panic.go:LINE +0x72 fp=ADDR sp=ADDR pc=ADDR

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 9db0ea45 Only set the IPv4 address in umb(4) if both MBIM_..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=148df277600000
kernel config: https://syzkaller.appspot.com/x/.config?x=26ca0a9c07f16a3a
dashboard link: https://syzkaller.appspot.com/bug?extid=e84472cac918e373c27b

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e84472...@syzkaller.appspotmail.com

/usr/local/go/src/runtime/panic.go:617 +0x72 fp=0xc000187a40
sp=0xc000187a10 pc=0x42cb72
runtime.sigpanic()
/usr/local/go/src/runtime/signal_unix.go:387 +0x47e fp=0xc000187a70
sp=0xc000187a40 pc=0x441fee
runtime.mapaccess2_fast64(0x8429a0, 0xc0027cb860, 0x354, 0xc002e81478,
0x200)
/usr/local/go/src/runtime/map_fast64.go:84 +0x69 fp=0xc000187a98
sp=0xc000187a70 pc=0x410aa9
github.com/google/syzkaller/prog.(*vmaAlloc).noteAlloc(0xc0027cb890, 0x0,
0x800)
/syzkaller/gopath/src/github.com/google/syzkaller/prog/alloc.go:128 +0x70
fp=0xc000187af0 sp=0xc000187a98 pc=0x7546b0
github.com/google/syzkaller/prog.(*state).analyzeImpl.func1(0x97cc00,
0xc0027cb530, 0xc002a9c2e0)
/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:64
+0x4e9 fp=0xc000187be8 sp=0xc000187af0 pc=0x7895d9
github.com/google/syzkaller/prog.foreachArgImpl(0x97cc00, 0xc0027cb530,
0xc002a76408, 0x0, 0x0, 0x8a9c00, 0xc000187d50)
/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:125
+0xbe fp=0xc000187cd8 sp=0xc000187be8 pc=0x75513e
github.com/google/syzkaller/prog.ForeachArg(0xc002a76400, 0xc000187d50)
/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:120
+0xa1 fp=0xc000187d40 sp=0xc000187cd8 pc=0x755011
github.com/google/syzkaller/prog.(*state).analyzeImpl(0xc0034891d0,
0xc002a76400, 0xc00258a001)
/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:58
+0x61 fp=0xc000187d78 sp=0xc000187d40 pc=0x754f51
github.com/google/syzkaller/prog.analyze(0xc00275bec0, 0xc00258a000,
0x1f01, 0x2400, 0xc002a76000, 0xc002a764c0, 0xc000187e38)
/syzkaller/gopath/src/github.com/google/syzkaller/prog/analysis.go:34
+0xa5 fp=0xc000187de0 sp=0xc000187d78 pc=0x754c85
github.com/google/syzkaller/prog.(*mutator).insertCall(0xc000187ec0, 0x14)
/syzkaller/gopath/src/github.com/google/syzkaller/prog/mutation.go:136
+0xc6 fp=0xc000187e48 sp=0xc000187de0 pc=0x76db76
github.com/google/syzkaller/prog.(*Prog).Mutate(0xc002a76000, 0x9779c0,
0xc0027b77a0, 0x1e, 0xc00275bec0, 0xc00258a000, 0x1f01, 0x2400)
/syzkaller/gopath/src/github.com/google/syzkaller/prog/mutation.go:42
+0x29f fp=0xc000187f08 sp=0xc000187e48 pc=0x76d03f
main.(*Proc).loop(0xc00275bf40)
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:99
+0x435 fp=0xc000187fd8 sp=0xc000187f08 pc=0x7d4be5
runtime.goexit()
/usr/local/go/src/runtime/asm_amd64.s:1337 +0x1 fp=0xc000187fe0
sp=0xc000187fd8 pc=0x45ad31
created by main.main
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:258
+0x111b

goroutine 1 [select]:
main.(*Fuzzer).pollLoop(0xc0000b5080)
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:295
+0x127
main.main()
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:261
+0x128d

goroutine 6 [syscall, 5 minutes]:
os/signal.signal_recv(0x0)
/usr/local/go/src/runtime/sigqueue.go:139 +0x9c
os/signal.loop()
/usr/local/go/src/os/signal/signal_unix.go:23 +0x22
created by os/signal.init.0
/usr/local/go/src/os/signal/signal_unix.go:29 +0x41

goroutine 14 [chan receive, 5 minutes]:
main.main.func1(0xc00006a660)
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:137
+0x34
created by main.main
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:135
+0x5b4

goroutine 13 [chan receive, 5 minutes]:
github.com/google/syzkaller/pkg/osutil.HandleInterrupts.func1(0xc00006a660)

/syzkaller/gopath/src/github.com/google/syzkaller/pkg/osutil/osutil_unix.go:74
+0xb9
created by github.com/google/syzkaller/pkg/osutil.HandleInterrupts

/syzkaller/gopath/src/github.com/google/syzkaller/pkg/osutil/osutil_unix.go:71
+0x3f

goroutine 16 [IO wait]:
internal/poll.runtime_pollWait(0x22b1c5df8, 0x72, 0xffffffffffffffff)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc0000d3398, 0x72, 0x1000, 0x1000,
0xffffffffffffffff)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Read(0xc0000d3380, 0xc000252000, 0x1000, 0x1000, 0x0,
0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:169 +0x19b
net.(*netFD).Read(0xc0000d3380, 0xc000252000, 0x1000, 0x1000, 0x4,
0x854800, 0xc000079b00)
/usr/local/go/src/net/fd_unix.go:202 +0x4f
net.(*conn).Read(0xc00000e928, 0xc000252000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
/usr/local/go/src/net/net.go:177 +0x69
bufio.(*Reader).fill(0xc0000617a0)
/usr/local/go/src/bufio/bufio.go:100 +0x10f
bufio.(*Reader).ReadByte(0xc0000617a0, 0xc00002e570, 0xc00002e500,
0xc000079b80)
/usr/local/go/src/bufio/bufio.go:249 +0x39
compress/flate.(*decompressor).moreBits(0xc00011f300, 0xc000079bc0, 0x10)
/usr/local/go/src/compress/flate/inflate.go:696 +0x37
compress/flate.(*decompressor).nextBlock(0xc00011f300)
/usr/local/go/src/compress/flate/inflate.go:303 +0x36
compress/flate.(*decompressor).Read(0xc00011f300, 0xc00025e000, 0x1000,
0x1000, 0x824501, 0xc000001b00, 0x3)
/usr/local/go/src/compress/flate/inflate.go:347 +0x77
github.com/google/syzkaller/pkg/rpctype.(*flateConn).Read(0xc0000faa80,
0xc00025e000, 0x1000, 0x1000, 0x42c191, 0x8f5288, 0xc000079c90)
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/rpctype/rpc.go:131
+0x51
bufio.(*Reader).Read(0xc000061800, 0xc000020a90, 0x1, 0x9, 0xc00000dbc0,
0x3, 0xc00002e570)
/usr/local/go/src/bufio/bufio.go:223 +0x23e
io.ReadAtLeast(0x9737c0, 0xc000061800, 0xc000020a90, 0x1, 0x9, 0x1, 0x0,
0x0, 0xc000079db0)
/usr/local/go/src/io/io.go:310 +0x88
io.ReadFull(...)
/usr/local/go/src/io/io.go:329
�
encoding/gob.decodeUintReader(0x9737c0, 0xc000061800, 0xc000020a90, 0x9,
0x9, 0x4050ac, 0xc000000180, 0xc000079db0, 0x42b8ef)
/usr/local/go/src/encoding/gob/decode.go:120 +0x70
encoding/gob.(*Decoder).recvMessage(0xc0000d3400, 0xc000079dc8)
/usr/local/go/src/encoding/gob/decoder.go:81 +0x57
encoding/gob.(*Decoder).decodeTypeSequence(0xc0000d3400, 0x8f6400,
0xc0000d3400)
/usr/local/go/src/encoding/gob/decoder.go:143 +0x12c
encoding/gob.(*Decoder).DecodeValue(0xc0000d3400, 0x8147a0, 0xc0000faf60,
0x16, 0x0, 0x0)
/usr/local/go/src/encoding/gob/decoder.go:211 +0xf6
encoding/gob.(*Decoder).Decode(0xc0000d3400, 0x8147a0, 0xc0000faf60, 0x0,
0x0)
/usr/local/go/src/encoding/gob/decoder.go:188 +0x191
net/rpc.(*gobClientCodec).ReadResponseHeader(0xc0000fab70, 0xc0000faf60,
0xc002b31b60, 0x0)
/usr/local/go/src/net/rpc/client.go:228 +0x45
net/rpc.(*Client).input(0xc0000618c0)
/usr/local/go/src/net/rpc/client.go:109 +0xa2
created by net/rpc.NewClientWithCodec
/usr/local/go/src/net/rpc/client.go:206 +0x89

goroutine 3306 [IO wait, 1 minutes]:
internal/poll.runtime_pollWait(0x22b1c5778, 0x72, 0xffffffffffffffff)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc001834198, 0x72, 0x1ff01, 0x1ff89,
0xffffffffffffffff)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Read(0xc001834180, 0xc00351a077, 0x1ff89, 0x1ff89, 0x0,
0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:169 +0x19b
os.(*File).read(...)
/usr/local/go/src/os/file_unix.go:263
os.(*File).Read(0xc00000e258, 0xc00351a077, 0x1ff89, 0x1ff89, 0x27, 0x0,
0x0)
/usr/local/go/src/os/file.go:108 +0x70
github.com/google/syzkaller/pkg/ipc.makeCommand.func2(0xc00000e258,
0xc0000e2150)
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:595 +0xaf
created by github.com/google/syzkaller/pkg/ipc.makeCommand
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:589 +0x91a

goroutine 21 [runnable]:
syscall.Syscall(0x3, 0xc, 0xc002054fe0, 0xc, 0xc, 0xc, 0x0)
/usr/local/go/src/syscall/asm_unix_amd64.s:19 +0x5
syscall.read(0xc, 0xc002054fe0, 0xc, 0xc, 0x0, 0x974cc0, 0xc55490)
/usr/local/go/src/syscall/zsyscall_openbsd_amd64.go:870 +0x5a
syscall.Read(...)
/usr/local/go/src/syscall/syscall_unix.go:172
internal/poll.(*FD).Read(0xc001834300, 0xc002054fe0, 0xc, 0xc, 0x0, 0x0,
0x0)
/usr/local/go/src/internal/poll/fd_unix.go:165 +0x131
os.(*File).read(...)
/usr/local/go/src/os/file_unix.go:263
os.(*File).Read(0xc00000e490, 0xc002054fe0, 0xc, 0xc, 0xc0038a9980,
0x40bf48, 0x10)
/usr/local/go/src/os/file.go:108 +0x70
io.ReadAtLeast(0x9740e0, 0xc00000e490, 0xc002054fe0, 0xc, 0xc, 0xc, 0x0,
0xc0038a9900, 0xc0038a9a38)
/usr/local/go/src/io/io.go:310 +0x88
io.ReadFull(...)
/usr/local/go/src/io/io.go:329
github.com/google/syzkaller/pkg/ipc.(*command).exec(0xc0000e2150,
0xc000022980, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78cc90, ...)
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:749 +0x286
github.com/google/syzkaller/pkg/ipc.(*Env).Exec(0xc0001442d0, 0xc000022980,
0xc001eb1640, 0x1, 0x4e3f23, 0xc003517500, 0x4e84b29b692ee43b,
0xc0038a9d50, 0x4e42b0, 0xc0027b7770)
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:279 +0x11b
main.(*Proc).executeRaw(0xc00275bf00, 0xc000022980, 0xc001eb1640, 0x1, 0x0)
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:292
+0x1f3
main.(*Proc).execute(0xc00275bf00, 0xc000022980, 0xc001eb1640, 0x0, 0x1,
0x1)
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:255
+0x6a
main.(*Proc).loop(0xc00275bf00)
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:101
+0x4df
created by main.main
/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:258
+0x111b

goroutine 4078 [select]:
github.com/google/syzkaller/pkg/ipc.(*command).exec.func1(0xc0000e2150,
0xc00275c900, 0xc00275c8a0)
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:734 +0xba
created by github.com/google/syzkaller/pkg/ipc.(*command).exec
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:732 +0x19c

goroutine 3980 [IO wait]:
internal/poll.runtime_pollWait(0x22b1c5ab8, 0x72, 0xffffffffffffffff)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc0020ebed8, 0x72, 0x1ff01, 0x1ff89,
0xffffffffffffffff)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Read(0xc0020ebec0, 0xc00304e077, 0x1ff89, 0x1ff89, 0x0,
0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:169 +0x19b
os.(*File).read(...)
/usr/local/go/src/os/file_unix.go:263
os.(*File).Read(0xc000796060, 0xc00304e077, 0x1ff89, 0x1ff89, 0x27, 0x0,
0x0)
/usr/local/go/src/os/file.go:108 +0x70
github.com/google/syzkaller/pkg/ipc.makeCommand.func2(0xc000796060,
0xc0007ce0e0)
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:595 +0xaf
created by github.com/google/syzkaller/pkg/ipc.makeCommand
/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:589 +0x91a


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Anton Lindqvist]

#syz invalid