panic: lock (rwlock) solock not locked

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c3a3d6092d41 Move PRU_PEERADDR request to (*pru_peeraddr)().
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11899993080000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=0e026f1bf8b259c6395e

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0e026f...@syzkaller.appspotmail.com

panic: lock (rwlock) solock not locked
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
243882 54193 0 0 0 0 syz-executor.0
* 2944 54193 0 0 0x4000000 1K syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82583901) at panic+0x177 sys/kern/subr_prf.c:198
witness_assert(fffffd806dd78400,4) at witness_assert+0x3ef sys/kern/subr_witness.c:1950
sbunlock(fffffd806dd783e8,fffffd806dd78530) at sbunlock+0xc9 soassertlocked sys/kern/uipc_socket2.c:414 [inline]
sbunlock(fffffd806dd783e8,fffffd806dd78530) at sbunlock+0xc9 sys/kern/uipc_socket2.c:479
sosplice(fffffd806dd78200,5,0,0) at sosplice+0x550
sosetopt(fffffd806dd78200,ffff,1023,fffffd8067819e00) at sosetopt+0x7f4
sys_setsockopt(ffff800029e51a40,ffff800029e4e728,ffff800029e4e770) at sys_setsockopt+0x1f6 sys/kern/uipc_syscalls.c:1233
syscall(ffff800029e4e7f0) at syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff800029e4e7f0) at syscall+0x435 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xe64cbf56e10, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: lock (rwlock) solock not locked
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82583901) at panic+0x177 sys/kern/subr_prf.c:198
witness_assert(fffffd806dd78400,4) at witness_assert+0x3ef sys/kern/subr_witness.c:1950
sbunlock(fffffd806dd783e8,fffffd806dd78530) at sbunlock+0xc9 soassertlocked sys/kern/uipc_socket2.c:414 [inline]
sbunlock(fffffd806dd783e8,fffffd806dd78530) at sbunlock+0xc9 sys/kern/uipc_socket2.c:479
sosplice(fffffd806dd78200,5,0,0) at sosplice+0x550
sosetopt(fffffd806dd78200,ffff,1023,fffffd8067819e00) at sosetopt+0x7f4
sys_setsockopt(ffff800029e51a40,ffff800029e4e728,ffff800029e4e770) at sys_setsockopt+0x1f6 sys/kern/uipc_syscalls.c:1233
syscall(ffff800029e4e7f0) at syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff800029e4e7f0) at syscall+0x435 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xe64cbf56e10, count: -9
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800029e4e470
rbx 0xffff800020dd9b8f
rdx 0xffff800000ba43c0
rcx 0
rax 0xffff800029e51a40
r8 0x101010101010101
r9 0x8080808080808080
r10 0xde5197fe4a6245e4
r11 0xde90cc56e680a455
r12 0xffff800020dd9990
r13 0
r14 0
r15 0x1
rip 0xffffffff81f03e68 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800029e4e460
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.0) pid=2944 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=32, usrpri=81, nice=20
forw=0xffffffffffffffff, list=0xffff800029e517a0,0xffffffff82ba8c88
process=0xffff8000ffff14e0 user=0xffff800029e49000, vmspace=0xfffffd8079ec6740
estcpu=36, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
54193 243882 92573 0 7 0 syz-executor.0
*54193 2944 92573 0 7 0x4000000 syz-executor.0
37641 156652 20598 0 2 0 syz-executor.7
3304 116819 98783 0 2 0 syz-executor.1
3304 200060 98783 0 3 0x4000080 fsleep syz-executor.1
57321 318112 63980 0 3 0x82 nanoslp syz-executor.6
93375 502951 0 0 3 0x14200 bored sosplice
20598 31736 63980 0 3 0x82 nanoslp syz-executor.7
69602 12957 63980 0 3 0x82 nanoslp syz-executor.4
44315 28934 63980 0 3 0x82 nanoslp syz-executor.5
98783 281168 63980 0 3 0x82 nanoslp syz-executor.1
20919 323231 63980 0 2 0x2 syz-executor.2
92573 318350 63980 0 3 0x82 nanoslp syz-executor.0
63980 473510 50085 0 3 0x82 wait syz-fuzzer
63980 218839 50085 0 3 0x4000082 thrsleep syz-fuzzer
63980 138069 50085 0 3 0x4000082 wait syz-fuzzer
63980 504709 50085 0 3 0x4000082 thrsleep syz-fuzzer
63980 436028 50085 0 3 0x4000082 wait syz-fuzzer
63980 411188 50085 0 3 0x4000082 thrsleep syz-fuzzer
63980 465105 50085 0 3 0x4000082 thrsleep syz-fuzzer
63980 406449 50085 0 3 0x4000082 wait syz-fuzzer
63980 179892 50085 0 3 0x4000082 thrsleep syz-fuzzer
63980 105547 50085 0 3 0x4000082 thrsleep syz-fuzzer
63980 411641 50085 0 3 0x4000082 wait syz-fuzzer
63980 146274 50085 0 3 0x4000082 wait syz-fuzzer
63980 186467 50085 0 3 0x4000082 wait syz-fuzzer
63980 55406 50085 0 3 0x4000082 kqread syz-fuzzer
63980 476878 50085 0 3 0x4000082 thrsleep syz-fuzzer
50085 292662 22648 0 3 0x10008a sigsusp ksh
22648 101391 7300 0 3 0x9a kqread sshd
72201 21944 1 0 3 0x100083 ttyin getty
7300 292266 1 0 3 0x88 kqread sshd
64154 347024 40642 74 3 0x1100092 bpf pflogd
40642 98029 1 0 3 0x80 netio pflogd
6209 363875 16400 73 3 0x1100090 kqread syslogd
16400 143554 1 0 3 0x100082 netio syslogd
278 132008 1 0 3 0x100080 kqread resolvd
67335 348842 56660 77 3 0x100092 kqread dhcpleased
13932 487283 56660 77 3 0x100092 kqread dhcpleased
56660 349860 1 0 3 0x80 kqread dhcpleased
67097 517712 0 0 3 0x14200 bored smr
98609 82571 0 0 2 0x14200 zerothread
4070 440453 0 0 3 0x14200 aiodoned aiodoned
46543 225656 0 0 3 0x14200 syncer update
41517 240216 0 0 3 0x14200 cleaner cleaner
60549 398337 0 0 3 0x14200 reaper reaper
27976 280407 0 0 3 0x14200 pgdaemon pagedaemon
78691 389646 0 0 3 0x14200 bored viomb
60986 70037 0 0 3 0x40014200 acpi0 acpi0
49767 412551 0 0 3 0x40014200 idle1
61155 354991 0 0 3 0x14200 bored softnet
40263 437294 0 0 3 0x14200 bored softnet
7894 70613 0 0 3 0x14200 bored softnet
60780 325201 0 0 3 0x14200 bored softnet
22773 35097 0 0 3 0x14200 bored systqmp
96833 339740 0 0 3 0x14200 bored systq
77528 451638 0 0 3 0x40014200 bored softclock
8012 75152 0 0 3 0x40014200 idle0
1 358019 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
Process 54193 (syz-executor.0) thread 0xffff800029e51a40 (2944)
exclusive rwlock netlock r = 0 (0xffffffff82991290)
#0 witness_lock+0x44d
#1 sys_setsockopt+0x1de sys/kern/uipc_syscalls.c:1233
#2 syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
#2 syscall+0x435 sys/arch/amd64/amd64/trap.c:585
#3 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff829ee950)
#0 witness_lock+0x44d
#1 syscall+0x41d mi_syscall sys/sys/syscall_mi.h:100 [inline]
#1 syscall+0x41d sys/arch/amd64/amd64/trap.c:585
#2 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10182 6465K 6668K 78643K 12268 0
pcb 13 8K 8K 78643K 139 0
rtable 85 5K 9K 78643K 662 0
ifaddr 53 12K 17K 78643K 209 0
sysctl 0 0K 1K 78643K 4 0
counters 44 34K 35K 78643K 86 0
ioctlops 0 0K 4K 78643K 1570 0
iov 0 0K 16K 78643K 49 0
mount 1 1K 1K 78643K 1 0
log 0 0K 0K 78643K 4 0
vnodes 1274 80K 80K 78643K 1840 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 5K 78643K 6 0
VM map 2 1K 1K 78643K 2 0
sem 9 0K 0K 78643K 9 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1697 195K 286K 78643K 12548 0
file desc 12 41K 89K 78643K 1903 0
sigio 0 0K 0K 78643K 4 0
proc 70 91K 128K 78643K 852 0
subproc 91 5K 6K 78643K 195 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 65 0
in_multi 24 1K 6K 78643K 280 0
ether_multi 1 0K 0K 78643K 18 0
mrt 0 0K 0K 78643K 5 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 73 334K 334K 78643K 73 0
exec 0 0K 2K 78643K 929 0
tdb 3 0K 0K 78643K 3 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 8 62K 64K 78643K 10 0
UVM amap 203 69K 82K 78643K 10878 0
UVM aobj 3 2K 4K 78643K 7 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 67 0
NDP 7 0K 2K 78643K 64 0
temp 68 4712K 4784K 78643K 8608 0
kqueue 12 18K 24K 78643K 123 0
SYN cache 2 16K 16K 78643K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 22 0 0 1 0 1 1 0 8 0
rtpcb 120 67 0 64 1 0 1 1 0 8 0
rtentry 112 216 0 184 4 0 4 4 0 8 0
unpcb 144 342 0 326 2 1 1 2 0 8 0
syncache 296 5 0 5 2 2 0 1 0 8 0
tcpqe 32 2 0 2 1 1 0 1 0 8 0
tcpcb 768 278 0 270 6 4 2 4 0 8 0
arp 120 32 0 26 1 0 1 1 0 8 0
inpcb 368 803 0 792 2 0 2 2 0 8 1
nd6 48 51 0 45 1 0 1 1 0 8 0
pkpcb 40 8 0 8 2 1 1 1 0 8 1
kcovpl 48 15 0 8 1 0 1 1 0 8 0
pfstscr 40 5 0 0 1 0 1 1 0 8 0
pffrag 232 5 0 4 1 0 1 1 0 482 0
pffrnode 88 5 0 4 1 0 1 1 0 8 0
pffrent 40 9 0 8 1 0 1 1 0 8 0
pfosfp 40 1430 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1430 0 714 21 0 21 21 0 8 0
pfrktable 1344 4 0 4 1 1 0 1 0 8 0
pftag 88 6 0 4 1 0 1 1 0 8 0
pfqueue 264 16 0 16 1 1 0 1 0 8 0
pfstitem 24 37 0 24 1 0 1 1 0 8 0
pfstkey 120 37 0 28 1 0 1 1 0 8 0
pfstate 336 36 0 24 3 1 2 3 0 8 0
pfrule 1360 36 0 35 2 1 1 2 0 8 0
art_heap8 4096 4 0 3 2 1 1 2 0 8 0
art_heap4 256 1034 0 910 29 14 15 29 0 8 0
art_table 32 1038 0 913 4 0 4 4 0 8 0
art_node 16 214 0 188 1 0 1 1 0 8 0
sysvmsgpl 40 12 0 0 1 0 1 1 0 8 0
semupl 112 1 0 1 1 1 0 1 0 8 0
semapl 112 7 0 0 1 0 1 1 0 8 0
shmpl 112 4 0 4 1 1 0 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 3738 0 2313 91 0 91 91 0 8 0
ffsino 272 3738 0 2313 97 0 97 97 0 8 0
nchpl 144 6071 0 4442 63 0 63 63 0 8 0
uvmvnodes 80 4248 0 0 87 0 87 87 0 8 0
vnodes 216 4248 0 0 236 0 236 236 0 8 0
namei 1024 17307 0 17307 2 1 1 2 0 8 1
percpumem 16 55 0 21 1 0 1 1 0 8 0
kstatmem 264 56 0 42 2 0 2 2 0 8 0
scxspl 216 19164 0 19164 11 9 2 8 0 8 2
plimitpl 152 139 0 125 1 0 1 1 0 8 0
sigapl 424 2211 0 2165 8 2 6 7 0 8 0
futexpl 64 10191 0 10190 1 0 1 1 0 8 0
knotepl 120 318 0 0 10 0 10 10 0 8 0
kqueuepl 216 177 0 169 1 0 1 1 0 8 0
pipepl 320 218 0 193 3 0 3 3 0 8 0
fdescpl 496 2189 0 2164 6 1 5 5 0 8 1
filepl 152 6713 0 6491 10 0 10 10 0 8 0
lockfpl 104 287 0 285 1 0 1 1 0 8 0
lockfspl 48 117 0 115 1 0 1 1 0 8 0
sessionpl 144 31 0 15 1 0 1 1 0 8 0
pgrppl 48 35 0 19 1 0 1 1 0 8 0
ucredpl 104 1043 0 1031 1 0 1 1 0 8 0
zombiepl 144 2168 0 2165 1 0 1 1 0 8 0
processpl 1064 2211 0 2165 4 0 4 4 0 8 0
procpl 672 4088 0 4026 8 1 7 7 0 8 1
srpgc 96 36 0 36 2 1 1 1 0 8 1
sosppl 168 10 0 8 2 1 1 1 0 8 0
sockpl 488 1220 0 1190 8 3 5 6 0 8 0
mcl16k 16384 3 0 0 1 0 1 1 0 8 0
mcl12k 12288 10 0 0 1 0 1 1 0 8 0
mcl9k 9216 3 0 0 1 0 1 1 0 8 0
mcl8k 8192 7 0 0 1 0 1 1 0 8 0
mcl4k 4096 17 0 0 3 0 3 3 0 8 0
mcl2k2 2112 5 0 0 1 0 1 1 0 8 0
mcl2k 2048 150 0 0 18 0 18 18 0 8 0
mtagpl 96 36 0 0 1 0 1 1 0 8 0
mbufpl 256 370 0 0 21 0 21 21 0 8 0
bufpl 288 7031 0 699 453 0 453 453 0 8 0
anonpl 24 389718 0 382136 104 23 81 102 0 186 11
amapchunkpl 152 31161 0 30674 44 19 25 41 0 158 0
amappl16 200 7138 0 6938 51 31 20 37 0 8 8
amappl15 192 558 0 551 1 0 1 1 0 8 0
amappl14 184 259 0 253 1 0 1 1 0 8 0
amappl13 176 167 0 165 1 0 1 1 0 8 0
amappl12 168 15 0 12 1 0 1 1 0 8 0
amappl11 160 662 0 641 2 0 2 2 0 8 1
amappl10 152 89 0 81 1 0 1 1 0 8 0
amappl9 144 483 0 481 1 0 1 1 0 8 0
amappl8 136 1319 0 1264 3 0 3 3 0 8 0
amappl7 128 763 0 743 1 0 1 1 0 8 0
amappl6 120 237 0 226 2 1 1 2 0 8 0
amappl5 112 1581 0 1566 1 0 1 1 0 8 0
amappl4 104 1851 0 1822 2 1 1 2 0 8 0
amappl3 96 5213 0 5172 2 0 2 2 0 8 0
amappl2 88 573 0 533 2 0 2 2 0 8 0
amappl1 80 52648 0 52063 21 5 16 20 0 8 0
amappl 88 10273 0 10139 4 0 4 4 0 92 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 6 0 4 1 0 1 1 0 8 0
uaddrrnd 24 2189 0 2164 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 2189 0 2164 1 0 1 1 0 8 0
vmmpekpl 168 16259 0 16196 4 0 4 4 0 8 0
vmmpepl 168 207986 0 206099 129 19 110 126 0 357 13
vmsppl 368 2188 0 2164 4 1 3 4 0 8 0
rwobjpl 56 54065 0 48684 80 2 78 79 0 8 0
pdppl 4096 4385 0 4328 137 68 69 81 0 8 12
pvpl 32 1006703 0 995357 260 38 222 259 0 265 93
pmappl 248 2188 0 2164 3 1 2 3 0 8 0
extentpl 40 56 0 38 1 0 1 1 0 8 0
phpool 112 872 0 89 23 0 23 23 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x1a: addq $0x8,%rsp
x86_ipi_db(ffffffff8296bff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff829ee748) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff829ee748) at __mp_lock+0x122 sys/kern/kern_lock.c:147
softintr_dispatch(0) at softintr_dispatch+0x4e sys/arch/amd64/amd64/softintr.c:88
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7ffffc3b90, count: 9
ddb{0}> trace
x86_ipi_db(ffffffff8296bff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff829ee748) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff829ee748) at __mp_lock+0x122 sys/kern/kern_lock.c:147
softintr_dispatch(0) at softintr_dispatch+0x4e sys/arch/amd64/amd64/softintr.c:88
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7ffffc3b90, count: -6
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x18: addq $0x8,%rsp
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82583901) at panic+0x177 sys/kern/subr_prf.c:198
witness_assert(fffffd806dd78400,4) at witness_assert+0x3ef sys/kern/subr_witness.c:1950
sbunlock(fffffd806dd783e8,fffffd806dd78530) at sbunlock+0xc9 soassertlocked sys/kern/uipc_socket2.c:414 [inline]
sbunlock(fffffd806dd783e8,fffffd806dd78530) at sbunlock+0xc9 sys/kern/uipc_socket2.c:479
sosplice(fffffd806dd78200,5,0,0) at sosplice+0x550
sosetopt(fffffd806dd78200,ffff,1023,fffffd8067819e00) at sosetopt+0x7f4
sys_setsockopt(ffff800029e51a40,ffff800029e4e728,ffff800029e4e770) at sys_setsockopt+0x1f6 sys/kern/uipc_syscalls.c:1233
syscall(ffff800029e4e7f0) at syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff800029e4e7f0) at syscall+0x435 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xe64cbf56e10, count: 6
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82583901) at panic+0x177 sys/kern/subr_prf.c:198
witness_assert(fffffd806dd78400,4) at witness_assert+0x3ef sys/kern/subr_witness.c:1950
sbunlock(fffffd806dd783e8,fffffd806dd78530) at sbunlock+0xc9 soassertlocked sys/kern/uipc_socket2.c:414 [inline]
sbunlock(fffffd806dd783e8,fffffd806dd78530) at sbunlock+0xc9 sys/kern/uipc_socket2.c:479
sosplice(fffffd806dd78200,5,0,0) at sosplice+0x550
sosetopt(fffffd806dd78200,ffff,1023,fffffd8067819e00) at sosetopt+0x7f4
sys_setsockopt(ffff800029e51a40,ffff800029e4e728,ffff800029e4e770) at sys_setsockopt+0x1f6 sys/kern/uipc_syscalls.c:1233
syscall(ffff800029e4e7f0) at syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff800029e4e7f0) at syscall+0x435 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xe64cbf56e10, count: -9


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c3a3d6092d41 Move PRU_PEERADDR request to (*pru_peeraddr)().
git tree: openbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=1711fcb7080000

kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=0e026f1bf8b259c6395e

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a6a96d080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10a5b643080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0e026f...@syzkaller.appspotmail.com

panic: lock (rwlock) solock not locked
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND

* 74223 62624 0 0x2 0 0K syz-executor1443616285
69469 39906 0 0x12 0 1 sshd

db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437

panic(ffffffff82585177) at panic+0x177 sys/kern/subr_prf.c:198
witness_assert(fffffd806e9a8b98,4) at witness_assert+0x3ef sys/kern/subr_witness.c:1950
somove(fffffd806da117b8,1) at somove+0x25d sbspace sys/sys/socketvar.h:209 [inline]
somove(fffffd806da117b8,1) at somove+0x25d sys/kern/uipc_socket.c:1487
sosplice(fffffd806da117b8,3,0,0) at sosplice+0x50b sys/kern/uipc_socket.c:1346
sosetopt(fffffd806da117b8,ffff,1023,fffffd806d7cec00) at sosetopt+0x7f4
sys_setsockopt(ffff800021232008,ffff80002127acb8,ffff80002127ad00) at sys_setsockopt+0x1f6 sys/kern/uipc_syscalls.c:1233
syscall(ffff80002127ad80) at syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff80002127ad80) at syscall+0x435 sys/arch/amd64/amd64/trap.c:585

Xsyscall() at Xsyscall+0x128
end of kernel

end trace frame: 0x7f7ffffec4b0, count: 6

https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.

ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: lock (rwlock) solock not locked
ddb{0}> trace

db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437

panic(ffffffff82585177) at panic+0x177 sys/kern/subr_prf.c:198
witness_assert(fffffd806e9a8b98,4) at witness_assert+0x3ef sys/kern/subr_witness.c:1950
somove(fffffd806da117b8,1) at somove+0x25d sbspace sys/sys/socketvar.h:209 [inline]
somove(fffffd806da117b8,1) at somove+0x25d sys/kern/uipc_socket.c:1487
sosplice(fffffd806da117b8,3,0,0) at sosplice+0x50b sys/kern/uipc_socket.c:1346
sosetopt(fffffd806da117b8,ffff,1023,fffffd806d7cec00) at sosetopt+0x7f4
sys_setsockopt(ffff800021232008,ffff80002127acb8,ffff80002127ad00) at sys_setsockopt+0x1f6 sys/kern/uipc_syscalls.c:1233
syscall(ffff80002127ad80) at syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff80002127ad80) at syscall+0x435 sys/arch/amd64/amd64/trap.c:585

Xsyscall() at Xsyscall+0x128
end of kernel

end trace frame: 0x7f7ffffec4b0, count: -9
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff80002127a9b0
rbx 0xffffffff829bab8f cpu_info_full_primary+0x2b8f
rdx 0x3fd
rcx 0
rax 0x27
r8 0x101010101010101
r9 0x8080808080808080
r10 0x53bf486ac725654e
r11 0x578b94db3c9eef66
r12 0xffffffff829ba990 cpu_info_full_primary+0x2990

r13 0
r14 0
r15 0x1

rip 0xffffffff81fd76c8 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff80002127a9a0

ss 0x10
db_enter+0x18: addq $0x8,%rsp

ddb{0}> show proc
PROC (syz-executor1443616285) pid=74223 stat=onproc
flags process=2<EXEC> proc=0
pri=52, usrpri=53, nice=20
forw=0xffffffffffffffff, list=0xffff800021232fc8,0xffff800021232d38
process=0xffff800021298438 user=0xffff800021275000, vmspace=0xfffffd807effd170
estcpu=3, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb{0}> ps

PID TID PPID UID S FLAGS WAIT COMMAND

26543 128176 0 0 2 0x14200 sosplice
*62624 74223 23539 0 7 0x2 syz-executor1443616285
23539 130284 39906 0 3 0x10008a sigsusp ksh
39906 69469 32645 0 7 0x12 sshd
32937 147996 1 0 3 0x100083 ttyin getty
32645 487716 1 0 3 0x88 kqread sshd
43197 321542 64397 73 3 0x1100090 kqread syslogd
64397 39362 1 0 3 0x100082 netio syslogd
91475 19052 1 0 3 0x100080 kqread resolvd
24457 436151 51338 77 3 0x100092 kqread dhcpleased
88829 359226 51338 77 3 0x100092 kqread dhcpleased
51338 63892 1 0 3 0x80 kqread dhcpleased
50616 54315 0 0 3 0x14200 bored smr
7697 16761 0 0 2 0x14200 zerothread
89317 54265 0 0 3 0x14200 aiodoned aiodoned
66317 427675 0 0 3 0x14200 syncer update
25806 48826 0 0 3 0x14200 cleaner cleaner
31451 235703 0 0 3 0x14200 reaper reaper
11519 262913 0 0 3 0x14200 pgdaemon pagedaemon
15670 210666 0 0 3 0x14200 bored viomb
33993 159758 0 0 3 0x40014200 acpi0 acpi0
90766 71171 0 0 3 0x40014200 idle1
80438 17611 0 0 3 0x14200 bored softnet
5924 504602 0 0 3 0x14200 bored softnet
92737 232974 0 0 3 0x14200 bored softnet
78847 125535 0 0 3 0x14200 bored softnet
69834 81664 0 0 3 0x14200 bored systqmp
43141 333357 0 0 3 0x14200 bored systq
68381 9067 0 0 3 0x40014200 bored softclock
27694 27673 0 0 3 0x40014200 idle0
1 167028 0 0 3 0x82 wait init

0 0 -1 0 3 0x10200 scheduler swapper

ddb{0}> show all locks
Process 62624 (syz-executor1443616285) thread 0xffff800021232008 (74223)
exclusive rwlock netlock r = 0 (0xffffffff82971a40)

#0 witness_lock+0x44d
#1 sys_setsockopt+0x1de sys/kern/uipc_syscalls.c:1233
#2 syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
#2 syscall+0x435 sys/arch/amd64/amd64/trap.c:585
#3 Xsyscall+0x128

exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82a8d100)

#0 witness_lock+0x44d
#1 syscall+0x41d mi_syscall sys/sys/syscall_mi.h:100 [inline]
#1 syscall+0x41d sys/arch/amd64/amd64/trap.c:585
#2 Xsyscall+0x128

ddb{0}> show malloc

Type InUse MemUse HighUse Limit Requests Type Lim

devbuf 10156 6389K 6420K 78643K 11246 0
pcb 13 8K 8K 78643K 13 0
rtable 58 1K 2K 78643K 111 0
ifaddr 25 7K 7K 78643K 25 0
counters 40 33K 33K 78643K 40 0
ioctlops 0 0K 2K 78643K 25 0

mount 1 1K 1K 78643K 1 0
log 0 0K 0K 78643K 4 0

vnodes 1166 73K 73K 78643K 1179 0

UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0

shm 2 1K 1K 78643K 2 0

VM map 2 1K 1K 78643K 2 0

sem 2 0K 0K 78643K 2 0

dirhash 12 2K 2K 78643K 12 0
ACPI 1697 195K 286K 78643K 12548 0

file desc 1 0K 0K 78643K 1 0
proc 55 78K 79K 78643K 226 0

NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0

in_multi 11 0K 0K 78643K 11 0
ether_multi 1 0K 0K 78643K 1 0

ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0

ttys 25 122K 122K 78643K 25 0
exec 0 0K 2K 78643K 410 0

tdb 3 0K 0K 78643K 3 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 8 62K 64K 78643K 10 0

UVM amap 50 2K 4K 78643K 1458 0
UVM aobj 3 2K 2K 78643K 3 0

memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0

NDP 3 0K 0K 78643K 3 0
temp 18 4709K 4773K 78643K 2342 0
kqueue 11 16K 18K 78643K 24 0

SYN cache 2 16K 16K 78643K 2 0

ddb{0}> show all pools

Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 22 0 0 1 0 1 1 0 8 0

rtpcb 120 21 0 18 1 0 1 1 0 8 0
rtentry 112 23 0 1 1 0 1 1 0 8 0
unpcb 144 35 0 20 1 0 1 1 0 8 0
syncache 296 5 0 5 1 0 1 1 0 8 1
tcpcb 768 8 0 5 1 0 1 1 0 8 0
arp 120 2 0 0 1 0 1 1 0 8 0
inpcb 368 26 0 19 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 96 0 0 6 0 6 6 0 8 0
art_table 32 97 0 0 1 0 1 1 0 8 0
art_node 16 22 0 2 1 0 1 1 0 8 0

dirhash 1024 17 0 0 3 0 3 3 0 8 0

dino2pl 256 1415 0 38 87 0 87 87 0 8 0
ffsino 272 1415 0 38 92 0 92 92 0 8 0
nchpl 144 1600 0 46 58 0 58 58 0 8 0
uvmvnodes 80 1424 0 0 30 0 30 30 0 8 0
vnodes 216 1424 0 0 80 0 80 80 0 8 0
namei 1024 4155 0 4155 1 0 1 1 0 8 1
percpumem 16 32 0 0 1 0 1 1 0 8 0
kstatmem 264 6 0 0 1 0 1 1 0 8 0
scxspl 216 3776 0 3776 2 1 1 2 0 8 1
plimitpl 152 15 0 9 1 0 1 1 0 8 0
sigapl 424 307 0 276 4 0 4 4 0 8 0
knotepl 120 48 0 0 2 0 2 2 0 8 0
kqueuepl 216 20 0 13 1 0 1 1 0 8 0
pipepl 320 83 0 80 1 0 1 1 0 8 0
fdescpl 496 289 0 276 3 1 2 3 0 8 0
filepl 152 1070 0 1014 3 0 3 3 0 8 0
lockfpl 104 6 0 4 1 0 1 1 0 8 0
lockfspl 48 4 0 2 1 0 1 1 0 8 0
sessionpl 144 17 0 9 1 0 1 1 0 8 0
pgrppl 48 17 0 9 1 0 1 1 0 8 0
ucredpl 104 64 0 54 1 0 1 1 0 8 0
zombiepl 144 276 0 276 1 0 1 1 0 8 1
processpl 1064 307 0 276 3 0 3 3 0 8 0
procpl 672 307 0 276 3 0 3 3 0 8 0
sosppl 168 2 0 0 1 0 1 1 0 8 0
sockpl 488 82 0 57 4 0 4 4 0 8 0
mcl8k 8192 8 0 0 1 0 1 1 0 8 0
mcl4k 4096 4 0 0 1 0 1 1 0 8 0
mcl2k 2048 65 0 0 9 0 9 9 0 8 0
mtagpl 96 2 0 0 1 0 1 1 0 8 0
mbufpl 256 114 0 0 8 0 8 8 0 8 0
bufpl 288 1907 0 75 131 0 131 131 0 8 0
anonpl 24 35895 0 34120 13 1 12 13 0 186 1
amapchunkpl 152 2628 0 2542 5 1 4 5 0 158 0
amappl16 200 27 0 26 2 1 1 1 0 8 0
amappl15 192 63 0 59 1 0 1 1 0 8 0
amappl14 184 1 0 0 1 0 1 1 0 8 0
amappl13 176 32 0 31 1 0 1 1 0 8 0
amappl12 168 3 0 3 1 0 1 1 0 8 1
amappl11 160 60 0 47 1 0 1 1 0 8 0
amappl9 144 469 0 467 1 0 1 1 0 8 0
amappl8 136 350 0 349 1 0 1 1 0 8 0
amappl7 128 62 0 55 1 0 1 1 0 8 0
amappl6 120 82 0 76 1 0 1 1 0 8 0
amappl5 112 87 0 78 1 0 1 1 0 8 0
amappl4 104 590 0 570 1 0 1 1 0 8 0
amappl3 96 421 0 398 1 0 1 1 0 8 0
amappl2 88 301 0 274 1 0 1 1 0 8 0
amappl1 80 9119 0 8742 9 0 9 9 0 8 0
amappl 88 1194 0 1159 1 0 1 1 0 92 0

dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0

aobjpl 72 2 0 0 1 0 1 1 0 8 0
uaddrrnd 24 289 0 276 1 0 1 1 0 8 0

uaddrbest 32 2 0 0 1 0 1 1 0 8 0

uaddr 24 289 0 276 1 0 1 1 0 8 0
vmmpekpl 168 6007 0 5992 1 0 1 1 0 8 0
vmmpepl 168 25800 0 25029 38 0 38 38 0 357 3
vmsppl 368 288 0 276 2 0 2 2 0 8 0
rwobjpl 56 9334 0 7393 29 0 29 29 0 8 0
pdppl 4096 585 0 552 53 20 33 41 0 8 0
pvpl 32 120097 0 116476 33 0 33 33 0 265 3
pmappl 248 288 0 276 2 1 1 2 0 8 0

extentpl 40 56 0 38 1 0 1 1 0 8 0

phpool 112 399 0 22 11 0 11 11 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace

db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437

panic(ffffffff82585177) at panic+0x177 sys/kern/subr_prf.c:198
witness_assert(fffffd806e9a8b98,4) at witness_assert+0x3ef sys/kern/subr_witness.c:1950
somove(fffffd806da117b8,1) at somove+0x25d sbspace sys/sys/socketvar.h:209 [inline]
somove(fffffd806da117b8,1) at somove+0x25d sys/kern/uipc_socket.c:1487
sosplice(fffffd806da117b8,3,0,0) at sosplice+0x50b sys/kern/uipc_socket.c:1346
sosetopt(fffffd806da117b8,ffff,1023,fffffd806d7cec00) at sosetopt+0x7f4
sys_setsockopt(ffff800021232008,ffff80002127acb8,ffff80002127ad00) at sys_setsockopt+0x1f6 sys/kern/uipc_syscalls.c:1233
syscall(ffff80002127ad80) at syscall+0x435 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff80002127ad80) at syscall+0x435 sys/arch/amd64/amd64/trap.c:585

Xsyscall() at Xsyscall+0x128
end of kernel

end trace frame: 0x7f7ffffec4b0, count: -9

ddb{0}> machine ddbcpu 1

Stopped at x86_ipi_db+0x1a: addq $0x8,%rsp
x86_ipi_db(ffff800020dd8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393

x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23

__mp_lock(ffffffff82a8cef8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82a8cef8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
syscall(ffff8000212af160) at syscall+0x41d mi_syscall sys/sys/syscall_mi.h:100 [inline]
syscall(ffff8000212af160) at syscall+0x41d sys/arch/amd64/amd64/trap.c:585

Xsyscall() at Xsyscall+0x128
end of kernel

end trace frame: 0x7f7ffffdec90, count: 9
ddb{1}> trace
x86_ipi_db(ffff800020dd8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393

x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23

__mp_lock(ffffffff82a8cef8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82a8cef8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
syscall(ffff8000212af160) at syscall+0x41d mi_syscall sys/sys/syscall_mi.h:100 [inline]
syscall(ffff8000212af160) at syscall+0x41d sys/arch/amd64/amd64/trap.c:585

Xsyscall() at Xsyscall+0x128
end of kernel

end trace frame: 0x7f7ffffdec90, count: -6
ddb{1}>

[Alexander Bluhm]

#syz fix: Use pru_send function to check socket splicing compatibility. Only checking socket type is not sufficient as it could splice together unix and inet sockets resulting in crashes. As splicing is about sending, the same send function looks like a good criteria. Reported-by: syzbot+fc6901...@syzkaller.appspotmail.com Reported-by: syzbot+0e026f...@syzkaller.appspotmail.com OK gnezdo@

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-openbsd-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-openbsd...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-openbsd-bugs/0000000000007289d305e7d15cc4%40google.com.

[syzbot]

This bug is marked as fixed by commit:

Use pru_send function to check socket splicing compatibility. Only checking socket type is not sufficient as it could splice together unix and inet sockets resulting in crashes. As splicing is about sending, the same send function looks like a good criteria. Reported-by: syzbot+fc6901...@syzkaller.appspotmail.com Reported-by: syzbot+0e026f...@syzkaller.appspotmail.com OK gnezdo@

But I can't find it in any tested tree for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and
new crashes with the same signature are ignored.

[syzbot]

Dashboard link: https://syzkaller.appspot.com/bug?extid=0e026f1bf8b259c6395e

[syzbot]

This bug is marked as fixed by commit:
Use pru_send function to check socket splicing compatibility. Only checking socket type is not sufficient as it could splice together unix and inet sockets resulting in crashes. As splicing is about sending, the same send function looks like a good criteria. Reported-by: syzbot+fc6901...@syzkaller.appspotmail.com Reported-by: syzbot+0e026f...@syzkaller.appspotmail.com OK gnezdo@

But I can't find it in the tested trees[1] for more than 90 days.

Is it a correct commit? Please update it by replying:

#syz fix: exact-commit-title

Until then the bug is still considered open and new crashes with
the same signature are ignored.

Kernel: OpenBSD
Dashboard link: https://syzkaller.appspot.com/bug?extid=0e026f1bf8b259c6395e

---
[1] I expect the commit to be present in:

1. master branch of
https://github.com/openbsd/src.git

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[Alexander Bluhm]

#syz fix: Use pru_send function to check socket splicing compatibility. Only

[syzbot]

This bug is marked as fixed by commit:

Use pru_send function to check socket splicing compatibility. Only

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]

[syzbot]