syzbot


panic() at panic+0x154

Status: closed as dup on 2019/02/20 07:17
Reported-by: syzbot+8352da5c61ebe2584112@syzkaller.appspotmail.com
First crash: 1919d, last: 1911d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
panic: fifo_badop called C 8841 1644d 1978d

Sample crash report:
panic() at panic+0x154 sys/kern/subr_prf.c:208
fifo_badop(ffffffff817e53a2) at fifo_badop+0x12 sys/miscfs/fifofs/fifo_vnops.c:491
VOP_STRATEGY(f1ecdb3ec6672324) at VOP_STRATEGY+0xa3 sys/kern/vfs_vops.c:715
bwrite(67cee23c2cd5ba47) at bwrite+0x1f5 sys/kern/vfs_bio.c:742
VOP_BWRITE(49a811356da79a31) at VOP_BWRITE+0x54 sys/kern/vfs_vops.c:727
ufs_mkdir(6f01b4ba0551a6a) at ufs_mkdir+0x73f sys/ufs/ufs/ufs_vnops.c:1250
VOP_MKDIR(49a811356d770924,ffff8000ffff4018,1ed,ffffff9c) at VOP_MKDIR+0x72 sys/kern/vfs_vops.c:445
domkdirat(d622db98a66ada5b,2,ffff8000ffff4018,ffff8000149de170) at domkdirat+0x12a sys/kern/vfs_syscalls.c:2881
syscall(2d239818bac2395f) at syscall+0x528
Xsyscall(6,88,7f7fffff8be0,88,0,7f7fffff8c20) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff8c50, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> show panic
fifo_badop called
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x154 sys/kern/subr_prf.c:208
fifo_badop(ffffffff817e53a2) at fifo_badop+0x12 sys/miscfs/fifofs/fifo_vnops.c:491
VOP_STRATEGY(f1ecdb3ec6672324) at VOP_STRATEGY+0xa3 sys/kern/vfs_vops.c:715
bwrite(67cee23c2cd5ba47) at bwrite+0x1f5 sys/kern/vfs_bio.c:742
VOP_BWRITE(49a811356da79a31) at VOP_BWRITE+0x54 sys/kern/vfs_vops.c:727
ufs_mkdir(6f01b4ba0551a6a) at ufs_mkdir+0x73f sys/ufs/ufs/ufs_vnops.c:1250
VOP_MKDIR(49a811356d770924,ffff8000ffff4018,1ed,ffffff9c) at VOP_MKDIR+0x72 sys/kern/vfs_vops.c:445
domkdirat(d622db98a66ada5b,2,ffff8000ffff4018,ffff8000149de170) at domkdirat+0x12a sys/kern/vfs_syscalls.c:2881
syscall(2d239818bac2395f) at syscall+0x528
Xsyscall(6,88,7f7fffff8be0,88,0,7f7fffff8c20) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff8c50, count: -11
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff8000149ddb70
rbx               0xffff8000149ddc10
rdx               0xffff8000ffff4018
rcx                                0
rax                                0
r8                0xffffffff815d5604    kprintf+0x184
r9                               0x1
r10               0xffff8000149dd970
r11               0x98311dc3ad96db23
r12                     0x3000000008
r13               0xffff8000149ddb80
r14                            0x100
r15                              0x1
rip               0xffffffff81e29268    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff8000149ddb60
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor0) pid=61131 stat=onproc
    flags process=2<EXEC> proc=0
    pri=17, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff5080,0xffff8000ffff5540
    process=0xffff8000149b8368 user=0xffff8000149d9000, vmspace=0xfffffd803f014d68
    estcpu=36, cpticks=4, pctcpu=0.1
    user=0, sys=4, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 76565  519709      1      0  3    0x100083  ttyopn        getty
 38493  508628   3402      0  2         0x2                syz-executor1
*95472   61131   3402      0  7         0x2                syz-executor0
 36104  323180      0      0  3     0x14200  bored         sosplice
  3402  212815  35148      0  3        0x82  thrsleep      syz-fuzzer
  3402   75892  35148      0  2   0x4000482                syz-fuzzer
  3402  192524  35148      0  3   0x4000082  thrsleep      syz-fuzzer
  3402  154483  35148      0  2   0x4000482                syz-fuzzer
  3402   38062  35148      0  3   0x4000082  kqread        syz-fuzzer
  3402  204154  35148      0  3   0x4000082  thrsleep      syz-fuzzer
  3402  147385  35148      0  3   0x4000082  thrsleep      syz-fuzzer
  3402  292373  35148      0  3   0x4000082  thrsleep      syz-fuzzer
 35148  506431  53053      0  3    0x10008a  pause         ksh
 53053  482198  76158      0  3        0x92  select        sshd
 76158  392153      1      0  3        0x80  select        sshd
 59929  490982  31496     73  3    0x100090  kqread        syslogd
 31496  295719      1      0  3    0x100082  netio         syslogd
 56376  441817      1     77  3    0x100090  poll          dhclient
 78167  445905      1      0  3        0x80  poll          dhclient
 12513  151457      0      0  3     0x14200  pgzero        zerothread
 53484  338801      0      0  3     0x14200  aiodoned      aiodoned
 87770   38944      0      0  3     0x14200  syncer        update
 80544  508183      0      0  3     0x14200  cleaner       cleaner
 25416   71371      0      0  3     0x14200  reaper        reaper
 41878  189176      0      0  3     0x14200  pgdaemon      pagedaemon
 99767    7967      0      0  3     0x14200  bored         crynlk
 29254  353689      0      0  3     0x14200  bored         crypto
 97922  261984      0      0  3  0x40014200  acpi0         acpi0
 11606  194644      0      0  3     0x14200  bored         softnet
 53439  483053      0      0  3     0x14200  bored         systqmp
 60290  476052      0      0  3     0x14200  bored         systq
 72165  141604      0      0  2  0x40014200                softclock
 17428  170043      0      0  3  0x40014200                idle0
     1   13268      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9485   6340K    6349K  78643K     10870        0        0
            pcb    23      9K      11K  78643K       565        0        0
         rtable   100      3K       3K  78643K       460        0        0
         ifaddr    49     12K      13K  78643K       176        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K        27        0        0
            iov     0      0K      24K  78643K       114        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1206     76K      76K  78643K      1970        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        27        0        0
         VM map     2      0K       0K  78643K         2        0        0
            sem    12      0K       1K  78643K       114        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1777    193K     286K  78643K     12501        0        0
      file desc     4      9K      25K  78643K      1120        0        0
          sigio     0      0K       0K  78643K        18        0        0
           proc    41     30K      54K  78643K       535        0        0
        subproc    64  65538K   67586K  78643K       222        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       131        0        0
       in_multi    33      2K       2K  78643K       134        0        0
    ether_multi     1      0K       0K  78643K        11        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    90    397K     397K  78643K        90        0        0
           exec     0      0K       1K  78643K       282        0        0
     pfkey data     0      0K       4K  78643K         2        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap    79     20K      25K  78643K      3444        0        0
       UVM aobj    66      5K       6K  78643K        79        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K        39        0        0
            NDP     9      0K       0K  78643K        52        0        0
           temp   149   2346K    2414K  78643K      6017        0        0
         kqueue     0      0K       0K  78643K         9        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        8    0        4     1     0     1     1     0     8    0
inpcbpl    280      536    0      529     1     0     1     1     0     8    0
plimitpl   152       35    0       28     1     0     1     1     0     8    0
rtentry    112       77    0       37     2     0     2     2     0     8    0
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpqe       32        2    0        2     1     1     0     1     0     8    0
tcpcb      544      188    0      184     1     0     1     1     0     8    0
nd6         48       12    0        8     1     0     1     1     0     8    0
ppxss      1128      21    0       21     8     7     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      368    0      180    12     0    12    12     0     8    0
art_table   32      369    0      180     2     0     2     2     0     8    0
art_node    16       76    0       42     1     0     1     1     0     8    0
sysvmsgpl   40       11    0        2     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      112    0      102     1     0     1     1     0     8    0
shmpl      112       77    0       13     2     0     2     2     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     3497    0     2101    46     0    46    46     0     8    0
ffsino     240     3497    0     2101    83     0    83    83     0     8    0
nchpl      144     5258    0     3683    59     0    59    59     0     8    0
uvmvnodes   72     3716    0        0    68     0    68    68     0     8    0
vnodes     200     3716    0        0   196     0   196   196     0     8    0
namei      1024   15495    0    15494     4     3     1     1     0     8    0
scsiplug    64        3    0        3     3     3     0     1     0     8    0
scxspl     192    22302    0    22302    13    12     1     6     0     8    1
sigapl     432     1277    0     1265     2     0     2     2     0     8    0
futexpl     56    17461    0    17461     5     4     1     1     0     8    1
knotepl    112      452    0      425     3     2     1     2     0     8    0
kqueuepl   104      392    0      390     1     0     1     1     0     8    0
pipepl     112      866    0      847     4     3     1     2     0     8    0
fdescpl    424     1278    0     1265     2     0     2     2     0     8    0
filepl     120     8120    0     8025     8     4     4     5     0     8    1
lockfpl    104      333    0      333     5     5     0     1     0     8    0
lockfspl    32      629    0      629     5     5     0     1     0     8    0
sessionpl  112       23    0       13     1     0     1     1     0     8    0
pgrppl      48       38    0       28     1     0     1     1     0     8    0
ucredpl     96     2478    0     2471     1     0     1     1     0     8    0
zombiepl   144     1265    0     1265     2     1     1     1     0     8    1
processpl  840     1292    0     1265     5     1     4     4     0     8    0
procpl     600     2756    0     2722     4     0     4     4     0     8    0
sosppl     128       27    0       27     6     6     0     1     0     8    0
sockpl     384     1060    0     1043     8     5     3     4     0     8    1
mcl64k     65536    251    0      251    34    33     1    29     0     8    1
mcl16k     16384      6    0        6     3     2     1     1     0     8    1
mcl12k     12288     24    0       24     5     4     1     1     0     8    1
mcl9k      9216      16    0       16     8     7     1     1     0     8    1
mcl8k      8192      23    0       23     7     6     1     1     0     8    1
mcl4k      4096      57    0       57     7     6     1     1     0     8    1
mcl2k2     2112       8    0        8     3     3     0     1     0     8    0
mcl2k      2048   41217    0    41186    11     6     5     8     0     8    0
mtagpl      80        2    0        2     1     1     0     1     0     8    0
mbufpl     256    73373    0    73295    26    18     8    21     0     8    1
bufpl      256     9248    0     2786   405     0   405   405     0     8    0
anonpl      16   141577    0   134279    92    45    47    50     0    62   14
amapchunkpl 152    5773    0     5697    25    21     4    14     0   158    0
amappl16   192     7352    0     6956    81    53    28    32     0     8    8
amappl15   184      317    0      315     1     0     1     1     0     8    0
amappl14   176       17    0       12     2     1     1     1     0     8    0
amappl13   168       27    0       24     1     0     1     1     0     8    0
amappl12   160      205    0      204     1     0     1     1     0     8    0
amappl11   152      647    0      638     1     0     1     1     0     8    0
amappl10   144       59    0       58     2     1     1     1     0     8    0
amappl9    136      778    0      775     1     0     1     1     0     8    0
amappl8    128      377    0      352     1     0     1     1     0     8    0
amappl7    120       50    0       40     1     0     1     1     0     8    0
amappl6    112       46    0       40     1     0     1     1     0     8    0
amappl5    104      384    0      372     1     0     1     1     0     8    0
amappl4     96      408    0      384     2     1     1     2     0     8    0
amappl3     88      177    0      170     1     0     1     1     0     8    0
amappl2     80    11457    0    11414     2     0     2     2     0     8    0
amappl1     72    31912    0    31516    24    15     9    19     0     8    0
amappl      72     3001    0     2972     1     0     1     1     0    75    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma64       64      259    0      259     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64       78    0       13     2     0     2     2     0     8    0
uaddrrnd    24     1278    0     1265     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1278    0     1265     1     0     1     1     0     8    0
vmmpekpl   168    12661    0    12640     2     0     2     2     0     8    0
vmmpepl    168   139861    0   138621   133    64    69    78     0   357    5
vmsppl     264     1277    0     1265     4     3     1     2     0     8    0
pdppl      4096    2562    0     2530     6     1     5     6     0     8    0
pvpl        32   516959    0   506704   306   151   155   232     0   265   65
pmappl     192     1277    0     1265     1     0     1     1     0     8    0
extentpl    40       39    0       25     1     0     1     1     0     8    0
phpool     112      605    0       77    17     0    17    17     0     8    1

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/02/01 15:05 openbsd dc36d2c7c3b1 aa432daf .config console log report ci-openbsd-main
2019/01/24 02:09 openbsd 5c077b0f7c9a 56558f63 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.