panic: receive 1a: so ADDR, so_type 3, m ADDR, m_type NUM

0 views
Skip to first unread message

syzbot

unread,
Nov 23, 2019, 8:14:09 AM11/23/19
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: ee79b9a7 On startup withdraw all proposals for all int..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=127c1d26e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0fe83f82fe104d4
dashboard link: https://syzkaller.appspot.com/bug?extid=7b65ae488e418a68f31b
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127d2dcae00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7b65ae...@syzkaller.appspotmail.com

login: panic: receive 1a: so 0xfffffd8037f9c180, so_type 3, m
0xfffffd8037000000, m_type 26989
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*143372 70662 0 0 0 0 dhclient
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
soreceive(fffffd8037f9c180,0,ffff800014886d68,0,0,ffff800014886c74) at
soreceive+0x170a sys/kern/uipc_socket.c:952
soo_read(fffffd8037561618,ffff800014886d68,0) at soo_read+0x53
sys/kern/sys_socket.c:70
dofilereadv(ffff8000ffff8280,6,ffff800014886d68,0,ffff800014886e50) at
dofilereadv+0x1a2 sys/kern/sys_generic.c:236
sys_read(ffff8000ffff8280,ffff800014886e00,ffff800014886e50) at
sys_read+0x83 sys/kern/sys_generic.c:156
syscall(ffff800014886ed0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbc080, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
receive 1a: so 0xfffffd8037f9c180, so_type 3, m 0xfffffd8037000000, m_type
26989
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
soreceive(fffffd8037f9c180,0,ffff800014886d68,0,0,ffff800014886c74) at
soreceive+0x170a sys/kern/uipc_socket.c:952
soo_read(fffffd8037561618,ffff800014886d68,0) at soo_read+0x53
sys/kern/sys_socket.c:70
dofilereadv(ffff8000ffff8280,6,ffff800014886d68,0,ffff800014886e50) at
dofilereadv+0x1a2 sys/kern/sys_generic.c:236
sys_read(ffff8000ffff8280,ffff800014886e00,ffff800014886e50) at
sys_read+0x83 sys/kern/sys_generic.c:156
syscall(ffff800014886ed0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbc080, count: -8
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff800014886ab0
rbx 0xffff800014886b60
rdx 0x2
rcx 0x1
rax 0x1
r8 0xffff800014886a70
r9 0x1
r10 0x7216dbc9590ddb73
r11 0x59cc1607c7c86c1a
r12 0x3000000008
r13 0xffff800014886ac0
r14 0x100
r15 0x1
rip 0xffffffff81339268 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800014886aa0
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
PROC (dhclient) pid=143372 stat=onproc
flags process=0 proc=0
pri=50, usrpri=50, nice=20
forw=0xffffffffffffffff, list=0xffff8000ffff9150,0xffff8000ffff8508
process=0xffff8000ffff66d0 user=0xffff800014881000,
vmspace=0xfffffd803f012660
estcpu=0, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
78256 410591 38308 0 3 0x82 thrsleep syz-execprog
78256 102713 38308 0 3 0x4000082 nanosleep syz-execprog
78256 59124 38308 0 3 0x4000082 thrsleep syz-execprog
78256 393020 38308 0 3 0x4000082 thrsleep syz-execprog
78256 320164 38308 0 2 0x4000002 syz-execprog
78256 488163 38308 0 3 0x4000082 thrsleep syz-execprog
78256 184690 38308 0 3 0x4000082 thrsleep syz-execprog
38308 324915 21153 0 3 0x10008a pause ksh
21153 184557 90652 0 2 0x12 sshd
77474 182064 1 0 3 0x100083 ttyin getty
90652 445290 1 0 3 0x80 select sshd
18146 206966 72741 73 3 0x100090 kqread syslogd
72741 516 1 0 3 0x100082 netio syslogd
97808 12684 1 77 3 0x100090 poll dhclient
*70662 143372 1 0 7 0 dhclient
33189 413379 0 0 2 0x14200 zerothread
46008 74930 0 0 3 0x14200 aiodoned aiodoned
83504 205623 0 0 3 0x14200 syncer update
23904 463349 0 0 3 0x14200 cleaner cleaner
96869 446359 0 0 3 0x14200 reaper reaper
89416 85885 0 0 3 0x14200 pgdaemon pagedaemon
16219 365974 0 0 3 0x14200 bored crynlk
74051 64891 0 0 3 0x14200 bored crypto
13856 115895 0 0 3 0x40014200 acpi0 acpi0
69989 175028 0 0 3 0x14200 bored softnet
79242 377480 0 0 3 0x14200 bored systqmp
70070 35588 0 0 3 0x14200 bored systq
37628 153326 0 0 3 0x40014200 bored softclock
82287 14948 0 0 3 0x40014200 idle0
41891 14847 0 0 3 0x14200 bored smr
1 391003 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9438 6318K 6320K 78643K 10539 0 0
pcb 13 8K 8K 78643K 13 0 0
rtable 63 1K 2K 78643K 157 0 0
ifaddr 24 7K 9K 78643K 91 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 14 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1180 74K 74K 78643K 1185 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 1K 78643K 2 0 0
VM map 2 0K 0K 78643K 2 0 0
sem 2 0K 0K 78643K 2 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1794 195K 288K 78643K 12646 0 0
file desc 1 0K 12K 78643K 76 0 0
proc 47 38K 54K 78643K 318 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
in_multi 11 0K 1K 78643K 22 0 0
ether_multi 1 0K 0K 78643K 1 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 18 79K 79K 78643K 18 0 0
exec 0 0K 1K 78643K 171 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 59 3K 11K 78643K 899 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
NDP 3 0K 0K 78643K 6 0 0
temp 22 3521K 3585K 78643K 3148 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 4 0 2 1 0 1 1 0
8 0
rtpcb 80 17 0 15 1 0 1 1 0
8 0
rtentry 112 34 0 11 1 0 1 1 0
8 0
unpcb 120 27 0 19 1 0 1 1 0
8 0
syncache 264 5 0 5 1 1 0 1 0
8 0
tcpcb 544 8 0 5 1 0 1 1 0
8 0
inpcb 280 85 0 79 1 0 1 1 0
8 0
nd6 48 2 0 2 1 0 1 1 0
8 1
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 167 0 47 11 0 11 11 0
8 2
art_table 32 168 0 47 2 0 2 2 0
8 0
art_node 16 33 0 12 1 0 1 1 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 1470 0 77 45 0 45 45 0
8 0
ffsino 240 1470 0 77 82 0 82 82 0
8 0
nchpl 144 1770 0 171 60 0 60 60 0
8 0
uvmvnodes 72 1479 0 0 27 0 27 27 0
8 0
vnodes 208 1479 0 0 78 0 78 78 0
8 0
namei 1024 4084 0 4084 1 0 1 1 0
8 1
scxspl 192 4338 0 4338 2 1 1 2 0
8 1
plimitpl 152 14 0 9 1 0 1 1 0
8 0
sigapl 432 254 0 244 2 0 2 2 0
8 0
knotepl 112 39 0 34 1 0 1 1 0
8 0
kqueuepl 104 2 0 0 1 0 1 1 0
8 0
pipepl 128 134 0 127 1 0 1 1 0
8 0
fdescpl 424 255 0 244 2 0 2 2 0
8 0
filepl 120 1094 0 1048 2 0 2 2 0
8 0
lockfpl 104 5 0 4 1 0 1 1 0
8 0
lockfspl 48 3 0 2 1 0 1 1 0
8 0
sessionpl 112 18 0 10 1 0 1 1 0
8 0
pgrppl 48 18 0 10 1 0 1 1 0
8 0
ucredpl 96 47 0 40 1 0 1 1 0
8 0
zombiepl 144 244 0 244 1 0 1 1 0
8 1
processpl 864 269 0 244 4 0 4 4 0
8 0
procpl 632 275 0 244 3 0 3 3 0
8 0
sockpl 384 129 0 113 2 0 2 2 0
8 0
mcl4k 4096 10 0 10 1 1 0 1 0
8 0
mcl2k 2048 5476 0 5444 7 2 5 7 0
8 1
mtagpl 80 2 0 2 1 1 0 1 0
8 0
mbufpl 256 9585 0 9493 11 3 8 8 0
8 1
bufpl 256 5841 0 1380 279 0 279 279 0
8 0
anonpl 16 21650 0 19997 15 2 13 13 0
62 6
amapchunkpl 152 801 0 743 5 0 5 5 0
158 2
amappl16 192 372 0 334 3 0 3 3 0
8 0
amappl15 184 62 0 61 1 0 1 1 0
8 0
amappl14 176 45 0 39 1 0 1 1 0
8 0
amappl13 168 3 0 2 2 1 1 1 0
8 0
amappl12 160 11 0 8 2 1 1 1 0
8 0
amappl11 152 44 0 33 1 0 1 1 0
8 0
amappl10 144 8 0 8 2 1 1 1 0
8 1
amappl9 136 389 0 388 1 0 1 1 0
8 0
amappl8 128 109 0 100 1 0 1 1 0
8 0
amappl7 120 39 0 35 1 0 1 1 0
8 0
amappl6 112 56 0 49 1 0 1 1 0
8 0
amappl5 104 136 0 126 1 0 1 1 0
8 0
amappl4 96 483 0 461 1 0 1 1 0
8 0
amappl3 88 116 0 110 1 0 1 1 0
8 0
amappl2 80 1009 0 958 3 0 3 3 0
8 1
amappl1 72 13537 0 13159 27 10 17 20 0
8 8
amappl 80 476 0 453 1 0 1 1 0
84 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma128 128 253 0 253 1 1 0 1 0
8 0
dma64 64 6 0 6 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 18 0 17 1 0 1 1 0
8 0
aobjpl 64 1 0 0 1 0 1 1 0
8 0
uaddrrnd 24 255 0 244 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 255 0 244 1 0 1 1 0
8 0
vmmpekpl 168 6287 0 6271 1 0 1 1 0
8 0
vmmpepl 168 31173 0 30367 86 10 76 76 0 357
39
vmsppl 272 254 0 244 1 0 1 1 0
8 0
pdppl 4096 516 0 488 5 0 5 5 0
8 0
pvpl 32 109223 0 105353 113 0 113 113 0 265
81
pmappl 200 254 0 244 1 0 1 1 0
8 0
extentpl 40 46 0 29 1 0 1 1 0
8 0
phpool 112 405 0 8 12 0 12 12 0
8 0


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

Anton Lindqvist

unread,
Nov 23, 2019, 8:39:06 AM11/23/19
to syzbot, syzkaller-o...@googlegroups.com
#syz dup: panic: receive 1a: so ADDR, so_type 3, m ADDR, m_type 0
Reply all
Reply to author
Forward
0 new messages