witness: pmap_unwire: wiring for pmap ADDR va ADDR didn't change!
|
|
|
|
2 |
1d00h |
1d18h
|
1d18h |
SYZFAIL: coverage filter is full (2)
|
|
|
|
3488 |
1d16h |
2d01h
|
2d01h |
protection_fault: klist_invalidate
|
|
|
|
1 |
2d17h |
2d16h
|
2d16h |
panic: thread -ADDR p_stat is -NUM
|
|
|
|
2 |
18h11m |
3d17h
|
3d17h |
assert "va >= entry->start" failed in uvm_fault.c
|
|
|
|
8 |
12h52m |
4d12h
|
4d12h |
panic: kernel diagnostic assertion "va >= entry->start" failed: file "/syzkaller/managers/setuid/kernel/sys/uvm/uvm_faul
|
|
|
|
1 |
5d00h |
5d00h
|
5d00h |
uvm_fault: rtrequest (3)
|
|
|
|
1 |
7d17h |
7d17h
|
7d17h |
panic: kernel diagnostic assertion "ps->ps_uvncount == NUM" failed: file "
|
|
|
|
1 |
9d16h |
9d16h
|
9d16h |
uvm_fault: spec_getattr
|
|
|
|
1 |
10d |
10d
|
10d |
panic: trap type NUM, code=NUM, pc=eaa29
|
|
|
|
1 |
11d |
11d
|
11d |
SYZFAIL: tun_id out of range (3)
|
|
|
|
135796 |
now |
14d
|
14d |
panic: kernel diagnostic assertion "nlevel >= IPL_NONE" failed:
|
|
|
|
1 |
17d |
17d
|
17d |
panic: mutex 0xffffWAfRd8N0I7NeG:b7 8S8PL1 NUM noNtO T heLOlWd EiREnD m tOxN SY_SlCeaALL v7e5 NUM
|
|
|
|
1 |
17d |
17d
|
17d |
panic: mutex ADDR not held in mtx_leave
|
|
|
|
1190 |
17d |
18d
|
18d |
panic: kernel diagnostic assertion "map->limit == rtmap_limit" f
|
|
|
|
1 |
18d |
18d
|
18d |
panic: kernel diagnostic assertion "ps->ps_uvncount == NUM" faile
|
|
|
|
96 |
16d |
19d
|
19d |
panic: kernel diagnostic assertion "pg->wire_count == NUM" failed
|
|
|
|
20 |
16d |
19d
|
19d |
SYZFAIL: failed to recv rpc (3)
|
|
|
|
527 |
6d13h |
21d
|
21d |
panic: kernel diagnostic assert
|
|
|
|
3 |
6d21h |
23d
|
23d |
malloc: free list modified: proc
|
|
|
|
1 |
27d |
27d
|
27d |
panic: Non dma-reachable buffer at curaddr ADDR(raw) (3)
|
|
|
|
3 |
9d02h |
29d
|
29d |
uvm_fault: lf_advlock
|
|
|
|
1 |
31d |
31d
|
31d |
assert "rdomain == rtable_l2(rdomain)" failed in route.c
|
|
|
|
2 |
2d05h |
34d
|
34d |
panic: kernel diagnostic assertion "uvm_page_owner_locked_p(pg)" failed
|
|
|
|
1 |
35d |
35d
|
35d |
assert "pr->ps_threadcnt == NUM" failed in kern_exit.c
|
|
|
|
1 |
36d |
36d
|
36d |
witness: lock_obwitness_checkordwitness_checkordrw_enter_write(ADDR)rw_enter_write+0unveil_delete_naunveil_delete_naunve
|
|
|
|
1 |
37d |
37d
|
37d |
uvm_fault: uao_detach
|
|
|
|
2 |
39d |
42d
|
42d |
panic: ffs_blkfree: freeing free frag
|
|
|
|
1 |
43d |
43d
|
43d |
panic: pfi_attach_ifnet: pfi_kif_get failed
|
|
|
|
1 |
46d |
46d
|
46d |
assert "kd_lookup(kd->kd_unit) == NULL" failed in kcov.c
|
|
|
|
2 |
10d |
48d
|
48d |
panic: pool_do_get: shmpl free list modified: page ADDR; item addr ADDR; offset 0x0=0x0 != ADDR
|
|
|
|
1 |
49d |
49d
|
49d |
protection_fault: in6_addmulti (3)
|
|
|
|
1 |
50d |
50d
|
50d |
witness: lock_object uninitializwitness_checkorder(ADDRwitness_checkordrw_enter_write(frw_enter_write+0unveil_delete_nau
|
|
|
|
1 |
53d |
53d
|
53d |
uvm_fault: ufsdirhash_findfree
|
|
|
|
1 |
53d |
53d
|
53d |
panic: ffs2_balloc: unwind failed
|
|
|
|
1 |
54d |
54d
|
54d |
panic: thread NUM p_stat is NUM (2)
|
|
|
|
2 |
1d09h |
54d
|
54d |
uvm_fault: ffs_alloccg
|
|
|
|
1 |
54d |
54d
|
54d |
uvm_fault: ffs_nodealloccg (2)
|
|
|
|
2 |
55d |
55d
|
55d |
uvm_fault: ffs_fragextend
|
|
|
|
2 |
55d |
56d
|
56d |
uvm_fault: ffs_blkfree
|
|
|
|
6 |
54d |
56d
|
56d |
panic: pledge_namei: ni_pledge
|
|
|
|
2 |
14d |
56d
|
56d |
uvm_fault: ufs_direnter (3)
|
|
|
|
3 |
53d |
56d
|
56d |
uvm_fault: ffs_freefile
|
|
|
|
2 |
54d |
56d
|
56d |
protection_fault: icmp_mtudisc_timeout (2)
|
|
|
|
1 |
58d |
58d
|
58d |
panic: trap type NUM, code=NUM, pc=e9779
|
|
|
|
133 |
28d |
58d
|
58d |
panic: trap type NUM, code=NUM, pc=e94f9
|
|
|
|
4 |
58d |
58d
|
58d |
protection_fault: witness_checkorder (4)
|
|
|
|
1 |
59d |
59d
|
59d |
assert "uvm_page_owner_locked_p(pg)" failed in managers/multicore/kernel/sys/uvm/uvm_page.c
|
|
|
|
1 |
60d |
60d
|
60d |
panic: malloc: out of space in kmem_map (3)
|
|
|
|
1 |
62d |
62d
|
62d |
panic: ffs_freefile: freeing free inode (2)
|
|
|
|
1 |
63d |
63d
|
63d |
uvm_fault: softclock (5)
|
|
|
|
1 |
67d |
67d
|
67d |
uvm_fault: unveil_add_vnode (2)
|
|
|
|
9 |
7d13h |
69d
|
69d |
panic: trap type NUM, code=NUM, pc=e9439
|
|
|
|
1 |
70d |
70d
|
70d |
kernel: protection fault trap, code=NUM (7)
|
|
|
|
6 |
23d |
73d
|
73d |
panic: ffs_valloc: dup alloc (2)
|
|
|
|
47 |
43d |
74d
|
74d |
panic: malloc: allocation too large, type = NUM, size = ADDR (2)
|
|
|
|
6 |
5d11h |
77d
|
77d |
multicore build error (19)
|
|
|
|
4 |
5d12h |
79d
|
79d |
protection_fault: __x86_indirect_thunk_r11 (3)
|
|
|
|
9 |
29d |
81d
|
81d |
SYZFAIL: too much cover
|
|
|
|
7 |
18h24m |
81d
|
81d |
pool: free list modified: shmpl (5)
|
|
|
|
38 |
1d17h |
82d
|
82d |
witness: reversal: sbufsnd inode
|
|
|
|
4 |
18d |
84d
|
84d |
panic: trap type NUM, code=NUM, pc=e8fb9
|
|
|
|
3 |
84d |
84d
|
84d |
assert "start >= vm_map_min(map) && end <= vm_map_max(map)" failed in uvm_fault.c
|
|
|
|
1 |
86d |
86d
|
86d |
protection_fault: reaper
|
|
|
|
7 |
32d |
87d
|
87d |
panic: vpaopni_cg:en keerrinecl_b daidaogpn
|
|
|
|
1 |
87d |
87d
|
87d |
SYZFAIL: SIGBUS
|
|
|
|
940 |
3d20h |
92d
|
92d |
protection_fault: done_flush (3)
|
|
|
|
5 |
79d |
93d
|
93d |
panic: softclock: invalid to_clock: ADDR (2)
|
|
|
|
4 |
22d |
94d
|
94d |
panic: free: size too small NUM <= NUM / NUM (ADDR) type shm
|
|
|
|
2 |
47d |
98d
|
98d |
uvm_fault: savectx (2)
|
|
|
|
33 |
17d |
105d
|
105d |
panic: assertwaitok: non-zero mutex count: NUM (2)
|
|
|
|
163 |
1d07h |
108d
|
108d |
panic: missing alias (5)
|
|
|
|
39 |
23h21m |
108d
|
108d |
SYZFAIL: posix_spawn failed
|
|
|
|
109 |
2d05h |
108d
|
108d |
SYZFAIL: failed to mkdtemp
|
|
|
|
21508 |
1h03m |
116d
|
116d |
SYZFAIL: failed to mkdir
|
|
|
|
3178 |
5h51m |
116d
|
116d |
SYZFAIL: pipe failed
|
|
|
|
11 |
12d |
116d
|
116d |
uvm_fault: vm_terminate
|
|
|
|
4 |
80d |
117d
|
117d |
SYZFAIL: repeatedly failed to execute the program
|
|
|
|
8 |
54d |
117d
|
117d |
assert "map->limit == rtmap_limit" failed in rtable.c
|
|
|
|
67 |
5d03h |
118d
|
118d |
SYZFAIL: SIGSEGV
|
|
|
|
10 |
60d |
120d
|
120d |
SYZFAIL: tun: can't open device (4)
|
|
|
|
8 |
18d |
120d
|
120d |
witness: reversal: lock order data missing (4)
|
|
|
|
52220 |
now |
120d
|
120d |
SYZFAIL: ioctl remote attach failed (5)
|
|
|
|
1523 |
now |
120d
|
120d |
SYZFAIL: too many calls in output
|
|
|
|
54 |
1d20h |
120d
|
120d |
SYZFAIL: failed to send rpc
|
|
|
|
7341 |
1h18m |
121d
|
121d |
pool: free list modified: pmappl
|
|
|
|
3 |
78d |
164d
|
164d |
openbsd build error (21)
|
|
|
|
114 |
42d |
169d
|
169d |
can't ssh into the instance
|
|
|
|
562 |
1d12h |
170d
|
142d |
protection_fault: nd6_timer
|
|
|
|
8 |
82d |
170d
|
170d |
panic: inconsistent bufpage counts
|
|
|
|
3 |
73d |
175d
|
175d |
assert "rw_write_held(uobj->vmobjlock)" failed in uvm_vnode.c
|
|
|
|
8 |
17d |
177d
|
177d |
panic: ffs_blkfree: bad size (4)
|
|
|
|
5 |
83d |
182d
|
182d |
pool: free list modified: pdppl (4)
|
|
|
|
8 |
16d |
193d
|
193d |
panic: vrele: ref cnt
|
|
|
|
4 |
77d |
200d
|
200d |
assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c (3)
|
|
|
|
8 |
74d |
201d
|
201d |
assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (3)
|
|
|
|
4 |
75d |
203d
|
203d |
uvm_fault: arp_rtrequest (2)
|
|
|
|
18 |
32d |
206d
|
206d |
pool: cpu free list modified: mbufpl (4)
|
|
|
|
5 |
87d |
206d
|
206d |
panic: ifa_update_broadaddr does not support dynamic length (3)
|
|
|
|
37 |
36d |
206d
|
206d |
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST: va ADDR, opte 0x3efff
|
|
|
|
11 |
75d |
206d
|
206d |
panic: vref used where vget required (4)
|
|
|
|
9 |
87d |
211d
|
211d |
uvm_fault: checkalias
|
|
|
|
8 |
87d |
212d
|
212d |
uvm_fault: proc_trampoline
|
|
|
|
6 |
42d |
214d
|
214d |
uvm_fault: witness_checkorder (5)
|
|
|
|
6 |
41d |
228d
|
228d |
pool: free list modified: rttmr
|
|
|
|
9 |
29d |
231d
|
231d |
protection_fault: lf_advlock (4)
|
C |
|
|
4 |
11h25m |
233d
|
233d |
assert "((flags & PGO_LOCKED) != NUM && rw_lock_held(uobj->vmobjlock)) || (flags & PGO_LOCKED) == NUM" failed in uvm_vno (4)
|
|
|
|
10 |
17d |
239d
|
239d |
assert "nlevel >= IPL_NONE" failed in intr.c (2)
|
|
|
|
106 |
14h52m |
247d
|
247d |
panic: softclock: invalid to_clock: NUM
|
|
|
|
14 |
26d |
249d
|
249d |
panic: softclock: invalid to_clock: -ADDR
|
|
|
|
22 |
18d |
252d
|
252d |
protection_fault: sys_semop
|
C |
|
|
5 |
10h38m |
253d
|
253d |
assert "ps->ps_uvncount == NUM" failed in kern_unveil.c (4)
|
C |
|
|
8803 |
8m |
258d
|
223d |
assert "sc->sc_dev == NUM" failed in if_tun.c (5)
|
|
|
|
355 |
31d |
259d
|
259d |
uvm_fault: db_read_bytes
|
|
|
|
94 |
28d |
261d
|
261d |
assert "cifp != NULL" failed in route.c (3)
|
|
|
|
203 |
8h16m |
266d
|
266d |
uvm_fault: pool_gc_pages (2)
|
|
|
|
9 |
78d |
266d
|
266d |
assert "pg->wire_count == NUM" failed in vfs_biomem.c (3)
|
|
|
|
1383 |
14d |
314d
|
314d |
uvm_fault: pmap_page_remove (5)
|
|
|
|
16 |
24d |
334d
|
334d |
uvm_fault: km_free (2)
|
|
|
|
10 |
89d |
336d
|
336d |
panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) vmmaplk (3)
|
|
|
|
166 |
14d |
380d
|
380d |
uvm_fault: ktrops (2)
|
C |
|
|
49 |
1d10h |
406d
|
406d |
uvm_fault: db_enter (5)
|
|
|
|
337 |
1d13h |
423d
|
423d |
uvm_fault: schedclock
|
syz |
|
|
11 |
63d |
432d
|
255d |
kernel: page fault trap, code=NUM (3)
|
C |
|
|
73 |
8d18h |
462d
|
219d |
malloc: free list modified: free (4)
|
C |
|
|
16 |
18d |
483d
|
483d |
panic: trap type NUM, code=NUM, pc=NUM (3)
|
|
|
|
209 |
19h20m |
513d
|
513d |
witness: lock_object uninitialized: ADDR (3)
|
C |
|
|
3897 |
now |
586d
|
445d |
uvm_fault: hardclock (5)
|
syz |
|
|
4 |
463d |
615d
|
615d |
panic: ufsdirhash_lookup: bad offset in hash array (3)
|
C |
|
|
79 |
35d |
626d
|
332d |
protection_fault: sys_msgrcv (2)
|
C |
|
|
35 |
20h17m |
757d
|
513d |
uvm_fault: memcpy (5)
|
C |
|
|
20 |
11d |
761d
|
761d |
assert "uvn->u_obj.uo_refs == NUM" failed in uvm_vnode.c (2)
|
syz |
|
|
2 |
765d |
765d
|
765d |
panic: vop_generic_badop (2)
|
|
|
|
91 |
64d |
796d
|
796d |
panic: pmap_unwire: invalid PDE
|
syz |
|
|
6 |
176d |
819d
|
761d |
no output from test machine (8)
|
C |
|
|
500665 |
now |
828d
|
824d |
uvm_fault: ffs_indirtrunc
|
C |
|
|
4 |
584d |
872d
|
872d |
witness: reversal: vmmaplk inode (3)
|
C |
|
|
988 |
9h29m |
904d
|
855d |
SYZFATAL: executor NUM failed NUM times: executor NUM: exit status NUM
|
syz |
|
|
175427 |
7d23h |
927d
|
927d |
panic: bad dir (3)
|
C |
|
|
42 |
3d18h |
933d
|
761d |
panic: uvm_fault_unwire_locked: address not in map (4)
|
C |
|
|
485 |
1h10m |
949d
|
930d |
uvm_fault: x86_ipi_db (8)
|
|
|
|
330 |
8d13h |
993d
|
993d |
uvm_fault: ufs_lookup
|
C |
|
|
84 |
53d |
1028d
|
380d |
kernel: double fault trap, code=NUM (2)
|
C |
|
|
34 |
85d |
1028d
|
980d |
panic: trap type NUM, code=NUM, pc=ADDR (2)
|
|
|
|
490 |
1h09m |
1035d
|
1035d |
protection_fault: ktrops
|
C |
|
|
259 |
89d |
1038d
|
1018d |
protection_fault: sblock
|
syz |
|
|
38 |
862d |
1042d
|
1041d |
assert "uvm_page_owner_locked_p(pg)" failed in uvm_page.c
|
|
|
|
6733 |
1d07h |
1046d
|
1046d |
uvm_fault: fifo_write (2)
|
C |
|
|
3430 |
64d |
1049d
|
734d |
SYZFAIL: tun: read failed
|
syz |
|
|
68550 |
now |
1067d
|
1035d |
corrupted report (6)
|
|
|
|
2210 |
10m |
1146d
|
1146d |
uvm_fault: memset
|
C |
|
|
78 |
9d08h |
1188d
|
1188d |
SYZFAIL: command failed
|
syz |
|
|
12796 |
22h00m |
1355d
|
1037d |
suppressed report
|
|
|
|
335665 |
8h15m |
1355d
|
1344d |
panic: ufs_rename: lost dir entry
|
C |
|
|
113 |
4d05h |
1729d
|
967d |
lost connection to test machine (2)
|
|
|
|
850338 |
now |
2145d
|
never |