syzbot


uvm_fault: memcpy (3)

Status: auto-closed as invalid on 2020/10/17 21:23
Reported-by: syzbot+a8e3d981e6af34453a5f@syzkaller.appspotmail.com
First crash: 1426d, last: 1369d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: memcpy C 460 1845d 1865d 3/3 fixed on 2019/03/31 22:33
openbsd uvm_fault: memcpy (5) C 6 31d 558d 0/3 upstream: reported C repro on 2022/10/08 21:10
openbsd uvm_fault: memcpy (2) syz 2168 1433d 1682d 0/3 closed as invalid on 2020/05/18 08:51
openbsd uvm_fault: memcpy (4) 2 777d 846d 0/3 auto-closed as invalid on 2022/06/01 18:10

Sample crash report:
uvm_fault(0xfffffd806bc09770, 0x0, 0, 2) -> e
kernel: page fault trap, code=0
Stopped at      memcpy+0x15:    repe movsq      (%rsi),%es:(%rdi)
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xfffffd806bc09770, 0x0, 0, 2) -> e
memcpy() at memcpy+0x15
end trace frame: 0xffff80001d723280, count: 0
ddb> trace
memcpy() at memcpy+0x15
sbappendstream(fffffd805da747d8,fffffd805da748d0,fffffd8059580300) at sbappendstream+0x105 sys/kern/uipc_socket2.c:665
tcp_usrreq(fffffd805da747d8,9,fffffd8059580300,0,0,ffff80001d71d120) at tcp_usrreq+0x225 sys/netinet/tcp_usrreq.c:323
sosend(fffffd805da747d8,0,ffff80001d7234d8,0,0,80) at sosend+0x669 sys/kern/uipc_socket.c:555
dofilewritev(ffff80001d71d120,4,ffff80001d7234d8,0,ffff80001d7235c0) at dofilewritev+0x1ab sys/kern/sys_generic.c:365
sys_write(ffff80001d71d120,ffff80001d723570,ffff80001d7235c0) at sys_write+0x83 sys/kern/sys_generic.c:285
syscall(ffff80001d723640) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2500, count: -8
ddb> show registers
rdi                                0
rsi               0xfffffd800607f000
rbp               0xffff80001d723220
rbx                              0x1
rdx                            0x1cc
rcx                             0x39
rax                                0
r8                0xffffffff814d4794    sbappendstream+0x64
r9                               0x5
r10               0x1e444ac8d39b0d43
r11                                0
r12               0xfffffd8059580300
r13               0xfffffd8059580400
r14                              0x1
r15               0xfffffd805da748d0
rip               0xffffffff81b139e5    memcpy+0x15
cs                               0x8
rflags                       0x10207    __ALIGN_SIZE+0xf207
rsp               0xffff80001d7231a8
ss                              0x10
memcpy+0x15:    repe movsq      (%rsi),%es:(%rdi)
ddb> show proc
PROC (sshd) pid=446711 stat=onproc
    flags process=12<EXEC,SUGID,8ORPHAN> proc=0
    pri=24, usrpri=51, nice=20
    forw=0xffffffffffffffff, list=0xffff80001d71dae0,0xffff80001d71c9e0
    process=0xffff80001d701238 user=0xffff80001d71e000, vmspace=0xfffffd806bc09770
    estcpu=1, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 67202   30884  44543  60928  3        0x90  nanosleep     syz-executor.1
 67202  485529  44543  60928  3   0x4000090  netio         syz-executor.1
 67202  230086  44543  60928  3   0x4000090  fsleep        syz-executor.1
 44543  138373  26157      0  3        0x82  nanosleep     syz-executor.1
 16827  361805  26157      0  2         0x2                syz-executor.0
 26157  162045  32041      0  3        0x82  thrsleep      syz-fuzzer
 26157  122086  32041      0  2   0x4000002                syz-fuzzer
 26157  351276  32041      0  3   0x4000082  thrsleep      syz-fuzzer
 26157  189168  32041      0  3   0x4000082  thrsleep      syz-fuzzer
 26157  450014  32041      0  3   0x4000082  thrsleep      syz-fuzzer
 26157  279778  32041      0  2   0x4000002                syz-fuzzer
 26157  198653  32041      0  3   0x4000082  thrsleep      syz-fuzzer
 32041  268138  27248      0  3    0x10008a  pause         ksh
*27248  446711  54824      0  7        0x12                sshd
 71564  173098      1      0  3    0x100083  ttyin         getty
 54824   64474      1      0  3        0x80  select        sshd
  8676  420626  46647     73  3    0x100090  kqread        syslogd
 46647   90226      1      0  3    0x100082  netio         syslogd
 71012   45526      1     77  3    0x100090  poll          dhclient
 17423  219039      1      0  3        0x80  poll          dhclient
  7953  350031      0      0  3     0x14200  bored         smr
  8012  221260      0      0  3     0x14200  pgzero        zerothread
 67378  223042      0      0  3     0x14200  aiodoned      aiodoned
 61574  146365      0      0  3     0x14200  syncer        update
 40003   98434      0      0  3     0x14200  cleaner       cleaner
 24657  501763      0      0  3     0x14200  reaper        reaper
 17847   71840      0      0  3     0x14200  pgdaemon      pagedaemon
 14441  479803      0      0  3     0x14200  bored         crynlk
  2013   33196      0      0  3     0x14200  bored         crypto
 87230  513031      0      0  3  0x40014200  acpi0         acpi0
 61941  472786      0      0  3     0x14200  bored         softnet
 23524   27563      0      0  3     0x14200  bored         systqmp
 31277  215002      0      0  3     0x14200  bored         systq
 13902  215756      0      0  3  0x40014200  bored         softclock
 44577  237785      0      0  3  0x40014200                idle0
     1  292434      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9464   6329K    6717K  78643K     10686        0
            pcb    13      8K       8K  78643K        21        0
         rtable   106      3K       4K  78643K       227        0
         ifaddr    48     11K      11K  78643K        61        0
       counters    21     16K      16K  78643K        23        0
       ioctlops     0      0K       4K  78643K        19        0
            iov     0      0K      12K  78643K        25        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1229     77K      78K  78643K      1259        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     8      0K       0K  78643K        12        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1809    195K     288K  78643K     12938        0
      file desc     5     13K      25K  78643K        64        0
          sigio     0      0K       0K  78643K         2        0
           proc    48     38K      63K  78643K       362        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    33      2K       2K  78643K        33        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    31    148K     148K  78643K        31        0
           exec     0      0K       1K  78643K       181        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   128     23K      39K  78643K      1017        0
       UVM aobj     5      2K       2K  78643K         5        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     7      0K       0K  78643K        13        0
           temp    70   3847K    3912K  78643K      1885        0
         kqueue     3      4K       4K  78643K         3        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        6    0        0     1     0     1     1     0     8    0
rtpcb       80       29    0       27     1     0     1     1     0     8    0
rtentry    112       45    0        1     2     0     2     2     0     8    0
unpcb      120       31    0       21     1     0     1     1     0     8    0
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpqe       32     1297    0     1297     1     0     1     1     0     8    1
tcpcb      544       12    0        8     1     0     1     1     0     8    0
inpcb      296       44    0       37     1     0     1     1     0     8    0
nd6         48        6    0        0     1     0     1     1     0     8    0
pfrktable  1344       6    0        6     1     0     1     1     0     8    1
pfrule     1360       2    0        2     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      189    0        0    12     0    12    12     0     8    0
art_table   32      190    0        0     2     0     2     2     0     8    0
art_node    16       44    0        4     1     0     1     1     0     8    0
semupl     112        1    0        1     1     0     1     1     0     8    1
semapl     112        6    0        0     1     0     1     1     0     8    0
shmpl      112        2    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1461    0       63    88     0    88    88     0     8    0
ffsino     240     1461    0       63    83     0    83    83     0     8    0
nchpl      144     1738    0      133    60     0    60    60     0     8    0
uvmvnodes   72     1536    0        0    28     0    28    28     0     8    0
vnodes     208     1536    0        0    81     0    81    81     0     8    0
namei      1024    4316    0     4316     2     1     1     1     0     8    1
pfiaddrpl  120        2    0        2     1     0     1     1     0     8    1
scxspl     192     5060    0     5060     1     0     1     1     0     8    1
plimitpl   152       14    0        7     1     0     1     1     0     8    0
sigapl     424      250    0      222     4     0     4     4     0     8    0
futexpl     56      646    0      645     1     0     1     1     0     8    0
knotepl    112       61    0       42     1     0     1     1     0     8    0
kqueuepl   144        6    0        4     1     0     1     1     0     8    0
pipepl     272       72    0       62     1     0     1     1     0     8    0
fdescpl    432      236    0      222     2     0     2     2     0     8    0
filepl     120     1180    0     1081     4     0     4     4     0     8    0
lockfpl    104       20    0       19     1     0     1     1     0     8    0
lockfspl    48        9    0        8     1     0     1     1     0     8    0
sessionpl  112       17    0        7     1     0     1     1     0     8    0
pgrppl      48       17    0        7     1     0     1     1     0     8    0
ucredpl     96       59    0       50     1     0     1     1     0     8    0
zombiepl   144      222    0      222     2     1     1     1     0     8    1
processpl  928      250    0      222     4     0     4     4     0     8    0
procpl     624      292    0      256     4     0     4     4     0     8    1
sockpl     400      104    0       85     3     0     3     3     0     8    0
mcl64k     65536      5    0        5     1     0     1     1     0     8    1
mcl12k     12288      1    0        1     1     0     1     1     0     8    1
mcl9k      9216       3    0        3     1     0     1     1     0     8    1
mcl8k      8192       2    0        2     1     0     1     1     0     8    1
mcl4k      4096      12    0       12     2     1     1     1     0     8    1
mcl2k      2048   89538    0    89467    35    18    17    26     0     8    8
mtagpl      96       10    0        2     2     1     1     1     0     8    0
mbufpl     256   142283    0   142180    15     1    14    15     0     8    2
bufpl      280     3375    0      126   233     0   233   233     0     8    0
anonpl      16    39792    0    24594    63     1    62    62     0   107    0
amapchunkpl 152    1435    0     1300    19     0    19    19     0   158   12
amappl16   192     1081    0      257    42     0    42    42     0     8    0
amappl15   184        1    0        0     1     0     1     1     0     8    0
amappl14   176       25    0       19     1     0     1     1     0     8    0
amappl13   168       57    0       51     1     0     1     1     0     8    0
amappl12   160       41    0       37     1     0     1     1     0     8    0
amappl11   152       48    0       38     1     0     1     1     0     8    0
amappl10   144       13    0        7     1     0     1     1     0     8    0
amappl9    136      377    0      375     1     0     1     1     0     8    0
amappl8    128      331    0      289     2     0     2     2     0     8    0
amappl7    120      105    0       94     1     0     1     1     0     8    0
amappl6    112       28    0       22     1     0     1     1     0     8    0
amappl5    104      152    0      141     1     0     1     1     0     8    0
amappl4     96      438    0      412     1     0     1     1     0     8    0
amappl3     88      123    0      115     1     0     1     1     0     8    0
amappl2     80     1073    0     1006     2     0     2     2     0     8    0
amappl1     72    14136    0    13716    23    10    13    17     0     8    3
amappl      80      539    0      496     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        4    0        0     1     0     1     1     0     8    0
uaddrrnd    24      236    0      222     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      236    0      222     1     0     1     1     0     8    0
vmmpekpl   168     5763    0     5737     3     1     2     2     0     8    0
vmmpepl    168    36390    0    34452   154     5   149   149     0   357   60
vmsppl     272      235    0      222     2     0     2     2     0     8    1
pdppl      4096     478    0      444     6     0     6     6     0     8    1
pvpl        32   132324    0   114161   148     0   148   148     0   265    1
pmappl     200      235    0      222     1     0     1     1     0     8    0
extentpl    40       53    0       36     1     0     1     1     0     8    0
phpool     112      263    0       23     7     0     7     7     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
memcpy() at memcpy+0x15
sbappendstream(fffffd805da747d8,fffffd805da748d0,fffffd8059580300) at sbappendstream+0x105 sys/kern/uipc_socket2.c:665
tcp_usrreq(fffffd805da747d8,9,fffffd8059580300,0,0,ffff80001d71d120) at tcp_usrreq+0x225 sys/netinet/tcp_usrreq.c:323
sosend(fffffd805da747d8,0,ffff80001d7234d8,0,0,80) at sosend+0x669 sys/kern/uipc_socket.c:555
dofilewritev(ffff80001d71d120,4,ffff80001d7234d8,0,ffff80001d7235c0) at dofilewritev+0x1ab sys/kern/sys_generic.c:365
sys_write(ffff80001d71d120,ffff80001d723570,ffff80001d7235c0) at sys_write+0x83 sys/kern/sys_generic.c:285
syscall(ffff80001d723640) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2500, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
memcpy() at memcpy+0x15
sbappendstream(fffffd805da747d8,fffffd805da748d0,fffffd8059580300) at sbappendstream+0x105 sys/kern/uipc_socket2.c:665
tcp_usrreq(fffffd805da747d8,9,fffffd8059580300,0,0,ffff80001d71d120) at tcp_usrreq+0x225 sys/netinet/tcp_usrreq.c:323
sosend(fffffd805da747d8,0,ffff80001d7234d8,0,0,80) at sosend+0x669 sys/kern/uipc_socket.c:555
dofilewritev(ffff80001d71d120,4,ffff80001d7234d8,0,ffff80001d7235c0) at dofilewritev+0x1ab sys/kern/sys_generic.c:365
sys_write(ffff80001d71d120,ffff80001d723570,ffff80001d7235c0) at sys_write+0x83 sys/kern/sys_generic.c:285
syscall(ffff80001d723640) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2500, count: -8

Crashes (26):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/19 21:22 openbsd 5cb69e53a7eb 9c812472 .config console log report ci-openbsd-main
2020/07/18 03:48 openbsd a44bf07fbdaa 9c812472 .config console log report ci-openbsd-multicore
2020/07/13 15:44 openbsd 63b35fb201d9 f90ec899 .config console log report ci-openbsd-multicore
2020/06/30 01:42 openbsd 83fd2a221a65 ce9ef6f2 .config console log report ci-openbsd-multicore
2020/06/28 23:40 openbsd 558cf89c3d26 a2cdad9d .config console log report ci-openbsd-multicore
2020/06/28 22:39 openbsd 558cf89c3d26 a2cdad9d .config console log report ci-openbsd-main
2020/06/28 05:10 openbsd 634337a5c27d a2cdad9d .config console log report ci-openbsd-multicore
2020/06/28 03:55 openbsd 634337a5c27d a2cdad9d .config console log report ci-openbsd-multicore
2020/06/25 15:09 openbsd 249524653efe c7b4497a .config console log report ci-openbsd-multicore
2020/06/25 06:43 openbsd 3209772dfcc3 9d60b18e .config console log report ci-openbsd-multicore
2020/06/24 20:38 openbsd e9c5ed46e587 41694dbf .config console log report ci-openbsd-multicore
2020/06/24 13:26 openbsd e9c5ed46e587 41694dbf .config console log report ci-openbsd-multicore
2020/06/24 08:07 openbsd 95d22deeeb03 bbad15ae .config console log report ci-openbsd-main
2020/06/14 07:18 openbsd 68a1d3c69b86 a61674a5 .config console log report ci-openbsd-main
2020/06/12 11:15 openbsd b981186b7111 819b58b0 .config console log report ci-openbsd-main
2020/06/09 12:03 openbsd 324b9c791e90 0d60b78a .config console log report ci-openbsd-main
2020/06/05 22:10 openbsd d21ef8e00906 d36418e9 .config console log report ci-openbsd-main
2020/06/05 08:47 openbsd 21ddc59af3b7 2420d1bc .config console log report ci-openbsd-multicore
2020/06/01 10:09 openbsd 33ca237a0cbf a0331e89 .config console log report ci-openbsd-multicore
2020/05/27 19:32 openbsd 4d5cbc65b3f2 fdf90f62 .config console log report ci-openbsd-multicore
2020/05/27 16:17 openbsd 4d5cbc65b3f2 fdf90f62 .config console log report ci-openbsd-main
2020/05/26 21:13 openbsd 6b204e2a39b4 9072c126 .config console log report ci-openbsd-multicore
2020/05/26 09:05 openbsd 4e2f099e1acf 8ca3b7d2 .config console log report ci-openbsd-multicore
2020/05/26 06:00 openbsd 4e2f099e1acf 8ca3b7d2 .config console log report ci-openbsd-multicore
2020/05/24 23:38 openbsd 12bad2091a27 ce7ca010 .config console log report ci-openbsd-multicore
2020/05/23 02:40 openbsd d957eea850e2 9682898d .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.