syzbot


panic: kernel diagnostic asserWtiARonNI N"Gr:t ->SPrLt _NifOTa ->LiOfWaE_RiEDf pO N! =S NYUSCLALL"L fa3 il4 eEdX:I fT i

Status: closed as dup on 2019/10/20 20:18
Reported-by: syzbot+16d82319557270a78afa@syzkaller.appspotmail.com
First crash: 1031d, last: 1031d
Duplicate of (1):
Title Repro Cause bisect Fix bisect Count Last Reported
assert "rt->rt_ifa->ifa_ifp != NULL" failed in route.c 830 1012d 1053d

Sample crash report:
panic: kernel diagnostic asserWtiARonNI N"Gr:t ->SPrLt _NifOTa ->LiOfWaE_RiEDf pO N! =S NYUSCLALL"L  fa3 il4 eEdX:I fT il0 e9 
"
Stopped at      savectx+0xb1:   movl    $0,%gs:0x530
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 412183  74176      0           0  0x4000000    0  syz-executor.0
*449665  35026     74    0x100012          0    1  pflogd
savectx(6,180,2fa3fa71eb0,3,2f792b03b16,2fa015cf000) at savectx+0xb1
end of kernel
end trace frame: 0x7f7ffffc9f10, count: 14
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
kernel diagnostic assertion "rt->rt_ifa->ifa_ifp != NULL" failed: file "/syzkaller/managers/multicore/kernel/sys/net/route.c", line 848
ddb{1}> trace
savectx(6,180,2fa3fa71eb0,3,2f792b03b16,2fa015cf000) at savectx+0xb1
end of kernel
end trace frame: 0x7f7ffffc9f10, count: -1
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff800020aab770
rbx                                0
rdx               0xffff800020ac0778
rcx                                0
rax                             0x31
r8                0xffffffff819ab01f    kprintf+0x16f
r9                               0x1
r10                             0x25
r11               0xc2348d82d72ba633
r12                                0
r13                                0
r14               0xffff800020ac0778
r15                                0
rip               0xffffffff819953f1    savectx+0xb1
cs                               0x8
rflags                          0x46
rsp               0xffff800020aab6f0
ss                              0x10
savectx+0xb1:   movl    $0,%gs:0x530
ddb{1}> show proc
PROC (pflogd) pid=449665 stat=onproc
    flags process=100012<EXEC,SUGID,PLEDGE> proc=0
    pri=50, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800020ac09f0,0xffff800020ac18d0
    process=0xffff800020add180 user=0xffff800020aa6000, vmspace=0xfffffd806e7d3008
    estcpu=0, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 74176   45306  27044      0  2           0                syz-executor.0
 74176  412183  27044      0  7   0x4000000                syz-executor.0
 27044  401813  45094      0  3        0x82  nanosleep     syz-executor.0
 80459  316866  45094      0  3        0x82  piperd        syz-executor.1
 32140  163637      0      0  3     0x14200  bored         sosplice
 45094  352634  60596      0  3        0x82  thrsleep      syz-fuzzer
 45094  263981  60596      0  2   0x4000482                syz-fuzzer
 45094  205937  60596      0  3   0x4000082  thrsleep      syz-fuzzer
 45094   87139  60596      0  3   0x4000082  thrsleep      syz-fuzzer
 45094  131508  60596      0  3   0x4000082  thrsleep      syz-fuzzer
 45094  117205  60596      0  3   0x4000082  thrsleep      syz-fuzzer
 45094  468623  60596      0  3   0x4000082  nanosleep     syz-fuzzer
 45094  231317  60596      0  3   0x4000082  thrsleep      syz-fuzzer
 45094  404875  60596      0  3   0x4000082  thrsleep      syz-fuzzer
 45094  467575  60596      0  3   0x4000082  kqread        syz-fuzzer
 60596  326318  62719      0  3    0x10008a  pause         ksh
 62719  369900  34927      0  3        0x92  select        sshd
  1377  191391      1      0  3    0x100083  ttyin         getty
 34927  303486      1      0  3        0x80  select        sshd
*35026  449665  32783     74  7    0x100012                pflogd
 32783  131215      1      0  3        0x80  netio         pflogd
 74289  251929  22456     73  3    0x100090  kqread        syslogd
 22456  410000      1      0  3    0x100082  netio         syslogd
 62203  414722      1     77  3    0x100090  poll          dhclient
 91861  183200      1      0  3        0x80  poll          dhclient
 44218   77362      0      0  3     0x14200  pgzero        zerothread
 49176  423745      0      0  3     0x14200  aiodoned      aiodoned
 27377   44064      0      0  3     0x14200  syncer        update
 47932  401542      0      0  3     0x14200  cleaner       cleaner
 41958  511123      0      0  3     0x14200  reaper        reaper
 84813   96072      0      0  3     0x14200  pgdaemon      pagedaemon
 92230  376885      0      0  3     0x14200  bored         crynlk
 61782  108771      0      0  3     0x14200  bored         crypto
 57531  283678      0      0  3  0x40014200  acpi0         acpi0
 54170  192606      0      0  3  0x40014200                idle1
  7536   56079      0      0  3     0x14200  bored         softnet
 89448    4987      0      0  3     0x14200  bored         systqmp
 70109  189496      0      0  3     0x14200  bored         systq
 71560   47191      0      0  2  0x40014200                softclock
 30241  317970      0      0  3  0x40014200                idle0
 95666  473585      0      0  3     0x14200  bored         smr
     1  469983      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 74176 (syz-executor.0) thread 0xffff800020abec70 (412183)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff826382b0)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  rt_clone+0x5c sys/net/route.c:266
#2  rtalloc_mpath+0xba rt_match sys/net/route.c:244 [inline]
#2  rtalloc_mpath+0xba sys/net/route.c:359
#3  ip_output+0x4f2 sys/netinet/ip_output.c:204
#4  rip_output+0x252 sys/netinet/raw_ip.c:289
#5  rip_usrreq+0x46a sys/netinet/raw_ip.c:538
#6  sosend+0x645 sys/kern/uipc_socket.c:524
#7  dofilewritev+0x1b7 sys/kern/sys_generic.c:364
#8  sys_write+0x83 sys/kern/sys_generic.c:284
#9  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#9  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#10 Xsyscall+0x128
exclusive rwlock netlock r = 0 (0xffffffff8247e1a8)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  solock+0x5a sys/kern/uipc_socket2.c:282
#2  sosend+0x51b sys/kern/uipc_socket.c:512
#3  dofilewritev+0x1b7 sys/kern/sys_generic.c:364
#4  sys_write+0x83 sys/kern/sys_generic.c:284
#5  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#5  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#6  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9486   6395K    6847K  78643K     11339        0        0
            pcb    13      8K       8K  78643K        65        0        0
         rtable   112      4K       4K  78643K       502        0        0
         ifaddr    49     13K      13K  78643K       149        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       4K  78643K      1483        0        0
            iov     0      0K      16K  78643K       777        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1218     77K      77K  78643K      1488        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K         9        0        0
         VM map     6      3K       3K  78643K         8        0        0
            sem    12      0K       0K  78643K      1549        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1808    196K     290K  78643K     12765        0        0
      file desc     5     13K      25K  78643K      2558        0        0
          sigio     0      0K       0K  78643K         2        0        0
           proc    60     63K      95K  78643K       571        0        0
        subproc    32      2K       2K  78643K        85        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K        44        0        0
       in_multi    34      2K       2K  78643K        77        0        0
    ether_multi     1      0K       0K  78643K         4        0        0
            mrt     0      0K       0K  78643K         2        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys    60    265K     265K  78643K        60        0        0
           exec     0      0K       1K  78643K      1355        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   115     54K      55K  78643K      7793        0        0
       UVM aobj    42      4K       4K  78643K        42        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K        56        0        0
            NDP    10      0K       0K  78643K        42        0        0
           temp   143   3559K    3635K  78643K     15307        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       18    0       11     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       27    0       25     1     0     1     1     0     8    0
rtentry    112       94    0       48     2     0     2     2     0     8    0
unpcb      120     1243    0     1231     2     1     1     2     0     8    0
syncache   264        8    0        8     3     3     0     1     0     8    0
tcpcb      544      142    0      138     3     0     3     3     0     8    2
inpcb      280     2277    0     2269     5     1     4     4     0     8    3
rttmr       72        1    0        1     1     1     0     1     0     8    0
ip6q        72        2    0        2     1     1     0     1     0     8    0
ip6af       40        6    0        6     1     1     0     1     0     8    0
nd6         48       13    0        9     1     0     1     1     0     8    0
pkpcb       40        2    0        2     1     1     0     1     0     8    0
ppxss      1128      20    0       20     3     2     1     1     0     8    1
pffrag     232        7    0        7     1     0     1     1     0   482    1
pffrnode    88        7    0        7     1     0     1     1     0     8    1
pffrent     40      226    0      226     1     0     1     1     0     8    1
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       55    0       23     1     0     1     1     0     8    0
pfstkey    112       55    0       23     1     0     1     1     0     8    0
pfstate    328       55    0       23     3     0     3     3     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      409    0      185    16     0    16    16     0     8    2
art_table   32      410    0      185     3     0     3     3     0     8    1
art_node    16       90    0       48     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        0     1     0     1     1     0     8    0
semupl     112        4    0        4     2     2     0     1     0     8    0
semapl     112     1547    0     1537     1     0     1     1     0     8    0
shmpl      112       40    0        0     2     0     2     2     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     4730    0     3328    46     0    46    46     0     8    0
ffsino     272     4730    0     3328    95     1    94    95     0     8    0
nchpl      144    12909    0    11310    61     0    61    61     0     8    0
uvmvnodes   72     4968    0        0    91     0    91    91     0     8    0
vnodes     208     4968    0        0   262     0   262   262     0     8    0
namei      1024   43654    0    43654     1     0     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
vcpupl     1984       4    0        0     1     0     1     1     0     8    0
vmpool     552        6    0        2     1     0     1     1     0     8    0
scxspl     192    22359    0    22359     9     8     1     7     0     8    1
plimitpl   152       36    0       28     1     0     1     1     0     8    0
sigapl     432     2749    0     2734     3     1     2     3     0     8    0
futexpl     56    93986    0    93986     1     0     1     1     0     8    1
knotepl    112     6074    0     6055     1     0     1     1     0     8    0
kqueuepl   104     8856    0     8854     1     0     1     1     0     8    0
pipepl     112     5502    0     5483     4     3     1     2     0     8    0
fdescpl    488     2750    0     2734     3     0     3     3     0     8    0
filepl     152    40983    0    40880     7     1     6     6     0     8    2
lockfpl    104     1527    0     1526     1     0     1     1     0     8    0
lockfspl    48      673    0      672     1     0     1     1     0     8    0
sessionpl  112       21    0       10     1     0     1     1     0     8    0
pgrppl      48       29    0       18     1     0     1     1     0     8    0
ucredpl     96     6551    0     6542     1     0     1     1     0     8    0
zombiepl   144     2735    0     2735     1     0     1     1     0     8    1
processpl  896     2767    0     2735     4     0     4     4     0     8    0
procpl     632     6890    0     6848     5     0     5     5     0     8    1
srpgc       64        6    0        6     2     1     1     1     0     8    1
sosppl     128     1094    0     1094     1     0     1     1     0     8    1
sockpl     384     4210    0     4188    11     5     6     8     0     8    3
mcl64k     65536      9    0        0     2     0     2     2     0     8    0
mcl16k     16384      4    0        0     1     0     1     1     0     8    0
mcl12k     12288      5    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192      17    0        0     3     0     3     3     0     8    0
mcl4k      4096      17    0        0     3     0     3     3     0     8    0
mcl2k2     2112       5    0        0     1     0     1     1     0     8    0
mcl2k      2048     167    0        0    19     0    19    19     0     8    0
mtagpl      80       23    0        0     1     0     1     1     0     8    0
mbufpl     256      362    0        0    19     0    19    19     0     8    0
bufpl      256     9064    0     2016   441     0   441   441     0     8    0
anonpl      16   208907    0   194806    95    18    77    90     0   124    2
amapchunkpl 152   12347    0    12202    14     7     7    11     0   158    1
amappl16   192    13379    0    12363    65    12    53    63     0     8    2
amappl14   176      175    0      172     1     0     1     1     0     8    0
amappl12   160      858    0      855     2     1     1     1     0     8    0
amappl11   152       68    0       52     1     0     1     1     0     8    0
amappl10   144       33    0       27     1     0     1     1     0     8    0
amappl9    136      658    0      652     1     0     1     1     0     8    0
amappl8    128      210    0      184     2     1     1     2     0     8    0
amappl7    120       57    0       49     1     0     1     1     0     8    0
amappl6    112       82    0       72     1     0     1     1     0     8    0
amappl5    104      997    0      983     1     0     1     1     0     8    0
amappl4     96     2873    0     2843     1     0     1     1     0     8    0
amappl3     88      381    0      370     1     0     1     1     0     8    0
amappl2     80    21828    0    21756     3     1     2     3     0     8    0
amappl1     72    68456    0    68020    25    15    10    20     0     8    0
amappl      80     7193    0     7146     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64       41    0        0     1     0     1     1     0     8    0
uaddrrnd    24     2756    0     2734     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2756    0     2734     1     0     1     1     0     8    0
vmmpekpl   168    30627    0    30590     3     0     3     3     0     8    0
vmmpepl    168   332244    0   330104   175    41   134   134     0   357   36
vmsppl     368     2749    0     2734     2     0     2     2     0     8    0
pdppl      4096    5519    0     5476     6     0     6     6     0     8    0
pvpl        32   603116    0   585822   221    36   185   211     0   265    9
pmappl     232     2755    0     2736     3     1     2     2     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      619    0        4    18     0    18    18     0     8    0

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2019/10/20 00:51 openbsd 8b95a59bc25b 8c88c9c1 .config log report