syzbot


pool: free list modified: sockpl (3)

Status: upstream: reported on 2022/09/19 02:44
Reported-by: syzbot+2a9771c648cecb40bd67@syzkaller.appspotmail.com
First crash: 133d, last: 83d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: sockpl (2) 3 271d 326d 0/3 auto-closed as invalid on 2022/08/02 08:04
openbsd pool: free list modified: sockpl 2 1069d 1080d 0/3 auto-closed as invalid on 2020/05/25 10:55

Sample crash report:
panic: pool_p_free: sockpl free list modified: page 0xfffffd807620e000; item addr 0xfffffd807620e9d3; offset 0x0=0x57bc5c292f266ae8
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*157896  25211      0     0x14000      0x200    0  systqmp
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff825f48e3) at panic+0x161 sys/kern/subr_prf.c:198
pool_p_free(ffffffff82ad5d88,fffffd807620ef90) at pool_p_free+0x1d3
pool_gc_pages(0) at pool_gc_pages+0x215 sys/kern/subr_pool.c:1583
taskq_thread(ffffffff82908470) at taskq_thread+0x9b sys/kern/kern_task.c:449
end trace frame: 0x0, count: 10
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-main 2022/11/07 21:53 openbsd 5c6e572844be a779b11a .config console log report [disk image] [bsd.gdb] [kernel image] pool: free list modified: sockpl
ci-openbsd-main 2022/11/05 14:12 openbsd c39877f08d26 6d752409 .config console log report [disk image] [bsd.gdb] [kernel image] pool: free list modified: sockpl
ci-openbsd-main 2022/09/26 17:24 openbsd 68aa891044c9 d59ba983 .config console log report [disk image] [bsd.gdb] [kernel image] pool: free list modified: sockpl
ci-openbsd-multicore 2022/09/19 02:44 openbsd 076ab34a56d3 dd9a85ff .config console log report [disk image] [bsd.gdb] [kernel image] pool: free list modified: sockpl
* Struck through repros no longer work on HEAD.