syzbot


pool: free list modified: vmsppl

Status: closed as invalid on 2020/06/29 07:00
Reported-by: syzbot+9b8e5654b0d67fc0a631@syzkaller.appspotmail.com
First crash: 1610d, last: 1610d

Sample crash report:
"C#DT9o|{>'sb/8)*2DEX@?6.t KVfqoi١`ےVJ=뽩OJ(]08#Q3Ez~H@[!"C#DT9o|{>'sb/8)*2DEX@?6.t KVfqoi١`ےVJ=뽩OJ(]08#Q3Ez~H@[!panic: pool_do_get: vmsppl free list modified: page 0xfffffd806e8e9000; item addr 0xfffffd80c8cf8303; offset 0x0=0xffffffffffffffff != 0xb18362a0b4afa7ff
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*236162  21921      0         0x2          0    0K syz-executor.1
  54568   1136      0         0x2  0x4000000    1  syz-fuzzer
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff824912bf) at panic+0x15c sys/kern/subr_prf.c:207
pool_do_get(ffffffff828d94f8,9,ffff800021efb438) at pool_do_get+0x439 sys/kern/subr_pool.c:738
pool_get(ffffffff828d94f8,9) at pool_get+0xeb sys/kern/subr_pool.c:581
uvmspace_fork(ffff800020dfcf80) at uvmspace_fork+0x64 uvmspace_alloc sys/uvm/uvm_map.c:3479 [inline]
uvmspace_fork(ffff800020dfcf80) at uvmspace_fork+0x64 sys/uvm/uvm_map.c:4060
process_new(ffff800020e469d8,ffff800020dfcf80,1) at process_new+0x16f sys/kern/kern_fork.c:258
fork1(ffff800020e47ae8,1,ffffffff81c58340,0,ffff800021efb690,0) at fork1+0x31b sys/kern/kern_fork.c:377
syscall(ffff800021efb710) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800021efb710) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbc6a0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/28 11:29 openbsd 634337a5c27d a2cdad9d .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.