syzbot


uvm_fault: memset

Status: upstream: reported C repro on 2021/08/08 04:46
Reported-by: syzbot+aed2c23886430a6eaedb@syzkaller.appspotmail.com
First crash: 548d, last: 8h48m

Sample crash report:
uvm_fault(0xffffffff82a30160, 0xffff80002115f002, 0, 2) -> d
kernel: page fault trap, code=0
Stopped at      memset+0x45:    repe stosb      %es:(%rdi)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*388438  74857     73   0x1100010          0    0  syslogd
memset() at memset+0x45
ffs_write(ffff800021643300) at ffs_write+0x93c
VOP_WRITE(fffffd806e601750,ffff800021643520,3,fffffd807f7d7c60) at VOP_WRITE+0xbf sys/kern/vfs_vops.c:245
vn_write(fffffd806edc55a8,ffff800021643520,0) at vn_write+0x152 sys/kern/vfs_vnops.c:414
dofilewritev(ffff8000ffff87e8,e,ffff800021643520,0,ffff800021643620) at dofilewritev+0x19c sys/kern/sys_generic.c:381
sys_writev(ffff8000ffff87e8,ffff8000216435c0,ffff800021643620) at sys_writev+0xa7 sys/kern/sys_generic.c:328
syscall(ffff800021643690) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe73b0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff82a30160, 0xffff80002115f002, 0, 2) -> d
ddb> trace
memset() at memset+0x45
ffs_write(ffff800021643300) at ffs_write+0x93c
VOP_WRITE(fffffd806e601750,ffff800021643520,3,fffffd807f7d7c60) at VOP_WRITE+0xbf sys/kern/vfs_vops.c:245
vn_write(fffffd806edc55a8,ffff800021643520,0) at vn_write+0x152 sys/kern/vfs_vnops.c:414
dofilewritev(ffff8000ffff87e8,e,ffff800021643520,0,ffff800021643620) at dofilewritev+0x19c sys/kern/sys_generic.c:381
sys_writev(ffff8000ffff87e8,ffff8000216435c0,ffff800021643620) at sys_writev+0xa7 sys/kern/sys_generic.c:328
syscall(ffff800021643690) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe73b0, count: -8
ddb> show registers
rdi               0xffff80002115f002
rsi                                0
rbp               0xffff800021643220
rbx                              0x1
rdx                              0x6
rcx                              0x6
rax                                0
r8                            0x3ff8    __ALIGN_SIZE+0x2ff8
r9                0xffff800021643178
r10               0x480b22f3507be06f
r11               0xffff80002115f002
r12                          0x30002    acpi_pdirpa+0x1be6a
r13               0xfffffd806ed74988
r14                           0x4000    __ALIGN_SIZE+0x3000
r15               0xfffffd806ed74970
rip               0xffffffff823965d5    memset+0x45
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff800021643028
ss                              0x10
memset+0x45:    repe stosb      %es:(%rdi)
ddb> show proc
PROC (syslogd) pid=388438 stat=onproc
    flags process=1100010<SUGID,PLEDGE,CHROOT> proc=0
    pri=24, usrpri=51, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff8d28,0xffff80002160b280
    process=0xffff8000ffff63f8 user=0xffff80002163e000, vmspace=0xfffffd807f015990
    estcpu=1, cpticks=2, pctcpu=0.2
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 31548  510533  27819      0  2       0x482                syz-executor171176059
 27819  134387  63274      0  3    0x10008a  sigsusp       ksh
 63274  313173  86820      0  3        0x9a  kqread        sshd
 88100  108466      1      0  3    0x100083  ttyin         getty
 86820  504415      1      0  3        0x88  kqread        sshd
*74857  388438  26166     73  7   0x1100010                syslogd
 26166   42027      1      0  3    0x100082  netio         syslogd
 51182   81405      1      0  3    0x100080  kqread        resolvd
 50512  450739  23811     77  3    0x100092  kqread        dhcpleased
 44380  344297  23811     77  3    0x100092  kqread        dhcpleased
 23811  103476      1      0  3        0x80  kqread        dhcpleased
 69769  357670      0      0  3     0x14200  bored         smr
   570  413157      0      0  3     0x14200  pgzero        zerothread
  1615  100951      0      0  3     0x14200  aiodoned      aiodoned
 96969  120182      0      0  3     0x14200  syncer        update
 95729  404552      0      0  3     0x14200  cleaner       cleaner
 19563  506572      0      0  3     0x14200  reaper        reaper
 96820  351341      0      0  3     0x14200  pgdaemon      pagedaemon
 11236  474699      0      0  3     0x14200  bored         viomb
 12233  521673      0      0  3  0x40014200  acpi0         acpi0
 70912  117453      0      0  3     0x14200  bored         softnet
 76525  276252      0      0  3     0x14200  bored         softnet
 37824   18499      0      0  3     0x14200  bored         softnet
 18962   86600      0      0  3     0x14200  bored         softnet
 85836  244562      0      0  3     0x14200  bored         systqmp
 34906   31956      0      0  3     0x14200  bored         systq
 17361   71843      0      0  3  0x40014200  bored         softclock
  6016  318401      0      0  3  0x40014200                idle0
     1  416264      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10135   6382K    6413K  78643K     11225        0
            pcb    13      8K       8K  78643K        13        0
         rtable    58      1K       2K  78643K       104        0
         ifaddr    24      7K       7K  78643K        24        0
       counters    19     16K      16K  78643K        19        0
       ioctlops     0      0K       2K  78643K      1628        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         5        0
         vnodes  1166     73K      73K  78643K      1180        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc     1      0K       0K  78643K         1        0
           proc    55     58K      59K  78643K       226        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    25    122K     122K  78643K        25        0
           exec     0      0K       2K  78643K      1994        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    51      3K       5K  78643K      2859        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     3      0K       0K  78643K         3        0
           temp    18   4709K    4773K  78643K      3876        0
         kqueue    11     16K      18K  78643K        24        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       17    0       14     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      136       33    0       20     1     0     1     1     0     8    0
syncache   296        5    0        5     2     2     0     1     0     8    0
tcpcb      736        8    0        5     1     0     1     1     0     8    0
arp         88        2    0        0     1     0     1     1     0     8    0
inpcb      312       25    0       19     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       97    0        0     7     0     7     7     0     8    0
art_table   32       98    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1417    0       38    87     0    87    87     0     8    0
ffsino     240     1417    0       38    82     0    82    82     0     8    0
nchpl      144     1604    0       47    58     0    58    58     0     8    0
uvmvnodes   80     1427    0        0    30     0    30    30     0     8    0
vnodes     224     1427    0        0    84     0    84    84     0     8    0
namei      1024   12191    0    12191     2     1     1     1     0     8    1
kstatmem   264        6    0        0     1     0     1     1     0     8    0
scxspl     216     7113    0     7113    13    12     1     8     0     8    1
plimitpl   152       15    0        9     1     0     1     1     0     8    0
sigapl     424     1897    0     1867     4     0     4     4     0     8    0
knotepl    120    18505    0    18476     3     2     1     2     0     8    0
kqueuepl   184       20    0       13     1     0     1     1     0     8    0
pipepl     304       79    0       76     2     1     1     1     0     8    0
fdescpl    432     1881    0     1868     2     0     2     2     0     8    0
filepl     120     7455    0     7402     2     0     2     2     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl     96       65    0       54     1     0     1     1     0     8    0
zombiepl   144     1868    0     1867     2     1     1     1     0     8    0
processpl  1000    1897    0     1867     5     1     4     5     0     8    0
procpl     672     1897    0     1867     3     0     3     3     0     8    0
sockpl     448       75    0       53     3     0     3     3     0     8    0
mcl8k      8192       9    0        9     2     2     0     1     0     8    0
mcl4k      4096       5    0        5     2     2     0     1     0     8    0
mcl2k      2048    6431    0     6402     8     4     4     6     0     8    0
mtagpl      96        3    0        3     1     1     0     1     0     8    0
mbufpl     256    15921    0    15853     7     1     6     6     0     8    0
bufpl      288     6757    0      468   450     0   450   450     0     8    0
anonpl      24    46463    0    44684    15     4    11    13     0   188    0
amapchunkpl 152    4175    0     4089     5     1     4     5     0   158    0
amappl16   200     1687    0     1683     1     0     1     1     0     8    0
amappl13   176       32    0       31     2     1     1     1     0     8    0
amappl12   168        3    0        3     2     2     0     1     0     8    0
amappl11   160       60    0       47     1     0     1     1     0     8    0
amappl10   152        1    0        0     1     0     1     1     0     8    0
amappl9    144      483    0      481     1     0     1     1     0     8    0
amappl8    136      333    0      332     2     1     1     1     0     8    0
amappl7    128       49    0       46     1     0     1     1     0     8    0
amappl6    120       92    0       82     1     0     1     1     0     8    0
amappl5    112     1684    0     1675     1     0     1     1     0     8    0
amappl4    104      566    0      547     1     0     1     1     0     8    0
amappl3     96      348    0      329     1     0     1     1     0     8    0
amappl2     88      419    0      381     2     0     2     2     0     8    0
amappl1     80    15132    0    14758    11     2     9     9     0     8    0
amappl      88     2606    0     2571     1     0     1     1     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24     1881    0     1868     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1881    0     1868     1     0     1     1     0     8    0
vmmpekpl   168     9182    0     9170     1     0     1     1     0     8    0
vmmpepl    168    50537    0    49761    44     9    35    38     0   357    0
vmsppl     272     1880    0     1868     2     1     1     2     0     8    0
rwobjpl     24    10681    0     8735    13     0    13    13     0     8    0
pdppl      4096    3768    0     3736    52    18    34    40     0     8    2
pvpl        32   164180    0   160561    40    10    30    33     0   265    0
pmappl     216     1880    0     1868     1     0     1     1     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112      713    0       31    20     0    20    20     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
memset() at memset+0x45
ffs_write(ffff800021643300) at ffs_write+0x93c
VOP_WRITE(fffffd806e601750,ffff800021643520,3,fffffd807f7d7c60) at VOP_WRITE+0xbf sys/kern/vfs_vops.c:245
vn_write(fffffd806edc55a8,ffff800021643520,0) at vn_write+0x152 sys/kern/vfs_vnops.c:414
dofilewritev(ffff8000ffff87e8,e,ffff800021643520,0,ffff800021643620) at dofilewritev+0x19c sys/kern/sys_generic.c:381
sys_writev(ffff8000ffff87e8,ffff8000216435c0,ffff800021643620) at sys_writev+0xa7 sys/kern/sys_generic.c:328
syscall(ffff800021643690) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe73b0, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
memset() at memset+0x45
ffs_write(ffff800021643300) at ffs_write+0x93c
VOP_WRITE(fffffd806e601750,ffff800021643520,3,fffffd807f7d7c60) at VOP_WRITE+0xbf sys/kern/vfs_vops.c:245
vn_write(fffffd806edc55a8,ffff800021643520,0) at vn_write+0x152 sys/kern/vfs_vnops.c:414
dofilewritev(ffff8000ffff87e8,e,ffff800021643520,0,ffff800021643620) at dofilewritev+0x19c sys/kern/sys_generic.c:381
sys_writev(ffff8000ffff87e8,ffff8000216435c0,ffff800021643620) at sys_writev+0xa7 sys/kern/sys_generic.c:328
syscall(ffff800021643690) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe73b0, count: -8

Crashes (26):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-main 2022/06/14 03:13 openbsd db879ab8e4d2 0f087040 .config console log report syz C uvm_fault: memset
ci-openbsd-multicore 2021/08/08 04:45 openbsd 3395d9ad18ab 6972b106 .config console log report syz C uvm_fault: memset
ci-openbsd-multicore 2023/02/07 13:57 openbsd 0da56a053721 b68d0e75 .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memset
ci-openbsd-main 2023/01/19 09:56 openbsd 7c5efb429235 66fca3ae .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memset
ci-openbsd-main 2023/01/14 18:23 openbsd 76b90a235db8 a63719e7 .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memset
ci-openbsd-multicore 2022/12/20 16:12 openbsd fea828ab47f1 d3e76707 .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memset
ci-openbsd-main 2022/11/23 09:56 openbsd d0597228d649 75740b3f .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memset
ci-openbsd-main 2022/11/21 05:45 openbsd 11064cccbc3a 5bb70014 .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memset
ci-openbsd-main 2022/10/08 20:04 openbsd 5cb1d9dce18f aea5da89 .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memset
ci-openbsd-main 2022/09/21 18:05 openbsd 3fc7a1c74b2f 380f82fb .config console log report [disk image] [bsd.gdb] [kernel image] uvm_fault: memset
ci-openbsd-main 2022/09/20 05:04 openbsd 00f5031a633c dd9a85ff .config console log report uvm_fault: memset
ci-openbsd-multicore 2022/08/31 17:08 openbsd 4bbd1b5285d2 51e54e30 .config console log report uvm_fault: memset
ci-openbsd-multicore 2022/08/25 23:29 openbsd 59a54550596b e5fb9cf5 .config console log report uvm_fault: memset
ci-openbsd-main 2022/07/13 07:55 openbsd 1cc9250c5648 5d921b08 .config console log report uvm_fault: memset
ci-openbsd-main 2022/03/08 04:09 openbsd 30dd31d2109d 7bdd8b2c .config console log report uvm_fault: memset
ci-openbsd-main 2022/03/06 11:45 openbsd a4cc87870bbc 7bdd8b2c .config console log report uvm_fault: memset
ci-openbsd-multicore 2022/01/25 00:23 openbsd 0e162ba39fbe 2cbffd88 .config console log report uvm_fault: memset
ci-openbsd-multicore 2022/01/24 19:45 openbsd 7f22cd74b38a 96ff84ef .config console log report uvm_fault: memset
ci-openbsd-multicore 2022/01/24 18:41 openbsd 7f22cd74b38a 96ff84ef .config console log report uvm_fault: memset
ci-openbsd-multicore 2022/01/24 18:13 openbsd 7f22cd74b38a 96ff84ef .config console log report uvm_fault: memset
ci-openbsd-multicore 2022/01/24 17:25 openbsd 7f22cd74b38a 96ff84ef .config console log report uvm_fault: memset
ci-openbsd-multicore 2022/01/24 16:50 openbsd 7f22cd74b38a 96ff84ef .config console log report uvm_fault: memset
ci-openbsd-main 2022/01/16 11:04 openbsd b0877370f8cb 723cfaf0 .config console log report uvm_fault: memset
ci-openbsd-main 2021/12/14 11:08 openbsd a7a431551857 5d14b1ea .config console log report uvm_fault: memset
ci-openbsd-multicore 2021/12/10 00:52 openbsd f231ff592234 b54aa474 .config console log report uvm_fault: memset
ci-openbsd-main 2021/08/29 18:49 openbsd 227bbaa63360 be2c130d .config console log report uvm_fault: memset
* Struck through repros no longer work on HEAD.