syzbot


Title Repro Cause bisect Fix bisect Count Last Reported
kernel: protection fault trap, code=NUM 1 4d23h 4d23h
uvm_fault: x86_ipi_db (6) 1 27d 27d
panic: wakeup: p_stat iSeaBIOS (version NUM.NUM.NUM-google) 1 28d 28d
uvm_fault: x86_ipi_db (5) 1 31d 31d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (19) 3 41d 41d
uvm_fault: x86_ipi_db (4) 1 45d 45d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (18) 6 64d 64d
panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) kmmaplk 11 162d 326d
multicore build error (12) 1 203d 203d
uvm_fault: x86_ipi_db (3) 4 210d 227d
panic: runtime error: invalid memory address or nil pointer dereference (6) 276 135d 135d
openbsd test error: lost connection to test machine (2) 3 148d 148d
multicore test error: lost connection to test machine (2) 6 148d 148d
openbsd test error: lost connection to test machine 15 148d 148d
multicore test error: lost connection to test machine 36 148d 148d
corrupted report (4) 21 244d 413d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (17) 3 194d 194d
panic: runtime error: invalid memory address or nil pointer dereference (5) 10821 187d 188d
panic: runtime error: invalid memory address or nil pointer dereference (4) 2753 188d 188d
SYZFAIL: clone failed syz 1 209d 209d
multicore build error (11) 2 210d 210d
multicore build error (10) 2 242d 315d
openbsd build error (13) 1 320d 320d
uvm_fault: x86_ipi_db (2) 1 260d 260d
uvm_fault: x86_ipi_db 1 264d 264d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (16) 21 266d 270d
assert "(key.from) > 0 && (key.from) <= w_max_used_index && (key.from) < witness_count" failed in subr_witness.c 1 367d 367d
uvm_fault: strlen 1 371d 371d
panic: ffs_alloccg: map corrupted 1 372d 372d
uvm_fault: fdcopy 1 376d 376d
panic (2) syz 8 291d 300d
uvm_fault: in6_pcbhashlookup 1 384d 384d
panic 1 303d 303d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 (3) 9 395d 398d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (15) 6 321d 330d
assert "ifp != NULL" failed in if_ether.c (3) 2 405d 410d
uvm_fault: pmap_page_remove (2) 5 410d 586d
uvm_fault: nd6_dad_duplicated 1 410d 410d
soreceive 1 58 416d 572d
pool: free list modified: pvpl 17 417d 672d
panic: runtime error: invalid memory address or nil pointer dereference (3) 28 418d 684d
panic: m_copym0: m == NULL and not COPYALL 306 415d 679d
panic: m_copym0: short mbuf chain 214 419d 678d
witness: reversal: vmmaplk inode (2) C 46771 330d 644d
witness: reversal: inode netlock C 6 330d 330d
witness: reversal: netlock inode C 11 330d 330d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 (3) 3 331d 331d
uvm_fault: tun_dev_read (2) 71 424d 671d
uvm_fault: rtrequest 1 424d 424d
openbsd build error (12) 1 335d 335d
multicore build error (9) 1 335d 335d
uvm_fault: ml_dequeue 2 425d 466d
assert "dupe == NULL" failed in uvm_page.c (2) 1 425d 425d
panic: pr_find_pagehead: mbufpl: incorrect page (2) 20 429d 696d
uvm_fault: memcpy (3) 26 429d 487d
uvm_fault: sbdrop 44 437d 656d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (14) 6 348d 349d
assert "pg->wire_count == 1" failed in vfs_biomem.c (2) 9 439d 507d
panic: in6_cksum: out of data, len 64 1 441d 441d
uvm_fault: _bpf_mtap (2) 8 444d 458d
panic: unhandled af (3) syz 7 440d 449d
uvm_fault: ml_enlist (2) 1 444d 444d
uvm_fault: ml_purge (2) 8 450d 668d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (13) 39 369d 447d
panic: pr_find_pagehead: mbufpl: page header missing (3) 2 453d 487d
uvm_fault: m_free (2) 429 424d 673d
uvm_fault: pool_cache_get 518 425d 703d
pool: free list modified: anonpl 8 457d 679d
panic: amap_lookup: offset out of range 2 460d 507d
uvm_fault: 0x1:uvm_fault(ADDR, 0x1, 0, 1) -> e kernel: page fault trap, code=0Stopped at db_read_bytes 1 372d 372d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 (2) 45 373d 374d
panic: free: size too small 10 <= 4096 / 2 (ADDR) type devbuf 2 463d 468d
pool: free list modified: vcpupl 1 464d 464d
uvm_fault: bpf_mtap 10 464d 692d
pool: free list modified: filepl 1 471d 471d
pool: free list modified: shmpl (3) 1 476d 476d
uvm_fault: uvmfault_anonget 1 479d 479d
uvm_fault: unveil_find_cover 1 480d 480d
assert "mhead->m_flags & M_PKTHDR" failed in switchctl.c (2) 1 481d 481d
malloc: free list modified: free 12 481d 703d
uvm_fault: nd6_ns_output 1 489d 489d
uvm_fault: x86_send_ipi (2) 2 491d 502d
panic.go:LINE +0x72 (7) syz 3 410d 411d
assert "ifp != NULL" failed in rtsock.c (2) 26 469d 472d
panic: vref used where vget required (2) 2 500d 504d
panic: amap_lookups: offset out of range (2) 1 501d 501d
pool: free list modified: pffrnode 7 501d 639d
uvm_fault: uvm_map_clean 1 503d 503d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (8) 10 455d 526d
uvm_fault: igmp_leavegroup 1 505d 505d
syzkaller: make target failed: failed to run ["gmake" "target"]: exit status 2 3 416d 416d
panic(ADDR) at panic+0x164 1 418d 418d
openbsd boot error: can't ssh into the instance (3) 18 419d 420d
multicore boot error: can't ssh into the instance (3) 15 419d 420d
kernel: privileged instruction fault trap, code=0 (2) 1 510d 510d
assert "!_kernel_lock_held()" failed in kern_fork.c (2) 1 510d 510d
uvm_fault(ADDR, 0xa, 0, 1) -> e (2) 1 425d 425d
assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (2) 1 514d 514d
no output from test machine (4) syz 14713 428d 434d
panic: amap_wipeout: corrupt amap 6 519d 608d
uvm_fault(ADDR, 0x7b8, 0, 1) -> e 1 437d 437d
uvm_fault(ADDR, 0x3, 0, 1) -> e (2) 1 441d 441d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 (2) 21 443d 445d
uvm_fault(ADDR, 0xa, 0, 1) -> e 1 443d 443d
pool: free list modified: tcpqe 4 534d 651d
uvm_fault(ADDR, 0x3, 0, 1) -> e 1 446d 446d
no output from test machine (2) C 89865 449d 502d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (12) 9 458d 460d
assert "sb->sb_cc == 0" failed in uipc_socket2.c 2 539d 584d
pool: free list modified: vmsppl 1 451d 451d
uvm_fault(ADDR, 0xbef, 0, 1) -> e (2) 1 451d 451d
uvm_fault(ADDR, 0x10b, 0, 1) -> e (2) 1 457d 457d
uvm_fault(ADDR, 0xbef, 0, 1) -> e 1 459d 459d
pool: free list modified: vnodes 1 553d 553d
uvm_fault(ADDR, 0x10b, 0, 1) -> e 1 472d 472d
kernel: page fault trap, code=0 (3) 1 473d 473d
panic: bad group arg size 29, should be <= 32 for &prog.GroupArg{ArgCommon:prog.ArgCommon{ref:LINEx328, dir:LINEx0}, Inn 1 476d 476d
assert "ps->ps_uvncount == 0" failed in kern_unveil.c (2) 1 571d 571d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (11) 6 482d 505d
pool: free list modified: uvmvnodes 1 573d 573d
pool: free list modified: sockpl 2 575d 585d
uvm_fault(ADDR, ADDR, 0, 1) -> e 1 485d 485d
panic: bad group arg size 29, should be <= 32 for &prog.GroupArg{ArgCommon:prog.ArgCommon{ref:LINEx2c0, dir:LINEx0}, Inn 1 489d 489d
uvm_fault: memcpy (2) syz 2168 494d 743d
uvm_fault: vio_start 1 585d 585d
uvm_fault: syscall 1 587d 587d
panic: broken type ref 1 502d 502d
pool: free list modified: mtagpl 1 588d 588d
assert "dupe == NULL" failed in uvm_page.c 4 589d 702d
pool: free list modified: art_table 1 592d 592d
assert "ifp != NULL" failed in if_ether.c (2) 1 599d 599d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 3 509d 509d
kqueue: knote !ACTIVE 2 602d 606d
uvm_fault: in4_cksum 1 606d 606d
panic: bad arg kind: <nil> (11) 1 522d 522d
kernel: privileged instruction fault trap, code=0 1 614d 614d
uvm_fault: ml_enlist 1 614d 614d
uvm_fault: tun_init 1 615d 615d
uvm_fault returns 14, GPA=ADDR C 2 528d 528d
panic: lock (kernel_lock) mbufpl not locked 1 618d 618d
panic: bad group arg size 0, should be <= 24 for &prog.GroupArg{ArgCommon:prog.ArgCommon{typ:(*prog.StructType)(ADDR)}, 1 531d 531d
panic.go:LINE +0x72 (5) 1 533d 533d
assert "pg->wire_count == 0" failed in uvm_page.c 1 629d 629d
panic: bad arg kind: <nil> (10) 1 543d 543d
panic: bad arg kind: <nil> (9) 1 546d 546d
pool: free list modified: art_heap4 2 642d 666d
uvm_fault: _bus_dmamap_load_mbuf 1 645d 645d
uvm_fault: m_copym 1 646d 646d
panic: bad arg kind: <nil> (8) 1 558d 558d
panic: pr_find_pagehead: mbufpl: page header missing (2) 1 649d 649d
pool: cpu free list modified: mcl2k 1 650d 650d
panic: bad arg kind: <nil> (7) 1 562d 562d
pool: free list modified: shmpl (2) 1 656d 656d
panic: bad arg kind: <nil> (6) 1 568d 568d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (7) 1 568d 568d
assert "mhead->m_flags & M_PKTHDR" failed in switchctl.c 1 660d 660d
pool: double put: mbufpl (2) 2 661d 692d
panic: attempt to access user address ADDR in supervisor mode 7 665d 715d
kernel: double fault trap, code=0 (2) syz 2 691d 691d
uvm_fault: rtable_satoplen (3) syz 237 699d 743d
panic: amap_lookups: offset out of range 1 669d 669d
panic: bad arg kind: <nil> (5) 1 581d 581d
uvm_fault: witness_checkorder (2) 1 672d 672d
panic: bad arg kind: &prog.IntType{IntTypeCommon:prog.IntTypeCommon{TypeCommon:prog.TypeCommon{TypeName:"int32", FldName 1 585d 585d
panic: bad arg kind (2) 2 675d 676d
assert "pg->wire_count == 1" failed in vfs_biomem.c 66 675d 1000d
assert "ifp != NULL" failed in rtsock.c 2 675d 677d
panic.go:LINE +0x72 (4) 1 586d 586d
uvm_fault: x86_send_ipi 1 679d 679d
uvm_fault: VOP_ISLOCKED 1 680d 680d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (10) 3 590d 590d
panic: bad arg kind: <nil> (4) 1 592d 592d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (6) 1 592d 592d
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = ADDR, pa = ADDR (2) 1 684d 684d
uvm_fault: m_zero 1 686d 686d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (5) 1 600d 600d
panic: free: non-malloced addr ADDR type in_multi 4 690d 712d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (9) 3 602d 602d
uvm_fault: pfi_kif_update 6 693d 819d
uvm_fault: fifo_write 1 693d 693d
panic.go:LINE +0x72 (3) 1 604d 604d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (4) 2 606d 607d
panic: receive 1: so ADDR, so_type 3, sb_cc 176 1 695d 695d
panic: ffs_valloc: dup alloc 2 696d 699d
uvm_fault: 0ddb{1}> ddb{1}> set $lines = 0ddb{1}> set $maxwidth = 0ddb{1}> show panickernel page faultattempt to e 1 608d 608d
assert "!_kernel_lock_held()" failed in kern_fork.c 15 700d 961d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (8) 3 613d 613d
panic: WAaRcNqIuNirGi:n g SPbLl NoOcT kLaObWlEReE Ds lOeNe pSY SloCcAkL Lwi 2 t15h7 s79p3i4n4l5o0c kEX IorT 0c rai 1 613d 613d
uvm_fault 10 706d 721d
panic: free: size too small 24 <= 256 / 2 (ADDR) type in_multi 1 711d 711d
panic: bad arg kind: <nil> (3) 1 622d 622d
assert "cifp != NULL" failed in route.c 89 685d 740d
assert "rt->rt_ifa->ifa_ifp != NULL" failed in route.c 830 684d 725d
uvm_fault: in6_purgeaddr 1423 684d 725d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (7) 3 626d 626d
assert "ifp != NULL" failed in if_ether.c 208 686d 741d
assert "ifa == rt->rt_ifa" failed in nd6.c (2) 262 686d 724d
uvm_fault: tun_clone_destroy 1 717d 717d
panic: bad arg kind: <nil> (2) 1 634d 634d
panic: bad arg kind: <nil> 1 637d 637d
panic.go:LINE +0x72 (2) 1 639d 639d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (6) 3 641d 641d
uvm_fault: pmap_page_remove 7 733d 990d
openbsd build error (7) 1 645d 645d
multicore boot error: can't ssh into the instance (2) 96 661d 662d
openbsd boot error: can't ssh into the instance (2) 48 661d 662d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (3) 1 661d 661d
panic: vref used where vget required 1 751d 751d
panic: pfi_dynaddr_update 2 767d 848d
uvm_fault: pool_do_put 1 685d 685d
panic: runtime error: invalid memory address or nil pointer dereference (2) 1 686d 686d
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = ADDR, pa = ADDR 1 690d 690d
pool: free list modified: pdppl 1 690d 690d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (5) 3 690d 689d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (2) 1 690d 690d
panic.go:LINE +0x72 1 691d 691d
witness: reversal: inode fdlock C 523 758d 971d
panic: runtime error: invalid memory address or nil pointer dereference 1 695d 695d
panic: fifo_badop called C 8841 697d 1032d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR 1 712d 712d
panic: ffs_blkfree: bad size 2 812d 816d
kernel: double fault trap, code=0 1 860d 860d
assert "la != NULL" failed in if_ether.c 3 845d 847d
uvm_fault: ml_purge 6 843d 849d
panic: in_cksum: out of data, len 63 1 829d 829d
uvm_fault: pfi_ifhead_RB_REMOVE 1 850d 850d
panic: uvm_fault_unwire_locked: address not in map (2) 7 840d 968d
panicConnection to ssh-serialport.googleapis.com closed by remote host. 1 699d 699d
uvm_fault: vfs_lookup 1 884d 884d
panic: Data modified on freelist: word 4 of object ADDR size 0x84 previous type free (ADDR != ADDR) 1 711d 711d
panic: Data modified on freelist: word 5 of object ADDR size 0xa0 previous type devbuf (0xd != ADDR) 1 711d 711d
panic: Data modified on freelist: word 5 of object ADDR size 0xc0 previous type devbuf (0xd != ADDR) 1 718d 718d
panic: Data modified on freelist: word 5 of object ADDR size 0x100 previous type devbuf (0xd != ADDR) syz 7 711d 741d
panic: attempt WtAoR eNIxNeGc:u tSeP uL seNOrT a LddOrWEesRsE D 0Ox0N iSYn SCsAuLpLe rv3i 4s orEX ImTo d0 e9 1 711d 711d
panic: bad arg kind 1 722d 722d
uvm_fault: ADDR: movl $ADDR,0(%rdi)ddb> ddb> set $lines = 0ddb> set $maxwidth = 0ddb> show panickernel page 1 726d 726d
uvm_fault: ADDR: jmp ADDR 1 728d 728d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (4) 9 735d 735d
uvm_fault: pmap_enter syz 3 976d 982d
panic: malloc: allocation tooWA RlNaIrNGge: ,SPL NOT LOWERED ON SYSCALL 3 4 EXIT 0 9 1 754d 754d
multicore test error: timed out 43 873d 910d
panic: amap_add: slot in use 2 963d 968d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (3) 12 792d 793d
panic: vput: v_writecount != 0 C 2 794d 794d
uvm_fault: _bpf_mtap 31 1005d 1027d
panic: pool_cache_item_magic_check: mcl2k cpu free list modified: item addr ADDR+24 ADDR!=ADDR 1 1009d 1009d
panic: rw_enter: vmmaplk locking against myself 3 1019d 1021d
uvm_fault: tun_dev_read 2 1019d 1021d
openbsd test error: timed out 19 878d 938d
panic: bpf_mcopy 1 1023d 1023d
multicore build error (4) 2 867d 867d
openbsd build error (6) 1 867d 867d
pool: double put: mcl2k 4 1025d 1027d
pool: double put: mcl64k 1 1026d 1026d
panic: missing alias 1 1030d 1030d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (2) 3 861d 861d
panic: bad dir C 1390 866d 867d
multicore build error (2) 10 892d 893d
openbsd build error (4) 5 892d 893d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 12 901d 902d
multicore build error 26 902d 903d
openbsd build error (3) 13 902d 903d
multicore boot error: can't ssh into the instance 6 902d 902d
openbsd boot error: can't ssh into the instance 3 902d 902d
panic: ffs_read: type 0 1 1039d 1039d
panic: serialport: VM disconnected. 1 910d 910d
panic: kserialport: VM disconnected. 1 911d 911d
panic: kernel diagnostic serialport: VM disconnected. 1 911d 911d
panic: kernel diserialport: VM disconnected. 1 990d 990d
openbsd build error 1 955d 955d
lost connection to test machine C 276 1003d 1077d
https://github.com/openbsd/src.git boot error: uvm_fault: memcmp 6 1009d 1009d
https://github.com/openbsd/src.git test error 16 1017d 1038d
multicore boot error: uvm_fault: smbios_find 12 1009d 1009d
kernel: kernel relinking fa 1 1098d 1077d
https://github.com/openbsd/src.git boot error 479 1032d 1077d
panic: sandbox escaping file name "../file0" 111 1031d 1033d
multicore test error (2) 3 1018d 1018d
multicore test error 3 1018d 1018d
panic: sandbox escaping file name "../file0/file0", Files are map[./file0:true ../file0:true] 1 1031d 1031d
panic: sandbox escaping file name "../file0", Files are map[../file0:true] 11 1031d 1031d
panic: sandbox escaping file name "../file0", Files are map[./file0:true ../file0:true] 1 1031d 1031d
panic: sandbox escaping file name "../file0/file0" 2 1032d 1032d