syzbot


Title Repro Cause bisect Fix bisect Count Last Reported
uvm_fault: in6_pcbhashlookup 1 90d 90d
panic 1 9d12h 9d12h
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 (3) 9 101d 105d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (15) 6 28d 37d
assert "ifp != NULL" failed in if_ether.c (3) 2 112d 116d
uvm_fault: pmap_page_remove (2) 5 116d 293d
uvm_fault: nd6_dad_duplicated 1 116d 116d
soreceive 1 58 122d 278d
pool: free list modified: pvpl 17 123d 378d
panic: runtime error: invalid memory address or nil pointer dereference (3) 28 124d 390d
panic: m_copym0: m == NULL and not COPYALL 306 121d 385d
panic: m_copym0: short mbuf chain 214 125d 384d
witness: reversal: vmmaplk inode (2) C 46771 36d 350d
witness: reversal: inode netlock C 6 36d 37d
witness: reversal: netlock inode C 11 36d 37d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 (3) 3 37d 37d
uvm_fault: tun_dev_read (2) 71 130d 377d
uvm_fault: rtrequest 1 130d 130d
openbsd build error (12) 1 41d 41d
multicore build error (9) 1 41d 41d
uvm_fault: ml_dequeue 2 131d 173d
assert "dupe == NULL" failed in uvm_page.c (2) 1 131d 131d
panic: pr_find_pagehead: mbufpl: incorrect page (2) 20 136d 402d
uvm_fault: memcpy (3) 26 136d 193d
uvm_fault: sbdrop 44 143d 362d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (14) 6 54d 55d
assert "pg->wire_count == 1" failed in vfs_biomem.c (2) 9 145d 213d
panic: in6_cksum: out of data, len 64 1 147d 147d
uvm_fault: _bpf_mtap (2) 8 150d 165d
panic: unhandled af (3) syz 7 146d 155d
uvm_fault: ml_enlist (2) 1 151d 151d
uvm_fault: ml_purge (2) 8 156d 374d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (13) 39 75d 154d
panic: pr_find_pagehead: mbufpl: page header missing (3) 2 160d 193d
uvm_fault: m_free (2) 429 130d 379d
uvm_fault: pool_cache_get 518 131d 409d
pool: free list modified: anonpl 8 163d 385d
panic: amap_lookup: offset out of range 2 166d 213d
uvm_fault: 0x1:uvm_fault(ADDR, 0x1, 0, 1) -> e kernel: page fault trap, code=0Stopped at db_read_bytes 1 78d 78d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 (2) 45 79d 81d
panic: free: size too small 10 <= 4096 / 2 (ADDR) type devbuf 2 169d 174d
pool: free list modified: vcpupl 1 170d 170d
uvm_fault: bpf_mtap 10 170d 398d
pool: free list modified: filepl 1 177d 177d
pool: free list modified: shmpl (3) 1 182d 182d
uvm_fault: uvmfault_anonget 1 185d 185d
uvm_fault: unveil_find_cover 1 186d 186d
assert "mhead->m_flags & M_PKTHDR" failed in switchctl.c (2) 1 187d 187d
malloc: free list modified: free 12 188d 410d
uvm_fault: nd6_ns_output 1 195d 195d
uvm_fault: x86_send_ipi (2) 2 197d 209d
panic.go:LINE +0x72 (7) syz 3 116d 117d
assert "ifp != NULL" failed in rtsock.c (2) 26 175d 178d
panic: vref used where vget required (2) 2 206d 210d
panic: amap_lookups: offset out of range (2) 1 207d 207d
pool: free list modified: pffrnode 7 207d 346d
uvm_fault: uvm_map_clean 1 209d 209d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (8) 10 161d 233d
uvm_fault: igmp_leavegroup 1 211d 211d
syzkaller: make target failed: failed to run ["gmake" "target"]: exit status 2 3 122d 122d
panic(ADDR) at panic+0x164 1 125d 125d
openbsd boot error: can't ssh into the instance (3) 18 125d 126d
multicore boot error: can't ssh into the instance (3) 15 125d 126d
kernel: privileged instruction fault trap, code=0 (2) 1 216d 216d
assert "!_kernel_lock_held()" failed in kern_fork.c (2) 1 216d 216d
uvm_fault(ADDR, 0xa, 0, 1) -> e (2) 1 131d 131d
assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (2) 1 220d 220d
no output from test machine (4) syz 14713 134d 141d
panic: amap_wipeout: corrupt amap 6 225d 314d
uvm_fault(ADDR, 0x7b8, 0, 1) -> e 1 143d 143d
uvm_fault(ADDR, 0x3, 0, 1) -> e (2) 1 147d 147d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 (2) 21 149d 151d
uvm_fault(ADDR, 0xa, 0, 1) -> e 1 149d 149d
pool: free list modified: tcpqe 4 240d 357d
uvm_fault(ADDR, 0x3, 0, 1) -> e 1 152d 152d
no output from test machine (2) C 89865 155d 208d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (12) 9 164d 167d
assert "sb->sb_cc == 0" failed in uipc_socket2.c 2 246d 290d
pool: free list modified: vmsppl 1 157d 157d
uvm_fault(ADDR, 0xbef, 0, 1) -> e (2) 1 157d 157d
uvm_fault(ADDR, 0x10b, 0, 1) -> e (2) 1 163d 163d
uvm_fault(ADDR, 0xbef, 0, 1) -> e 1 165d 165d
pool: free list modified: vnodes 1 259d 259d
uvm_fault(ADDR, 0x10b, 0, 1) -> e 1 178d 178d
kernel: page fault trap, code=0 (3) 1 179d 179d
panic: bad group arg size 29, should be <= 32 for &prog.GroupArg{ArgCommon:prog.ArgCommon{ref:LINEx328, dir:LINEx0}, Inn 1 182d 182d
assert "ps->ps_uvncount == 0" failed in kern_unveil.c (2) 1 277d 277d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (11) 6 189d 211d
pool: free list modified: uvmvnodes 1 279d 279d
pool: free list modified: sockpl 2 281d 292d
uvm_fault(ADDR, ADDR, 0, 1) -> e 1 191d 191d
panic: bad group arg size 29, should be <= 32 for &prog.GroupArg{ArgCommon:prog.ArgCommon{ref:LINEx2c0, dir:LINEx0}, Inn 1 195d 195d
uvm_fault: memcpy (2) syz 2168 200d 449d
uvm_fault: vio_start 1 291d 291d
uvm_fault: syscall 1 293d 293d
panic: broken type ref 1 208d 208d
pool: free list modified: mtagpl 1 295d 295d
assert "dupe == NULL" failed in uvm_page.c 4 296d 409d
pool: free list modified: art_table 1 298d 298d
assert "ifp != NULL" failed in if_ether.c (2) 1 306d 306d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 3 216d 216d
kqueue: knote !ACTIVE 2 308d 312d
uvm_fault: in4_cksum 1 312d 312d
panic: bad arg kind: <nil> (11) 1 229d 229d
kernel: privileged instruction fault trap, code=0 1 320d 320d
uvm_fault: ml_enlist 1 321d 321d
uvm_fault: tun_init 1 321d 321d
uvm_fault returns 14, GPA=ADDR C 2 234d 234d
panic: lock (kernel_lock) mbufpl not locked 1 325d 325d
panic: bad group arg size 0, should be <= 24 for &prog.GroupArg{ArgCommon:prog.ArgCommon{typ:(*prog.StructType)(ADDR)}, 1 237d 237d
panic.go:LINE +0x72 (5) 1 240d 240d
assert "pg->wire_count == 0" failed in uvm_page.c 1 335d 335d
panic: bad arg kind: <nil> (10) 1 250d 250d
panic: bad arg kind: <nil> (9) 1 253d 253d
pool: free list modified: art_heap4 2 348d 372d
uvm_fault: _bus_dmamap_load_mbuf 1 351d 351d
uvm_fault: m_copym 1 353d 353d
panic: bad arg kind: <nil> (8) 1 265d 265d
panic: pr_find_pagehead: mbufpl: page header missing (2) 1 355d 355d
pool: cpu free list modified: mcl2k 1 356d 356d
panic: bad arg kind: <nil> (7) 1 269d 269d
pool: free list modified: shmpl (2) 1 363d 363d
panic: bad arg kind: <nil> (6) 1 274d 274d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (7) 1 275d 275d
assert "mhead->m_flags & M_PKTHDR" failed in switchctl.c 1 366d 366d
pool: double put: mbufpl (2) 2 367d 398d
panic: attempt to access user address ADDR in supervisor mode 7 371d 421d
kernel: double fault trap, code=0 (2) syz 2 398d 398d
uvm_fault: rtable_satoplen (3) syz 237 406d 449d
panic: amap_lookups: offset out of range 1 375d 375d
panic: bad arg kind: <nil> (5) 1 288d 288d
uvm_fault: witness_checkorder (2) 1 378d 378d
panic: bad arg kind: &prog.IntType{IntTypeCommon:prog.IntTypeCommon{TypeCommon:prog.TypeCommon{TypeName:"int32", FldName 1 291d 291d
panic: bad arg kind (2) 2 381d 383d
assert "pg->wire_count == 1" failed in vfs_biomem.c 66 381d 706d
assert "ifp != NULL" failed in rtsock.c 2 382d 383d
panic.go:LINE +0x72 (4) 1 292d 292d
uvm_fault: x86_send_ipi 1 386d 386d
uvm_fault: VOP_ISLOCKED 1 386d 386d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (10) 3 296d 296d
panic: bad arg kind: <nil> (4) 1 299d 299d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (6) 1 299d 299d
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = ADDR, pa = ADDR (2) 1 390d 390d
uvm_fault: m_zero 1 392d 392d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (5) 1 306d 306d
panic: free: non-malloced addr ADDR type in_multi 4 396d 418d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (9) 3 308d 308d
uvm_fault: pfi_kif_update 6 399d 526d
uvm_fault: fifo_write 1 399d 399d
panic.go:LINE +0x72 (3) 1 310d 310d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (4) 2 312d 313d
panic: receive 1: so ADDR, so_type 3, sb_cc 176 1 401d 401d
panic: ffs_valloc: dup alloc 2 402d 405d
uvm_fault: 0ddb{1}> ddb{1}> set $lines = 0ddb{1}> set $maxwidth = 0ddb{1}> show panickernel page faultattempt to e 1 315d 315d
assert "!_kernel_lock_held()" failed in kern_fork.c 15 406d 667d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (8) 3 319d 319d
panic: WAaRcNqIuNirGi:n g SPbLl NoOcT kLaObWlEReE Ds lOeNe pSY SloCcAkL Lwi 2 t15h7 s79p3i4n4l5o0c kEX IorT 0c rai 1 319d 319d
uvm_fault 10 412d 427d
panic: free: size too small 24 <= 256 / 2 (ADDR) type in_multi 1 417d 417d
panic: bad arg kind: <nil> (3) 1 329d 329d
assert "cifp != NULL" failed in route.c 89 391d 446d
assert "rt->rt_ifa->ifa_ifp != NULL" failed in route.c 830 391d 431d
uvm_fault: in6_purgeaddr 1423 391d 431d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (7) 3 332d 332d
assert "ifp != NULL" failed in if_ether.c 208 392d 447d
assert "ifa == rt->rt_ifa" failed in nd6.c (2) 262 393d 430d
uvm_fault: tun_clone_destroy 1 423d 423d
panic: bad arg kind: <nil> (2) 1 340d 340d
panic: bad arg kind: <nil> 1 343d 343d
panic.go:LINE +0x72 (2) 1 346d 346d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (6) 3 347d 347d
uvm_fault: pmap_page_remove 7 439d 696d
openbsd build error (7) 1 351d 351d
multicore boot error: can't ssh into the instance (2) 96 367d 369d
openbsd boot error: can't ssh into the instance (2) 48 367d 369d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (3) 1 367d 367d
panic: vref used where vget required 1 457d 457d
panic: pfi_dynaddr_update 2 474d 554d
uvm_fault: pool_do_put 1 391d 391d
panic: runtime error: invalid memory address or nil pointer dereference (2) 1 393d 393d
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = ADDR, pa = ADDR 1 396d 396d
pool: free list modified: pdppl 1 396d 396d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (5) 3 396d 396d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (2) 1 396d 396d
panic.go:LINE +0x72 1 397d 397d
witness: reversal: inode fdlock C 523 464d 677d
panic: runtime error: invalid memory address or nil pointer dereference 1 402d 402d
panic: fifo_badop called C 8841 403d 738d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR 1 418d 418d
panic: ffs_blkfree: bad size 2 518d 522d
kernel: double fault trap, code=0 1 566d 566d
assert "la != NULL" failed in if_ether.c 3 551d 553d
uvm_fault: ml_purge 6 550d 555d
panic: in_cksum: out of data, len 63 1 536d 536d
uvm_fault: pfi_ifhead_RB_REMOVE 1 557d 557d
panic: uvm_fault_unwire_locked: address not in map (2) 7 546d 674d
panicConnection to ssh-serialport.googleapis.com closed by remote host. 1 405d 405d
uvm_fault: vfs_lookup 1 590d 590d
panic: Data modified on freelist: word 4 of object ADDR size 0x84 previous type free (ADDR != ADDR) 1 417d 417d
panic: Data modified on freelist: word 5 of object ADDR size 0xa0 previous type devbuf (0xd != ADDR) 1 417d 417d
panic: Data modified on freelist: word 5 of object ADDR size 0xc0 previous type devbuf (0xd != ADDR) 1 424d 424d
panic: Data modified on freelist: word 5 of object ADDR size 0x100 previous type devbuf (0xd != ADDR) syz 7 417d 447d
panic: attempt WtAoR eNIxNeGc:u tSeP uL seNOrT a LddOrWEesRsE D 0Ox0N iSYn SCsAuLpLe rv3i 4s orEX ImTo d0 e9 1 417d 417d
panic: bad arg kind 1 428d 428d
uvm_fault: ADDR: movl $ADDR,0(%rdi)ddb> ddb> set $lines = 0ddb> set $maxwidth = 0ddb> show panickernel page 1 432d 432d
uvm_fault: ADDR: jmp ADDR 1 434d 434d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (4) 9 441d 442d
uvm_fault: pmap_enter syz 3 682d 688d
panic: malloc: allocation tooWA RlNaIrNGge: ,SPL NOT LOWERED ON SYSCALL 3 4 EXIT 0 9 1 461d 461d
multicore test error: timed out 43 579d 616d
panic: amap_add: slot in use 2 669d 674d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (3) 12 498d 499d
panic: vput: v_writecount != 0 C 2 500d 500d
uvm_fault: _bpf_mtap 31 712d 734d
panic: pool_cache_item_magic_check: mcl2k cpu free list modified: item addr ADDR+24 ADDR!=ADDR 1 715d 715d
panic: rw_enter: vmmaplk locking against myself 3 725d 727d
uvm_fault: tun_dev_read 2 726d 727d
openbsd test error: timed out 19 584d 644d
panic: bpf_mcopy 1 729d 729d
multicore build error (4) 2 573d 573d
openbsd build error (6) 1 573d 573d
pool: double put: mcl2k 4 731d 733d
pool: double put: mcl64k 1 732d 732d
panic: missing alias 1 736d 736d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (2) 3 567d 567d
panic: bad dir C 1390 572d 573d
multicore build error (2) 10 598d 599d
openbsd build error (4) 5 598d 599d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 12 607d 608d
multicore build error 26 608d 609d
openbsd build error (3) 13 608d 609d
multicore boot error: can't ssh into the instance 6 608d 608d
openbsd boot error: can't ssh into the instance 3 608d 608d
panic: ffs_read: type 0 1 746d 746d
panic: serialport: VM disconnected. 1 617d 617d
panic: kserialport: VM disconnected. 1 617d 617d
panic: kernel diagnostic serialport: VM disconnected. 1 617d 617d
panic: kernel diserialport: VM disconnected. 1 696d 696d
openbsd build error 1 661d 661d
lost connection to test machine C 276 709d 783d
https://github.com/openbsd/src.git boot error: uvm_fault: memcmp 6 715d 715d
https://github.com/openbsd/src.git test error 16 723d 744d
multicore boot error: uvm_fault: smbios_find 12 715d 715d
kernel: kernel relinking fa 1 804d 783d
https://github.com/openbsd/src.git boot error 479 738d 783d
panic: sandbox escaping file name "../file0" 111 738d 739d
multicore test error (2) 3 725d 725d
multicore test error 3 725d 725d
panic: sandbox escaping file name "../file0/file0", Files are map[./file0:true ../file0:true] 1 738d 738d
panic: sandbox escaping file name "../file0", Files are map[../file0:true] 11 738d 738d
panic: sandbox escaping file name "../file0", Files are map[./file0:true ../file0:true] 1 738d 738d
panic: sandbox escaping file name "../file0/file0" 2 738d 738d