syzbot


protection_fault: lf_advlock

Status: fixed on 2022/04/28 05:27
Reported-by: syzbot+a2649c1d77e9d2463f33@syzkaller.appspotmail.com
Fix commit: c30ab30fe47b Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
First crash: 309d, last: 265d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: lf_advlock (2) 4 165d 213d 0/3 auto-obsoleted due to no activity on 2022/09/18 14:20

Sample crash report:
login: kernel: protection fault trap, code=0
Stopped at      lf_advlock+0x21f:       addl    $0x1,0x28(%rbx)
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
lf_advlock(ffff800000bcf0e0,0,fffffd806d5bf1f0,2,ffff8000212044c0,40) at lf_advlock+0x21f ls_ref sys/kern/vfs_lockf.c:140 [inline]
lf_advlock(ffff800000bcf0e0,0,fffffd806d5bf1f0,2,ffff8000212044c0,40) at lf_advlock+0x21f sys/kern/vfs_lockf.c:281
VOP_ADVLOCK(fffffd806caccb68,fffffd806d5bf1f0,2,ffff8000212044c0,40) at VOP_ADVLOCK+0x71 sys/kern/vfs_vops.c:628
closef(fffffd8075a19988,ffff800021192000) at closef+0xe5
syscall(ffff8000212045f0) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff8000212045f0) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe8490, count: -5
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff800021204410
rbx               0xdeaf4152deaf4152
rdx                              0x6
rcx                              0x5
rax                                0
r8                0xffff8000212044c0
r9                              0x40
r10                                0
r11               0xe3fde0640d4885cd
r12                              0x2
r13               0xffffffffffffffff
r14               0xffff800000bcf0e0
r15                                0
rip               0xffffffff81744def    lf_advlock+0x21f
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800021204380
ss                              0x10
lf_advlock+0x21f:       addl    $0x1,0x28(%rbx)
ddb{0}> show proc
PROC (syz-executor3824244753) pid=32750 stat=onproc
    flags process=0 proc=0
    pri=50, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800021192540,0xffff800021193cf0
    process=0xffff8000211f7620 user=0xffff8000211ff000, vmspace=0xfffffd8070acdb90
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 18628   35920  99008      0  3           0  lockflk       syz-executor3824244753
 81509   29344  89458      0  3           0  lockflk       syz-executor3824244753
 99232  196077  84468      0  3           0  lockflk       syz-executor3824244753
*26172   32750  56548      0  7           0                syz-executor3824244753
  5151  186564  48998      0  3        0x80  nanoslp       syz-executor3824244753
 82521  512317  48998      0  3        0x80  nanoslp       syz-executor3824244753
 37342  391057  48998      0  3        0x80  nanoslp       syz-executor3824244753
 85199   52638  48998      0  3        0x80  nanoslp       syz-executor3824244753
 56548   90145  48998      0  3        0x80  nanoslp       syz-executor3824244753
 84468   10416  48998      0  3        0x80  nanoslp       syz-executor3824244753
 99008  497388  48998      0  3        0x80  nanoslp       syz-executor3824244753
 89458  298492  48998      0  3        0x80  nanoslp       syz-executor3824244753
 48998  215837  96802      0  3        0x82  nanoslp       syz-executor3824244753
 96802  349695  92859      0  3    0x10008a  sigsusp       ksh
 92859  446585   2168      0  3        0x9a  kqread        sshd
 96558  428914      1      0  3    0x100083  ttyin         getty
  2168  465351      1      0  3        0x88  kqread        sshd
 21763  521931  36152     74  3   0x1100092  bpf           pflogd
 36152  121026      1      0  3        0x80  netio         pflogd
 16251  374712  84715     73  3   0x1100090  kqread        syslogd
 84715    6513      1      0  3    0x100082  netio         syslogd
 29116  345551      1      0  3    0x100080  kqread        resolvd
 91223   64900   2224     77  3    0x100092  kqread        dhcpleased
 14449   20130   2224     77  3    0x100092  kqread        dhcpleased
  2224  341632      1      0  3        0x80  kqread        dhcpleased
  1541  109059      0      0  3     0x14200  bored         smr
 73141  508431      0      0  3     0x14200  pgzero        zerothread
 19358  228342      0      0  3     0x14200  aiodoned      aiodoned
 56414  387776      0      0  3     0x14200  syncer        update
 45416  331533      0      0  3     0x14200  cleaner       cleaner
 65310  121593      0      0  3     0x14200  reaper        reaper
 98804    2362      0      0  3     0x14200  pgdaemon      pagedaemon
 75534  166076      0      0  3     0x14200  bored         viomb
 12650  218557      0      0  3  0x40014200  acpi0         acpi0
 21840  445146      0      0  7  0x40014200                idle1
 87651  438606      0      0  3     0x14200  bored         softnet
 29279  489971      0      0  3     0x14200  bored         systqmp
 15528  467937      0      0  3     0x14200  bored         systq
 14096  377589      0      0  3  0x40014200  bored         softclock
 57035  292852      0      0  3  0x40014200                idle0
     1  511746      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 26172 (syz-executor3824244753) thread 0xffff800021192000 (32750)
exclusive rwlock lockflk r = 0 (0xffffffff8291bb40)
#0  witness_lock+0x44d
#1  lf_advlock+0x189 sys/kern/vfs_lockf.c:263
#2  VOP_ADVLOCK+0x71 sys/kern/vfs_vops.c:628
#3  closef+0xe5
#4  syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#4  syscall+0x489 sys/arch/amd64/amd64/trap.c:585
#5  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10161   6456K    6478K  78643K    180684        0
            pcb    13      8K       8K  78643K        13        0
         rtable    62      2K       2K  78643K       112        0
         ifaddr    29      8K       8K  78643K        32        0
       counters    40     33K      33K  78643K        40        0
       ioctlops     0      0K       4K  78643K      1479        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         5        0
         vnodes  1171     73K      73K  78643K    254399        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      1K       1K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc     4      6K      17K  78643K    508309        0
           proc    67     87K      87K  78643K       282        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    97    440K     440K  78643K        97        0
           exec     0      0K       2K  78643K       432        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    95      5K       5K  78643K    171698        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     4      0K       0K  78643K         4        0
           temp    24   4690K    4753K  78643K    172778        0
         kqueue    11     16K      18K  78643K        24        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120       17    0       14     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      136       35    0       20     1     0     1     1     0     8    0
syncache   296        5    0        5     2     2     0     1     0     8    0
tcpcb      736        8    0        5     1     0     1     1     0     8    0
arp        120        2    0        0     1     0     1     1     0     8    0
inpcb      304       32    0       26     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24        8    0        7     2     1     1     1     0     8    0
pfstkey    112        8    0        7     2     1     1     1     0     8    0
pfstate    320        8    0        7     2     1     1     1     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       97    0        0     7     0     7     7     0     8    0
art_table   32       98    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256    85210    0    83826    87     0    87    87     0     8    0
ffsino     272    85210    0    83826    93     0    93    93     0     8    0
nchpl      144    85385    0    83835    58     0    58    58     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     224     5926    0        0   349     0   349   349     0     8    0
namei      1024 2376511    0  2376511     2     1     1     1     0     8    1
percpumem   16       32    0        0     1     0     1     1     0     8    0
scxspl     216     4234    0     4234    76    75     1     8     0     8    1
plimitpl   152       16    0        9     1     0     1     1     0     8    0
sigapl     424   169765    0   169720     6     0     6     6     0     8    0
knotepl    120       56    0        0     2     0     2     2     0     8    0
kqueuepl   216       20    0       13     1     0     1     1     0     8    0
pipepl     336       86    0       83     2     1     1     1     0     8    0
fdescpl    496   169751    0   169724     4     0     4     4     0     8    0
filepl     152  1864929    0  1864859     4     0     4     4     0     8    1
lockfpl    104   318975    0   318973     1     0     1     1     0     8    0
lockfspl    48   161044    0   161042     1     0     1     1     0     8    0
sessionpl  144       18    0        9     1     0     1     1     0     8    0
pgrppl      48       18    0        9     1     0     1     1     0     8    0
ucredpl     96  1524986    0  1524974     1     0     1     1     0     8    0
zombiepl   144   169724    0   169720     2     1     1     1     0     8    0
processpl  1064  169765    0   169720     4     0     4     4     0     8    0
procpl     672   169765    0   169720     4     0     4     4     0     8    0
sockpl     480       84    0       60     5     1     4     4     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096       3    0        0     1     0     1     1     0     8    0
mcl2k      2048      68    0        0     9     1     8     8     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      134    0        0     7     0     7     7     0     8    0
bufpl      288     2014    0       93   138     0   138   138     0     8    0
anonpl      24  1058003    0  1055650    17     2    15    17     0   186    0
amapchunkpl 152  173428    0   173272     8     1     7     8     0   158    0
amappl16   200   169465    0   169462     2     1     1     1     0     8    0
amappl15   192       67    0       64     1     0     1     1     0     8    0
amappl14   184        2    0        1     1     0     1     1     0     8    0
amappl13   176       35    0       34     2     1     1     1     0     8    0
amappl12   168        9    0        9     2     2     0     1     0     8    0
amappl11   160       48    0       34     1     0     1     1     0     8    0
amappl10   152        4    0        2     1     0     1     1     0     8    0
amappl9    144      450    0      448     1     0     1     1     0     8    0
amappl8    136      370    0      367     1     0     1     1     0     8    0
amappl7    128       65    0       62     1     0     1     1     0     8    0
amappl6    120      115    0      102     1     0     1     1     0     8    0
amappl5    112   169628    0   169607     1     0     1     1     0     8    0
amappl4    104      641    0      620     1     0     1     1     0     8    0
amappl3     96      121    0      112     1     0     1     1     0     8    0
amappl2     88      370    0      332     1     0     1     1     0     8    0
amappl1     80   686594    0   686196    10     1     9    10     0     8    0
amappl      88   171417    0   171340     2     0     2     2     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24   169751    0   169724     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24   169751    0   169724     1     0     1     1     0     8    0
vmmpekpl   168   387547    0   387530     1     0     1     1     0     8    0
vmmpepl    168  2737693    0  2736666    89    44    45    48     0   357    0
vmsppl     368   169750    0   169724     3     0     3     3     0     8    0
rwobjpl     56   183523    0   177035    92     0    92    92     0     8    0
pdppl      4096  339509    0   339448   199   138    61    69     0     8    0
pvpl        32  4718211    0  4713850    43     6    37    43     0   265    0
pmappl     248   169750    0   169724     2     0     2     2     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112      559    0      144    13     0    13    13     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
lf_advlock(ffff800000bcf0e0,0,fffffd806d5bf1f0,2,ffff8000212044c0,40) at lf_advlock+0x21f ls_ref sys/kern/vfs_lockf.c:140 [inline]
lf_advlock(ffff800000bcf0e0,0,fffffd806d5bf1f0,2,ffff8000212044c0,40) at lf_advlock+0x21f sys/kern/vfs_lockf.c:281
VOP_ADVLOCK(fffffd806caccb68,fffffd806d5bf1f0,2,ffff8000212044c0,40) at VOP_ADVLOCK+0x71 sys/kern/vfs_vops.c:628
closef(fffffd8075a19988,ffff800021192000) at closef+0xe5
syscall(ffff8000212045f0) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff8000212045f0) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe8490, count: -5
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff800020ce8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
acpicpu_idle() at acpicpu_idle+0x312 sys/dev/acpi/acpicpu.c:1206
sched_idle(ffff800020ce8ff0) at sched_idle+0x417 sys/kern/kern_sched.c:178
end trace frame: 0x0, count: -5

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2022/03/13 00:31 openbsd 447db83cf4f0 9e8eaa75 .config log report syz C protection_fault: lf_advlock
ci-openbsd-setuid 2022/01/27 11:06 openbsd ff683e69af4a 2cbffd88 .config log report protection_fault: lf_advlock
* Struck through repros no longer work on HEAD.