syzbot


assert "p == curproc" failed in vfs_vops.c

Status: fixed on 2020/04/03 05:45
Reported-by: syzbot+11f9f4bfcc5b5e90acc1@syzkaller.appspotmail.com
Fix commit: fc5a743df3a9 Revert previous, syzkaller found a way to trigger the KASSERT().
First crash: 1488d, last: 1487d

Sample crash report:
login: panic: kernel diagnostic assertion "p == curproc" failed: file "/syzkaller/managers/main/kernel/sys/kern/vfs_vops.c", line 169
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*155092   7119      0     0x14000      0x200    0  systq
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff821d5d2f) at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff8222900d,ffffffff8225c86f,a9,ffffffff82208fd2) at __assert+0x2b sys/kern/subr_prf.c:154
VOP_CLOSE(fffffd80645cf1b8,3,fffffd806c3bf9c0,0) at VOP_CLOSE+0x12f sys/kern/vfs_vops.c:170
vn_closefile(fffffd805d861008,0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd805d861008,0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:614
fdrop(fffffd805d861008,0) at fdrop+0xc2 sys/kern/kern_descrip.c:1276
closef(fffffd805d861008,0) at closef+0x117 sys/kern/kern_descrip.c:1260
unp_gc(0) at unp_gc+0x172 sys/kern/uipc_usrreq.c:944
taskq_thread(ffffffff824bcfd0) at taskq_thread+0x52 sys/kern/kern_task.c:370
end trace frame: 0x0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel diagnostic assertion "p == curproc" failed: file "/syzkaller/managers/main/kernel/sys/kern/vfs_vops.c", line 169
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff821d5d2f) at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff8222900d,ffffffff8225c86f,a9,ffffffff82208fd2) at __assert+0x2b sys/kern/subr_prf.c:154
VOP_CLOSE(fffffd80645cf1b8,3,fffffd806c3bf9c0,0) at VOP_CLOSE+0x12f sys/kern/vfs_vops.c:170
vn_closefile(fffffd805d861008,0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd805d861008,0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:614
fdrop(fffffd805d861008,0) at fdrop+0xc2 sys/kern/kern_descrip.c:1276
closef(fffffd805d861008,0) at closef+0x117 sys/kern/kern_descrip.c:1260
unp_gc(0) at unp_gc+0x172 sys/kern/uipc_usrreq.c:944
taskq_thread(ffffffff824bcfd0) at taskq_thread+0x52 sys/kern/kern_task.c:370
end trace frame: 0x0, count: -9
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80001d2fc4d0
rbx               0xffff80001d2fc580
rdx                              0x2
rcx                              0x1
rax                              0x1
r8                0xffff80001d2fc490
r9                               0x1
r10               0xb204fdf8593ba94c
r11               0xbb5d56cdec2b8c46
r12                     0x3000000008
r13               0xffff80001d2fc4e0
r14                            0x100
r15                              0x1
rip               0xffffffff813787c8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80001d2fc4c0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (systq) pid=155092 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    pri=32, usrpri=51, nice=20
    forw=0xffffffffffffffff, list=0xffff80001d2e1ea0,0xffff80001d2e19d0
    process=0xffff8000ffffe730 user=0xffff80001d2f7000, vmspace=0xffffffff82589be8
    estcpu=1, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 14375  492296  72268      0  3        0x82  nanosleep     syz-executor4776
 72268  280627  18226      0  3    0x10008a  pause         ksh
 18226  523033  42350      0  2        0x12                sshd
  8170   67465      1      0  3    0x100083  ttyin         getty
 42350  402646      1      0  3        0x80  select        sshd
 54042  265534  11323     73  3    0x100090  kqread        syslogd
 11323  373894      1      0  3    0x100082  netio         syslogd
 78927  401793      1     77  3    0x100090  poll          dhclient
 52823  281111      1      0  3        0x80  poll          dhclient
 27301  263655      0      0  3     0x14200  bored         smr
 77987   69536      0      0  2     0x14200                zerothread
 10542  381822      0      0  3     0x14200  aiodoned      aiodoned
 33313  201918      0      0  3     0x14200  syncer        update
 42375  255448      0      0  3     0x14200  cleaner       cleaner
 59446  247881      0      0  3     0x14200  reaper        reaper
 15492  301919      0      0  3     0x14200  pgdaemon      pagedaemon
 90496  136297      0      0  3     0x14200  bored         crynlk
 20088  497859      0      0  3     0x14200  bored         crypto
 29365  297857      0      0  3  0x40014200  acpi0         acpi0
 27741  514511      0      0  2     0x14200                softnet
 52379  480090      0      0  3     0x14200  bored         systqmp
* 7119  155092      0      0  7     0x14200                systq
 25501  507080      0      0  3  0x40014200  bored         softclock
 49423  441795      0      0  3  0x40014200                idle0
     1  210475      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9439   6319K    6320K  78643K     10536        0
            pcb    13      8K       8K  78643K        13        0
         rtable    61      1K       2K  78643K       117        0
         ifaddr    24      7K       7K  78643K        24        0
       counters    19     16K      16K  78643K        19        0
       ioctlops     0      0K       2K  78643K        13        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1182     74K      74K  78643K      1187        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1794    195K     288K  78643K     12646        0
      file desc     1      0K       0K  78643K         1        0
           proc    47     38K      46K  78643K       278        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    19     95K      95K  78643K        19        0
           exec     0      0K       1K  78643K       151        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    53      2K       3K  78643K       805        0
       UVM aobj     2      2K       2K  78643K         2        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     3      0K       0K  78643K         3        0
           temp   135   3039K    3089K  78643K      1535        0
         kqueue     2      2K       2K  78643K         2        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        2    0        0     1     0     1     1     0     8    0
rtpcb       80       15    0       13     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      120      263    0       21     8     0     8     8     0     8    0
syncache   264        5    0        5     2     1     1     1     0     8    1
tcpcb      544        8    0        5     1     0     1     1     0     8    0
inpcb      280       22    0       16     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       97    0        0     7     0     7     7     0     8    0
art_table   32       98    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1392    0       15    45     0    45    45     0     8    0
ffsino     240     1392    0       15    81     0    81    81     0     8    0
nchpl      144     1567    0       31    57     0    57    57     0     8    0
uvmvnodes   72     1401    0        0    26     0    26    26     0     8    0
vnodes     208     1401    0        0    74     0    74    74     0     8    0
namei      1024    3565    0     3565     2     1     1     1     0     8    1
scxspl     192     2735    0     2735     2     1     1     1     0     8    1
plimitpl   152       13    0        8     1     0     1     1     0     8    0
sigapl     424      309    0      284     4     0     4     4     0     8    0
knotepl    112        5    0        0     1     0     1     1     0     8    0
kqueuepl   144        1    0        0     1     0     1     1     0     8    0
pipelkpl    16       57    0       53     2     1     1     1     0     8    0
pipepl     120      114    0      107     2     1     1     1     0     8    0
fdescpl    432      295    0      284     2     0     2     2     0     8    0
filepl     120     1177    0      783    13     0    13    13     0     8    1
lockfpl    104        5    0        4     1     0     1     1     0     8    0
lockfspl    48        3    0        2     1     0     1     1     0     8    0
sessionpl  112       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl     96       47    0       40     1     0     1     1     0     8    0
zombiepl   144      284    0      283     2     1     1     1     0     8    0
processpl  920      309    0      283     4     0     4     4     0     8    0
procpl     624      309    0      283     3     0     3     3     0     8    0
sockpl     400      300    0       50    26     0    26    26     0     8    1
mcl4k      4096      10    0       10     2     1     1     1     0     8    1
mcl2k      2048    5865    0     5836     8     3     5     6     0     8    1
mtagpl      80        2    0        2     1     1     0     1     0     8    0
mbufpl     256    10591    0    10311    19     1    18    18     0     8    0
bufpl      280     1751    0       66   121     0   121   121     0     8    0
anonpl      16    17913    0    16789     7     2     5     7     0   107    0
amapchunkpl 152     584    0      548     2     0     2     2     0   158    0
amappl16   192      186    0      183     1     0     1     1     0     8    0
amappl15   184        1    0        0     1     0     1     1     0     8    0
amappl14   176        1    0        1     1     1     0     1     0     8    0
amappl13   168       12    0       11     2     1     1     1     0     8    0
amappl12   160        6    0        6     1     1     0     1     0     8    0
amappl11   152       54    0       42     1     0     1     1     0     8    0
amappl10   144        2    0        0     1     0     1     1     0     8    0
amappl9    136      213    0      212     1     0     1     1     0     8    0
amappl8    128      199    0      198     1     0     1     1     0     8    0
amappl7    120       79    0       71     1     0     1     1     0     8    0
amappl6    112       11    0       11     2     2     0     1     0     8    0
amappl5    104      267    0      257     1     0     1     1     0     8    0
amappl4     96      417    0      389     1     0     1     1     0     8    0
amappl3     88       98    0       93     1     0     1     1     0     8    0
amappl2     80      705    0      657     3     1     2     2     0     8    1
amappl1     72    12692    0    12306    16     7     9    16     0     8    0
amappl      80      472    0      453     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      295    0      284     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      295    0      284     1     0     1     1     0     8    0
vmmpekpl   168     5411    0     5393     1     0     1     1     0     8    0
vmmpepl    168    27324    0    26579    55    19    36    48     0   357    3
vmsppl     272      294    0      284     1     0     1     1     0     8    0
pdppl      4096     596    0      568     5     0     5     5     0     8    0
pvpl        32    73176    0    70472    32     6    26    26     0   265    1
pmappl     200      294    0      284     1     0     1     1     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      161    0        8     5     0     5     5     0     8    0
ddb> 

Crashes (187):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/30 23:08 openbsd f16a14f22029 c8d1cc20 .config console log report syz C ci-openbsd-main
2020/03/30 22:50 openbsd f16a14f22029 c8d1cc20 .config console log report syz C ci-openbsd-setuid
2020/03/31 11:25 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-main
2020/03/31 10:18 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-main
2020/03/31 09:18 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 08:55 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 07:51 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-setuid
2020/03/31 07:33 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 06:29 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 06:07 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 05:04 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 04:37 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 03:37 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 02:38 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 01:38 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-main
2020/03/31 01:12 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 00:12 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-setuid
2020/03/31 00:09 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 00:03 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/31 00:03 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:59 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-setuid
2020/03/30 23:57 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-main
2020/03/30 23:57 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:57 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-main
2020/03/30 23:48 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-setuid
2020/03/30 23:47 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:46 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-setuid
2020/03/30 23:37 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-setuid
2020/03/30 23:29 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-main
2020/03/30 23:28 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:23 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:19 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-main
2020/03/30 23:18 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:18 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:18 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:09 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:02 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:01 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 23:00 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 22:58 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 22:57 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 22:56 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 22:55 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 22:54 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-multicore
2020/03/30 22:50 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-main
2020/03/30 22:30 openbsd f16a14f22029 c8d1cc20 .config console log report ci-openbsd-setuid
* Struck through repros no longer work on HEAD.