syzbot


panic: receive 3: so ADDR, so_type 1, m ADDR, m_type 0

Status: closed as dup on 2020/01/26 09:59
Reported-by: syzbot+083c5435dbdc42d08b6a@syzkaller.appspotmail.com
First crash: 1637d, last: 1564d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
panic: receive 3: so ADDR, so_type 3, m ADDR, m_type 0 syz 400 1519d 1625d

Sample crash report:
panic: receive 3: so 0xfffffd8052129618, so_type 1, m 0xfffffd8057c01b00, m_type 0
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*378855  63051      0           0  0x4000000    0  syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8218fbcd) at panic+0x15c sys/kern/subr_prf.c:207
soreceive(fffffd8052129618,ffff80001e4465e0,ffff80001e4465a8,0,0,ffff80001e446754) at soreceive+0x16e7
recvit(ffff80001d4133d8,c,ffff80001e446728,0,ffff80001e446810) at recvit+0x32c sys/kern/uipc_syscalls.c:817
sys_recvmsg(ffff80001d4133d8,ffff80001e4467c8,ffff80001e446810) at sys_recvmsg+0x14b sys/kern/uipc_syscalls.c:753
syscall(ffff80001e446890) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x36210ac3af0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
receive 3: so 0xfffffd8052129618, so_type 1, m 0xfffffd8057c01b00, m_type 0
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8218fbcd) at panic+0x15c sys/kern/subr_prf.c:207
soreceive(fffffd8052129618,ffff80001e4465e0,ffff80001e4465a8,0,0,ffff80001e446754) at soreceive+0x16e7
recvit(ffff80001d4133d8,c,ffff80001e446728,0,ffff80001e446810) at recvit+0x32c sys/kern/uipc_syscalls.c:817
sys_recvmsg(ffff80001d4133d8,ffff80001e4467c8,ffff80001e446810) at sys_recvmsg+0x14b sys/kern/uipc_syscalls.c:753
syscall(ffff80001e446890) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x36210ac3af0, count: -7
ddb> show registers
rdi               0xffffffff8209f857    db_enter+0x17
rsi                           0x28a4    __ALIGN_SIZE+0x18a4
rbp               0xffff80001e4463f0
rbx               0xffff80001e4464a0
rdx                           0x28a5    __ALIGN_SIZE+0x18a5
rcx               0xffff80001d441000
rax               0xffff80001d441000
r8                0xffff80001e4463b0
r9                               0x1
r10               0xffff8000009f18c0
r11               0x34bc48bda7aa0999
r12                     0x3000000008
r13               0xffff80001e446400
r14                            0x100
r15                              0x1
rip               0xffffffff8209f858    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80001e4463e0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor.0) pid=378855 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=73, usrpri=73, nice=20
    forw=0xffffffffffffffff, list=0xffff80001d413160,0xffff80001d412ef8
    process=0xffff8000ffff6a30 user=0xffff80001e441000, vmspace=0xfffffd806bc0a110
    estcpu=23, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 54621  447424  73798      0  2           0                syz-executor.1
 54621  305338  73798      0  3   0x4000080  fsleep        syz-executor.1
 63051   49771  54369      0  2           0                syz-executor.0
*63051  378855  54369      0  7   0x4000000                syz-executor.0
 55652  409290      0      0  3     0x14200  bored         sosplice
 73798  212906  99070      0  3        0x82  nanosleep     syz-executor.1
 54369   19806  99070      0  3        0x82  nanosleep     syz-executor.0
 99070  495366   2309      0  3        0x82  thrsleep      syz-fuzzer
 99070   26968   2309      0  3   0x4000082  thrsleep      syz-fuzzer
 99070  121553   2309      0  3   0x4000082  thrsleep      syz-fuzzer
 99070  523615   2309      0  3   0x4000082  thrsleep      syz-fuzzer
 99070  502767   2309      0  3   0x4000082  thrsleep      syz-fuzzer
 99070  308188   2309      0  3   0x4000082  thrsleep      syz-fuzzer
 99070   70743   2309      0  3   0x4000082  thrsleep      syz-fuzzer
 99070  273636   2309      0  3   0x4000082  kqread        syz-fuzzer
  2309  227773  59979      0  3    0x10008a  pause         ksh
 59979  105049  18792      0  3        0x92  select        sshd
 50885  497672      1      0  3    0x100083  ttyin         getty
 18792  256450      1      0  3        0x80  select        sshd
 43273  127549  45422     73  3    0x100090  kqread        syslogd
 45422   39889      1      0  3    0x100082  netio         syslogd
 40987   55722      1     77  3    0x100090  poll          dhclient
  3642  372659      1      0  3        0x80  poll          dhclient
 80858  118347      0      0  2     0x14200                zerothread
 95321  424404      0      0  3     0x14200  aiodoned      aiodoned
 46559  400677      0      0  3     0x14200  syncer        update
 57073  424364      0      0  3     0x14200  cleaner       cleaner
 78002  277101      0      0  3     0x14200  reaper        reaper
 65492  495126      0      0  3     0x14200  pgdaemon      pagedaemon
 63416  276583      0      0  3     0x14200  bored         crynlk
 57183  338992      0      0  3     0x14200  bored         crypto
 58551  306387      0      0  3  0x40014200  acpi0         acpi0
 61100  440068      0      0  3     0x14200  bored         softnet
 40163   50817      0      0  3     0x14200  bored         systqmp
 16121  214297      0      0  3     0x14200  bored         systq
 56495  477620      0      0  3  0x40014200  bored         softclock
  5807  220995      0      0  3  0x40014200                idle0
  2498  387638      0      0  3     0x14200  bored         smr
     1  239260      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9488   6346K    6863K  78643K     11512        0
            pcb    13      8K       8K  78643K        43        0
         rtable   110      3K       4K  78643K       273        0
         ifaddr    70     15K      15K  78643K       107        0
       counters    19     16K      16K  78643K        19        0
       ioctlops     0      0K       2K  78643K        21        0
            iov     1      4K      16K  78643K        36        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1217     76K      77K  78643K      1340        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         4        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      1K       1K  78643K        24        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1794    195K     288K  78643K     12646        0
      file desc     6     17K      25K  78643K       169        0
           proc    50     38K      63K  78643K       375        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        14        0
       in_multi    65      3K       3K  78643K        84        0
    ether_multi     1      0K       0K  78643K         8        0
            mrt     0      0K       0K  78643K         2        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    49    228K     228K  78643K        49        0
           exec     0      0K       1K  78643K       193        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   105     21K      37K  78643K      1250        0
       UVM aobj     8      2K       2K  78643K         8        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        36        0
            NDP    10      0K       0K  78643K        20        0
           temp    88   3001K    3065K  78643K      9006        0
         kqueue     3      4K      18K  78643K        32        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        7    0        1     1     0     1     1     0     8    0
rtpcb       80       35    0       33     1     0     1     1     0     8    0
rtentry    112       49    0        4     2     0     2     2     0     8    0
unpcb      120      177    0      165     2     0     2     2     0     8    1
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpqe       32       12    0       12     1     1     0     1     0     8    0
tcpcb      544       56    0       52     1     0     1     1     0     8    0
inpcb      280      173    0      165     1     0     1     1     0     8    0
nd6         48        4    0        0     1     0     1     1     0     8    0
ppxss      1128       5    0        5     1     0     1     1     0     8    1
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      223    0        2    14     0    14    14     0     8    0
art_table   32      225    0        2     2     0     2     2     0     8    0
art_node    16       48    0        7     1     0     1     1     0     8    0
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl     112       18    0        8     1     0     1     1     0     8    0
shmpl      112        6    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1649    0      255    46     0    46    46     0     8    0
ffsino     240     1649    0      255    83     0    83    83     0     8    0
nchpl      144     2079    0      479    60     0    60    60     0     8    0
uvmvnodes   72     1777    0        0    33     0    33    33     0     8    0
vnodes     208     1777    0        0    94     0    94    94     0     8    0
namei      1024    6307    0     6307     1     0     1     1     0     8    1
scxspl     192     6312    0     6312     1     0     1     1     0     8    1
plimitpl   152       20    0       13     1     0     1     1     0     8    0
sigapl     432      340    0      326     2     0     2     2     0     8    0
futexpl     56     5646    0     5645     1     0     1     1     0     8    0
knotepl    112      100    0       81     1     0     1     1     0     8    0
kqueuepl   104       40    0       38     1     0     1     1     0     8    0
pipelkpl    16      101    0       91     1     0     1     1     0     8    0
pipepl     120      202    0      183     1     0     1     1     0     8    0
fdescpl    432      341    0      326     2     0     2     2     0     8    0
filepl     120     3075    0     2963     7     0     7     7     0     8    3
lockfpl    104       75    0       74     1     0     1     1     0     8    0
lockfspl    48       25    0       24     1     0     1     1     0     8    0
sessionpl  112       17    0        7     1     0     1     1     0     8    0
pgrppl      48       17    0        7     1     0     1     1     0     8    0
ucredpl     96      182    0      175     1     0     1     1     0     8    0
zombiepl   144      326    0      326     1     0     1     1     0     8    1
processpl  864      356    0      326     4     0     4     4     0     8    0
procpl     632      553    0      514     4     0     4     4     0     8    0
sockpl     384      385    0      363     5     0     5     5     0     8    2
mcl64k     65536     16    0       16     1     0     1     1     0     8    1
mcl12k     12288      6    0        6     1     0     1     1     0     8    1
mcl9k      9216       1    0        1     1     0     1     1     0     8    1
mcl8k      8192      11    0       11     1     0     1     1     0     8    1
mcl4k      4096      46    0       46     2     1     1     1     0     8    1
mcl2k2     2112       4    0        4     1     0     1     1     0     8    1
mcl2k      2048   62851    0    62812    12     6     6    11     0     8    0
mtagpl      80        4    0        2     2     1     1     1     0     8    0
mbufpl     256    99811    0    99728    12     4     8     9     0     8    1
bufpl      280     6788    0     1330   390     0   390   390     0     8    0
anonpl      16    50748    0    35574    77     1    76    76     0   107   15
amapchunkpl 152    1864    0     1731    19     1    18    19     0   158   12
amappl16   192     1864    0     1034    52     4    48    52     0     8    6
amappl15   184       51    0       47     1     0     1     1     0     8    0
amappl14   176       88    0       84     1     0     1     1     0     8    0
amappl13   168       74    0       71     1     0     1     1     0     8    0
amappl12   160        4    0        4     1     1     0     1     0     8    0
amappl11   152       48    0       37     1     0     1     1     0     8    0
amappl10   144       11    0        9     1     0     1     1     0     8    0
amappl9    136      572    0      567     1     0     1     1     0     8    0
amappl8    128      102    0       84     1     0     1     1     0     8    0
amappl7    120       94    0       81     1     0     1     1     0     8    0
amappl6    112       53    0       49     1     0     1     1     0     8    0
amappl5    104      141    0      131     1     0     1     1     0     8    0
amappl4     96      564    0      532     1     0     1     1     0     8    0
amappl3     88      249    0      238     1     0     1     1     0     8    0
amappl2     80     1946    0     1868     3     1     2     3     0     8    0
amappl1     72    15862    0    15419    26    16    10    20     0     8    0
amappl      80      773    0      730     2     0     2     2     0    84    1
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        7    0        0     1     0     1     1     0     8    0
uaddrrnd    24      341    0      326     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      341    0      326     1     0     1     1     0     8    0
vmmpekpl   168     6214    0     6188     2     0     2     2     0     8    0
vmmpepl    168    48551    0    46521   114    13   101   106     0   357   12
vmsppl     272      340    0      326     2     1     1     2     0     8    0
pdppl      4096     688    0      652     6     1     5     6     0     8    0
pvpl        32   162735    0   144459   180     0   180   180     0   265   32
pmappl     200      340    0      326     1     0     1     1     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      142    0       15     4     0     4     4     0     8    0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/13 14:24 openbsd de7a415f8978 99565c1a .config console log report ci-openbsd-main
2020/01/12 10:26 openbsd 2194ba32eb07 4c04afaa .config console log report ci-openbsd-main
2019/11/01 09:46 openbsd e3a62e69c833 a41ca8fa .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.