uvm_fault: filt_bpfrdetach

0 views
Skip to first unread message

syzbot

unread,
Oct 22, 2019, 2:01:07 AM10/22/19
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 09b70759 sync
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11f1fc28e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0fe83f82fe104d4
dashboard link: https://syzkaller.appspot.com/bug?extid=173a8db455144df8f505
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17638ef8e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+173a8d...@syzkaller.appspotmail.com

login: uvm_fault(0xfffffd803f013440, 0x8, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at filt_bpfrdetach+0x48: movq 0x8(%r15),%r12
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xfffffd803f013440, 0x8, 0, 1) -> e
filt_bpfrdetach(fffffd80363af540) at filt_bpfrdetach+0x48 sys/net/bpf.c:1199
end trace frame: 0xffff800014942360, count: 0
ddb> trace
filt_bpfrdetach(fffffd80363af540) at filt_bpfrdetach+0x48 sys/net/bpf.c:1199
knote_fdclose(ffff8000ffff5648,8) at knote_fdclose+0x96 knote_remove
sys/kern/kern_event.c:953 [inline]
knote_fdclose(ffff8000ffff5648,8) at knote_fdclose+0x96
sys/kern/kern_event.c:973
fdfree(ffff8000ffff5648) at fdfree+0xed sys/kern/kern_descrip.c:1195
exit1(ffff8000ffff5648,0,1) at exit1+0x32f sys/kern/kern_exit.c:196
sys_exit(ffff8000ffff5648,ffff800014942480,ffff8000149424d0) at
sys_exit+0x17 sys/kern/kern_exit.c:94
syscall(ffff800014942550) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,1,0,1,0,7f7ffffc2754) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc2720, count: -7
ddb> show registers
rdi 0xfffffd80363af540
rsi 0x8
rbp 0xffff800014942300
rbx 0x8
rdx 0x20
rcx 0xfffffd80331f3a10
rax 0xffffffff824f8e98 bpfread_filtops
r8 0
r9 0x5
r10 0xa8d62566123c86c5
r11 0x133931cff2816dd9
r12 0xffff800000a73b00
r13 0xfffffd8036223b60
r14 0xfffffd80363af540
r15 0
rip 0xffffffff8210ac88 filt_bpfrdetach+0x48
cs 0x8
rflags 0x10207 __ALIGN_SIZE+0xf207
rsp 0xffff8000149422d0
ss 0x10
filt_bpfrdetach+0x48: movq 0x8(%r15),%r12
ddb> show proc
PROC (syz-executor.1) pid=10860 stat=onproc
flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
pri=32, usrpri=52, nice=20
forw=0xffffffffffffffff, list=0xffff8000ffff93c8,0xffffffff8255d430
process=0xffff8000ffff70f0 user=0xffff80001493d000,
vmspace=0xfffffd803f013440
estcpu=2, cpticks=5, pctcpu=0.19
user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
35332 284917 7707 0 2 0x482 syz-executor.1
76467 20776 7707 0 2 0x482 syz-executor.0
7707 195798 226 0 3 0x82 thrsleep syz-execprog
7707 319505 226 0 3 0x4000082 thrsleep syz-execprog
7707 492290 226 0 3 0x4000082 thrsleep syz-execprog
7707 375543 226 0 3 0x4000082 thrsleep syz-execprog
7707 78307 226 0 3 0x4000082 thrsleep syz-execprog
7707 2250 226 0 3 0x4000082 kqread syz-execprog
7707 6963 226 0 3 0x4000082 thrsleep syz-execprog
226 29519 84932 0 3 0x10008a pause ksh
84932 417011 64388 0 3 0x92 select sshd
90876 471069 1 0 3 0x100083 ttyin getty
64388 39501 1 0 3 0x80 select sshd
12347 327039 4469 73 2 0x100090 syslogd
4469 383775 1 0 3 0x100082 netio syslogd
9390 411699 1 77 3 0x100090 poll dhclient
85330 429855 1 0 3 0x80 poll dhclient
37839 301561 0 0 2 0x14200 zerothread
87455 305127 0 0 3 0x14200 aiodoned aiodoned
60803 75566 0 0 3 0x14200 syncer update
63530 304323 0 0 3 0x14200 cleaner cleaner
54009 122194 0 0 3 0x14200 reaper reaper
75939 46059 0 0 3 0x14200 pgdaemon pagedaemon
74476 447156 0 0 3 0x14200 bored crynlk
42127 302813 0 0 3 0x14200 bored crypto
24341 88781 0 0 3 0x40014200 acpi0 acpi0
87791 464846 0 0 3 0x14200 bored softnet
91851 359794 0 0 3 0x14200 bored systqmp
56306 114780 0 0 3 0x14200 bored systq
64599 243290 0 0 3 0x40014200 bored softclock
16915 426941 0 0 3 0x40014200 idle0
24586 462229 0 0 3 0x14200 bored smr
1 7523 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9440 6311K 6632K 78643K 10561 0 0
pcb 13 8K 8K 78643K 13 0 0
rtable 65 2K 3K 78643K 203 0 0
ifaddr 22 7K 9K 78643K 35 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 15 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1191 75K 75K 78643K 1205 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 1K 78643K 2 0 0
VM map 2 0K 0K 78643K 2 0 0
sem 2 0K 0K 78643K 2 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1793 195K 288K 78643K 12645 0 0
file desc 4 12K 24K 78643K 35 0 0
proc 47 38K 63K 78643K 347 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
in_multi 11 0K 2K 78643K 33 0 0
ether_multi 1 0K 0K 78643K 1 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 18 79K 79K 78643K 18 0 0
exec 0 0K 1K 78643K 185 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 76 19K 20K 78643K 903 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
NDP 3 0K 0K 78643K 9 0 0
temp 37 3537K 3589K 78643K 3193 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 6 0 4 1 0 1 1 0
8 0
rtpcb 80 19 0 17 1 0 1 1 0
8 0
rtentry 112 45 0 21 2 0 2 2 0
8 0
unpcb 120 31 0 23 1 0 1 1 0
8 0
syncache 264 5 0 5 2 2 0 1 0
8 0
tcpcb 544 8 0 5 1 0 1 1 0
8 0
inpcb 280 30 0 24 1 0 1 1 0
8 0
nd6 48 4 0 4 1 0 1 1 0
8 1
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 213 0 90 14 0 14 14 0
8 4
art_table 32 214 0 90 2 0 2 2 0
8 0
art_node 16 44 0 22 1 0 1 1 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 1424 0 21 46 0 46 46 0
8 0
ffsino 240 1424 0 21 83 0 83 83 0
8 0
nchpl 144 1669 0 48 61 0 61 61 0
8 0
uvmvnodes 72 1451 0 0 27 0 27 27 0
8 0
vnodes 208 1451 0 0 77 0 77 77 0
8 0
namei 1024 3983 0 3983 2 1 1 1 0
8 1
scxspl 192 4181 0 4181 9 6 3 7 0
8 3
plimitpl 152 15 0 8 1 0 1 1 0
8 0
sigapl 432 211 0 198 2 0 2 2 0
8 0
futexpl 56 135 0 135 1 0 1 1 0
8 1
knotepl 112 69 0 46 1 0 1 1 0
8 0
kqueuepl 104 26 0 14 1 0 1 1 0
8 0
pipepl 112 146 0 127 2 1 1 1 0
8 0
fdescpl 424 212 0 198 2 0 2 2 0
8 0
filepl 120 1065 0 982 4 0 4 4 0
8 0
lockfpl 104 5 0 4 1 0 1 1 0
8 0
lockfspl 48 3 0 2 1 0 1 1 0
8 0
sessionpl 112 19 0 9 1 0 1 1 0
8 0
pgrppl 48 19 0 9 1 0 1 1 0
8 0
ucredpl 96 47 0 40 1 0 1 1 0
8 0
zombiepl 144 199 0 197 2 1 1 1 0
8 0
processpl 864 226 0 197 4 0 4 4 0
8 0
procpl 632 242 0 207 4 0 4 4 0
8 1
sockpl 384 80 0 64 2 0 2 2 0
8 0
mcl4k 4096 10 0 10 2 1 1 1 0
8 1
mcl2k 2048 5496 0 5456 9 3 6 9 0
8 0
mtagpl 80 2 0 2 1 1 0 1 0
8 0
mbufpl 256 9660 0 9615 10 2 8 8 0
8 3
bufpl 256 5796 0 1327 280 0 280 280 0
8 0
anonpl 16 21959 0 19730 15 1 14 14 0
62 3
amapchunkpl 152 970 0 899 5 0 5 5 0
158 0
amappl16 192 221 0 148 6 0 6 6 0
8 0
amappl15 184 4 0 1 1 0 1 1 0
8 0
amappl14 176 31 0 27 2 1 1 1 0
8 0
amappl12 160 7 0 5 2 1 1 1 0
8 0
amappl11 152 43 0 32 1 0 1 1 0
8 0
amappl10 144 8 0 6 1 0 1 1 0
8 0
amappl9 136 430 0 424 1 0 1 1 0
8 0
amappl8 128 121 0 109 1 0 1 1 0
8 0
amappl7 120 40 0 37 1 0 1 1 0
8 0
amappl6 112 71 0 63 1 0 1 1 0
8 0
amappl5 104 135 0 126 1 0 1 1 0
8 0
amappl4 96 442 0 417 1 0 1 1 0
8 0
amappl3 88 118 0 112 1 0 1 1 0
8 0
amappl2 80 889 0 824 4 1 3 3 0
8 1
amappl1 72 14029 0 13620 25 8 17 20 0
8 8
amappl 80 457 0 424 1 0 1 1 0
84 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma128 128 253 0 253 1 1 0 1 0
8 0
dma64 64 6 0 6 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 1 0 0 1 0 1 1 0
8 0
uaddrrnd 24 212 0 198 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 212 0 198 1 0 1 1 0
8 0
vmmpekpl 168 6282 0 6264 2 0 2 2 0
8 1
vmmpepl 168 30279 0 29306 93 16 77 77 0 357
30
vmsppl 272 211 0 198 2 0 2 2 0
8 1
pdppl 4096 430 0 396 6 0 6 6 0
8 0
pvpl 32 107733 0 103178 121 7 114 114 0 265
72
pmappl 200 211 0 198 1 0 1 1 0
8 0
extentpl 40 41 0 26 1 0 1 1 0
8 0
phpool 112 415 0 9 12 0 12 12 0
8 0
ddb>


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

Anton Lindqvist

unread,
Oct 22, 2019, 6:40:43 AM10/22/19
to syzbot, syzkaller-o...@googlegroups.com
#syz fix: put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
Reply all
Reply to author
Forward
0 new messages