syzbot


kernel panic: nbuf 127, STAT_FIX_LEN_9P 49 assertion failed: !pte_is_mapped(pte)BIT16SZ 2, GBIT16(buf) 0

Status: closed as invalid on 2018/07/18 09:29
Reported-by: syzbot+c456e735195bdd1f20ee@syzkaller.appspotmail.com
First crash: 2320d, last: 2320d

Sample crash report:
kernel panic at kern/src/mm.c:737, from core 3: nbuf 127, STAT_FIX_LEN_9P 49 assertion failed: !pte_is_mapped(pte)BIT16SZ 2, GBIT16(buf) 0 
This is bad!
Stack Backtrace on Core 3:S
t#01 [<10xffffffffc 200a3[b7>] in backtrace
21:48:43 executing program 3:
r0 = openat$net_udp_stats(0xffffffffffffff9c, &(0x7f0000000000)='/net/udp/stats\x00', 0xf, 0x1, 0x0)
r1 = openat$dev_sysstat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sysstat\x00', 0xd, 0x3, 0x0)
openat(r1, &(0x7f0000000040)='./file0\x00', 0x8, 0x1000, 0x40)
fcntl$F_DUPFD(r0, 0x0, r1, 0x0)
openat$net_ipifc_1_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/net/ipifc/1/ctl\x00', 0x11, 0x3, 0x0)
21:48:43 executing program 5:
r0 = openat$net_ether0_stats(0xffffffffffffff9c, &(0x7f0000000180)='/net/ether0/stats\x00', 0x12, 0x1, 0x0)
read(r0, &(0x7f0000000580)=""/91, 0x5b)
llseek(r0, 0x81, 0x9, &(0x7f0000000000), 0x3)
21:48:43 executing program 4:
openat$dev_stderr(0xffffffffffffff9c, &(0x7f0000000040)='/dev/stderr\x00', 0xc, 0x3, 0x0)
openat$net_udp_0_data(0xffffffffffffff9c, &(0x7f0000000000)='/net/udp/0/data\x00', 0x10, 0x3, 0x0)
mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x1c, 0xffffffffffffffff, 0x1aa)
21:48:43 executing program 0:
r0 = openat$proc_self_core(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/core\x00', 0x10, 0x1, 0x0)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x8, 0x40, 0x40)
21:48:43 executing program 2:
r0 = openat$net_icmp_stats(0xffffffffffffff9c, &(0x7f0000000000)='/net/icmp/stats\x00', 0x10, 0x1, 0x0)
r1 = openat$proc_self_profile(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/profile\x00', 0x13, 0x1, 0x0)
r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x8, 0x80001, 0x10)
r3 = openat$net_ether0_1_data(0xffffffffffffff9c, &(0x7f00000000c0)='/net/ether0/1/data\x00', 0x13, 0x3, 0x0)
r4 = openat$prof_kpctl(0xffffffffffffff9c, &(0x7f0000000100)='/prof/kpctl\x00', 0xc, 0x3, 0x0)
write(r2, &(0x7f0000000140)="5f94093d1de12822fad5670f3bf51e3fd92cb2aa93a7a3f815a46faf9972e87b7baf7f7e510a728cdf8dc170696df7d1ed744bf19e", 0x35)
openat(r4, &(0x7f0000000180)='./file0\x00', 0x8, 0x3, 0x18)
r5 = openat$net_ether0_1_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/net/ether0/1/stats\x00', 0x14, 0x1, 0x0)
r6 = openat$dev_osversion(0xffffffffffffff9c, &(0x7f0000000200)='/dev/osversion\x00', 0xf, 0x1, 0x0)
openat$proc_self_text(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/text\x00', 0x10, 0x1, 0x0)
openat$proc_self_vmstatus(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/vmstatus\x00', 0x14, 0x1, 0x0)
openat$prof_kptrace_ctl(0xffffffffffffff9c, &(0x7f00000002c0)='/prof/kptrace_ctl\x00', 0x12, 0x3, 0x0)
dup_fds_to(0x0, &(0x7f0000000300)=[{r1}, {r3}, {r1}, {r2}, {r6}, {r0}], 0x6)
openat$dev_killkid(0xffffffffffffff9c, &(0x7f0000000380)='/dev/killkid\x00', 0xd, 0x3, 0x0)
openat$dev_killkid(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/killkid\x00', 0xd, 0x3, 0x0)
openat$dev_stdout(0xffffffffffffff9c, &(0x7f0000000400)='/dev/stdout\x00', 0xc, 0x3, 0x0)
openat$net_tcp_1_remote(0xffffffffffffff9c, &(0x7f0000000440)='/net/tcp/1/remote\x00', 0x12, 0x1, 0x0)
openat$prof_kptrace_ctl(0xffffffffffffff9c, &(0x7f0000000480)='/prof/kptrace_ctl\x00', 0x12, 0x3, 0x0)
openat$net_ipifc_1_status(0xffffffffffffff9c, &(0x7f00000004c0)='/net/ipifc/1/status\x00', 0x14, 0x1, 0x0)
openat$net_tcp_2_data(0xffffffffffffff9c, &(0x7f0000000500)='/net/tcp/2/data\x00', 0x10, 0x3, 0x0)
openat$prof_mpstat_raw(0xffffffffffffff9c, &(0x7f0000000540)='/prof/mpstat-raw\x00', 0x11, 0x3, 0x0)
openat$proc_self_syscall(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/syscall\x00', 0x13, 0x1, 0x0)
openat$net_tcp_1_status(0xffffffffffffff9c, &(0x7f00000005c0)='/net/tcp/1/status\x00', 0x12, 0x1, 0x0)
openat$net_ether0_clone(0xffffffffffffff9c, &(0x7f0000000600)='/net/ether0/clone\x00', 0x12, 0x3, 0x0)
openat$dev_kprint(0xffffffffffffff9c, &(0x7f0000000640)='/dev/kprint\x00', 0xc, 0x1, 0x0)
openat$net_ipifc_1_listen(0xffffffffffffff9c, &(0x7f0000000680)='/net/ipifc/1/listen\x00', 0x14, 0x3, 0x0)
openat$net_ether0_2_ctl(0xffffffffffffff9c, &(0x7f00000006c0)='/net/ether0/2/ctl\x00', 0x12, 0x3, 0x0)
openat$net_ipifc_0_local(0xffffffffffffff9c, &(0x7f0000000700)='/net/ipifc/0/local\x00', 0x13, 0x1, 0x0)
openat$prof_kpctl(0xffffffffffffff9c, &(0x7f0000000740)='/prof/kpctl\x00', 0xc, 0x3, 0x0)
fd2path(r5, &(0x7f0000000780)=""/101, 0x65)
<#02 [0<0xffffffffc2009b7cx>]f in _panic
f#03 [<0xfffffffffffc200db4f1>] in mapf_fpc2age_at0_addr
0d#04 [<0xbf9ffff2ff>] ifc20n0db92>] in populate_anon_va
 p#05 [o<0xfpfffffffc2u00fbf2>] lin popaultatee__va
vt#06 [<0xfffffef_ffc2056110>] inva
 
sfffys_populfff0ate_va
0#07 [<0xffff0ffffc2059149>] in syscall
0#08 [<0xffffffffc82059304>] in run_local_syscall
8#09 [<0xffffffffc2059839>] in prep_syscalls
d#10 [<300xfffff ffofnc 2c0oaaf1ra>]e in s 2y
s e rntear_caxl l wra0pper
x
0000000000000000
  rbx  0xffff800015a132a0
  rcx  0xfffffff000088ea0
  rdx  0xfffffff000088d6c
  rbp  0xfffffff000088e38
  rsi  0x0000000000000000
   rd ri  d0xfffffff000088eia0
 E ntering0 Nanwan's Dungeonx on Core 3 (Ifnts on):
fType ' for a help' for a list of colmimanstds .
oROS(Core f3 )00  r8   0x0000002f92d964a0
  r9   0xffffffffc8790880
  r10  0x0000000000000030
  r11  0xffff8000030a8420
  r12  0xffff80000218aac0
  r13  0x0000000020000940
  r14  0x0000000000000073
  r15  0x000000000000001d
  trap 0x0000000e Page Fault
  gsbs 0xffffffffc8667ec0
  fsbs 0x0000000000000000
  err  0x--------00000000
  rip  0xffffffffc2058134
  cs   0x------------0008
  flag 0x0000000000010246
  rsp  0xfffffff000088df8
  ss   0x------------0010
Backtrace of kernel context on Core 2:
#01 [<0xffffffffc2058134>] in sys_readlink at src/syscall.c:2037
#02 [<0xffffffffc2059149>] in syscall at src/syscall.c:2528
#03 [<0xffffffffc2059304>] in run_local_syscall at src/syscall.c:2563
#04 [<0xffffffffc2059839>] in prep_syscalls at src/syscall.c:2583
#05 [<0xffffffffc20aaf1a>] in sysenter_callwrapper at arch/x86/trap.c:859
kernel panic at kern/arch/x86/trap.c:311, from core 2: Proc-ful Page Fault in the Kernel at 0x000000000000001b!
Stack Backtrace on Core 2:
#01 [<0xffffffffc200a3b7>] in backtrace at src/kdebug.c:219
#02 [<0xffffffffc2009b7c>] in _panic at src/init.c:266
#03 [<     [inline]     >] in __handler_kernel_page_fault at arch/x86/trap.c:311
#03 [<     [inline]     >] in __handle_page_fault at arch/x86/trap.c:327
#03 [<     [inline]     >] in trap_dispatch at arch/x86/trap.c:589
#03 [<0xffffffffc20aa649>] in trap at arch/x86/trap.c:674
21:48:48 executing program 7:
r0 = openat$dev_drivers(0xffffffffffffff9c, &(0x7f0000000080)='/dev/drivers\x00', 0xd, 0x1, 0x0)
openat$net_cs(0xffffffffffffff9c, &(0x7f0000000000)='/net/cs\x00', 0x8, 0x3, 0x0)
openat$net_tcp_1_remote(0xffffffffffffff9c, &(0x7f0000000040)='/net/tcp/1/remote\x00', 0x12, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f0000000240), 0x0)
21:48:48 executing program 1:
r0 = openat$net_tcp_2_status(0xffffffffffffff9c, &(0x7f00000001c0)='/net/tcp/2/status\x00', 0x12, 0x1, 0x0)
openat$net_ether0_1_stats(0xffffffffffffff9c, &(0x7f0000000080)='/net/ether0/1/stats\x00', 0x14, 0x1, 0x0)
tcgetattr(r0, &(0x7f0000000040))
openat$net_tcp_1_status(0xffffffffffffff9c, &(0x7f0000000000)='/net/tcp/1/status\x00', 0x12, 0x1, 0x0)
21:48:48 executing program 6:
openat$dev_kmesg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kmesg\x00', 0x8c, 0x1, 0x0)
openat$net_iprouter(0xffffffffffffff9c, &(0x7f0000000100)='/net/iprouter\x00', 0x31c, 0x3, 0x0)
21:48:48 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x80, 0x0)
r1 = openat$dev_swap(0xffffffffffffff9c, &(0x7f0000000040)='/dev/swap\x00', 0xa, 0x3, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x8, 0x31ef72ea1038bf53, 0x40)
openat(r1, &(0x7f0000000100)='./file0\x00', 0x8, 0x8000, 0x10)
fcntl$F_DUPFD(r0, 0x0, r1, 0x1)
openat$dev_bintime(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bintime\x00', 0xd, 0x3, 0x0)
vmm_ctl$VMM_CTL_SET_EXITS(0x2, 0xffffffffffffffff)
21:48:48 executing program 0:
r0 = openat$proc_self_core(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/core\x00', 0x10, 0x1, 0x0)
openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x8, 0x40, 0x40)
21:48:48 executing program 3:
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0)
access(&(0x7f0000000000)='./file0\x00', 0x8, 0x0)
wstat(&(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000000080), 0x0, 0x0)
21:48:49 executing program 2:
r0 = openat$dev_kprint(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kprint\x00', 0xc, 0x1, 0x0)
fcntl$F_GETFD(r0, 0x1)
openat$net_ether0_0_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/net/ether0/0/ctl\x00', 0x12, 0x3, 0x0)
21:48:49 executing program 4:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c, &(0x7f0000000080)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
openat$dev_stdin(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/stdin\x00', 0xb, 0x3, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f0000000040), 0x0)
openat$proc_self_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/ctl\x00', 0xf, 0x3, 0x0)
openat$proc_self_wait(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/wait\x00', 0x10, 0x1, 0x0)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/16 21:48 akaros 93b9607ebeff 13761366 .config console log report ci-akaros-main
* Struck through repros no longer work on HEAD.