syzbot


panic: m_copydata: null mbuf

Status: fixed on 2020/05/07 01:54
Reported-by: syzbot+7ee0eb2691d507fcad2e@syzkaller.appspotmail.com
Fix commit: 574b3a4fa98d Do sanity checks in ip6_pullexthdr() preventing a panic in m_copydata(9).
First crash: 1132d, last: 945d
duplicates (3):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
panic() at panic+0x15c (3) 5 1103d 1120d 0/3 closed as dup on 2019/11/11 08:21
panic: m_copydata: null mbpuafn 1 1124d 1124d 0/3 closed as dup on 2019/11/07 14:24
panic(ADDR) at panic+0x15c 69 946d 1095d 0/3 closed as dup on 2019/12/09 09:36
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: m_copydata: null mbuf (2) syz 2 198d 198d 3/3 fixed on 2022/05/23 22:08

Sample crash report:
login: panic: m_copydata: null mbuf
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*384192  21906      0         0x2          0    1  syz-executor9695
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff822419e2) at panic+0x15c sys/kern/subr_prf.c:207
m_copydata(fffffd80771a7700,6f8,8,fffffd806d68e420) at m_copydata+0x17e m_getptr sys/kern/uipc_mbuf.c:1031 [inline]
m_copydata(fffffd80771a7700,6f8,8,fffffd806d68e420) at m_copydata+0x17e sys/kern/uipc_mbuf.c:722
ip6_pullexthdr(fffffd80771a7700,6f8,0) at ip6_pullexthdr+0x16f sys/netinet6/ip6_input.c:1149
ip6_savecontrol(fffffd806f672578,fffffd80771a7700,ffff800020b134e0) at ip6_savecontrol+0x373 sys/netinet6/ip6_input.c:1036
rip6_input(ffff800020b13738,ffff800020b13744,0,18) at rip6_input+0x7e7 sys/netinet6/raw_ip6.c:225
ip_deliver(ffff800020b13738,ffff800020b13744,0,18) at ip_deliver+0x353 sys/netinet/ip_input.c:665
ip6_input_if(ffff800020b13738,ffff800020b13744,29,0,ffff800000670000) at ip6_input_if+0x17cb ip6_ours sys/netinet6/ip6_input.c:518 [inline]
ip6_input_if(ffff800020b13738,ffff800020b13744,29,0,ffff800000670000) at ip6_input_if+0x17cb sys/netinet6/ip6_input.c:340
ipv6_input(ffff800000670000,fffffd80771a7700) at ipv6_input+0x48 sys/netinet6/ip6_input.c:171
if_input_local(ffff800000670000,fffffd80771a7700,18) at if_input_local+0x121 sys/net/if.c:781
ip6_output(fffffd806dba7e00,ffff8000006bd080,fffffd806f6724d0,0,0,fffffd806f672460) at ip6_output+0xd26
rip6_output(fffffd806dba7e00,fffffd806d3a9d90,ffff800020b13aa0,0) at rip6_output+0x4c0 sys/netinet6/raw_ip6.c:481
rip6_usrreq(fffffd806d3a9d90,9,fffffd806dba7e00,0,0,ffff800020ad0500) at rip6_usrreq+0x5e1 sys/netinet6/raw_ip6.c:670
sosend(fffffd806d3a9d90,0,ffff800020b13ce8,0,0,0) at sosend+0x645 sys/kern/uipc_socket.c:524
end trace frame: 0xffff800020b13cd0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
m_copydata: null mbuf
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff822419e2) at panic+0x15c sys/kern/subr_prf.c:207
m_copydata(fffffd80771a7700,6f8,8,fffffd806d68e420) at m_copydata+0x17e m_getptr sys/kern/uipc_mbuf.c:1031 [inline]
m_copydata(fffffd80771a7700,6f8,8,fffffd806d68e420) at m_copydata+0x17e sys/kern/uipc_mbuf.c:722
ip6_pullexthdr(fffffd80771a7700,6f8,0) at ip6_pullexthdr+0x16f sys/netinet6/ip6_input.c:1149
ip6_savecontrol(fffffd806f672578,fffffd80771a7700,ffff800020b134e0) at ip6_savecontrol+0x373 sys/netinet6/ip6_input.c:1036
rip6_input(ffff800020b13738,ffff800020b13744,0,18) at rip6_input+0x7e7 sys/netinet6/raw_ip6.c:225
ip_deliver(ffff800020b13738,ffff800020b13744,0,18) at ip_deliver+0x353 sys/netinet/ip_input.c:665
ip6_input_if(ffff800020b13738,ffff800020b13744,29,0,ffff800000670000) at ip6_input_if+0x17cb ip6_ours sys/netinet6/ip6_input.c:518 [inline]
ip6_input_if(ffff800020b13738,ffff800020b13744,29,0,ffff800000670000) at ip6_input_if+0x17cb sys/netinet6/ip6_input.c:340
ipv6_input(ffff800000670000,fffffd80771a7700) at ipv6_input+0x48 sys/netinet6/ip6_input.c:171
if_input_local(ffff800000670000,fffffd80771a7700,18) at if_input_local+0x121 sys/net/if.c:781
ip6_output(fffffd806dba7e00,ffff8000006bd080,fffffd806f6724d0,0,0,fffffd806f672460) at ip6_output+0xd26
rip6_output(fffffd806dba7e00,fffffd806d3a9d90,ffff800020b13aa0,0) at rip6_output+0x4c0 sys/netinet6/raw_ip6.c:481
rip6_usrreq(fffffd806d3a9d90,9,fffffd806dba7e00,0,0,ffff800020ad0500) at rip6_usrreq+0x5e1 sys/netinet6/raw_ip6.c:670
sosend(fffffd806d3a9d90,0,ffff800020b13ce8,0,0,0) at sosend+0x645 sys/kern/uipc_socket.c:524
dofilewritev(ffff800020ad0500,4,ffff800020b13ce8,0,ffff800020b13dd0) at dofilewritev+0x1b7 sys/kern/sys_generic.c:364
sys_write(ffff800020ad0500,ffff800020b13d88,ffff800020b13dd0) at sys_write+0x83 sys/kern/sys_generic.c:284
syscall(ffff800020b13e50) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800020b13e50) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe7ba0, count: -18
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020b13250
rbx               0xffff800020b13300
rdx                             0x8b
rcx                              0x2
rax                              0x1
r8                0xffffffff81ff23ef    kprintf+0x16f
r9                               0x1
r10               0x2b405d60ae5dd269
r11               0xf14a09c39e5066ba
r12                     0x3000000008
r13               0xffff800020b13260
r14                            0x100
r15                              0x1
rip               0xffffffff81cee8a8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020b13240
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor9695) pid=384192 stat=onproc
    flags process=2<EXEC> proc=0
    pri=53, usrpri=53, nice=20
    forw=0xffffffffffffffff, list=0xffff800020ad09f0,0xffffffff82613fb8
    process=0xffff800020a9b190 user=0xffff800020b0e000, vmspace=0xfffffd806e7ad5c8
    estcpu=3, cpticks=1, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*21906  384192  67137      0  7         0x2                syz-executor9695
 67137   91078  50643      0  3    0x10008a  pause         ksh
 50643   95182  21006      0  3        0x92  select        sshd
 30597    7128      1      0  3    0x100083  ttyin         getty
 21006   79850      1      0  3        0x80  select        sshd
 10137  266082  52520     74  3    0x100092  bpf           pflogd
 52520  471173      1      0  3        0x80  netio         pflogd
 70986  181849  58520     73  3    0x100090  kqread        syslogd
 58520  311966      1      0  3    0x100082  netio         syslogd
 88701  416238      1     77  3    0x100090  poll          dhclient
 22055  508470      1      0  3        0x80  poll          dhclient
 11562  393212      0      0  3     0x14200  pgzero        zerothread
 99284  492304      0      0  3     0x14200  aiodoned      aiodoned
 59224  490513      0      0  3     0x14200  syncer        update
 89752  406032      0      0  3     0x14200  cleaner       cleaner
 70467  290736      0      0  3     0x14200  reaper        reaper
 22488  131165      0      0  3     0x14200  pgdaemon      pagedaemon
 43273  153982      0      0  3     0x14200  bored         crynlk
 40747   20905      0      0  3     0x14200  bored         crypto
 17145  420889      0      0  3  0x40014200  acpi0         acpi0
 70620  417001      0      0  3  0x40014200                idle1
 69325  392865      0      0  3     0x14200  bored         softnet
 18725  266648      0      0  3     0x14200  bored         systqmp
 34956  200703      0      0  3     0x14200  bored         systq
 66971  423830      0      0  3  0x40014200  bored         softclock
 22451  251599      0      0  7  0x40014200                idle0
 64542  472073      0      0  3     0x14200  bored         smr
     1   37629      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 21906 (syz-executor9695) thread 0xffff800020ad0500 (384192)
exclusive rwlock netlock r = 0 (0xffffffff824a3a38)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  solock+0x5a sys/kern/uipc_socket2.c:282
#2  sosend+0x51b sys/kern/uipc_socket.c:512
#3  dofilewritev+0x1b7 sys/kern/sys_generic.c:364
#4  sys_write+0x83 sys/kern/sys_generic.c:284
#5  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#5  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#6  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9461   6393K    6394K  78643K     10552        0
            pcb    15      8K       8K  78643K        17        0
         rtable    61      2K       2K  78643K       127        0
         ifaddr    29      8K       8K  78643K        30        0
       counters    39     33K      33K  78643K        39        0
       ioctlops     0      0K       4K  78643K      1467        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1181     74K      74K  78643K      1186        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      1K       1K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1809    196K     290K  78643K     12766        0
      file desc     1      0K       0K  78643K         1        0
           proc    59     63K      71K  78643K       358        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    18     79K      79K  78643K        18        0
           exec     0      0K       1K  78643K       177        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    67      3K       4K  78643K       816        0
       UVM aobj     2      2K       2K  78643K         2        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     2      0K       0K  78643K         2        0
            NDP     4      0K       0K  78643K         4        0
           temp    27   3003K    3067K  78643K      1978        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        2    0        0     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       15    0       13     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      120       29    0       19     1     0     1     1     0     8    0
syncache   264        5    0        5     1     0     1     1     0     8    1
tcpcb      544        9    0        5     1     0     1     1     0     8    0
inpcb      280       32    0       24     1     0     1     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24        9    0        0     1     0     1     1     0     8    0
pfstkey    112        9    0        0     1     0     1     1     0     8    0
pfstate    328        9    0        0     1     0     1     1     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       97    0        0     7     0     7     7     0     8    0
art_table   32       98    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1401    0       16    45     0    45    45     0     8    0
ffsino     272     1401    0       16    93     0    93    93     0     8    0
nchpl      144     1577    0       34    58     0    58    58     0     8    0
uvmvnodes   72     1411    0        0    26     0    26    26     0     8    0
vnodes     208     1411    0        0    75     0    75    75     0     8    0
namei      1024    3772    0     3772     1     0     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
scxspl     192     2517    0     2517     2     0     2     2     0     8    2
plimitpl   152       14    0        8     1     0     1     1     0     8    0
sigapl     432      204    0      192     2     0     2     2     0     8    0
knotepl    112        5    0        0     1     0     1     1     0     8    0
kqueuepl   104        1    0        0     1     0     1     1     0     8    0
pipepl     160      128    0      121     1     0     1     1     0     8    0
fdescpl    488      205    0      192     3     0     3     3     0     8    0
filepl     152      999    0      949     2     0     2     2     0     8    0
lockfpl    104        5    0        4     1     0     1     1     0     8    0
lockfspl    48        3    0        2     1     0     1     1     0     8    0
sessionpl  112       18    0        9     1     0     1     1     0     8    0
pgrppl      48       18    0        9     1     0     1     1     0     8    0
ucredpl     96       52    0       43     1     0     1     1     0     8    0
zombiepl   144      192    0      192     1     0     1     1     0     8    1
processpl  896      220    0      192     4     0     4     4     0     8    0
procpl     632      220    0      192     3     0     3     3     0     8    0
sockpl     384       76    0       56     3     0     3     3     0     8    0
mcl4k      4096       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      80    0        0    10     0    10    10     0     8    0
mtagpl      80        1    0        0     1     0     1     1     0     8    0
mbufpl     256      105    0        0     7     0     7     7     0     8    0
bufpl      280     2200    0      274   138     0   138   138     0     8    0
anonpl      16    19259    0    17999     7     1     6     7     0   125    0
amapchunkpl 152     522    0      485     2     0     2     2     0   158    0
amappl16   192       30    0       28     1     0     1     1     0     8    0
amappl15   184       50    0       46     1     0     1     1     0     8    0
amappl14   176       15    0       14     1     0     1     1     0     8    0
amappl12   160        1    0        1     1     0     1     1     0     8    1
amappl11   152       53    0       38     1     0     1     1     0     8    0
amappl10   144        7    0        4     1     0     1     1     0     8    0
amappl9    136      422    0      421     1     0     1     1     0     8    0
amappl8    128       69    0       65     1     0     1     1     0     8    0
amappl7    120       76    0       67     1     0     1     1     0     8    0
amappl6    112       50    0       47     1     0     1     1     0     8    0
amappl5    104      126    0      113     1     0     1     1     0     8    0
amappl4     96      460    0      437     1     0     1     1     0     8    0
amappl3     88      109    0      102     1     0     1     1     0     8    0
amappl2     80      824    0      764     2     0     2     2     0     8    0
amappl1     72    13915    0    13483    15     5    10    15     0     8    0
amappl      80      408    0      387     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      205    0      192     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      205    0      192     1     0     1     1     0     8    0
vmmpekpl   168     5356    0     5335     1     0     1     1     0     8    0
vmmpepl    168    29662    0    28797    48     5    43    48     0   357    4
vmsppl     368      204    0      192     2     0     2     2     0     8    0
pdppl      4096     417    0      384     5     0     5     5     0     8    0
pvpl        32    79379    0    76365    28     0    28    28     0   265    3
pmappl     232      204    0      192     1     0     1     1     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      135    0        3     4     0     4     4     0     8    0

Crashes (396):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2019/12/06 13:21 openbsd 45d8925ef193 ba97c611 .config log report syz C
ci-openbsd-multicore 2019/10/30 08:54 openbsd 78f4ad6080f0 5ea87a66 .config log report syz C
ci-openbsd-main 2020/05/04 10:06 openbsd 033c01a74961 58ae5e18 .config log report
ci-openbsd-main 2020/05/01 05:39 openbsd 9ebe8809227b a73c1fd9 .config log report
ci-openbsd-main 2020/04/26 16:48 openbsd bd99d219c11e 6e85fc25 .config log report
ci-openbsd-main 2020/04/23 19:21 openbsd 4b7f300a0481 b9233cab .config log report
ci-openbsd-main 2020/04/15 14:43 openbsd 20c8eb7cf336 3f3c5574 .config log report
ci-openbsd-main 2020/04/13 02:18 openbsd 7b9e33fbf33e 17a986e5 .config log report
ci-openbsd-main 2020/04/12 16:53 openbsd 616e219ab9b7 36b0b050 .config log report
ci-openbsd-main 2020/04/03 13:47 openbsd fc0b7835823d 9a526405 .config log report
ci-openbsd-main 2020/04/02 15:29 openbsd 12b74e2308a8 a34e2c33 .config log report
ci-openbsd-main 2020/03/30 03:45 openbsd 20a0d5cf0bdb 05736b29 .config log report
ci-openbsd-main 2020/03/29 06:26 openbsd 4826a2353272 05736b29 .config log report
ci-openbsd-main 2020/03/29 02:25 openbsd 4826a2353272 05736b29 .config log report
ci-openbsd-main 2020/03/28 01:33 openbsd a78cd575dde1 831e9a81 .config log report
ci-openbsd-main 2020/03/26 03:28 openbsd 2915e25c7b76 e8e6c7d2 .config log report
ci-openbsd-main 2020/03/25 10:02 openbsd 123348b85e1e 41f049cc .config log report
ci-openbsd-main 2020/03/24 06:48 openbsd 8cc78d45870f 33e14df3 .config log report
ci-openbsd-main 2020/03/12 17:28 openbsd b6d7e0c74f46 d850e9d0 .config log report
ci-openbsd-main 2020/03/11 00:40 openbsd bfe2257568b6 35f53e45 .config log report
ci-openbsd-main 2020/03/07 00:16 openbsd 40cca5d50a54 fd2a5f28 .config log report
ci-openbsd-main 2020/03/06 08:13 openbsd 17a1c5d6e306 b655d91b .config log report
ci-openbsd-main 2020/03/05 17:41 openbsd 175b339b7285 b655d91b .config log report
ci-openbsd-multicore 2020/03/05 05:17 openbsd 094ed2c3de32 576fb9bc .config log report
ci-openbsd-main 2020/03/04 07:19 openbsd b244f117c338 1f73b64b .config log report
ci-openbsd-main 2020/03/03 04:19 openbsd 23a32f86e8aa 4a4e0509 .config log report
ci-openbsd-main 2020/02/29 00:59 openbsd 2969925a5ca7 c88c7b75 .config log report
ci-openbsd-multicore 2020/02/25 01:55 openbsd 4331a4ca76ac 59b57593 .config log report
ci-openbsd-main 2020/02/23 05:40 openbsd 6bdb2b35c680 2c36e7a7 .config log report
ci-openbsd-main 2020/02/08 03:47 openbsd 3a92740d5dea 06150bf1 .config log report
ci-openbsd-main 2020/01/30 09:26 openbsd b0727cb75553 5ed23f9a .config log report
ci-openbsd-main 2020/01/13 19:44 openbsd de7a415f8978 99565c1a .config log report
ci-openbsd-main 2019/12/30 14:45 openbsd 05e5c69149cd af6b8ef8 .config log report
ci-openbsd-multicore 2019/12/30 01:53 openbsd e0fb840d78df af6b8ef8 .config log report
ci-openbsd-multicore 2019/12/29 19:48 openbsd e0fb840d78df af6b8ef8 .config log report
ci-openbsd-main 2019/12/29 16:59 openbsd e0fb840d78df af6b8ef8 .config log report
ci-openbsd-main 2019/12/29 14:49 openbsd e0fb840d78df af6b8ef8 .config log report
ci-openbsd-main 2019/12/29 00:13 openbsd 8fdeade23c58 af6b8ef8 .config log report
ci-openbsd-main 2019/12/28 16:18 openbsd 4ad79fcaa8be af6b8ef8 .config log report
ci-openbsd-main 2019/12/28 11:48 openbsd 4ad79fcaa8be af6b8ef8 .config log report
ci-openbsd-main 2019/12/28 04:50 openbsd 32c195e0069f be5c2c81 .config log report
ci-openbsd-main 2019/12/27 23:05 openbsd 32c195e0069f be5c2c81 .config log report
ci-openbsd-main 2019/12/27 18:04 openbsd b19021b290a5 be5c2c81 .config log report
ci-openbsd-main 2019/12/27 03:55 openbsd fa51c99ab5f1 be5c2c81 .config log report
ci-openbsd-main 2019/12/27 00:57 openbsd fa51c99ab5f1 be5c2c81 .config log report
ci-openbsd-multicore 2019/12/26 15:53 openbsd 4b157101db52 be5c2c81 .config log report
ci-openbsd-multicore 2019/12/26 14:47 openbsd 4b157101db52 be5c2c81 .config log report
ci-openbsd-multicore 2019/12/26 13:32 openbsd 4b157101db52 be5c2c81 .config log report
ci-openbsd-main 2019/12/26 12:00 openbsd 4b157101db52 be5c2c81 .config log report
ci-openbsd-multicore 2019/10/30 08:28 openbsd 78f4ad6080f0 5ea87a66 .config log report
* Struck through repros no longer work on HEAD.