syzbot


Title Repro Bisected Count Last Reported
panic: pr_find_pagehead: mbufpl: page header missing (3) 2 90d 123d
uvm_fault: m_free (2) 429 60d 310d
uvm_fault: pool_cache_get 518 61d 339d
pool: free list modified: anonpl 8 94d 316d
panic: amap_lookup: offset out of range 2 97d 143d
uvm_fault: 0x1:uvm_fault(ADDR, 0x1, 0, 1) -> e kernel: page fault trap, code=0Stopped at db_read_bytes 1 8d18h 8d18h
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 (2) 45 9d22h 11d
panic: free: size too small 10 <= 4096 / 2 (ADDR) type devbuf 2 100d 105d
pool: free list modified: vcpupl 1 101d 101d
uvm_fault: bpf_mtap 10 101d 328d
pool: free list modified: filepl 1 107d 107d
pool: free list modified: shmpl (3) 1 112d 112d
uvm_fault: uvmfault_anonget 1 115d 115d
uvm_fault: unveil_find_cover 1 116d 116d
assert "mhead->m_flags & M_PKTHDR" failed in switchctl.c (2) 1 117d 117d
malloc: free list modified: free 12 118d 340d
uvm_fault: nd6_ns_output 1 126d 126d
uvm_fault: x86_send_ipi (2) 2 127d 139d
panic.go:LINE +0x72 (7) syz 3 47d 48d
assert "ifp != NULL" failed in rtsock.c (2) 26 105d 109d
panic: vref used where vget required (2) 2 137d 140d
panic: amap_lookups: offset out of range (2) 1 138d 138d
pool: free list modified: pffrnode 7 138d 276d
uvm_fault: uvm_map_clean 1 139d 139d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (8) 10 92d 163d
uvm_fault: igmp_leavegroup 1 142d 142d
syzkaller: make target failed: failed to run ["gmake" "target"]: exit status 2 3 53d 53d
panic(ADDR) at panic+0x164 1 55d 55d
openbsd boot error: can't ssh into the instance (3) 18 56d 56d
multicore boot error: can't ssh into the instance (3) 15 56d 56d
kernel: privileged instruction fault trap, code=0 (2) 1 147d 147d
assert "!_kernel_lock_held()" failed in kern_fork.c (2) 1 147d 147d
uvm_fault(ADDR, 0xa, 0, 1) -> e (2) 1 61d 61d
assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (2) 1 150d 150d
no output from test machine (4) syz 14713 65d 71d
panic: amap_wipeout: corrupt amap 6 156d 244d
uvm_fault(ADDR, 0x7b8, 0, 1) -> e 1 73d 73d
uvm_fault(ADDR, 0x3, 0, 1) -> e (2) 1 77d 77d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 (2) 21 79d 81d
uvm_fault(ADDR, 0xa, 0, 1) -> e 1 80d 80d
pool: free list modified: tcpqe 4 171d 287d
uvm_fault(ADDR, 0x3, 0, 1) -> e 1 82d 82d
no output from test machine (2) C 89865 86d 139d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (12) 9 94d 97d
assert "sb->sb_cc == 0" failed in uipc_socket2.c 2 176d 220d
pool: free list modified: vmsppl 1 88d 88d
uvm_fault(ADDR, 0xbef, 0, 1) -> e (2) 1 88d 88d
uvm_fault(ADDR, 0x10b, 0, 1) -> e (2) 1 94d 94d
uvm_fault(ADDR, 0xbef, 0, 1) -> e 1 95d 95d
pool: free list modified: vnodes 1 190d 190d
uvm_fault(ADDR, 0x10b, 0, 1) -> e 1 108d 108d
kernel: page fault trap, code=0 (3) 1 109d 109d
panic: bad group arg size 29, should be <= 32 for &prog.GroupArg{ArgCommon:prog.ArgCommon{ref:LINEx328, dir:LINEx0}, Inn 1 112d 112d
assert "ps->ps_uvncount == 0" failed in kern_unveil.c (2) 1 208d 208d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (11) 6 119d 141d
pool: free list modified: uvmvnodes 1 210d 210d
pool: free list modified: sockpl 2 212d 222d
uvm_fault(ADDR, ADDR, 0, 1) -> e 1 122d 122d
panic: bad group arg size 29, should be <= 32 for &prog.GroupArg{ArgCommon:prog.ArgCommon{ref:LINEx2c0, dir:LINEx0}, Inn 1 126d 126d
uvm_fault: memcpy (2) syz 2168 131d 379d
uvm_fault: vio_start 1 221d 221d
uvm_fault: syscall 1 224d 224d
panic: broken type ref 1 138d 138d
pool: free list modified: mtagpl 1 225d 225d
assert "dupe == NULL" failed in uvm_page.c 4 226d 339d
pool: free list modified: art_table 1 228d 228d
assert "ifp != NULL" failed in if_ether.c (2) 1 236d 236d
syzkaller: make host failed: failed to run ["gmake" "host" "ci"]: exit status 2 3 146d 146d
kqueue: knote !ACTIVE 2 239d 242d
uvm_fault: in4_cksum 1 243d 243d
panic: bad arg kind: <nil> (11) 1 159d 159d
kernel: privileged instruction fault trap, code=0 1 251d 251d
uvm_fault: ml_enlist 1 251d 251d
uvm_fault: tun_init 1 252d 252d
uvm_fault returns 14, GPA=ADDR C 2 165d 165d
panic: lock (kernel_lock) mbufpl not locked 1 255d 255d
panic: bad group arg size 0, should be <= 24 for &prog.GroupArg{ArgCommon:prog.ArgCommon{typ:(*prog.StructType)(ADDR)}, 1 167d 167d
panic.go:LINE +0x72 (5) 1 170d 170d
assert "pg->wire_count == 0" failed in uvm_page.c 1 265d 265d
panic: bad arg kind: <nil> (10) 1 180d 180d
panic: bad arg kind: <nil> (9) 1 183d 183d
pool: free list modified: art_heap4 2 278d 303d
uvm_fault: _bus_dmamap_load_mbuf 1 282d 282d
uvm_fault: m_copym 1 283d 283d
panic: bad arg kind: <nil> (8) 1 195d 195d
panic: pr_find_pagehead: mbufpl: page header missing (2) 1 286d 286d
pool: cpu free list modified: mcl2k 1 286d 286d
panic: bad arg kind: <nil> (7) 1 199d 199d
pool: free list modified: shmpl (2) 1 293d 293d
panic: bad arg kind: <nil> (6) 1 204d 204d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (7) 1 205d 205d
assert "mhead->m_flags & M_PKTHDR" failed in switchctl.c 1 296d 296d
pool: double put: mbufpl (2) 2 297d 329d
panic: attempt to access user address ADDR in supervisor mode 7 302d 351d
kernel: double fault trap, code=0 (2) syz 2 328d 328d
uvm_fault: rtable_satoplen (3) syz 237 336d 379d
panic: amap_lookups: offset out of range 1 306d 306d
panic: bad arg kind: <nil> (5) 1 218d 218d
uvm_fault: witness_checkorder (2) 1 309d 309d
panic: bad arg kind: &prog.IntType{IntTypeCommon:prog.IntTypeCommon{TypeCommon:prog.TypeCommon{TypeName:"int32", FldName 1 221d 221d
panic: bad arg kind (2) 2 311d 313d
assert "pg->wire_count == 1" failed in vfs_biomem.c 66 312d 637d
assert "ifp != NULL" failed in rtsock.c 2 312d 314d
panic.go:LINE +0x72 (4) 1 223d 223d
uvm_fault: x86_send_ipi 1 316d 316d
uvm_fault: VOP_ISLOCKED 1 316d 316d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (10) 3 227d 227d
panic: bad arg kind: <nil> (4) 1 229d 229d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (6) 1 229d 229d
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = ADDR, pa = ADDR (2) 1 321d 321d
uvm_fault: m_zero 1 323d 323d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (5) 1 237d 237d
panic: free: non-malloced addr ADDR type in_multi 4 327d 349d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (9) 3 238d 238d
uvm_fault: pfi_kif_update 6 329d 456d
uvm_fault: fifo_write 1 329d 329d
panic.go:LINE +0x72 (3) 1 241d 241d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (4) 2 243d 243d
panic: receive 1: so ADDR, so_type 3, sb_cc 176 1 332d 332d
panic: ffs_valloc: dup alloc 2 332d 336d
uvm_fault: 0ddb{1}> ddb{1}> set $lines = 0ddb{1}> set $maxwidth = 0ddb{1}> show panickernel page faultattempt to e 1 245d 245d
assert "!_kernel_lock_held()" failed in kern_fork.c 15 336d 597d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (8) 3 249d 249d
panic: WAaRcNqIuNirGi:n g SPbLl NoOcT kLaObWlEReE Ds lOeNe pSY SloCcAkL Lwi 2 t15h7 s79p3i4n4l5o0c kEX IorT 0c rai 1 250d 250d
uvm_fault 10 342d 357d
panic: free: size too small 24 <= 256 / 2 (ADDR) type in_multi 1 348d 348d
panic: bad arg kind: <nil> (3) 1 259d 259d
assert "cifp != NULL" failed in route.c 89 322d 376d
assert "rt->rt_ifa->ifa_ifp != NULL" failed in route.c 830 321d 362d
uvm_fault: in6_purgeaddr 1423 321d 362d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (7) 3 263d 263d
assert "ifp != NULL" failed in if_ether.c 208 323d 377d
assert "ifa == rt->rt_ifa" failed in nd6.c (2) 262 323d 360d
uvm_fault: tun_clone_destroy 1 354d 354d
panic: bad arg kind: <nil> (2) 1 270d 270d
panic: bad arg kind: <nil> 1 274d 274d
panic.go:LINE +0x72 (2) 1 276d 276d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (6) 3 278d 278d
uvm_fault: pmap_page_remove 7 370d 627d
openbsd build error (7) 1 282d 282d
multicore boot error: can't ssh into the instance (2) 96 298d 299d
openbsd boot error: can't ssh into the instance (2) 48 298d 299d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (3) 1 298d 298d
panic: vref used where vget required 1 387d 387d
panic: pfi_dynaddr_update 2 404d 484d
uvm_fault: pool_do_put 1 322d 322d
panic: runtime error: invalid memory address or nil pointer dereference (2) 1 323d 323d
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = ADDR, pa = ADDR 1 326d 326d
pool: free list modified: pdppl 1 327d 327d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (5) 3 326d 326d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR (2) 1 327d 327d
panic.go:LINE +0x72 1 328d 328d
witness: reversal: inode fdlock C 523 395d 608d
panic: runtime error: invalid memory address or nil pointer dereference 1 332d 332d
panic: fifo_badop called C 8841 334d 668d
panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR 1 348d 348d
panic: ffs_blkfree: bad size 2 448d 453d
kernel: double fault trap, code=0 1 496d 496d
assert "la != NULL" failed in if_ether.c 3 481d 483d
uvm_fault: ml_purge 6 480d 486d
panic: in_cksum: out of data, len 63 1 466d 466d
uvm_fault: pfi_ifhead_RB_REMOVE 1 487d 487d
panic: uvm_fault_unwire_locked: address not in map (2) 7 477d 604d
panicConnection to ssh-serialport.googleapis.com closed by remote host. 1 336d 336d
uvm_fault: vfs_lookup 1 521d 521d
panic: Data modified on freelist: word 4 of object ADDR size 0x84 previous type free (ADDR != ADDR) 1 347d 347d
panic: Data modified on freelist: word 5 of object ADDR size 0xa0 previous type devbuf (0xd != ADDR) 1 348d 348d
panic: Data modified on freelist: word 5 of object ADDR size 0xc0 previous type devbuf (0xd != ADDR) 1 354d 354d
panic: Data modified on freelist: word 5 of object ADDR size 0x100 previous type devbuf (0xd != ADDR) syz 7 348d 377d
panic: attempt WtAoR eNIxNeGc:u tSeP uL seNOrT a LddOrWEesRsE D 0Ox0N iSYn SCsAuLpLe rv3i 4s orEX ImTo d0 e9 1 348d 348d
panic: bad arg kind 1 359d 359d
uvm_fault: ADDR: movl $ADDR,0(%rdi)ddb> ddb> set $lines = 0ddb> set $maxwidth = 0ddb> show panickernel page 1 363d 363d
uvm_fault: ADDR: jmp ADDR 1 364d 364d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (4) 9 371d 372d
uvm_fault: pmap_enter syz 3 612d 618d
panic: malloc: allocation tooWA RlNaIrNGge: ,SPL NOT LOWERED ON SYSCALL 3 4 EXIT 0 9 1 391d 391d
multicore test error: timed out 43 509d 547d
panic: amap_add: slot in use 2 600d 605d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (3) 12 429d 429d
panic: vput: v_writecount != 0 C 2 431d 431d
uvm_fault: _bpf_mtap 31 642d 664d
panic: pool_cache_item_magic_check: mcl2k cpu free list modified: item addr ADDR+24 ADDR!=ADDR 1 645d 645d
panic: rw_enter: vmmaplk locking against myself 3 656d 658d
uvm_fault: tun_dev_read 2 656d 657d
openbsd test error: timed out 19 515d 575d
panic: bpf_mcopy 1 660d 660d
multicore build error (4) 2 504d 504d
openbsd build error (6) 1 504d 504d
pool: double put: mcl2k 4 662d 664d
pool: double put: mcl64k 1 663d 663d
panic: missing alias 1 667d 667d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 1 (2) 3 497d 497d
panic: bad dir C 1390 503d 504d
multicore build error (2) 10 529d 529d
openbsd build error (4) 5 529d 529d
syzkaller: testing failed: failed to run ["go" "test" "-short" "./..."]: exit status 2 12 538d 538d
multicore build error 26 539d 540d
openbsd build error (3) 13 539d 540d
multicore boot error: can't ssh into the instance 6 539d 539d
openbsd boot error: can't ssh into the instance 3 539d 539d
panic: ffs_read: type 0 1 676d 676d
panic: serialport: VM disconnected. 1 547d 547d
panic: kserialport: VM disconnected. 1 547d 547d
panic: kernel diagnostic serialport: VM disconnected. 1 548d 548d
panic: kernel diserialport: VM disconnected. 1 626d 626d
openbsd build error 1 592d 592d
lost connection to test machine C 276 640d 714d
https://github.com/openbsd/src.git boot error: uvm_fault: memcmp 6 645d 645d
https://github.com/openbsd/src.git test error 16 653d 674d
multicore boot error: uvm_fault: smbios_find 12 645d 645d
kernel: kernel relinking fa 1 734d 714d
https://github.com/openbsd/src.git boot error 479 668d 714d
panic: sandbox escaping file name "../file0" 111 668d 669d
multicore test error (2) 3 655d 655d
multicore test error 3 655d 655d
panic: sandbox escaping file name "../file0/file0", Files are map[./file0:true ../file0:true] 1 668d 668d
panic: sandbox escaping file name "../file0", Files are map[../file0:true] 11 668d 668d
panic: sandbox escaping file name "../file0", Files are map[./file0:true ../file0:true] 1 668d 668d
panic: sandbox escaping file name "../file0/file0" 2 668d 668d