syzbot


kernel: protection fault trap, code=NUM (6)

Status: upstream: reported on 2022/11/10 22:10
Reported-by: syzbot+8eba244a293b9b0a46a3@syzkaller.appspotmail.com
First crash: 80d, last: 12d
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd kernel: protection fault trap, code=NUM (3) 1 314d 314d 0/3 closed as invalid on 2022/03/22 11:48
openbsd kernel: protection fault trap, code=NUM (5) 2 154d 155d 0/3 closed as dup on 2022/08/29 15:02
openbsd kernel: protection fault trap, code=NUM (2) C 16 396d 419d 0/3 closed as invalid on 2021/12/31 06:19
openbsd kernel: protection fault trap, code=NUM 1 499d 499d 0/3 closed as invalid on 2021/09/18 05:58
openbsd kernel: protection fault trap, code=NUM (4) 1 277d 277d 0/3 closed as invalid on 2022/04/28 06:52

Sample crash report:
kernel: protection fault trap, code=0
Faulted in DDB; continuing...
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10226   6413K    6421K  78643K     11345        0
            pcb    13     16K      18K  78643K        19        0
         rtable   236      6K       7K  78643K       781        0
         ifaddr    73     24K      24K  78643K       131        0
         sysctl     1      1K       1K  78643K         1        0
       counters    60     35K      35K  78643K        78        0
       ioctlops     0      0K       2K  78643K        49        0
            iov     0      0K      16K  78643K       875        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1286     80K      80K  78643K      1988        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K        46        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       0K  78643K      1083        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    24     89K     117K  78643K      2907        0
          sigio     0      0K       0K  78643K         6        0
           proc    59     91K     103K  78643K       849        0
        subproc   117      7K       7K  78643K       221        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       149        0
       in_multi    99      6K       6K  78643K       217        0
    ether_multi     1      0K       0K  78643K         9        0
            mrt     2      0K       0K  78643K         2        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   229   1023K    1023K  78643K       229        0
           exec     0      0K       1K  78643K       755        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   335     99K     108K  78643K     22047        0
       UVM aobj   131      4K       4K  78643K       131        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        90        0
            NDP    11      0K       2K  78643K        54        0
           temp   128   5774K    5842K  78643K     11153        0
         kqueue    12     18K      26K  78643K       314        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120      809    0      805    11    10     1     3     0     8    0
rtentry    112      213    0      102     4     0     4     4     0     8    0
unpcb      144     2074    0     2059    24    21     3     6     0     8    2
syncache   296       55    0       55     8     7     1     1     0     8    1
tcpqe       32       47    0       47     6     5     1     1     0     8    1
tcpcb      776     4976    0     4966    70    60    10    18     0     8    8
arp        120       37    0       19     1     0     1     1     0     8    0
ipq         40        5    0        5     3     3     0     1     0     8    0
ipqe        40       17    0       17     3     3     0     1     0     8    0
inpcb      368     7677    0     7664    99    87    12    23     0     8    8
ip6q        72        3    0        3     1     1     0     1     0     8    0
ip6af       40        9    0        9     1     1     0     1     0     8    0
nd6         48       53    0       28     1     0     1     1     0     8    0
kcovpl      48       17    0        8     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      863    0      405    29     0    29    29     0     8    0
art_table   32      864    0      405     4     0     4     4     0     8    0
art_node    16      212    0      111     1     0     1     1     0     8    0
semapl     112     1081    0     1071     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     5167    0     3727    91     0    91    91     0     8    0
ffsino     272     5168    0     3727    97     0    97    97     0     8    0
nchpl      144     9235    0     7599    63     0    63    63     0     8    0
uvmvnodes   80     5398    0        0   111     0   111   111     0     8    0
vnodes     216     5398    0        0   300     0   300   300     0     8    0
namei      1024   34607    0    34604     6     5     1     2     0     8    0
percpumem   16       52    0        9     1     0     1     1     0     8    0
kstatmem   264       40    0       18     2     0     2     2     0     8    0
scxspl     216    30362    0    30362    16    15     1     8     0     8    1
plimitpl   152      500    0      476    10     8     2     2     0     8    1
sigapl     424     3170    0     3117     7     0     7     7     0     8    0
futexpl     64    28096    0    28095     3     2     1     1     0     8    0
knotepl    120      341    0        0    10     0    10    10     0     8    0
kqueuepl   216      815    0      807    10     5     5     8     0     8    4
pipepl     320      999    0      968    28    19     9     9     0     8    6
fdescpl    496     3152    0     3117     7     1     6     6     0     8    0
filepl     152    26918    0    26663    63    45    18    25     0     8    7
lockfpl    104      235    0      233     1     0     1     1     0     8    0
lockfspl    48       68    0       66     1     0     1     1     0     8    0
sessionpl  144       32    0       15     1     0     1     1     0     8    0
pgrppl      48     1005    0      988     1     0     1     1     0     8    0
ucredpl    104     4032    0     4014     1     0     1     1     0     8    0
zombiepl   144     3118    0     3117     2     1     1     1     0     8    0
processpl  1072    3170    0     3117     5     1     4     5     0     8    0
procpl     696     8710    0     8639    11     2     9     9     0     8    0
srpgc       96        2    0        2     1     1     0     1     0     8    0
sosppl     168       51    0       51     7     6     1     1     0     8    1
sockpl     488    10753    0    10721   211   197    14    33     0     8    8
mcl64k     65536     17    0        0     3     0     3     3     0     8    0
mcl16k     16384     17    0        0     3     0     3     3     0     8    0
mcl12k     12288     18    0        0     2     0     2     2     0     8    0
mcl9k      9216      14    0        0     1     0     1     1     0     8    0
mcl8k      8192      17    0        0     3     1     2     3     0     8    0
mcl4k      4096      17    0        0     3     0     3     3     0     8    0
mcl2k2     2112       5    0        0     1     0     1     1     0     8    0
mcl2k      2048     324    0        0    38     3    35    38     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256     6999    0        0   434     0   434   434     0     8    0
bufpl      288     8633    0     2310   452     0   452   452     0     8    0
anonpl      24   669718    0   656067   140    42    98   120     0   186    0
amapchunkpl 152   62512    0    61755    60    25    35    45     0   158    2
amappl16   200     6832    0     6501    47    25    22    29     0     8    4
amappl15   192        7    0        7     1     1     0     1     0     8    0
amappl14   184      161    0      147     2     1     1     2     0     8    0
amappl13   176       10    0        9     1     0     1     1     0     8    0
amappl12   168      504    0      500     1     0     1     1     0     8    0
amappl11   160       51    0       40     1     0     1     1     0     8    0
amappl10   152       41    0       29     1     0     1     1     0     8    0
amappl9    144      973    0      973     3     2     1     1     0     8    1
amappl8    136      261    0      191     3     0     3     3     0     8    0
amappl7    128      175    0      149     2     0     2     2     0     8    0
amappl6    120      225    0      208     1     0     1     1     0     8    0
amappl5    112      207    0      200     1     0     1     1     0     8    0
amappl4    104      617    0      585     2     1     1     2     0     8    0
amappl3     96     9057    0     8999     3     1     2     3     0     8    0
amappl2     88     3649    0     3569     3     1     2     3     0     8    0
amappl1     80    74500    0    73722    22     3    19    22     0     8    0
amappl      88    21398    0    21186     6     0     6     6     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      130    0        0     3     0     3     3     0     8    0
uaddrrnd    24     3152    0     3117     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3152    0     3117     1     0     1     1     0     8    0
vmmpekpl   168    31998    0    31931     4     0     4     4     0     8    0
vmmpepl    168   298241    0   295491   183    42   141   143     0   357    6
vmsppl     368     3151    0     3117     4     0     4     4     0     8    0
rwobjpl     56    86091    0    79044   102     1   101   101     0     8    0
pdppl      4096    6311    0     6234   231   144    87    93     0     8   10
pvpl        32  1376156    0  1356340   353   171   182   252     0   265    6
pmappl     248     3151    0     3117     4     1     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1500    0      242    37     0    37    37     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffffffff82baaff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x68
savectx() at savectx+0xae
end of kernel
end trace frame: 0x7f7fffff08c0, count: 10
ddb{0}> trace
x86_ipi_db(ffffffff82baaff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x68
savectx() at savectx+0xae
end of kernel
end trace frame: 0x7f7fffff08c0, count: -5
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8273ecef) at panic+0x177 sys/kern/subr_prf.c:198
vop_generic_badop(ffff80002ca1f8f8) at vop_generic_badop+0x1b sys/kern/vfs_default.c:133
VOP_STRATEGY(fffffd8066ef8000,fffffd805a571388) at VOP_STRATEGY+0x9b sys/kern/vfs_vops.c:628
bwrite(fffffd805a571388) at bwrite+0x1f0 sys/kern/vfs_bio.c:760
VOP_BWRITE(fffffd805a571388) at VOP_BWRITE+0x4a sys/kern/vfs_vops.c:640
ufs_mkdir(ffff80002ca1fb90) at ufs_mkdir+0x6b4 sys/ufs/ufs/ufs_vnops.c:1236
VOP_MKDIR(fffffd806c0f46d8,ffff80002ca1fcf0,ffff80002ca1fd20,ffff80002ca1fc20) at VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388
domkdirat(ffff800021217350,ffffff9c,20000000,9) at domkdirat+0x121 sys/kern/vfs_syscalls.c:3112
syscall(ffff80002ca1fea0) at syscall+0x4e9 mi_syscall sys/sys/syscall_mi.h:113 [inline]
syscall(ffff80002ca1fea0) at syscall+0x4e9 sys/arch/amd64/amd64/trap.c:600
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9ca84bd680, count: 4
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8273ecef) at panic+0x177 sys/kern/subr_prf.c:198
vop_generic_badop(ffff80002ca1f8f8) at vop_generic_badop+0x1b sys/kern/vfs_default.c:133
VOP_STRATEGY(fffffd8066ef8000,fffffd805a571388) at VOP_STRATEGY+0x9b sys/kern/vfs_vops.c:628
bwrite(fffffd805a571388) at bwrite+0x1f0 sys/kern/vfs_bio.c:760
VOP_BWRITE(fffffd805a571388) at VOP_BWRITE+0x4a sys/kern/vfs_vops.c:640
ufs_mkdir(ffff80002ca1fb90) at ufs_mkdir+0x6b4 sys/ufs/ufs/ufs_vnops.c:1236
VOP_MKDIR(fffffd806c0f46d8,ffff80002ca1fcf0,ffff80002ca1fd20,ffff80002ca1fc20) at VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388
domkdirat(ffff800021217350,ffffff9c,20000000,9) at domkdirat+0x121 sys/kern/vfs_syscalls.c:3112
syscall(ffff80002ca1fea0) at syscall+0x4e9 mi_syscall sys/sys/syscall_mi.h:113 [inline]
syscall(ffff80002ca1fea0) at syscall+0x4e9 sys/arch/amd64/amd64/trap.c:600
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9ca84bd680, count: -11

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-setuid 2023/01/17 13:40 openbsd c6918e3c7e44 aedf5331 .config console log report [disk image] [bsd.gdb] [kernel image] kernel: protection fault trap, code=NUM
ci-openbsd-setuid 2022/12/22 12:41 openbsd 6a5148d0c915 c692fab1 .config console log report [disk image] [bsd.gdb] [kernel image] kernel: protection fault trap, code=NUM
ci-openbsd-setuid 2022/11/10 22:09 openbsd f799f30eb9db 3ead01ad .config console log report [disk image] [bsd.gdb] [kernel image] kernel: protection fault trap, code=NUM
* Struck through repros no longer work on HEAD.