panic: uvm_fault_unwire_locked: address not in map

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: d55171694444 Always use log_getverbose() instead of someti..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15b965c7400000
kernel config: https://syzkaller.appspot.com/x/.config?x=906264fb5874384d
dashboard link: https://syzkaller.appspot.com/bug?extid=b6a9255faa0605669432
compiler:

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b6a925...@syzkaller.appspotmail.com

panic: uvm_fault_unwire_locked: address not in map
Stopped at db_enter+0xa: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*343967 8289 0 0 0x4000000 0 syz-executor1
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
uvm_fault_unwire_locked(20240000,20251000,0) at
uvm_fault_unwire_locked+0x270
uvm_fault_unwire(10000,ffffff003cb3b400,10000) at uvm_fault_unwire+0x3b
sys/uvm/uvm_fault.c:1314
physio(ffff800014b0f878,ffffff002c3cae60,ffffff002c3cae60,ffff800014b0f878,ffff800014b0f748)
at
physio+0x2ba sys/kern/kern_physio.c:183
spec_read(0) at spec_read+0x9d sys/kern/spec_vnops.c:223
VOP_READ(ffff800014b0f878,ffffff002c3cae60,ffffff003770a018,0) at
VOP_READ+0x5e sys/kern/vfs_vops.c:247
vn_read(ffffff003770a018,ffff8000ffffa278,84e4633b) at vn_read+0x130
sys/kern/vfs_vnops.c:365
dofilereadv(0,292,ffff8000ffffa278,ffff800014b0f9a0,ffff800014b0f9b8) at
dofilereadv+0x14f sys/kern/sys_generic.c:235
sys_readv(ffff800014b0fa40,ffff8000ffffa278,ffff8000149fa638) at
sys_readv+0xce sys/kern/sys_generic.c:182
syscall(0) at syscall+0x3e4
Xsyscall(6,0,ffffffffffffffbc,0,3,11cab2bc0d8) at Xsyscall+0x128
end of kernel
end trace frame: 0x11f206576b0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> show panic
uvm_fault_unwire_locked: address not in map
ddb> trace
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
uvm_fault_unwire_locked(20240000,20251000,0) at
uvm_fault_unwire_locked+0x270
uvm_fault_unwire(10000,ffffff003cb3b400,10000) at uvm_fault_unwire+0x3b
sys/uvm/uvm_fault.c:1314
physio(ffff800014b0f878,ffffff002c3cae60,ffffff002c3cae60,ffff800014b0f878,ffff800014b0f748)
at
physio+0x2ba sys/kern/kern_physio.c:183
spec_read(0) at spec_read+0x9d sys/kern/spec_vnops.c:223
VOP_READ(ffff800014b0f878,ffffff002c3cae60,ffffff003770a018,0) at
VOP_READ+0x5e
sys/kern/vfs_vops.c:247vn_read(ffffff003770a018,ffff8000ffffa278,84e4633b)
at vn_read+0x130
dofilereadv(0,292,ffff8000ffffa278,ffff800014b0f9a0,ffff800014b0f9b8) at
dofilereadv+0x14f sys/kern/sys_generic.c:235
sys_readv(ffff800014b0fa40,ffff8000ffffa278,ffff8000149fa638) at
sys_readv+0xce sys/kern/sys_generic.c:182syscall(0) at syscall+0x3e4
Xsyscall(6,0,ffffffffffffffbc,0,3,11cab2bc0d8) at Xsyscall+0x128
end of kernel
end trace frame: 0x11f206576b0, count: -12
ddb> show registers
rdi 0xffffffff81e04f20 kprintf_mutex
rsi 0xffffffff8126ba89 db_enter+0x9
rbp 0xffff800014b0f4f0
rbx 0xffff800014b0f590
rdx 0xffff800000ccc000
rcx 0x37d02 acpi_pdirpa+0x23b6a
rax 0xffff800000ccc000
r8 0xffff800014b0f4c0
r9 0
r10 0
r11 0xffffffff813028e0 x86_bus_space_io_read_1
r12 0x3000000008
r13 0xffff800014b0f500
r14 0x100
r15 0xffffffff81c4ce55 cy_pio_rec+0x15f13
rip 0xffffffff8126ba8a db_enter+0xa
cs 0x8
rflags 0x202
rsp 0xffff800014b0f4f0
ss 0x10
db_enter+0xa: popq %rbp
ddb> show proc
PROC (syz-executor1) pid=343967 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=17, usrpri=59, nice=20
forw=0xffffffffffffffff, list=0xffff8000ffffa020,0xffff8000ffffb098
process=0xffff8000149fa638 user=0xffff800014b0a000,
vmspace=0xffffff003f12c948
estcpu=9, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
8289 480189 45459 0 2 0 syz-executor1
8289 300379 45459 0 2 0x4000080 syz-executor1
* 8289 343967 45459 0 7 0x4000000 syz-executor1
8289 110415 45459 0 2 0x4000000 syz-executor1
8289 222151 45459 0 2 0x4000000 syz-executor1
96997 378051 7799 0 2 0x4081000 syz-executor0
96997 5893 7799 0 2 0x4081000 syz-executor0
96997 366335 7799 0 2 0x4081080 syz-executor0
96997 314638 7799 0 2 0x4081080 syz-executor0
96997 46778 7799 0 3 0x4003000 suspend syz-executor0
55981 337912 66874 0 3 0x82 netio sshd
6573 202846 0 0 3 0x14200 bored sosplice
7799 354165 10106 0 3 0x82 wait syz-executor0
45459 491825 10106 0 3 0x82 wait syz-executor1
10106 184497 70505 0 3 0x82 thrsleep syz-fuzzer
10106 125704 70505 0 3 0x4000082 thrsleep syz-fuzzer
10106 135221 70505 0 3 0x4000082 thrsleep syz-fuzzer
10106 128606 70505 0 3 0x4000082 kqread syz-fuzzer
10106 492117 70505 0 3 0x4000082 thrsleep syz-fuzzer
10106 156294 70505 0 3 0x4000082 thrsleep syz-fuzzer
10106 448359 70505 0 3 0x4000082 thrsleep syz-fuzzer
70505 111313 49836 0 3 0x10008a pause ksh
49836 320105 66874 0 3 0x92 select sshd
53603 393155 1 0 3 0x100083 ttyin getty
66874 284611 1 0 3 0x80 select sshd
86082 50328 29141 73 2 0x100010 syslogd
29141 447416 1 0 3 0x100082 netio syslogd
33472 260856 1 77 3 0x100090 poll dhclient
5536 114462 1 0 3 0x80 poll dhclient
26530 174783 0 0 2 0x14200 zerothread
47400 237466 0 0 3 0x14200 aiodoned aiodoned
81554 166555 0 0 3 0x14200 syncer update
4831 375920 0 0 3 0x14200 cleaner cleaner
35780 415877 0 0 3 0x14200 reaper reaper
10639 111229 0 0 3 0x14200 pgdaemon pagedaemon
80876 290499 0 0 3 0x14200 bored crynlk
73565 242952 0 0 3 0x14200 bored crypto
3509 333658 0 0 3 0x40014200 acpi0 acpi0
94651 98919 0 0 3 0x14200 bored softnet
54444 397709 0 0 3 0x14200 bored systqmp
2593 471017 0 0 3 0x14200 bored systq
7565 83617 0 0 3 0x40014200 bored softclock
67712 344639 0 0 3 0x40014200 idle0
1 148929 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: d55171694444 Always use log_getverbose() instead of someti..
git tree: openbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=167965c7400000

kernel config: https://syzkaller.appspot.com/x/.config?x=906264fb5874384d
dashboard link: https://syzkaller.appspot.com/bug?extid=b6a9255faa0605669432
compiler:

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e65877400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1745caab400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b6a925...@syzkaller.appspotmail.com

panic: uvm_fault_unwire_locked: address not in map
Stopped at db_enter+0xa: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND

*170348 73 0 0x2 0x4000000 0 syz-executor8645

db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208

uvm_fault_unwire_locked(20070000,20081000,0) at
uvm_fault_unwire_locked+0x270
uvm_fault_unwire(10000,ffffff0035596300,10000) at uvm_fault_unwire+0x3b
sys/uvm/uvm_fault.c:1314
physio(ffff800014a70948,ffffff00354f4968,ffffff00354f4968,ffff800014a70948,ffff800014a70818)

at
physio+0x2ba sys/kern/kern_physio.c:183
spec_read(0) at spec_read+0x9d sys/kern/spec_vnops.c:223

VOP_READ(ffff800014a70948,ffffff00354f4968,ffffff00360b32d8,0) at
VOP_READ+0x5e sys/kern/vfs_vops.c:247
vn_read(ffffff00360b32d8,ffff800014a32718,84e4633b) at vn_read+0x130
sys/kern/vfs_vnops.c:365
dofilereadv(0,292,ffff800014a32718,ffff800014a70a70,ffff800014a70a88) at
dofilereadv+0x14f sys/kern/sys_generic.c:235
sys_readv(ffff800014a70b10,ffff800014a32718,ffff800014a15fd8) at

sys_readv+0xce sys/kern/sys_generic.c:182
syscall(0) at syscall+0x3e4

Xsyscall(6,0,43928ffaa0,0,40d4fc2098,40d4fc2090) at Xsyscall+0x128
end of kernel
end trace frame: 0x42de373ca0, count: 3

https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> show panic
uvm_fault_unwire_locked: address not in map
ddb> trace
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208

uvm_fault_unwire_locked(20070000,20081000,0) at
uvm_fault_unwire_locked+0x270
uvm_fault_unwire(10000,ffffff0035596300,10000) at uvm_fault_unwire+0x3b
sys/uvm/uvm_fault.c:1314
physio(ffff800014a70948,ffffff00354f4968,ffffff00354f4968,ffff800014a70948,ffff800014a70818)

at
physio+0x2ba sys/kern/kern_physio.c:183
spec_read(0) at spec_read+0x9d sys/kern/spec_vnops.c:223

VOP_READ(ffff800014a70948,ffffff00354f4968,ffffff00360b32d8,0) at
VOP_READ+0x5e
sys/kern/vfs_vops.c:247vn_read(ffffff00360b32d8,ffff800014a32718,84e4633b)
at vn_read+0x130
dofilereadv(0,292,ffff800014a32718,ffff800014a70a70,ffff800014a70a88) at
dofilereadv+0x14f sys/kern/sys_generic.c:235
sys_readv(ffff800014a70b10,ffff800014a32718,ffff800014a15fd8) at

sys_readv+0xce sys/kern/sys_generic.c:182syscall(0) at syscall+0x3e4

Xsyscall(6,0,43928ffaa0,0,40d4fc2098,40d4fc2090) at Xsyscall+0x128
end of kernel
end trace frame: 0x42de373ca0, count: -12

ddb> show registers
rdi 0xffffffff81e04f20 kprintf_mutex

rsi 0x5
rbp 0xffff800014a705c0
rbx 0xffff800014a70660
rdx 0x3fd
rcx 0
rax 0x1
r8 0xffff800014a70590

r9 0
r10 0
r11 0xffffffff813028e0 x86_bus_space_io_read_1
r12 0x3000000008

r13 0xffff800014a705d0

r14 0x100
r15 0xffffffff81c4ce55 cy_pio_rec+0x15f13
rip 0xffffffff8126ba8a db_enter+0xa
cs 0x8
rflags 0x202

rsp 0xffff800014a705c0

ss 0x10
db_enter+0xa: popq %rbp
ddb> show proc

PROC (syz-executor8645) pid=170348 stat=onproc
flags process=2<EXEC> proc=4000000<THREAD>
pri=17, usrpri=50, nice=20
forw=0xffffffffffffffff, list=0xffff800014a32bc8,0xffff800014a324d0
process=0xffff800014a15fd8 user=0xffff800014a6b000,
vmspace=0xffffff003f12c630
estcpu=0, cpticks=0, pctcpu=0.0

user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND

73 173122 91581 0 3 0x82 nanosleep syz-executor8645
* 73 170348 91581 0 7 0x4000002 syz-executor8645
73 320879 91581 0 3 0x4000082 fsleep syz-executor8645
91581 482479 95830 0 3 0x10008a pause ksh
95830 213052 31586 0 3 0x92 select sshd
43389 150056 1 0 3 0x100083 ttyin getty
31586 418132 1 0 3 0x80 select sshd
15154 21778 97280 73 3 0x100090 kqread syslogd
97280 318896 1 0 3 0x100082 netio syslogd
96243 400378 1 77 3 0x100090 poll dhclient
65021 235505 1 0 3 0x80 poll dhclient
11377 177341 0 0 2 0x14200 zerothread
64523 184979 0 0 3 0x14200 aiodoned aiodoned
34870 343705 0 0 3 0x14200 syncer update
99296 35852 0 0 3 0x14200 cleaner cleaner
97948 270528 0 0 3 0x14200 reaper reaper
13580 278597 0 0 3 0x14200 pgdaemon pagedaemon
2826 120954 0 0 3 0x14200 bored crynlk
65260 273822 0 0 3 0x14200 bored crypto
80372 88901 0 0 3 0x40014200 acpi0 acpi0
50953 191099 0 0 3 0x14200 bored softnet
91896 23881 0 0 3 0x14200 bored systqmp
71570 80383 0 0 3 0x14200 bored systq
7736 52718 0 0 3 0x40014200 bored softclock
4946 92095 0 0 3 0x40014200 idle0
1 43360 0 0 3 0x82 wait init

0 0 -1 0 3 0x10200 scheduler swapper

ddb>