syzbot


uvm_fault: kqueue_scan

Status: fixed on 2019/10/22 13:03
Reported-by: syzbot+c813ea42bd08d33e5e8d@syzkaller.appspotmail.com
Fix commit: put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
First crash: 1162d, last: 1162d

Sample crash report:
login: uvm_fault(0xfffffd806e7e35c8, 0x25e, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      kqueue_scan+0x47f:      movq    0x18(%rax),%r11
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xfffffd806e7e35c8, 0x25e, 0, 1) -> e
kqueue_scan(fffffd806e81fdd0,40,c00013f698,ffff800020b49690,ffff800020a5e280,ffff800020b496dc) at kqueue_scan+0x47f sys/kern/kern_event.c:771
end trace frame: 0xffff800020b49740, count: 0
ddb{0}> trace
kqueue_scan(fffffd806e81fdd0,40,c00013f698,ffff800020b49690,ffff800020a5e280,ffff800020b496dc) at kqueue_scan+0x47f sys/kern/kern_event.c:771
sys_kevent(ffff800020a5e280,ffff800020b49750,ffff800020b497a0) at sys_kevent+0x48b sys/kern/kern_event.c:553
syscall(ffff800020b49820) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800020b49820) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,48,c00013f680,48,ffffffffffffffff,4) at Xsyscall+0x128
end of kernel
end trace frame: 0xc00013fe98, count: -4
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff800020b49580
rbx                                0
rdx               0xffff800020b49438
rcx                                0
rax                            0x246
r8                0xffff800020a5e280
r9                0xffff800020b496dc
r10               0xff8058dc5f9f37ce
r11                 0x7fa723dd8dcca9
r12                              0x1
r13               0xfffffd806e81fdd0
r14               0xffff800020b03780
r15               0xffff800020b03768
rip               0xffffffff820b8bbf    kqueue_scan+0x47f
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800020b49330
ss                              0x10
kqueue_scan+0x47f:      movq    0x18(%rax),%r11
ddb{0}> show proc
PROC (syz-fuzzer) pid=167367 stat=onproc
    flags process=2<EXEC> proc=4000000<THREAD>
    pri=17, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800020a5e4f8,0xffff800020a5e9f8
    process=0xffff800020a8b890 user=0xffff800020b44000, vmspace=0xfffffd806e7e35c8
    estcpu=0, cpticks=1, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 78897  311149      1      0  3    0x100083  ttyin         getty
 98503  254644  74077      0  3         0x2  biowait       syz-executor.0
 10217  419976      0      0  3     0x14200  acct          acct
 64167  154049      0      0  3     0x14200  bored         sosplice
 74077  180752  16580      0  2         0x3                syz-fuzzer
 74077  290001  16580      0  2   0x4000003                syz-fuzzer
 74077  214277  16580      0  3   0x4000082  thrsleep      syz-fuzzer
 74077  480247  16580      0  2   0x4000003                syz-fuzzer
 74077  305080  16580      0  3   0x4000082  thrsleep      syz-fuzzer
*74077  167367  16580      0  7   0x4000002                syz-fuzzer
 74077  172928  16580      0  3   0x4000082  thrsleep      syz-fuzzer
 74077  245248  16580      0  3   0x4000082  thrsleep      syz-fuzzer
 74077  247931  16580      0  3   0x4000082  thrsleep      syz-fuzzer
 74077  217174  16580      0  3   0x4000082  thrsleep      syz-fuzzer
 16580    5933  59025      0  3    0x10008a  pause         ksh
 59025  239343  97136      0  3        0x92  select        sshd
 97136   29512      1      0  3        0x80  select        sshd
 38468  410760  17354     74  3    0x100092  bpf           pflogd
 17354  495564      1      0  3        0x80  netio         pflogd
 72001  295608  43049     73  3    0x100090  kqread        syslogd
 43049  280606      1      0  3    0x100082  netio         syslogd
 44986   67248      1     77  3    0x100090  poll          dhclient
 97921   33673      1      0  3        0x80  poll          dhclient
 10521  121928      0      0  3     0x14200  pgzero        zerothread
 86389  452609      0      0  3     0x14200  aiodoned      aiodoned
 80705  391633      0      0  3     0x14200  syncer        update
 89400  108133      0      0  3     0x14200  cleaner       cleaner
  8115  260378      0      0  7     0x14200                reaper
 19313  175365      0      0  3     0x14200  pgdaemon      pagedaemon
  1288  104782      0      0  3     0x14200  bored         crynlk
 59234  221284      0      0  3     0x14200  bored         crypto
 71585  145833      0      0  3  0x40014200  acpi0         acpi0
 10565  228537      0      0  3  0x40014200                idle1
 96647  276797      0      0  3     0x14200  bored         softnet
 74881  229835      0      0  3     0x14200  bored         systqmp
 47571  365125      0      0  3     0x14200  bored         systq
 16670  351451      0      0  3  0x40014200  bored         softclock
 12929  421052      0      0  3  0x40014200                idle0
 42936   56716      0      0  3     0x14200  bored         smr
     1  364181      0      0  2        0x82                init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 98503 (syz-executor.0) thread 0xffff800020ab1b40 (254644)
exclusive rrwlock inode r = 0 (0xfffffd806e1abf88)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  rw_enter+0x447 sys/kern/kern_rwlock.c:306
#2  rrw_enter+0x4f sys/kern/kern_rwlock.c:435
#3  VOP_LOCK+0xf0 sys/kern/vfs_vops.c:615
#4  vn_lock+0x81 sys/kern/vfs_vnops.c:562
#5  uvm_vnp_uncache+0xe6 sys/uvm/uvm_vnode.c:1334
#6  dounlinkat+0x17b sys/kern/vfs_syscalls.c:1821
#7  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#7  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#8  Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806ec48918)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  rw_enter+0x447 sys/kern/kern_rwlock.c:306
#2  rrw_enter+0x4f sys/kern/kern_rwlock.c:435
#3  VOP_LOCK+0xf0 sys/kern/vfs_vops.c:615
#4  vn_lock+0x81 sys/kern/vfs_vnops.c:562
#5  vget+0x1c3 sys/kern/vfs_subr.c:672
#6  cache_lookup+0x2bb sys/kern/vfs_cache.c:224
#7  ufs_lookup+0x1bc sys/ufs/ufs/ufs_lookup.c:162
#8  VOP_LOOKUP+0x5b sys/kern/vfs_vops.c:91
#9  vfs_lookup+0x7a6 sys/kern/vfs_lookup.c:568
#10 namei+0x63c sys/kern/vfs_lookup.c:249
#11 dounlinkat+0x99 sys/kern/vfs_syscalls.c:1785
#12 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#12 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#13 Xsyscall+0x128
Process 74077 (syz-fuzzer) thread 0xffff800020a5e280 (167367)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff82676880)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  __mp_acquire_count+0x51 sys/kern/kern_lock.c:227
#2  mi_switch+0x392 sys/kern/sched_bsd.c:441
#3  sleep_finish+0x113 sys/kern/kern_synch.c:373
#4  tsleep+0x198 sleep_finish_timeout sys/kern/kern_synch.c:397 [inline]
#4  tsleep+0x198 sleep_finish_all sys/kern/kern_synch.c:183 [inline]
#4  tsleep+0x198 sys/kern/kern_synch.c:152
#5  getblk+0x14c sys/kern/vfs_bio.c:993
#6  bread+0x3a bio_doread sys/kern/vfs_bio.c:435 [inline]
#6  bread+0x3a sys/kern/vfs_bio.c:480
#7  ffs1_balloc+0x123e sys/ufs/ffs/ffs_balloc.c:364
#8  ffs_write+0x3c1 sys/ufs/ffs/ffs_vnops.c:345
#9  VOP_WRITE+0xc6 sys/kern/vfs_vops.c:269
#10 ktrwriteraw+0x148 sys/kern/kern_ktrace.c:653
#11 ktrstruct+0x169 ktrwrite2 sys/kern/kern_ktrace.c:620 [inline]
#11 ktrstruct+0x169 sys/kern/kern_ktrace.c:306
#12 sys_kevent+0x14a sys/kern/kern_event.c:505
#13 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#13 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#14 Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9599   7075K    8154K  78643K     15217        0        0
            pcb    13     10K      12K  78643K       406        0        0
         rtable   104     13K      14K  78643K      1504        0        0
         ifaddr    79     16K      18K  78643K       457        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       4K  78643K      1540        0        0
            iov     0      0K      32K  78643K       401        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1224     77K      78K  78643K      3129        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        32        0        0
         VM map     2      1K       1K  78643K        17        0        0
            sem    12      0K       1K  78643K       395        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1808    196K     290K  78643K     12765        0        0
      file desc     3      5K      25K  78643K      2009        0        0
          sigio     0      0K       0K  78643K        37        0        0
           proc    62     63K      95K  78643K      1070        0        0
        subproc    16      1K       2K  78643K       208        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       140        0        0
       in_multi    19      1K       2K  78643K       248        0        0
    ether_multi     1      0K       0K  78643K        20        0        0
            mrt     0      0K       0K  78643K        21        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys   192    848K     848K  78643K       192        0        0
           exec     0      0K       1K  78643K       555        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   122     22K      31K  78643K      8587        0        0
       UVM aobj   130      4K       4K  78643K       139        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       363        0        0
            NDP    19      0K       0K  78643K       141        0        0
           temp   221   3560K    4199K  78643K     48302        0        0
         kqueue     0      0K       0K  78643K        45        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       54    0       48     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80      147    0      145     1     0     1     1     0     8    0
rtentry    112      249    0      213     2     0     2     2     0     8    0
unpcb      120      840    0      829     3     2     1     2     0     8    0
syncache   264       18    0       18     7     7     0     1     0     8    0
tcpqe       32     7052    0     7052     2     2     0     1     0     8    0
tcpcb      544      674    0      670     2     1     1     2     0     8    0
inpcb      280     2653    0     2644    26    25     1    13     0     8    0
rttmr       72        5    0        5     4     4     0     1     0     8    0
nd6         48       31    0       30     1     0     1     1     0     8    0
pkpcb       40       17    0       17     8     8     0     1     0     8    0
ppxss      1128      65    0       65    16    16     0     1     0     8    0
pffrag     232       37    0       37    12    12     0     1     0   482    0
pffrnode    88       37    0       37    12    12     0     1     0     8    0
pffrent     40      472    0      472    12    12     0     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24      169    0      161     1     0     1     1     0     8    0
pfstkey    112      169    0      161     2     0     2     2     0     8    0
pfstate    328      169    0      161     4     3     1     4     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       3    0        2     3     2     1     3     0     8    0
art_heap4  256     1020    0      850    25    12    13    15     0     8    0
art_table   32     1023    0      852     2     0     2     2     0     8    0
art_node    16      247    0      213     1     0     1     1     0     8    0
sysvmsgpl   40       21    0        6     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      393    0      383     1     0     1     1     0     8    0
shmpl      112      137    0        9     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     4593    0     3194    46     0    46    46     0     8    0
ffsino     272     4593    0     3194    95     1    94    95     0     8    0
nchpl      144     8162    0     6548    61     0    61    61     0     8    0
uvmvnodes   72     5910    0        0   108     0   108   108     0     8    0
vnodes     208     5910    0        0   312     0   312   312     0     8    0
namei      1024   29160    0    29160     4     3     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
vmpool     552       15    0       15     7     7     0     1     0     8    0
scsiplug    64        4    0        4     3     3     0     1     0     8    0
scxspl     192    22774    0    22771    28    27     1     7     0     8    0
plimitpl   152      162    0      154     1     0     1     1     0     8    0
sigapl     432     2180    0     2166     5     3     2     3     0     8    0
futexpl     56    39484    0    39484     1     0     1     1     0     8    1
knotepl    112      957    0      938     2     1     1     2     0     8    0
kqueuepl   104     1392    0     1390     1     0     1     1     0     8    0
pipepl     112     1786    0     1770     9     8     1     2     0     8    0
fdescpl    488     2181    0     2167     3     0     3     3     0     8    0
filepl     152    20304    0    20223    35    30     5    13     0     8    0
lockfpl    104      800    0      799     1     0     1     1     0     8    0
lockfspl    48      288    0      287     1     0     1     1     0     8    0
sessionpl  112       29    0       18     1     0     1     1     0     8    0
pgrppl      48       47    0       36     1     0     1     1     0     8    0
ucredpl     96     4604    0     4595     1     0     1     1     0     8    0
zombiepl   144     2168    0     2166     4     3     1     1     0     8    0
processpl  896     2199    0     2166     5     1     4     5     0     8    0
procpl     632     7273    0     7231     5     0     5     5     0     8    0
srpgc       64       14    0       14     5     5     0     1     0     8    0
sosppl     128       11    0       11     5     5     0     1     0     8    0
sockpl     384     3705    0     3685    40    37     3    22     0     8    0
mcl64k     65536     12    0        0     2     0     2     2     0     8    0
mcl16k     16384      8    0        0     1     0     1     1     0     8    0
mcl12k     12288     14    0        0     2     0     2     2     0     8    0
mcl9k      9216       9    0        0     1     0     1     1     0     8    0
mcl8k      8192      18    0        0     3     1     2     3     0     8    0
mcl4k      4096      25    0        0     3     1     2     3     0     8    0
mcl2k2     2112       9    0        0     1     0     1     1     0     8    0
mcl2k      2048     210    0        0    21     7    14    21     0     8    0
mtagpl      80       81    0        0     1     0     1     1     0     8    0
mbufpl     256      612    0        0    31     0    31    31     0     8    0
bufpl      256    11285    0     4237   441     0   441   441     0     8    0
anonpl      16   346813    0   330008   112    35    77    85     0   124    0
amapchunkpl 152   15369    0    15253    34    28     6    13     0   158    0
amappl16   192    18236    0    17196   111    56    55    66     0     8    0
amappl15   184        8    0        8     1     1     0     1     0     8    0
amappl14   176      381    0      379     2     1     1     1     0     8    0
amappl13   168      308    0      307     2     1     1     1     0     8    0
amappl12   160      301    0      298     2     1     1     1     0     8    0
amappl11   152      890    0      875     1     0     1     1     0     8    0
amappl10   144       29    0       24     1     0     1     1     0     8    0
amappl9    136      883    0      875     1     0     1     1     0     8    0
amappl8    128      429    0      392     2     0     2     2     0     8    0
amappl7    120       97    0       89     1     0     1     1     0     8    0
amappl6    112      907    0      894     1     0     1     1     0     8    0
amappl5    104      506    0      489     1     0     1     1     0     8    0
amappl4     96     2233    0     2206     1     0     1     1     0     8    0
amappl3     88      932    0      925     1     0     1     1     0     8    0
amappl2     80    15888    0    15818     4     2     2     3     0     8    0
amappl1     72    59379    0    58941    27    17    10    20     0     8    0
amappl      80     7682    0     7641     4     2     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      138    0        9     3     0     3     3     0     8    0
uaddrrnd    24     2196    0     2165     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2196    0     2165     1     0     1     1     0     8    0
vmmpekpl   168    24560    0    24527     2     0     2     2     0     8    0
vmmpepl    168   289398    0   287214   303   200   103   142     0   357    0
vmsppl     368     2180    0     2165     2     0     2     2     0     8    0
pdppl      4096    4399    0     4360     7     2     5     6     0     8    0
pvpl        32   938834    0   918340   335   149   186   210     0   265    7
pmappl     232     2195    0     2180    12    11     1     2     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      647    0       33    18     0    18    18     0     8    0

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2019/09/30 09:40 openbsd f6e3733c141c c1ad5441 .config log report
* Struck through repros no longer work on HEAD.