syzbot

 sign-in | mailing list | source | docs
🐞 Open [125] 🐞 Fixed [269] 🐞 Invalid [574] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

panic: vput: v_writecount != 0 (2)

Status: fixed on 2019/08/05 23:05
Reported-by: syzbot+a430606fd528645559db@syzkaller.appspotmail.com
Fix commit: 3e253b4759f0 Favor vn_close() in the error path of diskmapioctl() since side-effects caused by calling vn_open() with write permissions must be reverted. Otherwise, the vfs subsystem could panic while releasing the last vnode reference if the writecount is still positive.
First crash: 1724d, last: 1718d
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: vput: v_writecount != 0 C 2 1734d 1734d 0/3 closed as invalid on 2019/07/22 06:58
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2019/08/02 16:00 16m anton@basename.se https://github.com/mptre/openbsd-src diskmap OK

Sample crash report:
panic: vput: v_writecount != 0
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
vput(fffffd80365ad580) at vput+0x187 sys/kern/vfs_subr.c:759
vn_closefile(fffffd80361625a8,ffff8000ffff5b38) at vn_closefile+0x15b sys/kern/vfs_vnops.c:584
fdrop(fffffd80361625a8,ffff8000ffff5b38) at fdrop+0xc9 sys/kern/kern_descrip.c:1269
closef(fffffd80361625a8,ffff8000ffff5b38) at closef+0x118 sys/kern/kern_descrip.c:1253
fdfree(ffff8000ffff5b38) at fdfree+0xf7 sys/kern/kern_descrip.c:1185
exit1(ffff8000ffff5b38,0,1) at exit1+0x32f sys/kern/kern_exit.c:196
sys_exit(ffff8000ffff5b38,ffff8000149781d0,ffff800014978240) at sys_exit+0x17 sys/kern/kern_exit.c:94
syscall(ffff8000149782a0) at syscall+0x508
Xsyscall(6,1,7b9aab57000,1,7f7ffffe32f8,0) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe3270, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
vput: v_writecount != 0
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
vput(fffffd80365ad580) at vput+0x187 sys/kern/vfs_subr.c:759
vn_closefile(fffffd80361625a8,ffff8000ffff5b38) at vn_closefile+0x15b sys/kern/vfs_vnops.c:584
fdrop(fffffd80361625a8,ffff8000ffff5b38) at fdrop+0xc9 sys/kern/kern_descrip.c:1269
closef(fffffd80361625a8,ffff8000ffff5b38) at closef+0x118 sys/kern/kern_descrip.c:1253
fdfree(ffff8000ffff5b38) at fdfree+0xf7 sys/kern/kern_descrip.c:1185
exit1(ffff8000ffff5b38,0,1) at exit1+0x32f sys/kern/kern_exit.c:196
sys_exit(ffff8000ffff5b38,ffff8000149781d0,ffff800014978240) at sys_exit+0x17 sys/kern/kern_exit.c:94
syscall(ffff8000149782a0) at syscall+0x508
Xsyscall(6,1,7b9aab57000,1,7f7ffffe32f8,0) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe3270, count: -11
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800014977ec0
rbx               0xffff800014977f70
rdx                              0x2
rcx                              0x1
rax                              0x1
r8                0xffff800014977e80
r9                               0x1
r10               0x3e1714cd3c855e2d
r11               0x3adfe135cfb3c66a
r12                     0x3000000008
r13               0xffff800014977ed0
r14                            0x100
r15                              0x1
rip               0xffffffff8141a408    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800014977eb0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor5323) pid=465591 stat=onproc
    flags process=100a<EXEC,EXITING,SINGLEEXIT> proc=2000<WEXIT>
    pri=32, usrpri=51, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff4778,0xffffffff82298c18
    process=0xffff800014942018 user=0xffff800014973000, vmspace=0xfffffd803f00c880
    estcpu=1, cpticks=2, pctcpu=0.26
    user=0, sys=2, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 29991  402795  15670      0  3    0x10008a  pause         ksh
 15670   94556  51809      0  3        0x92  select        sshd
 18731  469241      1      0  3    0x100083  ttyin         getty
 51809  457842      1      0  3        0x80  select        sshd
 38197  270356  58469     73  2    0x100090                syslogd
 58469  370880      1      0  3    0x100082  netio         syslogd
 60303  240953      1     77  3    0x100090  poll          dhclient
 78467  178114      1      0  3        0x80  poll          dhclient
 18027  195233      0      0  3     0x14200  pgzero        zerothread
  1463  405450      0      0  3     0x14200  aiodoned      aiodoned
 57967  304960      0      0  3     0x14200  syncer        update
 16995  166438      0      0  3     0x14200  cleaner       cleaner
 23718  414175      0      0  3     0x14200  reaper        reaper
 58189   87268      0      0  3     0x14200  pgdaemon      pagedaemon
  1989  289181      0      0  3     0x14200  bored         crynlk
 59943   10757      0      0  3     0x14200  bored         crypto
 86292  295651      0      0  3  0x40014200  acpi0         acpi0
 34753  382454      0      0  3     0x14200  bored         softnet
 25479  258957      0      0  3     0x14200  bored         systqmp
 17978  239700      0      0  3     0x14200  bored         systq
 69271  415696      0      0  3  0x40014200  bored         softclock
 25946  210983      0      0  3  0x40014200                idle0
 48739  506358      0      0  3     0x14200  bored         smr
     1  117423      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9428   6307K    6310K  78643K     10526        0        0
            pcb    13      8K       8K  78643K        13        0        0
         rtable    61      1K       2K  78643K       116        0        0
         ifaddr    21      7K       7K  78643K        21        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K        13        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1181     74K      74K  78643K      1187        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       1K  78643K         2        0        0
         VM map     2      0K       0K  78643K         2        0        0
            sem     2      0K       0K  78643K         2        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12645        0        0
      file desc     1      0K       0K  78643K         1        0        0
           proc    40     30K      38K  78643K       257        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
       in_multi    11      0K       0K  78643K        11        0        0
    ether_multi     1      0K       0K  78643K         1        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    18     79K      79K  78643K        18        0        0
           exec     0      0K       1K  78643K       154        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    58      3K       3K  78643K       731        0        0
       UVM aobj     2      2K       2K  78643K         2        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
            NDP     3      0K       0K  78643K         3        0        0
           temp    30   2707K    2771K  78643K      1716        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        2    0        0     1     0     1     1     0     8    0
rtpcb       80       15    0       13     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      120       31    0       21     1     0     1     1     0     8    0
syncache   264        5    0        5     1     0     1     1     0     8    1
tcpcb      544        8    0        5     1     0     1     1     0     8    0
inpcb      280       22    0       16     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       97    0        0     7     0     7     7     0     8    0
art_table   32       98    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1393    0       17    45     0    45    45     0     8    0
ffsino     240     1393    0       17    81     0    81    81     0     8    0
nchpl      144     1578    0       43    57     0    57    57     0     8    0
uvmvnodes   72     1402    0        0    26     0    26    26     0     8    0
vnodes     200     1402    0        0    74     0    74    74     0     8    0
namei      1024    3376    0     3376     1     0     1     1     0     8    1
scxspl     192     2266    0     2266     4     3     1     4     0     8    1
plimitpl   152       13    0        8     1     0     1     1     0     8    0
sigapl     432      176    0      166     2     0     2     2     0     8    0
futexpl     56       17    0       17     1     0     1     1     0     8    1
knotepl    112        5    0        0     1     0     1     1     0     8    0
kqueuepl   104        1    0        0     1     0     1     1     0     8    0
pipepl     112      118    0      111     1     0     1     1     0     8    0
fdescpl    424      177    0      166     2     0     2     2     0     8    0
filepl     120      843    0      799     2     0     2     2     0     8    0
lockfpl    104        6    0        6     1     1     0     1     0     8    0
lockfspl    48        3    0        3     1     1     0     1     0     8    0
sessionpl  112       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl     96       47    0       40     1     0     1     1     0     8    0
zombiepl   144      167    0      166     1     0     1     1     0     8    0
processpl  864      191    0      166     4     0     4     4     0     8    0
procpl     632      194    0      169     3     0     3     3     0     8    0
sockpl     384       68    0       50     2     0     2     2     0     8    0
mcl4k      4096      10    0       10     1     0     1     1     0     8    1
mcl2k      2048    6083    0     6048     8     2     6     8     0     8    0
mtagpl      80        2    0        2     1     1     0     1     0     8    0
mbufpl     256    10347    0    10304     7     3     4     5     0     8    1
bufpl      256     2078    0      262   114     0   114   114     0     8    0
anonpl      16    19170    0    17985     6     1     5     6     0    62    0
amapchunkpl 152     564    0      523     2     0     2     2     0   158    0
amappl16   192       93    0       86     1     0     1     1     0     8    0
amappl14   176       36    0       32     1     0     1     1     0     8    0
amappl13   168        1    0        1     1     1     0     1     0     8    0
amappl12   160        4    0        4     1     1     0     1     0     8    0
amappl11   152       41    0       30     1     0     1     1     0     8    0
amappl10   144       46    0       46     1     0     1     1     0     8    1
amappl9    136      385    0      384     1     0     1     1     0     8    0
amappl8    128       84    0       79     1     0     1     1     0     8    0
amappl7    120       16    0       15     1     0     1     1     0     8    0
amappl6    112       42    0       38     1     0     1     1     0     8    0
amappl5    104      144    0      134     1     0     1     1     0     8    0
amappl4     96      399    0      375     1     0     1     1     0     8    0
amappl3     88      147    0      135     1     0     1     1     0     8    0
amappl2     80      720    0      665     2     0     2     2     0     8    0
amappl1     72    12131    0    11731    14     5     9    14     0     8    0
amappl      80      392    0      370     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      177    0      166     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      177    0      166     1     0     1     1     0     8    0
vmmpekpl   168     5326    0     5312     1     0     1     1     0     8    0
vmmpepl    168    25873    0    25069    44     8    36    44     0   357    1
vmsppl     272      176    0      166     1     0     1     1     0     8    0
pdppl      4096     361    0      332     5     0     5     5     0     8    0
pvpl        32    72506    0    69721    26     0    26    26     0   265    3
pmappl     200      176    0      166     1     0     1     1     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      232    0        7     7     0     7     7     0     8    0
ddb>

Crashes (112):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/30 23:32 openbsd 75866a61bd74 7c7ded69 .config console log report syz C ci-openbsd-main
2019/07/30 23:31 openbsd 75866a61bd74 7c7ded69 .config console log report syz C ci-openbsd-multicore
2019/08/05 13:22 openbsd fa32c33cb2c9 6affd8e8 .config console log report ci-openbsd-main
2019/08/05 09:00 openbsd 864b814f529e 6affd8e8 .config console log report ci-openbsd-main
2019/08/05 06:25 openbsd 864b814f529e 6affd8e8 .config console log report ci-openbsd-main
2019/08/05 04:15 openbsd 864b814f529e 6affd8e8 .config console log report ci-openbsd-main
2019/08/04 23:39 openbsd 864b814f529e 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/04 22:09 openbsd 864b814f529e 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/04 18:43 openbsd e4f599ca6879 6affd8e8 .config console log report ci-openbsd-main
2019/08/04 17:58 openbsd e4f599ca6879 6affd8e8 .config console log report ci-openbsd-main
2019/08/04 16:57 openbsd e4f599ca6879 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/04 14:09 openbsd e4f599ca6879 6affd8e8 .config console log report ci-openbsd-main
2019/08/04 13:05 openbsd e4f599ca6879 6affd8e8 .config console log report ci-openbsd-main
2019/08/04 10:52 openbsd e4f599ca6879 6affd8e8 .config console log report ci-openbsd-main
2019/08/04 09:03 openbsd e4f599ca6879 6affd8e8 .config console log report ci-openbsd-main
2019/08/04 07:04 openbsd d72f70aa5ac4 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/04 04:52 openbsd d72f70aa5ac4 6affd8e8 .config console log report ci-openbsd-main
2019/08/04 02:41 openbsd d72f70aa5ac4 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/04 00:03 openbsd d72f70aa5ac4 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/03 22:18 openbsd d72f70aa5ac4 6affd8e8 .config console log report ci-openbsd-main
2019/08/03 20:45 openbsd d72f70aa5ac4 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/03 17:41 openbsd c935b51f457f 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/03 16:16 openbsd c935b51f457f 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/03 13:34 openbsd c935b51f457f 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/03 12:18 openbsd c935b51f457f 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/03 10:47 openbsd c935b51f457f 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/03 08:58 openbsd c935b51f457f 6affd8e8 .config console log report ci-openbsd-main
2019/08/03 07:55 openbsd c935b51f457f 6affd8e8 .config console log report ci-openbsd-multicore
2019/08/03 06:43 openbsd c935b51f457f 6affd8e8 .config console log report ci-openbsd-main
2019/08/03 02:38 openbsd f7c95aac3abf 3faab807 .config console log report ci-openbsd-main
2019/08/03 01:33 openbsd f7c95aac3abf 3faab807 .config console log report ci-openbsd-main
2019/08/02 22:58 openbsd f7c95aac3abf 3faab807 .config console log report ci-openbsd-main
2019/08/02 20:39 openbsd f7c95aac3abf 3faab807 .config console log report ci-openbsd-multicore
2019/08/02 16:13 openbsd f7c95aac3abf 835dffe7 .config console log report ci-openbsd-main
2019/08/02 14:49 openbsd f7c95aac3abf 835dffe7 .config console log report ci-openbsd-multicore
2019/08/02 13:31 openbsd c529027a472a 835dffe7 .config console log report ci-openbsd-main
2019/08/02 09:39 openbsd c529027a472a 835dffe7 .config console log report ci-openbsd-main
2019/08/02 06:14 openbsd c529027a472a 835dffe7 .config console log report ci-openbsd-main
2019/08/02 02:52 openbsd c529027a472a 835dffe7 .config console log report ci-openbsd-main
2019/08/02 00:00 openbsd 6521c58462c4 835dffe7 .config console log report ci-openbsd-multicore
2019/08/01 22:31 openbsd 6521c58462c4 835dffe7 .config console log report ci-openbsd-main
2019/08/01 18:48 openbsd 6521c58462c4 835dffe7 .config console log report ci-openbsd-main
2019/08/01 17:38 openbsd 6521c58462c4 835dffe7 .config console log report ci-openbsd-main
2019/08/01 17:13 openbsd 6521c58462c4 835dffe7 .config console log report ci-openbsd-main
2019/08/01 14:13 openbsd 6521c58462c4 835dffe7 .config console log report ci-openbsd-main
2019/08/01 13:43 openbsd 6521c58462c4 835dffe7 .config console log report ci-openbsd-main
2019/08/01 11:38 openbsd e9c83ba3b557 c692b5bd .config console log report ci-openbsd-multicore
2019/08/01 10:19 openbsd e9c83ba3b557 c692b5bd .config console log report ci-openbsd-main
2019/08/01 10:10 openbsd e9c83ba3b557 c692b5bd .config console log report ci-openbsd-main
2019/08/01 09:56 openbsd e9c83ba3b557 c692b5bd .config console log report ci-openbsd-main
2019/07/30 23:08 openbsd 75866a61bd74 7c7ded69 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.