syzbot


panic: attempt to execute user address

Status: fixed on 2020/01/02 21:14
Reported-by: syzbot+f4d4aec9f19c0970b666@syzkaller.appspotmail.com
Fix commit: f30ff743e528 Fix some races in kqueue_register().
First crash: 1158d, last: 1064d
duplicates (4):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
panic: attempt to execute user address 0x1 in supervisor mode 1 1166d 1166d 0/3 closed as dup on 2019/09/27 06:52
panic: attempt to execute user address 0xf7 in supervisor mode 1 1158d 1158d 0/3 closed as dup on 2019/09/27 06:52
panic: attempt to execute user address 0x0 in supervisor mode 426 1158d 1173d 0/3 closed as dup on 2019/09/27 06:52
panic: attempt to execute user address 0x0 in supervipasnoirc: mokdeern 1 1152d 1152d 0/3 closed as dup on 2019/10/02 12:47
Patch testing requests:
Created Duration User Patch Repo Result
2019/12/30 08:55 17m anton@basename.se https://github.com/mptre/openbsd-src kqueue OK

Sample crash report:
login: panic: attempt to execute user address 0x0 in supervisor mode
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 78903  53434      0           0  0x4000000    0K syz-executor.1
 497310  50793      0         0x2  0x4000000    1  syz-execprog
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff82234bff) at panic+0x15c sys/kern/subr_prf.c:207
pageflttrap(ffff800020ba30f0,0) at pageflttrap+0x40b
kerntrap(ffff800020ba30f0) at kerntrap+0xec sys/arch/amd64/amd64/trap.c:287
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
0(fffffd806e8dddd0,ffff800020ba3300,ffff800020aa1650,fffffd806e8dddd0,14ccc39b3c4cf773,7) at 0
sys_kevent(ffff800020aa1650,ffff800020ba3408,ffff800020ba3450) at sys_kevent+0x2b1 sys/kern/kern_event.c:522
syscall(ffff800020ba34d0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800020ba34d0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x41a98097c90, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
attempt to execute user address 0x0 in supervisor mode
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff82234bff) at panic+0x15c sys/kern/subr_prf.c:207
pageflttrap(ffff800020ba30f0,0) at pageflttrap+0x40b
kerntrap(ffff800020ba30f0) at kerntrap+0xec sys/arch/amd64/amd64/trap.c:287
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
0(fffffd806e8dddd0,ffff800020ba3300,ffff800020aa1650,fffffd806e8dddd0,14ccc39b3c4cf773,7) at 0
sys_kevent(ffff800020aa1650,ffff800020ba3408,ffff800020ba3450) at sys_kevent+0x2b1 sys/kern/kern_event.c:522
syscall(ffff800020ba34d0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800020ba34d0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x41a98097c90, count: -9
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020ba2f60
rbx               0xffff800020ba3010
rdx                             0x8b
rcx                              0x2
rax                              0x1
r8                0xffffffff8191fd6f    kprintf+0x16f
r9                               0x1
r10               0x6cb278c79a1c6b59
r11               0x908d8312e7c6a85f
r12                     0x3000000008
r13               0xffff800020ba2f70
r14                            0x100
r15                              0x1
rip               0xffffffff81e12998    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020ba2f50
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor.1) pid=78903 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=61, usrpri=61, nice=20
    forw=0xffffffffffffffff, list=0xffff800020aa1160,0xffffffff826177f8
    process=0xffff800020aa2aa8 user=0xffff800020b9e000, vmspace=0xfffffd807efff730
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{0}> 

Crashes (1539):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-setuid 2019/12/30 01:30 openbsd e0fb840d78df af6b8ef8 .config log report syz
ci-openbsd-setuid 2019/12/30 01:11 openbsd e0fb840d78df af6b8ef8 .config log report
ci-openbsd-main 2019/12/28 08:09 openbsd 32c195e0069f be5c2c81 .config log report
ci-openbsd-multicore 2019/12/10 05:24 openbsd 902569092a77 4b83c8fb .config log report
ci-openbsd-multicore 2019/11/28 08:49 openbsd 258e938fc1ef 861a5980 .config log report
ci-openbsd-multicore 2019/11/23 23:23 openbsd 254679ff52b1 598ca6c8 .config log report
ci-openbsd-multicore 2019/11/07 23:09 openbsd b50d7ae0ca56 efb49b4d .config log report
ci-openbsd-multicore 2019/11/07 21:36 openbsd b50d7ae0ca56 efb49b4d .config log report
ci-openbsd-main 2019/11/07 16:54 openbsd b50d7ae0ca56 efb49b4d .config log report
ci-openbsd-multicore 2019/11/07 12:51 openbsd b50d7ae0ca56 efb49b4d .config log report
ci-openbsd-multicore 2019/11/07 09:08 openbsd 36a555e043b4 d797d201 .config log report
ci-openbsd-multicore 2019/11/07 06:57 openbsd 36a555e043b4 d797d201 .config log report
ci-openbsd-multicore 2019/11/07 03:42 openbsd 36a555e043b4 d797d201 .config log report
ci-openbsd-multicore 2019/11/06 22:45 openbsd 71d558da6271 da505f84 .config log report
ci-openbsd-multicore 2019/11/06 16:12 openbsd 71d558da6271 da505f84 .config log report
ci-openbsd-multicore 2019/11/06 13:44 openbsd 71d558da6271 da505f84 .config log report
ci-openbsd-multicore 2019/11/06 12:02 openbsd 38dc29e6b4c8 bc2c6e45 .config log report
ci-openbsd-multicore 2019/11/06 10:41 openbsd 38dc29e6b4c8 bc2c6e45 .config log report
ci-openbsd-multicore 2019/11/06 08:25 openbsd 38dc29e6b4c8 bc2c6e45 .config log report
ci-openbsd-multicore 2019/11/06 07:04 openbsd 38dc29e6b4c8 bc2c6e45 .config log report
ci-openbsd-multicore 2019/11/06 05:34 openbsd 38dc29e6b4c8 bc2c6e45 .config log report
ci-openbsd-multicore 2019/11/06 04:12 openbsd 38dc29e6b4c8 bc2c6e45 .config log report
ci-openbsd-multicore 2019/11/06 01:58 openbsd 38dc29e6b4c8 bc2c6e45 .config log report
ci-openbsd-multicore 2019/11/05 20:15 openbsd 1f857ec20594 0f3ec414 .config log report
ci-openbsd-main 2019/11/04 22:42 openbsd 8e2343b4ffae 18e12644 .config log report
ci-openbsd-main 2019/11/04 14:49 openbsd 8e2343b4ffae 18e12644 .config log report
ci-openbsd-main 2019/11/04 11:00 openbsd 8e2343b4ffae b35fad31 .config log report
ci-openbsd-multicore 2019/11/03 18:05 openbsd 67038345843e c9610487 .config log report
ci-openbsd-multicore 2019/11/03 15:11 openbsd 67038345843e c9610487 .config log report
ci-openbsd-multicore 2019/11/03 06:25 openbsd 001c308cab42 d603afc9 .config log report
ci-openbsd-main 2019/11/03 02:48 openbsd 001c308cab42 d603afc9 .config log report
ci-openbsd-multicore 2019/11/02 19:20 openbsd d9601055ff2c 997ccc67 .config log report
ci-openbsd-multicore 2019/11/02 18:10 openbsd d9601055ff2c 997ccc67 .config log report
ci-openbsd-multicore 2019/11/02 12:52 openbsd d9601055ff2c 997ccc67 .config log report
ci-openbsd-main 2019/11/02 08:59 openbsd d9601055ff2c 997ccc67 .config log report
ci-openbsd-multicore 2019/11/02 06:42 openbsd c2600de8aa52 997ccc67 .config log report
ci-openbsd-multicore 2019/11/02 05:17 openbsd c2600de8aa52 997ccc67 .config log report
ci-openbsd-main 2019/11/01 23:18 openbsd 21c01296238d 997ccc67 .config log report
ci-openbsd-multicore 2019/11/01 18:53 openbsd c2600de8aa52 997ccc67 .config log report
ci-openbsd-multicore 2019/11/01 14:46 openbsd c2600de8aa52 a41ca8fa .config log report
ci-openbsd-main 2019/11/01 12:26 openbsd 21c01296238d a41ca8fa .config log report
ci-openbsd-multicore 2019/11/01 06:45 openbsd 18a730e69630 a41ca8fa .config log report
ci-openbsd-multicore 2019/11/01 01:46 openbsd 18a730e69630 a41ca8fa .config log report
ci-openbsd-main 2019/11/01 00:08 openbsd e3a62e69c833 a41ca8fa .config log report
ci-openbsd-multicore 2019/10/31 22:16 openbsd 6f77cf22e25c a41ca8fa .config log report
ci-openbsd-multicore 2019/10/31 21:02 openbsd 6f77cf22e25c a41ca8fa .config log report
ci-openbsd-multicore 2019/10/31 19:53 openbsd 6f77cf22e25c a41ca8fa .config log report
ci-openbsd-multicore 2019/10/31 17:24 openbsd 6f77cf22e25c a41ca8fa .config log report
ci-openbsd-multicore 2019/10/31 15:38 openbsd 6f77cf22e25c a41ca8fa .config log report
ci-openbsd-multicore 2019/10/31 14:06 openbsd 6f77cf22e25c a41ca8fa .config log report
ci-openbsd-main 2019/09/26 20:11 openbsd 7a2afd89bbfb 2f1548bc .config log report
* Struck through repros no longer work on HEAD.