syzbot


panic: kmmaplk: lock not shared

Status: fixed on 2022/03/13 01:44
Reported-by: syzbot+739bb901045d9b193bde@syzkaller.appspotmail.com
Fix commit: 447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
First crash: 261d, last: 260d

Sample crash report:
panic: kmmaplk: lock not shared
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*483507  66720      0         0x2          0    0  syz-executor1354427187
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff825b9701) at panic+0x161 sys/kern/subr_prf.c:202
rw_exit_read(ffffffff82a80478) at rw_exit_read+0x154 sys/kern/kern_rwlock.c:398
uvm_map_fill_vmmap(ffffffff82a80470,ffff800000bb1000,ffff80002163b568) at uvm_map_fill_vmmap+0xf6 vm_map_upgrade_ln sys/uvm/uvm_map.c:5540 [inline]
uvm_map_fill_vmmap(ffffffff82a80470,ffff800000bb1000,ffff80002163b568) at uvm_map_fill_vmmap+0xf6 sys/uvm/uvm_map.c:5593
sysctl_proc_vmmap(ffff80002163b948,1,200006c0,ffff80002163b978,ffff8000215eda50) at sysctl_proc_vmmap+0x229 sys/kern/kern_sysctl.c:2111
kern_sysctl(ffff80002163b944,2,200006c0,ffff80002163b978,0,fffffffffffffe97,6d5e7431cfb019bc) at kern_sysctl+0xfd sys/kern/kern_sysctl.c:449
sys_sysctl(ffff8000215eda50,ffff80002163b9e8,ffff80002163ba40) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:249
syscall(ffff80002163bab0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffda6a0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: kmmaplk: lock not shared
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff825b9701) at panic+0x161 sys/kern/subr_prf.c:202
rw_exit_read(ffffffff82a80478) at rw_exit_read+0x154 sys/kern/kern_rwlock.c:398
uvm_map_fill_vmmap(ffffffff82a80470,ffff800000bb1000,ffff80002163b568) at uvm_map_fill_vmmap+0xf6 vm_map_upgrade_ln sys/uvm/uvm_map.c:5540 [inline]
uvm_map_fill_vmmap(ffffffff82a80470,ffff800000bb1000,ffff80002163b568) at uvm_map_fill_vmmap+0xf6 sys/uvm/uvm_map.c:5593
sysctl_proc_vmmap(ffff80002163b948,1,200006c0,ffff80002163b978,ffff8000215eda50) at sysctl_proc_vmmap+0x229 sys/kern/kern_sysctl.c:2111
kern_sysctl(ffff80002163b944,2,200006c0,ffff80002163b978,0,fffffffffffffe97,6d5e7431cfb019bc) at kern_sysctl+0xfd sys/kern/kern_sysctl.c:449
sys_sysctl(ffff8000215eda50,ffff80002163b9e8,ffff80002163ba40) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:249
syscall(ffff80002163bab0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffda6a0, count: -9
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002163b3e0
rbx               0xffffffff82a80478    kernel_map_store+0x8
rdx                            0x3fd
rcx                                0
rax                             0x20
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x903c50c062659b4b
r11               0xf0a6f65a852d09d3
r12                                0
r13               0xffffffff82a80470    kernel_map_store
r14                                0
r15                              0x1
rip               0xffffffff8120dfc8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80002163b3d0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor1354427187) pid=483507 stat=onproc
    flags process=2<EXEC> proc=0
    pri=50, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff8000215ed7b0,0xffffffff829b7c50
    process=0xffff8000215e1780 user=0xffff800021636000, vmspace=0xfffffd807f017220
    estcpu=0, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*66720  483507  36050      0  7         0x2                syz-executor1354427187
 36050  482628  48873      0  3    0x10008a  sigsusp       ksh
 48873   88675   1011      0  2        0x12                sshd
 11568  191825      1      0  3    0x100083  ttyin         getty
  1011  194989      1      0  3        0x88  kqread        sshd
 50387  312660  70434     73  3   0x1100090  kqread        syslogd
 70434  366160      1      0  3    0x100082  netio         syslogd
 43519  123967      1      0  3    0x100080  kqread        resolvd
 89484   66170  98974     77  3    0x100092  kqread        dhcpleased
 81466  282894  98974     77  3    0x100092  kqread        dhcpleased
 98974  145261      1      0  3        0x80  kqread        dhcpleased
 47189  203982      0      0  3     0x14200  bored         smr
 40118  295401      0      0  2     0x14200                zerothread
 58323  442421      0      0  3     0x14200  aiodoned      aiodoned
 13294  489146      0      0  3     0x14200  syncer        update
  4122   32926      0      0  3     0x14200  cleaner       cleaner
 21573  395550      0      0  3     0x14200  reaper        reaper
  2094  308781      0      0  3     0x14200  pgdaemon      pagedaemon
 71813   52870      0      0  3     0x14200  bored         viomb
 82877  212491      0      0  3  0x40014200  acpi0         acpi0
 77110  450145      0      0  3     0x14200  bored         softnet
 76614   95174      0      0  3     0x14200  bored         systqmp
 80844  376647      0      0  3     0x14200  bored         systq
  5086  375631      0      0  3  0x40014200  bored         softclock
 86433  418749      0      0  3  0x40014200                idle0
     1  480229      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10131   6381K    6412K  78643K     11221        0
            pcb    13      8K       8K  78643K        13        0
         rtable    62      2K       2K  78643K       114        0
         ifaddr    24      7K       7K  78643K        24        0
       counters    19     16K      16K  78643K        19        0
       ioctlops     0      0K       2K  78643K        25        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1166     73K      73K  78643K      1179        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc     1      0K       0K  78643K         1        0
           proc    55     54K      55K  78643K       226        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    25    122K     122K  78643K        25        0
           exec     0      0K       2K  78643K       406        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    73      3K       5K  78643K      1915        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     3      0K       0K  78643K         3        0
           temp    20   4690K    4745K  78643K      3094        0
         kqueue    11     16K      18K  78643K        24        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       20    0       17     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      136       33    0       20     1     0     1     1     0     8    0
syncache   296        5    0        5     2     1     1     1     0     8    1
tcpcb      736        8    0        5     1     0     1     1     0     8    0
arp         88        2    0        0     1     0     1     1     0     8    0
inpcb      304       25    0       19     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1415    0       38    87     0    87    87     0     8    0
ffsino     240     1415    0       38    81     0    81    81     0     8    0
nchpl      144     1590    0       47    58     0    58    58     0     8    0
uvmvnodes   80     1424    0        0    30     0    30    30     0     8    0
vnodes     224     1424    0        0    84     0    84    84     0     8    0
namei      1024    4181    0     4181     2     1     1     1     0     8    1
scxspl     216     3659    0     3659     2     1     1     2     0     8    1
plimitpl   152       15    0        9     1     0     1     1     0     8    0
sigapl     424      300    0      274     4     0     4     4     0     8    0
knotepl    120     6209    0     6178     3     1     2     2     0     8    1
kqueuepl   184       20    0       13     1     0     1     1     0     8    0
pipepl     304       82    0       79     2     1     1     1     0     8    0
fdescpl    432      287    0      274     2     0     2     2     0     8    0
filepl     120     1028    0      975     2     0     2     2     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl     96       64    0       54     1     0     1     1     0     8    0
zombiepl   144      274    0      274     2     1     1     1     0     8    1
processpl  1000     300    0      274     4     0     4     4     0     8    0
procpl     672      300    0      274     3     0     3     3     0     8    0
sockpl     448       78    0       56     3     0     3     3     0     8    0
mcl8k      8192       9    0        9     2     1     1     1     0     8    1
mcl4k      4096       5    0        5     2     1     1     1     0     8    1
mcl2k      2048    5617    0     5589     7     1     6     6     0     8    2
mtagpl      96        4    0        4     1     1     0     1     0     8    0
mbufpl     256    10209    0    10142     6     0     6     6     0     8    0
bufpl      288     1932    0       86   132     0   132   132     0     8    0
anonpl      24    39309    0    37268    16     2    14    15     0   188    1
amapchunkpl 152    3750    0     3623     7     1     6     7     0   158    0
amappl16   200       28    0       27     2     1     1     1     0     8    0
amappl15   192       62    0       59     1     0     1     1     0     8    0
amappl13   176       32    0       31     2     1     1     1     0     8    0
amappl12   168        7    0        7     2     1     1     1     0     8    1
amappl11   160       43    0       33     1     0     1     1     0     8    0
amappl9    144      396    0      394     1     0     1     1     0     8    0
amappl8    136      350    0      347     1     0     1     1     0     8    0
amappl7    128       61    0       58     1     0     1     1     0     8    0
amappl6    120      109    0       96     1     0     1     1     0     8    0
amappl5    112      263    0      254     1     0     1     1     0     8    0
amappl4    104      590    0      571     1     0     1     1     0     8    0
amappl3     96      117    0      108     1     0     1     1     0     8    0
amappl2     88      356    0      319     1     0     1     1     0     8    0
amappl1     80     8336    0     7991     9     1     8     9     0     8    0
amappl      88     1653    0     1596     2     0     2     2     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      287    0      274     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      287    0      274     1     0     1     1     0     8    0
vmmpekpl   168     5868    0     5853     1     0     1     1     0     8    0
vmmpepl    168    25223    0    24468    39     2    37    38     0   357    3
vmsppl     272      286    0      274     2     1     1     2     0     8    0
rwobjpl     24     9170    0     7244    12     0    12    12     0     8    0
pdppl      4096     580    0      548    53    21    32    40     0     8    0
pvpl        32   127320    0   123535    35     1    34    34     0   265    2
pmappl     216      286    0      274     1     0     1     1     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112      391    0       28    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff825b9701) at panic+0x161 sys/kern/subr_prf.c:202
rw_exit_read(ffffffff82a80478) at rw_exit_read+0x154 sys/kern/kern_rwlock.c:398
uvm_map_fill_vmmap(ffffffff82a80470,ffff800000bb1000,ffff80002163b568) at uvm_map_fill_vmmap+0xf6 vm_map_upgrade_ln sys/uvm/uvm_map.c:5540 [inline]
uvm_map_fill_vmmap(ffffffff82a80470,ffff800000bb1000,ffff80002163b568) at uvm_map_fill_vmmap+0xf6 sys/uvm/uvm_map.c:5593
sysctl_proc_vmmap(ffff80002163b948,1,200006c0,ffff80002163b978,ffff8000215eda50) at sysctl_proc_vmmap+0x229 sys/kern/kern_sysctl.c:2111
kern_sysctl(ffff80002163b944,2,200006c0,ffff80002163b978,0,fffffffffffffe97,6d5e7431cfb019bc) at kern_sysctl+0xfd sys/kern/kern_sysctl.c:449
sys_sysctl(ffff8000215eda50,ffff80002163b9e8,ffff80002163ba40) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:249
syscall(ffff80002163bab0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffda6a0, count: -9
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff825b9701) at panic+0x161 sys/kern/subr_prf.c:202
rw_exit_read(ffffffff82a80478) at rw_exit_read+0x154 sys/kern/kern_rwlock.c:398
uvm_map_fill_vmmap(ffffffff82a80470,ffff800000bb1000,ffff80002163b568) at uvm_map_fill_vmmap+0xf6 vm_map_upgrade_ln sys/uvm/uvm_map.c:5540 [inline]
uvm_map_fill_vmmap(ffffffff82a80470,ffff800000bb1000,ffff80002163b568) at uvm_map_fill_vmmap+0xf6 sys/uvm/uvm_map.c:5593
sysctl_proc_vmmap(ffff80002163b948,1,200006c0,ffff80002163b978,ffff8000215eda50) at sysctl_proc_vmmap+0x229 sys/kern/kern_sysctl.c:2111
kern_sysctl(ffff80002163b944,2,200006c0,ffff80002163b978,0,fffffffffffffe97,6d5e7431cfb019bc) at kern_sysctl+0xfd sys/kern/kern_sysctl.c:449
sys_sysctl(ffff8000215eda50,ffff80002163b9e8,ffff80002163ba40) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:249
syscall(ffff80002163bab0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffda6a0, count: -9
ddb> 

Crashes (15):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2022/03/12 00:08 openbsd 5f69141a284a 9e8eaa75 .config log report syz C panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 12:32 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 11:41 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 10:05 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 09:12 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 08:49 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 07:48 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 07:11 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 06:26 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 06:02 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 05:54 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 04:02 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/12 03:23 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/11 23:58 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
ci-openbsd-main 2022/03/11 23:48 openbsd 5f69141a284a 9e8eaa75 .config log report panic: kmmaplk: lock not shared
* Struck through repros no longer work on HEAD.