multicore boot error: uvm_fault (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ce8152cabdef Prefix get_trusted_issuer() with x509_vfy_
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15f615a5e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=d99e0f464c49f2701b56

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/826f6a7b48f4/disk-ce8152ca.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/15323f34bfea/bsd-ce8152ca.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d004e34fff1c/kernel-ce8152ca.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d99e0f...@syzkaller.appspotmail.com


uvm_fault(0xffffffff82ce6830, 0x8, 0, 1) -> e

kernel: page fault trap, code=0

Stopped at pool_get+0xb5: movq 0x8(%rax),%r11

TID PID UID PRFLAGS PFLAGS CPU COMMAND

* 0 0 0 0x10000 0x200 0K swapper

pool_get(ffffffff82d3a550,1,24ca215bde7c13b3,0,ffff8000001a12a8,ffff8000001a196

8) at pool_get+0xb5 pl_enter sys/kern/subr_pool.c:104 [inline]

8) at pool_get+0xb5 sys/kern/subr_pool.c:578

counters_alloc(c,c,b2abc8c8da511fdc,0,ffff8000001a12a8,ffff8000001a1968) at cou

nters_alloc+0x56

if_attach_common(ffff8000001a12a8,ffff8000001a12a8,c9e550a8ef63b7a1,ffff8000001

a1050,ffff8000001a12a8,7) at if_attach_common+0xc7 sys/net/if.c:648

if_attach(ffff8000001a12a8,ffff8000001a12a8,ffff800000024c00,7,ffffffff81bc85fd

,ffffffff831687d0) at if_attach+0x1d sys/net/if.c:572

vio_attach(ffff800000024c00,ffff8000001a1000,ffff800000024c00,ffff800000024c00,

90c0aebb83f6e829,ffffffff82c0c9c0) at vio_attach+0x652 sys/dev/pv/if_vio.c:608

config_attach(ffff800000024c00,ffffffff82b94c98,ffff800000024c00,0,5dd70823b376

20a1,0) at config_attach+0x33a sys/kern/subr_autoconf.c:418

virtio_pci_attach(ffff80000002de00,ffff800000024c00,ffffffff83168a10,ffff800000

02de00,3baa4f15b9fd1045,ffffffff82bb24b0) at virtio_pci_attach+0x24d sys/dev/pci/virtio_pci.c:611

config_attach(ffff80000002de00,ffffffff82b96f60,ffffffff83168a10,ffffffff823987

50,5dd70823b34ff59c,ffff80000007b180) at config_attach+0x33a sys/kern/subr_autoconf.c:418

pci_probe_device(ffff80000002de00,80002000,0,0,3ab71789273e6212,0) at pci_probe

--db_more--serialport: Connected to syzkaller.us-central1-b.ci-openbsd-multicore-test-2 port 1 (session ID: f92ac94911cb231cbcea635fb40034481267af9fe54f1fa75b32f7977256ea51, active connections: 1).


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
syzkaller-o...@googlegroups.com.

***

Subject: Re: multicore boot error: uvm_fault (2)
Author: gr...@nest.cx

#syz fix: Backout always allocate per-CPU statistics counters for network
interface descriptor. It panics during attach of em(4) device at
boot.

> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-openbsd-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-openbsd...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-openbsd-bugs/00000000000085284a060d263972%40google.com
> .
>


--
nest.cx is Gmail hosted, use PGP:
https://pgp.key-server.io/0x0B1542BD8DF5A1B0
Fingerprint: 5E2B 2D0E 1E03 2046 BEC3 4D50 0B15 42BD 8DF5 A1B0

[syzbot]

This bug is marked as fixed by commit:

Backout always allocate per-CPU statistics counters for network

But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:

#syz fix: exact-commit-title

Until then the bug is still considered open and new crashes with
the same signature are ignored.

Kernel: OpenBSD
Dashboard link: https://syzkaller.appspot.com/bug?extid=d99e0f464c49f2701b56

---
[1] I expect the commit to be present in:

1. master branch of
https://github.com/openbsd/src.git

[syzbot]

[syzbot]