syzbot


uvm_fault: wsevent_fini (3)

Status: fixed on 2020/12/06 19:54
Reported-by: syzbot+684707f0312345a090ef@syzkaller.appspotmail.com
Fix commit: 996a5b4d63fa Fix yet another wscons race. In the same subsystem, the following properties must always hold true:
First crash: 660d, last: 660d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: wsevent_fini (2) 1 808d 808d 3/3 fixed on 2020/07/30 07:21
openbsd uvm_fault: wsevent_fini 1 920d 920d 3/3 fixed on 2020/03/24 16:19
Patch testing requests:
Created Duration User Patch Repo Result
2020/12/05 09:35 17m anton@basename.se https://github.com/mptre/openbsd-src wscons OK

Sample crash report:
uvm_fault(0xfffffd800848ea10, 0x28, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      wsevent_fini+0x12:      movq    0x28(%r14),%r15
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
kernel page fault
uvm_fault(0xfffffd800848ea10, 0x28, 0, 1) -> e
wsevent_fini(0) at wsevent_fini+0x12 sys/dev/wscons/wsevent.c:130
end trace frame: 0xffff80002126d490, count: 0
ddb{1}> trace
wsevent_fini(0) at wsevent_fini+0x12 sys/dev/wscons/wsevent.c:130
wsmouseclose(4400,81,2000,ffff8000211c2008) at wsmouseclose+0x91 sys/dev/wscons/wsmouse.c:355
spec_close(ffff80002126d510) at spec_close+0x311 sys/kern/spec_vnops.c:560
VOP_CLOSE(fffffd806e678688,81,fffffd807f7b7b40,ffff8000211c2008) at VOP_CLOSE+0xeb sys/kern/vfs_vops.c:177
vn_closefile(fffffd806eb25e48,ffff8000211c2008) at vn_closefile+0xd7 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806eb25e48,ffff8000211c2008) at vn_closefile+0xd7 sys/kern/vfs_vnops.c:614
fdrop(fffffd806eb25e48,ffff8000211c2008) at fdrop+0xc2 sys/kern/kern_descrip.c:1279
closef(fffffd806eb25e48,ffff8000211c2008) at closef+0x11c sys/kern/kern_descrip.c:1263
fdfree(ffff8000211c2008) at fdfree+0xf4 sys/kern/kern_descrip.c:1195
exit1(ffff8000211c2008,0,0,1) at exit1+0x340 sys/kern/kern_exit.c:197
sys_exit(ffff8000211c2008,ffff80002126d7a0,ffff80002126d7f0) at sys_exit+0x16 sys/kern/kern_exit.c:95
syscall(ffff80002126d870) at syscall+0x4a1 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002126d870) at syscall+0x4a1 sys/arch/amd64/amd64/trap.c:590
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffd3cc0, count: -12
ddb{1}> show registers
rdi                                0
rsi               0xffff8000211c200c
rbp               0xffff80002126d440
rbx                                0
rdx                             0x8b
rcx                                0
rax                              0x1
r8                0xffffffff81e5a2be    witness_assert+0x1fe
r9                               0x5
r10               0x50c3f31ce569cd00
r11               0x2f780684fcac36fb
r12                           0x4000    __ALIGN_SIZE+0x3000
r13                           0x2000    __ALIGN_SIZE+0x1000
r14                                0
r15                                0
rip               0xffffffff820a3782    wsevent_fini+0x12
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002126d420
ss                              0x10
wsevent_fini+0x12:      movq    0x28(%r14),%r15
ddb{1}> show proc
PROC (syz-executor0371) pid=500180 stat=onproc
    flags process=8<EXITING> proc=2000<WEXIT>
    pri=0, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff8000ffff6a50,0xffffffff828ea588
    process=0xffff8000212354b0 user=0xffff800021268000, vmspace=0xfffffd800848ea10
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 16899  517590  12473      0  3        0x80  nanosleep     syz-executor0371
 34123  340221  12473      0  3        0x80  nanosleep     syz-executor0371
 12473   45085  97766      0  3        0x82  nanosleep     syz-executor0371
 97766  145901  46949      0  3    0x10008a  pause         ksh
 46949  424433  20250      0  3        0x92  select        sshd
 67443   31530      1      0  3    0x100083  ttyin         getty
 20250  130389      1      0  3        0x80  select        sshd
 94938  246857  56078     74  3    0x100092  bpf           pflogd
 56078  428767      1      0  3        0x80  netio         pflogd
  6573  209361  15465     73  3    0x100090  kqread        syslogd
 15465  200168      1      0  3    0x100082  netio         syslogd
 93692  422475      1     77  3    0x100090  poll          dhclient
 97424  443748      1      0  3        0x80  poll          dhclient
 29576  292105      0      0  3     0x14200  bored         smr
 13589  162249      0      0  3     0x14200  pgzero        zerothread
 75563  234572      0      0  3     0x14200  aiodoned      aiodoned
 59858  369105      0      0  3     0x14200  syncer        update
 99626   66242      0      0  3     0x14200  cleaner       cleaner
 45536  319786      0      0  3     0x14200  reaper        reaper
 74126  402768      0      0  3     0x14200  pgdaemon      pagedaemon
 35159   72372      0      0  3     0x14200  bored         crynlk
 73122  121579      0      0  3     0x14200  bored         crypto
 85253   11926      0      0  3     0x14200  bored         viomb
  4407  462083      0      0  3  0x40014200  acpi0         acpi0
 61668   10261      0      0  3  0x40014200                idle1
 50376   42577      0      0  3     0x14200  bored         softnet
 92225  523081      0      0  3     0x14200  bored         systqmp
 63796  338259      0      0  3     0x14200  bored         systq
 53062  169768      0      0  3  0x40014200  bored         softclock
 28312   42800      0      0  7  0x40014200                idle0
     1  146310      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9480   6413K    6431K  78643K     10669        0
            pcb    13      8K       8K  78643K        13        0
         rtable    61      2K       2K  78643K       127        0
         ifaddr    29      8K       8K  78643K        30        0
       counters    39     33K      33K  78643K        39        0
       ioctlops     0      0K       4K  78643K      1467        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1185     75K      75K  78643K      1224        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      1K       1K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1825    197K     290K  78643K     13109        0
      file desc     1      0K       0K  78643K         1        0
           proc    59     63K      71K  78643K       367        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    19     95K      95K  78643K        19        0
           exec     0      0K       2K  78643K       302        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    41      2K       2K  78643K       633        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     4      0K       0K  78643K         4        0
           temp    23   3957K    4021K  78643K      1791        0
         kqueue     2      2K       2K  78643K         2        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        2    0        0     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb      120       15    0       13     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      120       29    0       19     1     0     1     1     0     8    0
syncache   296        5    0        5     2     1     1     1     0     8    1
tcpcb      736        8    0        5     1     0     1     1     0     8    0
inpcb      296       29    0       23     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24        9    0        2     1     0     1     1     0     8    0
pfstkey    112        9    0        2     1     0     1     1     0     8    0
pfstate    328        9    0        2     1     0     1     1     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1436    0       50    87     0    87    87     0     8    0
ffsino     272     1436    0       50    93     0    93    93     0     8    0
nchpl      144     1646    0      103    59     1    58    58     0     8    0
uvmvnodes   72     1482    0        0    27     0    27    27     0     8    0
vnodes     208     1482    0        0    78     0    78    78     0     8    0
namei      1024    4034    0     4034     2     1     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
scxspl     216     3771    0     3771    10     9     1     8     0     8    1
plimitpl   152       14    0        8     1     0     1     1     0     8    0
sigapl     424      259    0      227     4     0     4     4     0     8    0
knotepl    112        5    0        0     1     0     1     1     0     8    0
kqueuepl   152        1    0        0     1     0     1     1     0     8    0
pipepl     304       64    0       60     2     1     1     1     0     8    0
fdescpl    496      243    0      227     3     0     3     3     0     8    0
filepl     152     1099    0     1050     3     0     3     3     0     8    1
lockfpl    104       75    0       74     1     0     1     1     0     8    0
lockfspl    48       38    0       37     1     0     1     1     0     8    0
sessionpl  144       18    0        9     1     0     1     1     0     8    0
pgrppl      48       18    0        9     1     0     1     1     0     8    0
ucredpl     96       62    0       53     1     0     1     1     0     8    0
zombiepl   144      228    0      226     2     1     1     1     0     8    0
processpl  1056     259    0      226     3     0     3     3     0     8    0
procpl     656      259    0      226     3     0     3     3     0     8    0
sockpl     400       73    0       55     2     0     2     2     0     8    0
mcl4k      4096       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      81    0        0    10     0    10    10     0     8    0
mtagpl      96        1    0        0     1     0     1     1     0     8    0
mbufpl     256      100    0        0     6     0     6     6     0     8    0
bufpl      280     2014    0      112   136     0   136   136     0     8    0
anonpl      16    20020    0    18751     8     2     6     7     0   124    0
amapchunkpl 152     549    0      509     2     0     2     2     0   158    0
amappl16   192      119    0      108     1     0     1     1     0     8    0
amappl15   184        1    0        0     1     0     1     1     0     8    0
amappl14   176       22    0       19     1     0     1     1     0     8    0
amappl13   168       14    0       13     2     1     1     1     0     8    0
amappl12   160        7    0        7     1     1     0     1     0     8    0
amappl11   152       54    0       39     1     0     1     1     0     8    0
amappl10   144        9    0        7     1     0     1     1     0     8    0
amappl9    136      220    0      220     2     1     1     1     0     8    1
amappl8    128       58    0       57     1     0     1     1     0     8    0
amappl7    120      209    0      208     1     0     1     1     0     8    0
amappl6    112       57    0       50     1     0     1     1     0     8    0
amappl5    104      356    0      336     1     0     1     1     0     8    0
amappl4     96      279    0      254     1     0     1     1     0     8    0
amappl3     88      139    0      131     1     0     1     1     0     8    0
amappl2     80      873    0      818     3     1     2     2     0     8    0
amappl1     72    14350    0    13911    15     6     9    15     0     8    0
amappl      80      440    0      417     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      243    0      227     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      243    0      227     1     0     1     1     0     8    0
vmmpekpl   168     5656    0     5639     1     0     1     1     0     8    0
vmmpepl    168    30905    0    29986    55    13    42    48     0   357    0
vmsppl     368      242    0      227     2     0     2     2     0     8    0
pdppl      4096     493    0      454    59    18    41    41     0     8    2
pvpl        32    82242    0    79109    33     4    29    29     0   265    2
pmappl     232      242    0      227     1     0     1     1     0     8    0
extentpl    40       58    0       40     1     0     1     1     0     8    0
phpool     112      278    0       22     8     0     8     8     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff826b7ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff828ea210) at __mp_lock+0x133 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff828ea210) at __mp_lock+0x133 sys/kern/kern_lock.c:147
softintr_dispatch(0) at softintr_dispatch+0x4e sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
acpicpu_idle() at acpicpu_idle+0x2eb sys/dev/acpi/acpicpu.c:1206
sched_idle(ffffffff826b7ff0) at sched_idle+0x417 sys/kern/kern_sched.c:178
end trace frame: 0x0, count: -8
ddb{0}> machine ddbcpu 1
Stopped at      wsevent_fini+0x12:      movq    0x28(%r14),%r15
ddb{1}> trace
wsevent_fini(0) at wsevent_fini+0x12 sys/dev/wscons/wsevent.c:130
wsmouseclose(4400,81,2000,ffff8000211c2008) at wsmouseclose+0x91 sys/dev/wscons/wsmouse.c:355
spec_close(ffff80002126d510) at spec_close+0x311 sys/kern/spec_vnops.c:560
VOP_CLOSE(fffffd806e678688,81,fffffd807f7b7b40,ffff8000211c2008) at VOP_CLOSE+0xeb sys/kern/vfs_vops.c:177
vn_closefile(fffffd806eb25e48,ffff8000211c2008) at vn_closefile+0xd7 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806eb25e48,ffff8000211c2008) at vn_closefile+0xd7 sys/kern/vfs_vnops.c:614
fdrop(fffffd806eb25e48,ffff8000211c2008) at fdrop+0xc2 sys/kern/kern_descrip.c:1279
closef(fffffd806eb25e48,ffff8000211c2008) at closef+0x11c sys/kern/kern_descrip.c:1263
fdfree(ffff8000211c2008) at fdfree+0xf4 sys/kern/kern_descrip.c:1195
exit1(ffff8000211c2008,0,0,1) at exit1+0x340 sys/kern/kern_exit.c:197
sys_exit(ffff8000211c2008,ffff80002126d7a0,ffff80002126d7f0) at sys_exit+0x16 sys/kern/kern_exit.c:95
syscall(ffff80002126d870) at syscall+0x4a1 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002126d870) at syscall+0x4a1 sys/arch/amd64/amd64/trap.c:590
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffd3cc0, count: -12
ddb{1}> 

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2020/12/04 06:36 openbsd 2724571b5981 9e0b299f .config log report syz C
ci-openbsd-multicore 2020/12/04 06:20 openbsd 2724571b5981 9e0b299f .config log report
* Struck through repros no longer work on HEAD.