syzbot


uvm_fault: hardclock (4)

Status: auto-obsoleted due to no activity on 2023/01/23 15:58
Reported-by: syzbot+16e713560187f9306436@syzkaller.appspotmail.com
First crash: 546d, last: 546d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: hardclock (2) 1 809d 809d 0/3 auto-closed as invalid on 2022/05/06 11:22
openbsd uvm_fault: hardclock 1 958d 958d 0/3 auto-closed as invalid on 2021/12/07 21:45
openbsd uvm_fault: hardclock (3) 1 689d 689d 0/3 auto-obsoleted due to no activity on 2022/09/02 21:31
openbsd uvm_fault: hardclock (5) syz 4 265d 418d 0/3 upstream: reported syz repro on 2023/03/03 14:04

Sample crash report:
kernel: page fault trap, code=0
Stopped at      hardclock+0x102:        movq    0x260(%r15),%r12
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
hardclock(ffff800029929290) at hardclock+0x102 sys/kern/kern_clock.c:154
lapic_clockintr(0,0) at lapic_clockintr+0x36 sys/arch/amd64/amd64/lapic.c:452
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x26
uvm_objtree_RBT_COMPARE(ffff8000299293e8,fffffd8005399800) at uvm_objtree_RBT_COMPARE+0x36 uvm_pagecmp sys/uvm/uvm_page.c:87 [inline]
uvm_objtree_RBT_COMPARE(ffff8000299293e8,fffffd8005399800) at uvm_objtree_RBT_COMPARE+0x36 sys/uvm/uvm_page.c:82
_rb_find(ffffffff826af918,fffffd807b684d58,ffff8000299293e8) at _rb_find+0x58 sys/kern/subr_tree.c:450
uvm_pagelookup(fffffd807b684d48,3dd1000) at uvm_pagelookup+0x44 sys/uvm/uvm_page.c:1239
buf_map(fffffd807b684c88) at buf_map+0x206 sys/kern/vfs_biomem.c:124
buf_get(0,0,d850000) at buf_get+0x739 sys/kern/vfs_bio.c:1179
geteblk(d850000) at geteblk+0x2c sys/kern/vfs_bio.c:1061
readdisklabel(2902,ffffffff81d785d0,ffff800000c18400,0) at readdisklabel+0x145 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,81,2000,ffff80002179ed30) at vndopen+0x17a sys/dev/vnd.c:203
spec_open(ffff800029929848) at spec_open+0x3df sys/kern/spec_vnops.c:150
VOP_OPEN(fffffd8072023dd8,81,fffffd807f7d7958,ffff80002179ed30) at VOP_OPEN+0x6c sys/kern/vfs_vops.c:138
vn_open(ffff800029929a98,81,0) at vn_open+0x467 sys/kern/vfs_vnops.c:177
doopenat(ffff80002179ed30,ffffff9c,20000140,80,0,ffff800029929c80) at doopenat+0x26a sys/kern/vfs_syscalls.c:1127
syscall(ffff800029929cf0) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xb584089b370, count: -17
ddb> show registers
rdi                              0x3
rsi                                0
rbp               0xffff800029929250
rbx                              0x6
rdx                                0
rcx                                0
rax               0xffff80002179ed30
r8                                 0
r9                                 0
r10                                0
r11               0xa8e28f2414d7ff65
r12                                0
r13               0xffff80002179ed30
r14               0xffff800029929290
r15                                0
rip               0xffffffff81332dd2    hardclock+0x102
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800029929220
ss                              0x10
hardclock+0x102:        movq    0x260(%r15),%r12
ddb> show proc
PROC (kernel: page fault trap, code=0
Faulted in DDB; continuing...
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10208   6421K    6999K  78643K     16993        0
            pcb    14     20K      22K  78643K      3661        0
         rtable   214     16K      20K  78643K      2521        0
         ifaddr   118     27K      27K  78643K      1030        0
         sysctl     2      0K       0K  78643K         2        0
       counters    26     17K      17K  78643K       163        0
       ioctlops     0      0K       4K  78643K       874        0
            iov     0      0K      24K  78643K       454        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1371     86K      86K  78643K      3630        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K        44        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      0K       1K  78643K       194        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    17     61K      65K  78643K      4401        0
          sigio     0      0K       0K  78643K       161        0
           proc    58     59K      75K  78643K      1010        0
        subproc   104      6K       6K  78643K       299        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       271        0
       in_multi    92      6K       6K  78643K       535        0
    ether_multi     1      0K       0K  78643K        30        0
            mrt     1      0K       0K  78643K        40        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   157    705K     705K  78643K       157        0
           exec     0      0K       1K  78643K      1086        0
     pfkey data     0      0K       0K  78643K         3        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   292     86K      95K  78643K     28965        0
       UVM aobj   131      4K       4K  78643K       140        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K       252        0
            NDP    12      0K       2K  78643K       186        0
           temp   128   4730K    4802K  78643K     61776        0
         kqueue    12     18K      24K  78643K       376        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      213    0      210     2     1     1     2     0     8    0
rtentry    112      417    0      325     4     1     3     4     0     8    0
unpcb      144     3087    0     3072    25    19     6     6     0     8    5
syncache   296       45    0       45     6     5     1     1     0     8    1
tcpqe       32      209    0      209     6     6     0     1     0     8    0
tcpcb      768     4185    0     4169   137   124    13    38     0     8    8
arp         88       69    0       53     1     0     1     1     0     8    0
ipq         40        9    0        9     2     2     0     1     0     8    0
ipqe        40       26    0       26     2     2     0     1     0     8    0
inpcb      336     9735    0     9720    95    83    12    15     0     8    8
ip6q        72        6    0        5     1     0     1     1     0     8    0
ip6af       40       10    0        9     1     0     1     1     0     8    0
nd6         48      113    0       92     1     0     1     1     0     8    0
pkpcb       40        3    0        3     1     1     0     1     0     8    0
kcovpl      48       23    0       15     1     0     1     1     0     8    0
ppxss      1160      85    0       85     7     7     0     1     0     8    0
pppxif     1608       7    0        7     2     2     0     1     0     8    0
pfstscr     40      181    0      178     1     0     1     1     0     8    0
pfosfp      40        2    0        1     1     0     1     1     0     8    0
pfosfpen   112        2    0        1     1     0     1     1     0     8    0
pfrktable  1344     572    0      571     1     0     1     1     0     8    0
pfanchor   1280     769    0      326    44     7    37    38     0     8    0
pftag       88        9    0        7     2     1     1     1     0     8    0
pfstitem    24        4    0        0     1     0     1     1     0     8    0
pfstkey    120      220    0      216     1     0     1     1     0     8    0
pfstate    336      110    0      108     1     0     1     1     0     8    0
pfrule     1360     185    0      179     1     0     1     1     0     8    0
rttmr      136       10    0       10     1     1     0     1     0     8    0
art_heap8  4096       4    0        3     4     3     1     2     0     8    0
art_heap4  256     1533    0     1122    37    10    27    30     0     8    0
art_table   32     1537    0     1125     4     0     4     4     0     8    0
art_node    16      416    0      336     1     0     1     1     0     8    0
sysvmsgpl   40        2    0        0     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      190    0      180     1     0     1     1     0     8    0
shmpl      112      137    0        9     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dirhash: pool(0xffffffff829f6a80:dirhash): free list modified: page 0xffff800021706000; item ordinal 0; addr 0xffff800021706c00 (p 0xfffffd806e81e000); offset 0x0=0x0
pool(dirhash): free list modified: page 0xffff800021706000; item ordinal 0; addr 0xffff800021706c00 (p 0xfffffd806e81e000); offset 0x0=0x0
dirhash: pool(0xffffffff829f6a80:dirhash): page inconsistency: page 0xffff800021706000; item ordinal 1; addr 0x123e62062677b9be
dino2pl    256     7435    0     5995    91     0    91    91     0     8    0
ffsino     240     7435    0     5995    85     0    85    85     0     8    0
nchpl      144    13191    0    12701    63    34    29    63     0     8    7
rtmask      32        6    0        6     2     2     0     1     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   46125    0    46125     3     2     1     2     0     8    1
namei: pool(0xffffffff829f61f8:namei): free list modified: page 0xffff8000216df000; item ordinal 0; addr 0xffff8000216e0000 (p 0xfffffd805a2da000); offset 0x0=0x0
pool(namei): free list modified: page 0xffff8000216df000; item ordinal 0; addr 0xffff8000216e0000 (p 0xfffffd805a2da000); offset 0x0=0x0
namei: pool(0xffffffff829f61f8:namei): page inconsistency: page 0xffff8000216df000; item ordinal 1; addr 0x382d209cc205bdeb
pfiaddrpl  120      168    0      168     4     4     0     1     0     8    0
kstatmem   264      194    0      170     2     0     2     2     0     8    0
scsiplug    72        8    0        8     2     2     0     1     0     8    0
scxspl     216    40011    0    40011    10     9     1     8     0     8    1
plimitpl   152      738    0      723     1     0     1     1     0     8    0
sigapl     424     4686    0     4621    10     2     8     8     0     8    0
futexpl     64    44478    0    44473     3     2     1     1     0     8    0
knotepl    120    91809    0    91728    45    38     7    11     0     8    3
kqueuepl   184      815    0      807    10     9     1     4     0     8    0
pipepl     288      864    0      836    19    16     3     7     0     8    0
fdescpl    432     4649    0     4621     5     1     4     4     0     8    0
filepl     120    35084    0    34846    52    38    14    17     0     8    6
lockfpl    104     1312    0     1309     3     2     1     2     0     8    0
lockfspl    48      456    0      453     1     0     1     1     0     8    0
sessionpl  144       39    0       23     1     0     1     1     0     8    0
pgrppl      48      120    0      104     1     0     1     1     0     8    0
ucredpl    104     4235    0     4224     1     0     1     1     0     8    0
zombiepl   144     4621    0     4621     1     0     1     1     0     8    1
processpl  1000    4686    0     4621     9     0     9     9     0     8    0
processpl: pool(0xffffffff829b7e58:processpl): page inconsistency: page 0x0; at page head addr 0xffff8000231fbf90 (p 0xffff8000231fa000)
processpl: pool(0xffffffff829b7e58:processpl): page inconsistency: page 0x0; at page head addr 0xffff80002178ff90 (p 0xffff80002178e000)
procpl     672    11276    0    11189    17     9     8     9     0     8    0
procpl: pool(0xffffffff829b7cb0:procpl): page inconsistency: page 0x0; at page head addr 0xffff800021705f90 (p 0xffff800021704000)
procpl: pool(0xffffffff829b7cb0:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002320bf90 (p 0xffff80002320a000)
sosppl     168       59    0       58     6     5     1     1     0     8    0
sockpl     456    13086    0    13053   295   281    14    41     0     8    8
mcl64k     65536    203    0      203    10     9     1     1     0     8    1
mcl16k     16384     75    0       75    10     9     1     1     0     8    1
mcl12k     12288    136    0      136    11    10     1     1     0     8    1
mcl9k      9216      44    0       44    13    12     1     1     0     8    1
mcl8k      8192     256    0      256     6     5     1     1     0     8    1
mcl4k      4096     484    0      484     6     5     1     1     0     8    1
mcl2k2     2112      63    0       63    13    12     1     1     0     8    1
mcl2k      2048   89855    0    89723    44    25    19    31     0     8    1
mtagpl      96      673    0      494    10     4     6     8     0     8    0
mbufpl     256   182695    0   182340   152   114    38    71     0     8    8
bufpl      288    10686    0     4281   458     0   458   458     0     8    0
anonpl      24   876625    0   859126   172    51   121   133     0   188    3
amapchunkpl 152   82002    0    81284    70    40    30    40     0   158    0
amappl16   200     8506    0     7858    79    44    35    43     0     8    0
amappl15   192        1    0        0     1     0     1     1     0     8    0
amappl14   184      200    0      187     2     0     2     2     0     8    0
amappl13   176     4074    0     4059     1     0     1     1     0     8    0
amappl12   168      589    0      584     1     0     1     1     0     8    0
amappl11   160       40    0       30     1     0     1     1     0     8    0
amappl10   152       41    0       31     1     0     1     1     0     8    0
amappl9    144     1247    0     1243     1     0     1     1     0     8    0
amappl8    136      282    0      210     3     0     3     3     0     8    0
amappl7    128       62    0       45     1     0     1     1     0     8    0
amappl6    120      439    0      422     2     1     1     2     0     8    0
amappl5    112      152    0      143     1     0     1     1     0     8    0
amappl4    104      670    0      643     2     1     1     2     0     8    0
amappl3     96    12599    0    12544     2     0     2     2     0     8    0
amappl2     88     1076    0     1024     3     1     2     3     0     8    0
amappl1     80   104597    0   103886    22     6    16    21     0     8    0
amappl      88    28445    0    28257     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      139    0        9     3     0     3     3     0     8    0
uaddrrnd    24     4649    0     4621     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     4649    0     4621     1     0     1     1     0     8    0
vmmpekpl   168    36661    0    36607     3     0     3     3     0     8    0
vmmpepl    168   425133    0   422348   208    68   140   140     0   357   15
vmsppl     272     4648    0     4621     2     0     2     2     0     8    0
rwobjpl     24   114083    0   106270    48     0    48    48     0     8    0
pdppl      4096    9304    0     9242   315   251    64    64     0     8    2
pvpl        32  1827555    0  1804273   321   112   209   269     0   265    8
pmappl     216     4648    0     4621     2     0     2     2     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1345    0      534    25     0    25    25     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
hardclock(ffff800029929290) at hardclock+0x102 sys/kern/kern_clock.c:154
lapic_clockintr(0,0) at lapic_clockintr+0x36 sys/arch/amd64/amd64/lapic.c:452
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x26
uvm_objtree_RBT_COMPARE(ffff8000299293e8,fffffd8005399800) at uvm_objtree_RBT_COMPARE+0x36 uvm_pagecmp sys/uvm/uvm_page.c:87 [inline]
uvm_objtree_RBT_COMPARE(ffff8000299293e8,fffffd8005399800) at uvm_objtree_RBT_COMPARE+0x36 sys/uvm/uvm_page.c:82
_rb_find(ffffffff826af918,fffffd807b684d58,ffff8000299293e8) at _rb_find+0x58 sys/kern/subr_tree.c:450
uvm_pagelookup(fffffd807b684d48,3dd1000) at uvm_pagelookup+0x44 sys/uvm/uvm_page.c:1239
buf_map(fffffd807b684c88) at buf_map+0x206 sys/kern/vfs_biomem.c:124
buf_get(0,0,d850000) at buf_get+0x739 sys/kern/vfs_bio.c:1179
geteblk(d850000) at geteblk+0x2c sys/kern/vfs_bio.c:1061
readdisklabel(2902,ffffffff81d785d0,ffff800000c18400,0) at readdisklabel+0x145 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,81,2000,ffff80002179ed30) at vndopen+0x17a sys/dev/vnd.c:203
spec_open(ffff800029929848) at spec_open+0x3df sys/kern/spec_vnops.c:150
VOP_OPEN(fffffd8072023dd8,81,fffffd807f7d7958,ffff80002179ed30) at VOP_OPEN+0x6c sys/kern/vfs_vops.c:138
vn_open(ffff800029929a98,81,0) at vn_open+0x467 sys/kern/vfs_vnops.c:177
doopenat(ffff80002179ed30,ffffff9c,20000140,80,0,ffff800029929c80) at doopenat+0x26a sys/kern/vfs_syscalls.c:1127
syscall(ffff800029929cf0) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xb584089b370, count: -17
ddb> machine ddbcpu 1
No such command
ddb> trace
hardclock(ffff800029929290) at hardclock+0x102 sys/kern/kern_clock.c:154
lapic_clockintr(0,0) at lapic_clockintr+0x36 sys/arch/amd64/amd64/lapic.c:452
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x26
uvm_objtree_RBT_COMPARE(ffff8000299293e8,fffffd8005399800) at uvm_objtree_RBT_COMPARE+0x36 uvm_pagecmp sys/uvm/uvm_page.c:87 [inline]
uvm_objtree_RBT_COMPARE(ffff8000299293e8,fffffd8005399800) at uvm_objtree_RBT_COMPARE+0x36 sys/uvm/uvm_page.c:82
_rb_find(ffffffff826af918,fffffd807b684d58,ffff8000299293e8) at _rb_find+0x58 sys/kern/subr_tree.c:450
uvm_pagelookup(fffffd807b684d48,3dd1000) at uvm_pagelookup+0x44 sys/uvm/uvm_page.c:1239
buf_map(fffffd807b684c88) at buf_map+0x206 sys/kern/vfs_biomem.c:124
buf_get(0,0,d850000) at buf_get+0x739 sys/kern/vfs_bio.c:1179
geteblk(d850000) at geteblk+0x2c sys/kern/vfs_bio.c:1061
readdisklabel(2902,ffffffff81d785d0,ffff800000c18400,0) at readdisklabel+0x145 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,81,2000,ffff80002179ed30) at vndopen+0x17a sys/dev/vnd.c:203
spec_open(ffff800029929848) at spec_open+0x3df sys/kern/spec_vnops.c:150
VOP_OPEN(fffffd8072023dd8,81,fffffd807f7d7958,ffff80002179ed30) at VOP_OPEN+0x6c sys/kern/vfs_vops.c:138
vn_open(ffff800029929a98,81,0) at vn_open+0x467 sys/kern/vfs_vnops.c:177
doopenat(ffff80002179ed30,ffffff9c,20000140,80,0,ffff800029929c80) at doopenat+0x26a sys/kern/vfs_syscalls.c:1127
syscall(ffff800029929cf0) at syscall+0x447 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xb584089b370, count: -17

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/10/25 15:58 openbsd f61291ae0e05 45645420 .config console log report ci-openbsd-main uvm_fault: hardclock
* Struck through repros no longer work on HEAD.