     3     0     8    0
vmmpepl    168  1285153    0  1282958   199    80   119   124     0   357    5
vmsppl     272    13875    0    13839     6     2     4     4     0     8    0
rwobjpl     24   299178    0   291825    46     0    46    46     0     8    0
pdppl      4096   27758    0    27692   608   530    78    87     0     8   12
pvpl        32  4956906    0  4941475   390   248   142   268     0   265    0
pmappl     216    13875    0    13839     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1894    0     1052    26     0    26    26     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
pool_do_get(ffffffff82a00088,9,ffff800029a43968) at pool_do_get+0x2c7 pool_update_curpage sys/kern/subr_pool.c:1059 [inline]
pool_do_get(ffffffff82a00088,9,ffff800029a43968) at pool_do_get+0x2c7 sys/kern/subr_pool.c:765
pool_get(ffffffff82a00088,9) at pool_get+0xb3 sys/kern/subr_pool.c:582
socreate(1,ffff800029a43a40,5,0) at socreate+0xa8 soalloc sys/kern/uipc_socket.c:147 [inline]
socreate(1,ffff800029a43a40,5,0) at socreate+0xa8 sys/kern/uipc_socket.c:178
sys_socketpair(ffff8000216f0000,ffff800029a43ad8,ffff800029a43b30) at sys_socketpair+0x6e sys/kern/uipc_syscalls.c:471
syscall(ffff800029a43ba0) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xadb7230ffd0, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
pool_do_get(ffffffff82a00088,9,ffff800029a43968) at pool_do_get+0x2c7 pool_update_curpage sys/kern/subr_pool.c:1059 [inline]
pool_do_get(ffffffff82a00088,9,ffff800029a43968) at pool_do_get+0x2c7 sys/kern/subr_pool.c:765
pool_get(ffffffff82a00088,9) at pool_get+0xb3 sys/kern/subr_pool.c:582
socreate(1,ffff800029a43a40,5,0) at socreate+0xa8 soalloc sys/kern/uipc_socket.c:147 [inline]
socreate(1,ffff800029a43a40,5,0) at socreate+0xa8 sys/kern/uipc_socket.c:178
sys_socketpair(ffff8000216f0000,ffff800029a43ad8,ffff800029a43b30) at sys_socketpair+0x6e sys/kern/uipc_syscalls.c:471
syscall(ffff800029a43ba0) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xadb7230ffd0, count: -6

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-main 2022/10/16 12:52 openbsd 157b2ee22030 67cb024c .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: pool_do_get
ci-openbsd-main 2022/09/23 08:53 openbsd e9c0eaf3ee16 0042f2b4 .config console log report uvm_fault: pool_do_get
* Struck through repros no longer work on HEAD.