syzbot


panic: ifa_update_broadaddr does not support dypananimicc: l eknegrtnhe

Status: closed as dup on 2019/10/07 13:44
Reported-by: syzbot+7d653328679f7c4185c9@syzkaller.appspotmail.com
First crash: 1634d, last: 1634d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
panic: ifa_update_broadaddr does not support dynamic length syz 6780 1603d 1661d

Sample crash report:
panic: ifa_update_broadaddr does not support dypananimicc: l eknegrtnhe
lStopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*417843  14930      0           0  0x4000000    0  syz-executor.1
  82301  69863      0           0  0x4000000    1  syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
ifa_update_broadaddr(ffff800000add800,ffff800000b72a00,ffff800024bc1ce0) at ifa_update_broadaddr+0x61 sys/net/if.c:2970
in_ioctl(80206913,ffff800024bc1cd0,ffff800000add800,1) at in_ioctl+0x463 sys/netinet/in.c:299
ifioctl(fffffd8061795db0,80206913,ffff800024bc1cd0,ffff800020ace790) at ifioctl+0xb64 sys/net/if.c:2202
sys_ioctl(ffff800020ace790,ffff800024bc1de8,ffff800024bc1e30) at sys_ioctl+0x5b9
syscall(ffff800024bc1eb0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800024bc1eb0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,ffffffffffffff36,0,3,196c3736010) at Xsyscall+0x128
end of kernel
end trace frame: 0x1990dd61d00, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
ifa_update_broadaddr does not support dynamic length
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
ifa_update_broadaddr(ffff800000add800,ffff800000b72a00,ffff800024bc1ce0) at ifa_update_broadaddr+0x61 sys/net/if.c:2970
in_ioctl(80206913,ffff800024bc1cd0,ffff800000add800,1) at in_ioctl+0x463 sys/netinet/in.c:299
ifioctl(fffffd8061795db0,80206913,ffff800024bc1cd0,ffff800020ace790) at ifioctl+0xb64 sys/net/if.c:2202
sys_ioctl(ffff800020ace790,ffff800024bc1de8,ffff800024bc1e30) at sys_ioctl+0x5b9
syscall(ffff800024bc1eb0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800024bc1eb0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,ffffffffffffff36,0,3,196c3736010) at Xsyscall+0x128
end of kernel
end trace frame: 0x1990dd61d00, count: -8
ddb{0}> show registers
rdi               0xffffffff81d20337    db_enter+0x17
rsi                           0x1b96    __ALIGN_SIZE+0xb96
rbp               0xffff800024bc1a70
rbx               0xffff800024bc1b20
rdx                           0x1b97    __ALIGN_SIZE+0xb97
rcx               0xffff800020f6e000
rax               0xffff800020f6e000
r8                0xffffffff8182804f    kprintf+0x16f
r9                               0x1
r10                             0x25
r11               0xbfcecd5f1fa414a1
r12                     0x3000000008
r13               0xffff800024bc1a80
r14                            0x100
r15                              0x1
rip               0xffffffff81d20338    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800024bc1a60
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor.1) pid=417843 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=77, usrpri=77, nice=20
    forw=0xffffffffffffffff, list=0xffff800020acea08,0xffffffff8266a638
    process=0xffff800020adc380 user=0xffff800024bbc000, vmspace=0xfffffd807f00b730
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 14930  107735  37939      0  2           0                syz-executor.1
*14930  417843  37939      0  7   0x4000000                syz-executor.1
 69863  469189  86003      0  2           0                syz-executor.0
 69863   82301  86003      0  7   0x4000000                syz-executor.0
 86003  372488  79376      0  3        0x82  nanosleep     syz-executor.0
 48209    5735      0      0  3     0x14200  acct          acct
 37939   84921  79376      0  3        0x82  nanosleep     syz-executor.1
 54897  297509      1      0  3    0x100083  ttyin         getty
 25783  416188      0      0  3     0x14200  bored         sosplice
 79376  226436  91081      0  3        0x82  thrsleep      syz-fuzzer
 79376  104618  91081      0  3   0x4000082  nanosleep     syz-fuzzer
 79376  312352  91081      0  3   0x4000082  thrsleep      syz-fuzzer
 79376   93617  91081      0  3   0x4000082  thrsleep      syz-fuzzer
 79376  254143  91081      0  3   0x4000082  thrsleep      syz-fuzzer
 79376  480714  91081      0  3   0x4000082  thrsleep      syz-fuzzer
 79376   86694  91081      0  3   0x4000082  thrsleep      syz-fuzzer
 79376  277851  91081      0  3   0x4000082  thrsleep      syz-fuzzer
 79376  409776  91081      0  3   0x4000082  kqread        syz-fuzzer
 79376  485860  91081      0  3   0x4000082  thrsleep      syz-fuzzer
 91081  523605  71341      0  3    0x10008a  pause         ksh
 71341  518669  51262      0  3        0x92  select        sshd
 51262   26216      1      0  3        0x80  select        sshd
 74250  488267  55836     74  3    0x100092  bpf           pflogd
 55836  146098      1      0  3        0x80  netio         pflogd
 75644  165262  38421     73  3    0x100090  kqread        syslogd
 38421   48700      1      0  3    0x100082  netio         syslogd
 76388  442036      1     77  3    0x100090  poll          dhclient
 62081  401790      1      0  3        0x80  poll          dhclient
 30074  345732      0      0  2     0x14200                zerothread
 56279  141580      0      0  3     0x14200  aiodoned      aiodoned
 37850  107610      0      0  3     0x14200  syncer        update
 73991  192286      0      0  3     0x14200  cleaner       cleaner
 38298  398262      0      0  3     0x14200  reaper        reaper
 92962  489846      0      0  3     0x14200  pgdaemon      pagedaemon
 98265  361278      0      0  3     0x14200  bored         crynlk
 40558  290974      0      0  3     0x14200  bored         crypto
 11943  276955      0      0  3  0x40014200  acpi0         acpi0
 51004  184948      0      0  3  0x40014200                idle1
 62514  375357      0      0  3     0x14200  bored         softnet
 30076  289854      0      0  3     0x14200  bored         systqmp
 56318  238701      0      0  3     0x14200  bored         systq
 89644   51956      0      0  3  0x40014200  bored         softclock
 88918  371654      0      0  3  0x40014200                idle0
 67500  178873      0      0  3     0x14200  bored         smr
     1  375746      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 14930 (syz-executor.1) thread 0xffff800020ace790 (417843)
exclusive rwlock netlock r = 0 (0xffffffff82505ce8)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  in_ioctl+0x142
#2  ifioctl+0xb64 sys/net/if.c:2202
#3  sys_ioctl+0x5b9
#4  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#4  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#5  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8262ed78)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  syscall+0x400 mi_syscall sys/sys/syscall_mi.h:83 [inline]
#1  syscall+0x400 sys/arch/amd64/amd64/trap.c:555
#2  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9620   6588K    8254K  78643K     23255        0        0
            pcb    13      8K       8K  78643K       482        0        0
         rtable   115     13K      14K  78643K      1633        0        0
         ifaddr    98     19K      19K  78643K       458        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       4K  78643K      1555        0        0
            iov     0      0K      28K  78643K       513        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1232     77K      78K  78643K      5069        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K        38        0        0
         VM map     9      4K       5K  78643K        16        0        0
            sem    12      0K       0K  78643K       926        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1808    196K     290K  78643K     12765        0        0
      file desc     6     17K      25K  78643K      2329        0        0
          sigio     0      0K       0K  78643K        23        0        0
           proc    62     63K      83K  78643K      1218        0        0
        subproc    32      2K       2K  78643K       242        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       161        0        0
       in_multi    35      2K       2K  78643K       261        0        0
    ether_multi     1      0K       0K  78643K        26        0        0
            mrt     0      0K       0K  78643K        22        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    90    397K     397K  78643K        90        0        0
           exec     0      0K       1K  78643K       617        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   125    120K     129K  78643K      9345        0        0
       UVM aobj   118      3K       3K  78643K       123        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K       498        0        0
            NDP    24      0K       1K  78643K       157        0        0
           temp   259   3561K    3657K  78643K     92786        0        0
         kqueue     0      0K       0K  78643K        21        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       49    0       43     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80      171    0      169     1     0     1     1     0     8    0
rtentry    112      260    0      220     2     0     2     2     0     8    0
unpcb      120     1031    0     1019     1     0     1     1     0     8    0
syncache   264       11    0       11     3     3     0     1     0     8    0
sackhl      24        1    0        1     1     1     0     1     0     8    0
tcpqe       32     7634    0     7634     3     3     0     1     0     8    0
tcpcb      544      847    0      842     4     3     1     4     0     8    0
inpcb      280     2650    0     2641     9     7     2     4     0     8    1
rttmr       72        7    0        7     5     5     0     1     0     8    0
nd6         48       34    0       30     2     1     1     1     0     8    0
pkpcb       40        2    0        2     1     1     0     1     0     8    0
ppxss      1128      62    0       61     1     0     1     1     0     8    0
pffrag     232       50    0       50     6     6     0     1     0   482    0
pffrnode    88       50    0       50     6     6     0     1     0     8    0
pffrent     40     1136    0     1136     6     6     0     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24      183    0      134     1     0     1     1     0     8    0
pfstkey    112      183    0      134     3     0     3     3     0     8    0
pfstate    328      183    0      133     7     0     7     7     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096      11    0       10     5     4     1     3     0     8    0
art_heap4  256     1039    0      823    24     9    15    15     0     8    0
art_table   32     1050    0      833     2     0     2     2     0     8    0
art_node    16      259    0      223     1     0     1     1     0     8    0
sysvmsgpl   40       23    0        3     1     0     1     1     0     8    0
semupl     112        2    0        2     2     2     0     1     0     8    0
semapl     112      924    0      914     1     0     1     1     0     8    0
shmpl      112      121    0        5     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     5081    0     3674    46     0    46    46     0     8    0
ffsino     272     5081    0     3674    95     0    95    95     0     8    0
nchpl      144     9384    0     7771    61     0    61    61     0     8    0
uvmvnodes   72     6072    0        0   111     0   111   111     0     8    0
vnodes     208     6072    0        0   320     0   320   320     0     8    0
namei      1024   32578    0    32578     4     3     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
vcpupl     1984       7    0        0     1     0     1     1     0     8    0
vmpool     552       14    0        7     1     0     1     1     0     8    0
scsiplug    64        1    0        1     1     1     0     1     0     8    0
scxspl     192    26930    0    26930    27    26     1     7     0     8    1
plimitpl   152      205    0      197     1     0     1     1     0     8    0
sigapl     432     2495    0     2479     3     1     2     3     0     8    0
futexpl     56    52668    0    52668     1     0     1     1     0     8    1
knotepl    112      519    0      500     1     0     1     1     0     8    0
kqueuepl   104      511    0      509     1     0     1     1     0     8    0
pipepl     112     1508    0     1489     3     2     1     2     0     8    0
fdescpl    488     2496    0     2479     3     0     3     3     0     8    0
filepl     152    21427    0    21326    16    10     6     7     0     8    2
lockfpl    104      866    0      865     1     0     1     1     0     8    0
lockfspl    48      307    0      306     1     0     1     1     0     8    0
sessionpl  112       32    0       21     1     0     1     1     0     8    0
pgrppl      48       59    0       48     1     0     1     1     0     8    0
ucredpl     96     2337    0     2328     1     0     1     1     0     8    0
zombiepl   144     2480    0     2480     3     2     1     1     0     8    1
processpl  896     2514    0     2480     4     0     4     4     0     8    0
procpl     632     7897    0     7852     6     1     5     5     0     8    0
srpgc       64       18    0       18     5     4     1     1     0     8    1
sosppl     128       27    0       27     8     8     0     1     0     8    0
sockpl     384     3879    0     3856    13     9     4     7     0     8    0
mcl64k     65536    262    0        0    33     3    30    33     0     8    0
mcl16k     16384      7    0        0     1     0     1     1     0     8    0
mcl12k     12288     13    0        0     2     0     2     2     0     8    0
mcl9k      9216      10    0        0     1     0     1     1     0     8    0
mcl8k      8192      25    0        0     4     1     3     3     0     8    0
mcl4k      4096      13    0        0     2     0     2     2     0     8    0
mcl2k2     2112       6    0        0     1     0     1     1     0     8    0
mcl2k      2048     390    0        0    34     0    34    34     0     8    0
mtagpl      80      358    0        0     6     0     6     6     0     8    0
mbufpl     256      744    0        0    42     0    42    42     0     8    0
bufpl      256    17085    0    10037   441     0   441   441     0     8    0
anonpl      16   295014    0   277402   138    58    80    88     0   124    5
amapchunkpl 152   17951    0    17835    31    21    10    13     0   158    3
amappl16   192    13497    0    12477   112    60    52    64     0     8    0
amappl15   184        1    0        1     1     1     0     1     0     8    0
amappl14   176      437    0      435     2     1     1     1     0     8    0
amappl13   168       15    0       14     1     0     1     1     0     8    0
amappl12   160      332    0      327     1     0     1     1     0     8    0
amappl11   152      526    0      511     1     0     1     1     0     8    0
amappl10   144      327    0      321     1     0     1     1     0     8    0
amappl9    136     1016    0     1010     1     0     1     1     0     8    0
amappl8    128      598    0      563     2     0     2     2     0     8    0
amappl7    120      395    0      385     1     0     1     1     0     8    0
amappl6    112      495    0      482     1     0     1     1     0     8    0
amappl5    104      552    0      536     1     0     1     1     0     8    0
amappl4     96     2374    0     2339     2     1     1     2     0     8    0
amappl3     88      915    0      909     1     0     1     1     0     8    0
amappl2     80    18311    0    18233     4     2     2     3     0     8    0
amappl1     72    67150    0    66694    25    15    10    20     0     8    0
amappl      80     8400    0     8353     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      122    0        5     2     0     2     2     0     8    0
uaddrrnd    24     2510    0     2479     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2510    0     2479     1     0     1     1     0     8    0
vmmpekpl   168    22465    0    22424     4     1     3     3     0     8    0
vmmpepl    168   320854    0   318567   238   110   128   135     0   357   27
vmsppl     368     2495    0     2479     2     0     2     2     0     8    0
pdppl      4096    5027    0     4979     8     1     7     7     0     8    1
pvpl        32   780141    0   759248   286    96   190   208     0   265   16
pmappl     232     2509    0     2486     3     1     2     2     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      706    0       27    20     0    20    20     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/07 13:17 openbsd 29a2b068f14b 28ac6e64 .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.