syzbot


Title Repro Cause bisect Fix bisect Count Last Reported
uvm_fault: hardclock 1 90d 90d
SYZFAIL: open of /dev/kcov failed 3 4d04h 4d10h
SYZFAIL: ioctl remote attach failed 3 105d 158d
kernel: page fault trap, code=0 (4) 2 107d 135d
SYZFAIL: tun: can't open device (2) 1 136d 136d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (20) 24 62d 81d
openbsd test error: timed out (3) 72 68d 71d
multicore test error: timed out (3) 150 68d 71d
kernel: protection fault trap, code=NUM 1 81d 81d
uvm_fault: x86_ipi_db (6) 1 103d 103d
panic: wakeup: p_stat iSeaBIOS (version NUM.NUM.NUM-google) 1 104d 104d
uvm_fault: x86_ipi_db (5) 1 107d 107d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (19) 3 117d 117d
uvm_fault: x86_ipi_db (4) 1 121d 121d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (18) 6 140d 141d
panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) kmmaplk 11 238d 402d
multicore build error (12) 1 279d 279d
uvm_fault: x86_ipi_db (3) 4 286d 303d
panic: runtime error: invalid memory address or nil pointer dereference (6) 276 211d 211d
openbsd test error: lost connection to test machine (2) 3 224d 224d
multicore test error: lost connection to test machine (2) 6 224d 224d
openbsd test error: lost connection to test machine 15 224d 224d
multicore test error: lost connection to test machine 36 224d 225d
corrupted report (4) 21 320d 489d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (17) 3 271d 271d
panic: runtime error: invalid memory address or nil pointer dereference (5) 10821 264d 264d
panic: runtime error: invalid memory address or nil pointer dereference (4) 2753 264d 264d
SYZFAIL: clone failed syz 1 285d 285d
multicore build error (11) 2 286d 286d
multicore build error (10) 2 318d 391d
openbsd build error (13) 1 396d 396d
uvm_fault: x86_ipi_db (2) 1 337d 337d
uvm_fault: x86_ipi_db 1 340d 340d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (16) 21 342d 347d
assert "(key.from) > 0 && (key.from) <= w_max_used_index && (key.from) < witness_count" failed in subr_witness.c 1 443d 443d
uvm_fault: strlen 1 447d 447d
panic: ffs_alloccg: map corrupted 1 448d 448d
uvm_fault: fdcopy 1 452d 452d
panic (2) syz 8 367d 376d
uvm_fault: in6_pcbhashlookup 1 460d 460d
panic 1 379d 379d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 (3) 9 471d 474d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (15) 6 398d 406d
assert "ifp != NULL" failed in if_ether.c (3) 2 481d 486d
uvm_fault: pmap_page_remove (2) 5 486d 663d
uvm_fault: nd6_dad_duplicated 1 486d 486d
soreceive 1 58 492d 648d
pool: free list modified: pvpl 17 493d 748d
panic: runtime error: invalid memory address or nil pointer dereference (3) 28 494d 760d
panic: m_copym0: m == NULL and not COPYALL 306 491d 755d
panic: m_copym0: short mbuf chain 214 495d 754d
witness: reversal: vmmaplk inode (2) C 46771 406d 720d
witness: reversal: inode netlock C 6 406d 406d
witness: reversal: netlock inode C 11 406d 406d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 (3) 3 407d 407d
uvm_fault: tun_dev_read (2) 71 500d 747d
uvm_fault: rtrequest 1 500d 500d
openbsd build error (12) 1 411d 411d
multicore build error (9) 1 411d 411d
uvm_fault: ml_dequeue 2 501d 542d
assert "dupe == NULL" failed in uvm_page.c (2) 1 501d 501d
panic: pr_find_pagehead: mbufpl: incorrect page (2) 20 505d 772d
uvm_fault: memcpy (3) 26 506d 563d
uvm_fault: sbdrop 44 513d 732d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (14) 6 424d 425d
assert "pg->wire_count == 1" failed in vfs_biomem.c (2) 9 515d 583d
panic: in6_cksum: out of data, len 64 1 517d 517d
uvm_fault: _bpf_mtap (2) 8 520d 535d
panic: unhandled af (3) syz 7 516d 525d
uvm_fault: ml_enlist (2) 1 520d 520d
uvm_fault: ml_purge (2) 8 526d 744d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (13) 39 445d 524d
panic: pr_find_pagehead: mbufpl: page header missing (3) 2 530d 563d
uvm_fault: m_free (2) 429 500d 749d
uvm_fault: pool_cache_get 518 501d 779d
pool: free list modified: anonpl 8 533d 755d
panic: amap_lookup: offset out of range 2 536d 583d
uvm_fault: 0x1:uvm_fault(ADDR, 0x1, 0, 1) -> e kernel: page fault trap, code=0Stopped at db_read_bytes 1 448d 448d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 (2) 45 449d 450d
panic: free: size too small 10 <= 4096 / 2 (ADDR) type devbuf 2 539d 544d
pool: free list modified: vcpupl 1 540d 540d
uvm_fault: bpf_mtap 10 540d 768d
pool: free list modified: filepl 1 547d 547d
pool: free list modified: shmpl (3) 1 552d 552d
uvm_fault: uvmfault_anonget 1 555d 555d
uvm_fault: unveil_find_cover 1 556d 556d
assert "mhead->m_flags & M_PKTHDR" failed in switchctl.c (2) 1 557d 557d
malloc: free list modified: free 12 558d 780d
uvm_fault: nd6_ns_output 1 565d 565d
uvm_fault: x86_send_ipi (2) 2 567d 578d
panic.go:LINE +0x72 (7) syz 3 486d 487d
assert "ifp != NULL" failed in rtsock.c (2) 26 545d 548d
panic: vref used where vget required (2) 2 576d 580d
panic: amap_lookups: offset out of range (2) 1 577d 577d
pool: free list modified: pffrnode 7 577d 715d
uvm_fault: uvm_map_clean 1 579d 579d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (8) 10 531d 602d
uvm_fault: igmp_leavegroup 1 581d 581d
syzkaller: make target failed: failed to run ["gmake" "target"]: exit status 2 3 492d 492d
panic(ADDR) at panic+0x164 1 494d 494d
openbsd boot error: can't ssh into the instance (3) 18 495d 496d
multicore boot error: can't ssh into the instance (3) 15 495d 496d
kernel: privileged instruction fault trap, code=0 (2) 1 586d 586d
assert "!_kernel_lock_held()" failed in kern_fork.c (2) 1 586d 586d
uvm_fault(ADDR, 0xa, 0, 1) -> e (2) 1 501d 501d
assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (2) 1 590d 590d
no output from test machine (4) syz 14713 504d 510d
panic: amap_wipeout: corrupt amap 6 595d 684d
uvm_fault(ADDR, 0x7b8, 0, 1) -> e 1 513d 513d
uvm_fault(ADDR, 0x3, 0, 1) -> e (2) 1 517d 517d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 (2) 21 519d 521d
uvm_fault(ADDR, 0xa, 0, 1) -> e 1 519d 519d
pool: free list modified: tcpqe 4 610d 727d
uvm_fault(ADDR, 0x3, 0, 1) -> e 1 522d 522d
no output from test machine (2) C 89865 525d 578d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (12) 9 534d 536d
assert "sb->sb_cc == 0" failed in uipc_socket2.c 2 615d 660d
pool: free list modified: vmsppl 1 527d 527d
uvm_fault(ADDR, 0xbef, 0, 1) -> e (2) 1 527d 527d
uvm_fault(ADDR, 0x10b, 0, 1) -> e (2) 1 533d 533d
uvm_fault(ADDR, 0xbef, 0, 1) -> e 1 535d 535d
pool: free list modified: vnodes 1 629d 629d
uvm_fault(ADDR, 0x10b, 0, 1) -> e 1 548d 548d
kernel: page fault trap, code=0 (3) 1 549d 549d
panic: bad group arg size 29, should be <= 32 for &prog.GroupArg{ArgCommon:prog.ArgCommon{ref:LINEx328, dir:LINEx0}, Inn 1 552d 552d
assert "ps->ps_uvncount == 0" failed in kern_unveil.c (2) 1 647d 647d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (11) 6 558d 581d
pool: free list modified: uvmvnodes 1 649d 649d
pool: free list modified: sockpl 2 651d 661d
uvm_fault(ADDR, ADDR, 0, 1) -> e 1 561d 561d
panic: bad group arg size 29, should be <= 32 for &prog.GroupArg{ArgCommon:prog.ArgCommon{ref:LINEx2c0, dir:LINEx0}, Inn 1 565d 565d
uvm_fault: memcpy (2) syz 2168 570d 819d
uvm_fault: vio_start 1 661d 661d
uvm_fault: syscall 1 663d 663d
panic: broken type ref 1 578d 578d
pool: free list modified: mtagpl 1 665d 665d
assert "dupe == NULL" failed in uvm_page.c 4 665d 779d
pool: free list modified: art_table 1 668d 668d
assert "ifp != NULL" failed in if_ether.c (2) 1 675d 675d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 3 585d 585d
kqueue: knote !ACTIVE 2 678d 682d
uvm_fault: in4_cksum 1 682d 682d
panic: bad arg kind: <nil> (11) 1 598d 598d
kernel: privileged instruction fault trap, code=0 1 690d 690d
uvm_fault: ml_enlist 1 690d 690d
uvm_fault: tun_init 1 691d 691d
uvm_fault returns 14, GPA=ADDR C 2 604d 604d
panic: lock (kernel_lock) mbufpl not locked 1 695d 695d
panic: bad group arg size 0, should be <= 24 for &prog.GroupArg{ArgCommon:prog.ArgCommon{typ:(*prog.StructType)(ADDR)}, 1 607d 607d
panic.go:LINE +0x72 (5) 1 610d 610d
assert "pg->wire_count == 0" failed in uvm_page.c 1 705d 705d
panic: bad arg kind: <nil> (10) 1 619d 619d
panic: bad arg kind: <nil> (9) 1 623d 623d
pool: free list modified: art_heap4 2 718d 742d
uvm_fault: _bus_dmamap_load_mbuf 1 721d 721d
uvm_fault: m_copym 1 722d 722d
panic: bad arg kind: <nil> (8) 1 634d 634d
panic: pr_find_pagehead: mbufpl: page header missing (2) 1 725d 725d
pool: cpu free list modified: mcl2k 1 726d 726d
panic: bad arg kind: <nil> (7) 1 638d 638d
pool: free list modified: shmpl (2) 1 732d 732d
panic: bad arg kind: <nil> (6) 1 644d 644d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (7) 1 645d 645d
assert "mhead->m_flags & M_PKTHDR" failed in switchctl.c 1 736d 736d
pool: double put: mbufpl (2) 2 737d 768d
panic: attempt to access user address ADDR in supervisor mode 7 741d 791d
kernel: double fault trap, code=0 (2) syz 2 767d 767d
uvm_fault: rtable_satoplen (3) syz 237 775d 819d
panic: amap_lookups: offset out of range 1 745d 745d
panic: bad arg kind: <nil> (5) 1 658d 658d
uvm_fault: witness_checkorder (2) 1 748d 748d
panic: bad arg kind: &prog.IntType{IntTypeCommon:prog.IntTypeCommon{TypeCommon:prog.TypeCommon{TypeName:"int32", FldName 1 661d 661d
panic: bad arg kind (2) 2 751d 752d
assert "pg->wire_count == 1" failed in vfs_biomem.c 66 751d 1076d
assert "ifp != NULL" failed in rtsock.c 2 752d 753d
panic.go:LINE +0x72 (4) 1 662d 662d
uvm_fault: x86_send_ipi 1 755d 755d
uvm_fault: VOP_ISLOCKED 1 756d 756d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (10) 3 666d 666d
panic: bad arg kind: <nil> (4) 1 668d 668d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (6) 1 668d 668d
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = ADDR, pa = ADDR (2) 1 760d 760d
uvm_fault: m_zero 1 762d 762d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (5) 1 676d 676d
panic: free: non-malloced addr ADDR type in_multi 4 766d 788d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (9) 3 678d 678d
uvm_fault: pfi_kif_update 6 769d 896d
uvm_fault: fifo_write 1 769d 769d
panic.go:LINE +0x72 (3) 1 680d 680d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (4) 2 682d 683d
panic: receive 1: so ADDR, so_type 3, sb_cc 176 1 771d 771d
panic: ffs_valloc: dup alloc 2 772d 775d
uvm_fault: 0ddb{1}> ddb{1}> set $lines = 0ddb{1}> set $maxwidth = 0ddb{1}> show panickernel page faultattempt to e 1 684d 684d
assert "!_kernel_lock_held()" failed in kern_fork.c 15 776d 1037d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (8) 3 689d 689d
panic: WAaRcNqIuNirGi:n g SPbLl NoOcT kLaObWlEReE Ds lOeNe pSY SloCcAkL Lwi 2 t15h7 s79p3i4n4l5o0c kEX IorT 0c rai 1 689d 689d
uvm_fault 10 782d 797d
panic: free: size too small 24 <= 256 / 2 (ADDR) type in_multi 1 787d 787d
panic: bad arg kind: <nil> (3) 1 698d 698d
assert "cifp != NULL" failed in route.c 89 761d 816d
assert "rt->rt_ifa->ifa_ifp != NULL" failed in route.c 830 760d 801d
uvm_fault: in6_purgeaddr 1423 760d 801d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (7) 3 702d 702d
assert "ifp != NULL" failed in if_ether.c 208 762d 817d
assert "ifa == rt->rt_ifa" failed in nd6.c (2) 262 763d 800d
uvm_fault: tun_clone_destroy 1 793d 793d
panic: bad arg kind: <nil> (2) 1 710d 710d
panic: bad arg kind: <nil> 1 713d 713d
panic.go:LINE +0x72 (2) 1 715d 715d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (6) 3 717d 717d
uvm_fault: pmap_page_remove 7 809d 1066d
openbsd build error (7) 1 721d 721d
multicore boot error: can't ssh into the instance (2) 96 737d 738d
openbsd boot error: can't ssh into the instance (2) 48 737d 738d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (3) 1 737d 737d
panic: vref used where vget required 1 827d 827d
panic: pfi_dynaddr_update 2 843d 924d
uvm_fault: pool_do_put 1 761d 761d
panic: runtime error: invalid memory address or nil pointer dereference (2) 1 763d 763d
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = ADDR, pa = ADDR 1 766d 766d
pool: free list modified: pdppl 1 766d 766d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (5) 3 766d 766d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (2) 1 766d 766d
panic.go:LINE +0x72 1 767d 767d
witness: reversal: inode fdlock C 523 834d 1047d
panic: runtime error: invalid memory address or nil pointer dereference 1 771d 771d
panic: fifo_badop called C 8841 773d 1108d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR 1 788d 788d
panic: ffs_blkfree: bad size 2 888d 892d
kernel: double fault trap, code=0 1 936d 936d
assert "la != NULL" failed in if_ether.c 3 921d 923d
uvm_fault: ml_purge 6 919d 925d
panic: in_cksum: out of data, len 63 1 905d 905d
uvm_fault: pfi_ifhead_RB_REMOVE 1 926d 926d
panic: uvm_fault_unwire_locked: address not in map (2) 7 916d 1044d
panicConnection to ssh-serialport.googleapis.com closed by remote host. 1 775d 775d
uvm_fault: vfs_lookup 1 960d 960d
panic: Data modified on freelist: word 4 of object ADDR size 0x84 previous type free (ADDR != ADDR) 1 787d 787d
panic: Data modified on freelist: word 5 of object ADDR size 0xa0 previous type devbuf (0xd != ADDR) 1 787d 787d
panic: Data modified on freelist: word 5 of object ADDR size 0xc0 previous type devbuf (0xd != ADDR) 1 794d 794d
panic: Data modified on freelist: word 5 of object ADDR size 0x100 previous type devbuf (0xd != ADDR) syz 7 787d 817d
panic: attempt WtAoR eNIxNeGc:u tSeP uL seNOrT a LddOrWEesRsE D 0Ox0N iSYn SCsAuLpLe rv3i 4s orEX ImTo d0 e9 1 787d 787d
panic: bad arg kind 1 798d 798d
uvm_fault: ADDR: movl $ADDR,0(%rdi)ddb> ddb> set $lines = 0ddb> set $maxwidth = 0ddb> show panickernel page 1 802d 802d
uvm_fault: ADDR: jmp ADDR 1 804d 804d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (4) 9 811d 811d
uvm_fault: pmap_enter syz 3 1052d 1058d
panic: malloc: allocation tooWA RlNaIrNGge: ,SPL NOT LOWERED ON SYSCALL 3 4 EXIT 0 9 1 830d 830d
multicore test error: timed out 43 949d 986d
panic: amap_add: slot in use 2 1039d 1044d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (3) 12 868d 869d
panic: vput: v_writecount != 0 C 2 870d 870d
uvm_fault: _bpf_mtap 31 1081d 1104d
panic: pool_cache_item_magic_check: mcl2k cpu free list modified: item addr ADDR+24 ADDR!=ADDR 1 1085d 1085d
panic: rw_enter: vmmaplk locking against myself 3 1095d 1097d
uvm_fault: tun_dev_read 2 1095d 1097d
openbsd test error: timed out 19 954d 1014d
panic: bpf_mcopy 1 1099d 1099d
multicore build error (4) 2 943d 943d
openbsd build error (6) 1 943d 943d
pool: double put: mcl2k 4 1101d 1103d
pool: double put: mcl64k 1 1102d 1102d
panic: missing alias 1 1106d 1106d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (2) 3 937d 937d
panic: bad dir C 1390 942d 943d
multicore build error (2) 10 968d 969d
openbsd build error (4) 5 968d 969d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 12 977d 978d
multicore build error 26 978d 979d
openbsd build error (3) 13 978d 979d
multicore boot error: can't ssh into the instance 6 978d 978d
openbsd boot error: can't ssh into the instance 3 978d 978d
panic: ffs_read: type 0 1 1115d 1115d
panic: serialport: VM disconnected. 1 986d 986d
panic: kserialport: VM disconnected. 1 987d 987d
panic: kernel diagnostic serialport: VM disconnected. 1 987d 987d
panic: kernel diserialport: VM disconnected. 1 1066d 1066d
openbsd build error 1 1031d 1031d
lost connection to test machine C 276 1079d 1153d
https://github.com/openbsd/src.git boot error: uvm_fault: memcmp 6 1085d 1085d
https://github.com/openbsd/src.git test error 16 1093d 1114d
multicore boot error: uvm_fault: smbios_find 12 1085d 1085d
kernel: kernel relinking fa 1 1174d 1153d
https://github.com/openbsd/src.git boot error 479 1108d 1153d
panic: sandbox escaping file name "../file0" 111 1108d 1109d
multicore test error (2) 3 1094d 1094d
multicore test error 3 1094d 1094d
panic: sandbox escaping file name "../file0/file0", Files are map[./file0:true ../file0:true] 1 1108d 1108d
panic: sandbox escaping file name "../file0", Files are map[../file0:true] 11 1108d 1108d
panic: sandbox escaping file name "../file0", Files are map[./file0:true ../file0:true] 1 1108d 1108d
panic: sandbox escaping file name "../file0/file0" 2 1108d 1108d