panic: mallocarray: overflow ADDR * 8
5 views
Skip to first unread message
syzbot
Jan 27, 2019, 3:54:04 PM1/27/19
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 269c2856b78e sentences start with capital letters;
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=150fd2ef400000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffa1da4399f74b2b
dashboard link: https://syzkaller.appspot.com/bug?extid=1632ffc147e7585697a8
compiler:
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1632ff...@syzkaller.appspotmail.com
panic: mallocarray: overflow 18446744071562067968 * 8
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*292052 94723 0 0 0x4000000 0 syz-executor1
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x154 sys/kern/subr_prf.c:208
mallocarray(23ce4d59a2091730,7fffffff,80000000,82) at mallocarray+0xec
wsmux_getmux(1011a0424e17e7fc) at wsmux_getmux+0x6f
sys/dev/wscons/wsmux.c:135
wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0)
a
t wsmux_do_ioctl+0x268
VOP_IOCTL(c97283363b0b6998,80085761,fffffd80302c4b50,ffff800014a34728,fffffd802f4e3608,ffff800014a34728)
at
VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290
vn_ioctl(db60ad9b09e87882,fffffd80302c4b50,ffff800014a34728,8) at
vn_ioctl+0xc5 sys/kern/vfs_vnops.c:512
sys_ioctl(d1e55ca8673f6766,0,ffff800014a34728) at sys_ioctl+0x639
syscall(291d745eba10a5de) at syscall+0x528
Xsyscall(6,0,ffffffffffffff8a,0,3,974baac010) at Xsyscall+0x128
end of kernel
end trace frame: 0x99ea22a6d0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> show panic
mallocarray: overflow 18446744071562067968 * 8
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x154 sys/kern/subr_prf.c:208
mallocarray(23ce4d59a2091730,7fffffff,80000000,82) at mallocarray+0xec
wsmux_getmux(1011a0424e17e7fc) at wsmux_getmux+0x6f
sys/dev/wscons/wsmux.c:135
wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0)
at
wsmux_do_ioctl+0x268 wsmux_add_mux sys/dev/wscons/wsmux.c:563 [inline]
wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0)
at
wsmux_do_ioctl+0x268 sys/dev/wscons/wsmux.c:424
VOP_IOCTL(c97283363b0b6998,80085761,fffffd80302c4b50,ffff800014a34728,fffffd802f4e3608,ffff800014a34728)
at
VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290
vn_ioctl(db60ad9b09e87882,fffffd80302c4b50,ffff800014a34728,8) at
vn_ioctl+0xc5
sys/kern/vfs_vnops.c:512sys_ioctl(d1e55ca8673f6766,0,ffff800014a34728) at
sys_ioctl+0x639
syscall(291d745eba10a5de) at syscall+0x528
Xsyscall(6,0,ffffffffffffff8a,0,3,974baac010) at Xsyscall+0x128
end of kernel
end trace frame: 0x99ea22a6d0, count: -10
ddb> show registers
rdi 0xffffffff8111eb77 db_enter+0x17
rsi 0x1813 __ALIGN_SIZE+0x813
rbp 0xffff800014a168c0
rbx 0xffff800014a16960
rdx 0x1814 __ALIGN_SIZE+0x814
rcx 0xffff800001b3a000
rax 0xffff800001b3a000
r8 0xffffffff813e1344 kprintf+0x184
r9 0x1
r10 0x1bc291b96ad5a1a0
r11 0x93de8d51f34f3a7e
r12 0x3000000008
r13 0xffff800014a168d0
r14 0x100
r15 0x1
rip 0xffffffff8111eb78 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800014a168b0
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor1) pid=292052 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=79, usrpri=79, nice=20
forw=0xffffffffffffffff, list=0xffff800014a359e8,0xffffffff82229718
process=0xffff8000149b8d40 user=0xffff800014a11000,
vmspace=0xfffffd803f015d68
estcpu=36, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
94723 231470 34245 0 2 0 syz-executor1
*94723 292052 34245 0 7 0x4000000 syz-executor1
15039 76821 90556 0 2 0 syz-executor0
15039 244895 90556 0 3 0x4000080 netio syz-executor0
34245 22204 22910 0 3 0x82 nanosleep syz-executor1
90556 8267 22910 0 3 0x82 nanosleep syz-executor0
6067 150524 1 0 3 0x100083 ttyin getty
79481 409029 0 0 3 0x14200 bored sosplice
22910 224595 15747 0 3 0x82 thrsleep syz-fuzzer
22910 208193 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 243563 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 401571 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 268977 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 424376 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 47300 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 464024 15747 0 3 0x4000082 kqread syz-fuzzer
22910 132978 15747 0 3 0x4000082 thrsleep syz-fuzzer
15747 41908 24821 0 3 0x10008a pause ksh
24821 43503 52003 0 3 0x92 select sshd
52003 195562 1 0 3 0x80 select sshd
84807 201983 47464 73 3 0x100090 kqread syslogd
47464 501780 1 0 3 0x100082 netio syslogd
94337 493308 1 77 3 0x100090 poll dhclient
31061 55835 1 0 3 0x80 poll dhclient
27811 191534 0 0 2 0x14200 zerothread
39438 503250 0 0 3 0x14200 aiodoned aiodoned
10397 345920 0 0 3 0x14200 syncer update
83433 497308 0 0 3 0x14200 cleaner cleaner
69471 9322 0 0 3 0x14200 reaper reaper
60778 387324 0 0 3 0x14200 pgdaemon pagedaemon
80958 48510 0 0 3 0x14200 bored crynlk
94694 13106 0 0 3 0x14200 bored crypto
32683 107285 0 0 3 0x40014200 acpi0 acpi0
10178 58475 0 0 3 0x14200 bored softnet
37581 396177 0 0 3 0x14200 bored systqmp
69884 438574 0 0 3 0x14200 bored systq
7153 181485 0 0 3 0x40014200 bored softclock
52663 207194 0 0 3 0x40014200 idle0
1 167243 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9589 8945K 8946K 78643K 16777 0 0
pcb 26 9K 12K 78643K 13792 0 0
rtable 100 3K 3K 78643K 3182 0 0
ifaddr 78 22K 26K 78643K 1775 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 217 0 0
iov 0 0K 34K 78643K 2904 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1193 75K 76K 78643K 17980 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 9K 78643K 416 0 0
VM map 2 0K 0K 78643K 2 0 0
sem 12 0K 0K 78643K 2408 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1777 193K 286K 78643K 12501 0 0
file desc 6 17K 25K 78643K 26912 0 0
sigio 0 0K 0K 78643K 426 0 0
proc 42 30K 54K 78643K 4552 0 0
subproc 64 65538K 67586K 78643K 522 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 3596 0 0
in_multi 33 2K 2K 78643K 1219 0 0
ether_multi 1 0K 0K 78643K 156 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 156 689K 689K 78643K 156 0 0
exec 0 0K 1K 78643K 2315 0 0
pfkey data 0 0K 4K 78643K 18 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 149 24K 61K 78643K 66245 0 0
UVM aobj 130 4K 4K 78643K 161 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 1K 78643K 702 0 0
NDP 18 0K 0K 78643K 508 0 0
temp 212 2348K 2428K 78643K 74113 0 0
kqueue 0 0K 0K 78643K 318 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 11 0 7 1 0 1 1 0
8 0
inpcbpl 280 11515 0 11508 1 0 1 1 0
8 0
plimitpl 152 348 0 341 1 0 1 1 0
8 0
rtentry 112 104 0 64 2 0 2 2 0
8 0
syncache 264 4 0 4 1 1 0 1 0
8 0
tcpcb 544 4216 0 4212 1 0 1 1 0
8 0
nd6 48 18 0 14 1 0 1 1 0
8 0
swfcl 56 5 0 0 1 0 1 1 0
8 0
ppxss 1128 317 0 317 110 109 1 1 0
8 1
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 499 0 310 12 0 12 12 0
8 0
art_table 32 500 0 310 2 0 2 2 0
8 0
art_node 16 103 0 69 1 0 1 1 0
8 0
sysvmsgpl 40 14 0 8 2 1 1 1 0
8 0
semupl 112 2 0 2 1 1 0 1 0
8 0
semapl 112 2406 0 2396 1 0 1 1 0
8 0
shmpl 112 159 0 31 4 0 4 4 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 53909 0 51875 66 0 66 66 0
8 0
ffsino 240 53909 0 51875 122 2 120 120 0
8 0
nchpl 144 92901 0 91316 60 1 59 60 0
8 0
uvmvnodes 72 6499 0 0 119 0 119 119 0
8 0
vnodes 200 6499 0 0 343 0 343 343 0
8 0
namei 1024 298114 0 298114 9 8 1 1 0
8 1
scsiplug 64 101 0 101 66 66 0 1 0
8 0
scxspl 192 295803 0 295803 119 118 1 6 0
8 1
sigapl 432 27060 0 27046 2 0 2 2 0
8 0
futexpl 56 433428 0 433428 9 8 1 1 0
8 1
knotepl 112 6987 0 6960 53 52 1 2 0
8 0
kqueuepl 104 9415 0 9413 1 0 1 1 0
8 0
pipepl 112 17972 0 17953 53 51 2 2 0
8 1
fdescpl 424 27061 0 27046 2 0 2 2 0
8 0
filepl 120 175055 0 174956 36 32 4 6 0
8 1
lockfpl 96 9181 0 9180 43 42 1 1 0
8 0
lockfspl 24 15621 0 15620 38 37 1 1 0
8 0
sessionpl 112 26 0 16 1 0 1 1 0
8 0
pgrppl 48 351 0 341 1 0 1 1 0
8 0
ucredpl 96 58956 0 58949 1 0 1 1 0
8 0
zombiepl 144 27046 0 27046 1 0 1 1 0
8 1
processpl 840 27075 0 27046 5 1 4 4 0
8 0
procpl 600 64487 0 64448 5 1 4 4 0
8 0
sosppl 128 505 0 505 106 106 0 1 0
8 0
sockpl 384 24692 0 24672 55 52 3 4 0
8 1
mcl64k 65536 15274 0 15274 1413 1385 28 65 0 8
28
mcl16k 16384 90 0 90 70 70 0 1 0
8 0
mcl12k 12288 512 0 512 129 128 1 1 0
8 1
mcl9k 9216 516 0 516 119 118 1 1 0
8 1
mcl8k 8192 554 0 554 132 131 1 1 0
8 1
mcl4k 4096 1347 0 1347 65 64 1 1 0
8 1
mcl2k2 2112 262 0 262 110 109 1 1 0
8 1
mcl2k 2048 81273 0 81246 29 24 5 7 0
8 0
mtagpl 80 4 0 4 2 2 0 1 0
8 0
mbufpl 256 270159 0 270118 759 745 14 36 0
8 8
bufpl 256 51643 0 45112 409 0 409 409 0
8 0
anonpl 16 2743646 0 2735809 945 897 48 65 0 62
11
amapchunkpl 152 135426 0 135344 607 535 72 189 0 158
67
amappl16 192 195830 0 195418 1359 1330 29 45 0
8 8
amappl15 184 1080 0 1079 1 0 1 1 0
8 0
amappl14 176 284 0 280 2 1 1 1 0
8 0
amappl13 168 914 0 910 1 0 1 1 0
8 0
amappl12 160 16 0 16 4 4 0 1 0
8 0
amappl11 152 415 0 406 1 0 1 1 0
8 0
amappl10 144 233 0 232 1 0 1 1 0
8 0
amappl9 136 523 0 522 1 0 1 1 0
8 0
amappl8 128 484 0 393 3 0 3 3 0
8 0
amappl7 120 926 0 917 1 0 1 1 0
8 0
amappl6 112 159 0 151 1 0 1 1 0
8 0
amappl5 104 1463 0 1452 1 0 1 1 0
8 0
amappl4 96 12708 0 12679 2 1 1 2 0
8 0
amappl3 88 14339 0 14331 1 0 1 1 0
8 0
amappl2 80 271111 0 271048 2 0 2 2 0
8 0
amappl1 72 487870 0 487428 25 15 10 19 0
8 0
amappl 72 65133 0 65100 1 0 1 1 0
75 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 160 0 31 3 0 3 3 0
8 0
uaddrrnd 24 27061 0 27046 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 27061 0 27046 1 0 1 1 0
8 0
vmmpekpl 168 208912 0 208887 2 0 2 2 0
8 0
vmmpepl 168 2802772 0 2801249 743 666 77 89 0
357 4
vmsppl 264 27060 0 27046 3 2 1 2 0
8 0
pdppl 4096 54128 0 54092 6 1 5 6 0
8 0
pvpl 32 7806214 0 7795163 1822 1695 127 232 0 265
32
pmappl 192 27060 0 27046 1 0 1 1 0
8 0
extentpl 40 39 0 25 1 0 1 1 0
8 0
phpool 112 3033 0 2432 21 2 19 19 0
8 0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot found the following crash on:
HEAD commit: 269c2856b78e sentences start with capital letters;
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=150fd2ef400000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffa1da4399f74b2b
dashboard link: https://syzkaller.appspot.com/bug?extid=1632ffc147e7585697a8
compiler:
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1632ff...@syzkaller.appspotmail.com
panic: mallocarray: overflow 18446744071562067968 * 8
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*292052 94723 0 0 0x4000000 0 syz-executor1
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x154 sys/kern/subr_prf.c:208
mallocarray(23ce4d59a2091730,7fffffff,80000000,82) at mallocarray+0xec
wsmux_getmux(1011a0424e17e7fc) at wsmux_getmux+0x6f
sys/dev/wscons/wsmux.c:135
wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0)
a
t wsmux_do_ioctl+0x268
VOP_IOCTL(c97283363b0b6998,80085761,fffffd80302c4b50,ffff800014a34728,fffffd802f4e3608,ffff800014a34728)
at
VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290
vn_ioctl(db60ad9b09e87882,fffffd80302c4b50,ffff800014a34728,8) at
vn_ioctl+0xc5 sys/kern/vfs_vnops.c:512
sys_ioctl(d1e55ca8673f6766,0,ffff800014a34728) at sys_ioctl+0x639
syscall(291d745eba10a5de) at syscall+0x528
Xsyscall(6,0,ffffffffffffff8a,0,3,974baac010) at Xsyscall+0x128
end of kernel
end trace frame: 0x99ea22a6d0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> show panic
mallocarray: overflow 18446744071562067968 * 8
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x154 sys/kern/subr_prf.c:208
mallocarray(23ce4d59a2091730,7fffffff,80000000,82) at mallocarray+0xec
wsmux_getmux(1011a0424e17e7fc) at wsmux_getmux+0x6f
sys/dev/wscons/wsmux.c:135
wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0)
at
wsmux_do_ioctl+0x268 wsmux_add_mux sys/dev/wscons/wsmux.c:563 [inline]
wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0)
at
wsmux_do_ioctl+0x268 sys/dev/wscons/wsmux.c:424
VOP_IOCTL(c97283363b0b6998,80085761,fffffd80302c4b50,ffff800014a34728,fffffd802f4e3608,ffff800014a34728)
at
VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290
vn_ioctl(db60ad9b09e87882,fffffd80302c4b50,ffff800014a34728,8) at
vn_ioctl+0xc5
sys/kern/vfs_vnops.c:512sys_ioctl(d1e55ca8673f6766,0,ffff800014a34728) at
sys_ioctl+0x639
syscall(291d745eba10a5de) at syscall+0x528
Xsyscall(6,0,ffffffffffffff8a,0,3,974baac010) at Xsyscall+0x128
end of kernel
end trace frame: 0x99ea22a6d0, count: -10
ddb> show registers
rdi 0xffffffff8111eb77 db_enter+0x17
rsi 0x1813 __ALIGN_SIZE+0x813
rbp 0xffff800014a168c0
rbx 0xffff800014a16960
rdx 0x1814 __ALIGN_SIZE+0x814
rcx 0xffff800001b3a000
rax 0xffff800001b3a000
r8 0xffffffff813e1344 kprintf+0x184
r9 0x1
r10 0x1bc291b96ad5a1a0
r11 0x93de8d51f34f3a7e
r12 0x3000000008
r13 0xffff800014a168d0
r14 0x100
r15 0x1
rip 0xffffffff8111eb78 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800014a168b0
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor1) pid=292052 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=79, usrpri=79, nice=20
forw=0xffffffffffffffff, list=0xffff800014a359e8,0xffffffff82229718
process=0xffff8000149b8d40 user=0xffff800014a11000,
vmspace=0xfffffd803f015d68
estcpu=36, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
94723 231470 34245 0 2 0 syz-executor1
*94723 292052 34245 0 7 0x4000000 syz-executor1
15039 76821 90556 0 2 0 syz-executor0
15039 244895 90556 0 3 0x4000080 netio syz-executor0
34245 22204 22910 0 3 0x82 nanosleep syz-executor1
90556 8267 22910 0 3 0x82 nanosleep syz-executor0
6067 150524 1 0 3 0x100083 ttyin getty
79481 409029 0 0 3 0x14200 bored sosplice
22910 224595 15747 0 3 0x82 thrsleep syz-fuzzer
22910 208193 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 243563 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 401571 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 268977 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 424376 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 47300 15747 0 3 0x4000082 thrsleep syz-fuzzer
22910 464024 15747 0 3 0x4000082 kqread syz-fuzzer
22910 132978 15747 0 3 0x4000082 thrsleep syz-fuzzer
15747 41908 24821 0 3 0x10008a pause ksh
24821 43503 52003 0 3 0x92 select sshd
52003 195562 1 0 3 0x80 select sshd
84807 201983 47464 73 3 0x100090 kqread syslogd
47464 501780 1 0 3 0x100082 netio syslogd
94337 493308 1 77 3 0x100090 poll dhclient
31061 55835 1 0 3 0x80 poll dhclient
27811 191534 0 0 2 0x14200 zerothread
39438 503250 0 0 3 0x14200 aiodoned aiodoned
10397 345920 0 0 3 0x14200 syncer update
83433 497308 0 0 3 0x14200 cleaner cleaner
69471 9322 0 0 3 0x14200 reaper reaper
60778 387324 0 0 3 0x14200 pgdaemon pagedaemon
80958 48510 0 0 3 0x14200 bored crynlk
94694 13106 0 0 3 0x14200 bored crypto
32683 107285 0 0 3 0x40014200 acpi0 acpi0
10178 58475 0 0 3 0x14200 bored softnet
37581 396177 0 0 3 0x14200 bored systqmp
69884 438574 0 0 3 0x14200 bored systq
7153 181485 0 0 3 0x40014200 bored softclock
52663 207194 0 0 3 0x40014200 idle0
1 167243 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9589 8945K 8946K 78643K 16777 0 0
pcb 26 9K 12K 78643K 13792 0 0
rtable 100 3K 3K 78643K 3182 0 0
ifaddr 78 22K 26K 78643K 1775 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 217 0 0
iov 0 0K 34K 78643K 2904 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1193 75K 76K 78643K 17980 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 9K 78643K 416 0 0
VM map 2 0K 0K 78643K 2 0 0
sem 12 0K 0K 78643K 2408 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1777 193K 286K 78643K 12501 0 0
file desc 6 17K 25K 78643K 26912 0 0
sigio 0 0K 0K 78643K 426 0 0
proc 42 30K 54K 78643K 4552 0 0
subproc 64 65538K 67586K 78643K 522 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 3596 0 0
in_multi 33 2K 2K 78643K 1219 0 0
ether_multi 1 0K 0K 78643K 156 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 156 689K 689K 78643K 156 0 0
exec 0 0K 1K 78643K 2315 0 0
pfkey data 0 0K 4K 78643K 18 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 149 24K 61K 78643K 66245 0 0
UVM aobj 130 4K 4K 78643K 161 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 1K 78643K 702 0 0
NDP 18 0K 0K 78643K 508 0 0
temp 212 2348K 2428K 78643K 74113 0 0
kqueue 0 0K 0K 78643K 318 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 11 0 7 1 0 1 1 0
8 0
inpcbpl 280 11515 0 11508 1 0 1 1 0
8 0
plimitpl 152 348 0 341 1 0 1 1 0
8 0
rtentry 112 104 0 64 2 0 2 2 0
8 0
syncache 264 4 0 4 1 1 0 1 0
8 0
tcpcb 544 4216 0 4212 1 0 1 1 0
8 0
nd6 48 18 0 14 1 0 1 1 0
8 0
swfcl 56 5 0 0 1 0 1 1 0
8 0
ppxss 1128 317 0 317 110 109 1 1 0
8 1
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 499 0 310 12 0 12 12 0
8 0
art_table 32 500 0 310 2 0 2 2 0
8 0
art_node 16 103 0 69 1 0 1 1 0
8 0
sysvmsgpl 40 14 0 8 2 1 1 1 0
8 0
semupl 112 2 0 2 1 1 0 1 0
8 0
semapl 112 2406 0 2396 1 0 1 1 0
8 0
shmpl 112 159 0 31 4 0 4 4 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 53909 0 51875 66 0 66 66 0
8 0
ffsino 240 53909 0 51875 122 2 120 120 0
8 0
nchpl 144 92901 0 91316 60 1 59 60 0
8 0
uvmvnodes 72 6499 0 0 119 0 119 119 0
8 0
vnodes 200 6499 0 0 343 0 343 343 0
8 0
namei 1024 298114 0 298114 9 8 1 1 0
8 1
scsiplug 64 101 0 101 66 66 0 1 0
8 0
scxspl 192 295803 0 295803 119 118 1 6 0
8 1
sigapl 432 27060 0 27046 2 0 2 2 0
8 0
futexpl 56 433428 0 433428 9 8 1 1 0
8 1
knotepl 112 6987 0 6960 53 52 1 2 0
8 0
kqueuepl 104 9415 0 9413 1 0 1 1 0
8 0
pipepl 112 17972 0 17953 53 51 2 2 0
8 1
fdescpl 424 27061 0 27046 2 0 2 2 0
8 0
filepl 120 175055 0 174956 36 32 4 6 0
8 1
lockfpl 96 9181 0 9180 43 42 1 1 0
8 0
lockfspl 24 15621 0 15620 38 37 1 1 0
8 0
sessionpl 112 26 0 16 1 0 1 1 0
8 0
pgrppl 48 351 0 341 1 0 1 1 0
8 0
ucredpl 96 58956 0 58949 1 0 1 1 0
8 0
zombiepl 144 27046 0 27046 1 0 1 1 0
8 1
processpl 840 27075 0 27046 5 1 4 4 0
8 0
procpl 600 64487 0 64448 5 1 4 4 0
8 0
sosppl 128 505 0 505 106 106 0 1 0
8 0
sockpl 384 24692 0 24672 55 52 3 4 0
8 1
mcl64k 65536 15274 0 15274 1413 1385 28 65 0 8
28
mcl16k 16384 90 0 90 70 70 0 1 0
8 0
mcl12k 12288 512 0 512 129 128 1 1 0
8 1
mcl9k 9216 516 0 516 119 118 1 1 0
8 1
mcl8k 8192 554 0 554 132 131 1 1 0
8 1
mcl4k 4096 1347 0 1347 65 64 1 1 0
8 1
mcl2k2 2112 262 0 262 110 109 1 1 0
8 1
mcl2k 2048 81273 0 81246 29 24 5 7 0
8 0
mtagpl 80 4 0 4 2 2 0 1 0
8 0
mbufpl 256 270159 0 270118 759 745 14 36 0
8 8
bufpl 256 51643 0 45112 409 0 409 409 0
8 0
anonpl 16 2743646 0 2735809 945 897 48 65 0 62
11
amapchunkpl 152 135426 0 135344 607 535 72 189 0 158
67
amappl16 192 195830 0 195418 1359 1330 29 45 0
8 8
amappl15 184 1080 0 1079 1 0 1 1 0
8 0
amappl14 176 284 0 280 2 1 1 1 0
8 0
amappl13 168 914 0 910 1 0 1 1 0
8 0
amappl12 160 16 0 16 4 4 0 1 0
8 0
amappl11 152 415 0 406 1 0 1 1 0
8 0
amappl10 144 233 0 232 1 0 1 1 0
8 0
amappl9 136 523 0 522 1 0 1 1 0
8 0
amappl8 128 484 0 393 3 0 3 3 0
8 0
amappl7 120 926 0 917 1 0 1 1 0
8 0
amappl6 112 159 0 151 1 0 1 1 0
8 0
amappl5 104 1463 0 1452 1 0 1 1 0
8 0
amappl4 96 12708 0 12679 2 1 1 2 0
8 0
amappl3 88 14339 0 14331 1 0 1 1 0
8 0
amappl2 80 271111 0 271048 2 0 2 2 0
8 0
amappl1 72 487870 0 487428 25 15 10 19 0
8 0
amappl 72 65133 0 65100 1 0 1 1 0
75 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 160 0 31 3 0 3 3 0
8 0
uaddrrnd 24 27061 0 27046 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 27061 0 27046 1 0 1 1 0
8 0
vmmpekpl 168 208912 0 208887 2 0 2 2 0
8 0
vmmpepl 168 2802772 0 2801249 743 666 77 89 0
357 4
vmsppl 264 27060 0 27046 3 2 1 2 0
8 0
pdppl 4096 54128 0 54092 6 1 5 6 0
8 0
pvpl 32 7806214 0 7795163 1822 1695 127 232 0 265
32
pmappl 192 27060 0 27046 1 0 1 1 0
8 0
extentpl 40 39 0 25 1 0 1 1 0
8 0
phpool 112 3033 0 2432 21 2 19 19 0
8 0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot
Jan 27, 2019, 4:12:03 PM1/27/19
to syzkaller-o...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 269c2856b78e sentences start with capital letters;
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=10ceafcf400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15459098c00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1632ff...@syzkaller.appspotmail.com
login: panic: mallocarray: overflow 18446744071562067968 * 8
wsmux_getmux(19d433a91bf8ed67) at wsmux_getmux+0x6f
sys/dev/wscons/wsmux.c:135
wsmux_do_ioctl(1ea22aad786082f4,80085761,fffffd80355b18a0,82,fffffd803f7c7ba0)
a
t wsmux_do_ioctl+0x268
VOP_IOCTL(4100270dde7ab8cb,80085761,fffffd80361ca0f8,ffff80001496c268,fffffd80355b18a0,ffff80001496c268)
at
VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290
vn_ioctl(b72d78449c0c7fe6,fffffd80361ca0f8,ffff80001496c268,8) at
vn_ioctl+0xc5 sys/kern/vfs_vnops.c:512
sys_ioctl(10a1d4d71c3c052c,2,ffff80001496c268) at sys_ioctl+0x639
syscall(3a6a3d0078531698) at syscall+0x528
Xsyscall(6,0,7f7ffffdbbd8,0,1,7f7ffffdbbe8) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffdbb70, count: 5
wsmux_getmux(19d433a91bf8ed67) at wsmux_getmux+0x6f
sys/dev/wscons/wsmux.c:135
wsmux_do_ioctl(1ea22aad786082f4,80085761,fffffd80355b18a0,82,fffffd803f7c7ba0)
at
wsmux_do_ioctl+0x268 sys/dev/wscons/wsmux.c:424
VOP_IOCTL(4100270dde7ab8cb,80085761,fffffd80361ca0f8,ffff80001496c268,fffffd80355b18a0,ffff80001496c268)
at
VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290
vn_ioctl(b72d78449c0c7fe6,fffffd80361ca0f8,ffff80001496c268,8) at
vn_ioctl+0xc5
sys/kern/vfs_vnops.c:512sys_ioctl(10a1d4d71c3c052c,2,ffff80001496c268) at
sys_ioctl+0x639
syscall(3a6a3d0078531698) at syscall+0x528
Xsyscall(6,0,7f7ffffdbbd8,0,1,7f7ffffdbbe8) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffdbb70, count: -10
rbp 0xffff8000149a3b40
rbx 0xffff8000149a3be0
rdx 0x8b
rcx 0x1
rax 0x1
r11 0xeceda87443a9fab4
r12 0x3000000008
r13 0xffff8000149a3b50
flags process=2<EXEC> proc=0
pri=50, usrpri=50, nice=20
forw=0xffffffffffffffff, list=0xffff80001496c970,0xffffffff82229718
process=0xffff8000ffff73c0 user=0xffff80001499f000,
vmspace=0xfffffd803f015210
estcpu=0, cpticks=0, pctcpu=0.0
32311 479400 9047 0 3 0x10008a pause ksh
9047 312248 30285 0 3 0x92 select sshd
48289 132453 1 0 3 0x100083 ttyin getty
30285 349563 1 0 3 0x80 select sshd
108 187453 84761 73 3 0x100090 kqread syslogd
84761 396966 1 0 3 0x100082 netio syslogd
27777 98359 1 77 3 0x100090 poll dhclient
61280 342652 1 0 3 0x80 poll dhclient
57114 460914 0 0 3 0x14200 pgzero zerothread
86401 182935 0 0 3 0x14200 aiodoned aiodoned
57196 21747 0 0 3 0x14200 syncer update
17205 347434 0 0 3 0x14200 cleaner cleaner
62155 130196 0 0 3 0x14200 reaper reaper
81790 389862 0 0 3 0x14200 pgdaemon pagedaemon
63064 94284 0 0 3 0x14200 bored crynlk
54065 293878 0 0 3 0x14200 bored crypto
60252 14071 0 0 3 0x40014200 acpi0 acpi0
97731 173904 0 0 3 0x14200 bored softnet
81814 495473 0 0 3 0x14200 bored systqmp
32188 304465 0 0 3 0x14200 bored systq
96910 218540 0 0 3 0x40014200 bored softclock
98254 208307 0 0 3 0x40014200 idle0
1 266194 0 0 3 0x82 wait init
pcb 23 9K 9K 78643K 55 0 0
rtable 61 1K 2K 78643K 115 0 0
ifaddr 21 7K 7K 78643K 21 0 0
proc 40 30K 38K 78643K 201 0 0
ether_multi 1 0K 0K 78643K 1 0 0
exec 0 0K 1K 78643K 149 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
temp 30 2327K 2391K 78643K 1690 0 0
8 0
inpcbpl 280 22 0 16 1 0 1 1 0
8 0
plimitpl 152 13 0 8 1 0 1 1 0
8 0
rtentry 112 23 0 1 1 0 1 1 0
8 0
syncache 264 5 0 5 2 1 1 1 0
8 1
tcpcb 544 8 0 5 1 0 1 1 0
8 0
8 0
art_table 32 97 0 0 1 0 1 1 0
8 0
art_node 16 22 0 2 1 0 1 1 0
8 0
8 0
ffsino 240 1383 0 18 81 0 81 81 0
8 0
nchpl 144 1554 0 30 57 0 57 57 0
8 0
uvmvnodes 72 1392 0 0 26 0 26 26 0
8 0
vnodes 200 1392 0 0 74 0 74 74 0
8 0
namei 1024 3257 0 3257 3 2 1 1 0
8 1
scxspl 192 2337 0 2337 8 7 1 6 0
8 1
sigapl 432 173 0 163 2 0 2 2 0
8 0
knotepl 112 5 0 0 1 0 1 1 0
8 0
kqueuepl 104 1 0 0 1 0 1 1 0
8 0
pipepl 112 114 0 107 3 2 1 1 0
8 0
fdescpl 424 174 0 163 2 0 2 2 0
8 0
filepl 120 808 0 765 2 0 2 2 0
8 0
lockfpl 96 7 0 6 2 1 1 1 0
8 0
lockfspl 24 4 0 3 2 1 1 1 0
8 0
sessionpl 112 17 0 9 1 0 1 1 0
8 0
pgrppl 48 17 0 9 1 0 1 1 0
8 0
ucredpl 96 47 0 40 1 0 1 1 0
8 0
zombiepl 144 163 0 163 3 2 1 1 0
8 1
processpl 840 187 0 163 4 1 3 4 0
8 0
procpl 600 187 0 163 3 0 3 3 0
8 0
sockpl 384 64 0 48 2 0 2 2 0
8 0
mcl4k 4096 10 0 10 2 1 1 1 0
8 1
mcl2k 2048 5504 0 5476 6 0 6 6 0
8 2
mtagpl 80 2 0 2 1 1 0 1 0
8 0
mbufpl 256 9452 0 9415 6 2 4 4 0
8 1
bufpl 256 1997 0 261 109 0 109 109 0
8 0
anonpl 16 16659 0 15558 7 2 5 7 0
62 0
amapchunkpl 152 491 0 456 2 0 2 2 0
158 0
amappl16 192 67 0 62 1 0 1 1 0
8 0
amappl15 184 1 0 0 1 0 1 1 0
8 0
amappl14 176 1 0 1 1 1 0 1 0
8 0
amappl13 168 15 0 12 1 0 1 1 0
8 0
amappl12 160 6 0 6 2 1 1 1 0
8 1
8 0
amappl9 136 193 0 192 1 0 1 1 0
8 0
amappl8 128 101 0 95 1 0 1 1 0
8 0
amappl7 120 30 0 26 1 0 1 1 0
8 0
amappl6 112 42 0 38 1 0 1 1 0
8 0
amappl5 104 154 0 143 1 0 1 1 0
8 0
amappl4 96 252 0 234 1 0 1 1 0
8 0
amappl3 88 111 0 106 1 0 1 1 0
8 0
amappl2 80 552 0 517 1 0 1 1 0
8 0
amappl1 72 11524 0 11133 16 6 10 16 0
8 0
amappl 72 366 0 347 1 0 1 1 0
8 0
uaddrrnd 24 174 0 163 1 0 1 1 0
8 0
8 0
vmmpekpl 168 5174 0 5160 1 0 1 1 0
8 0
vmmpepl 168 23283 0 22593 53 19 34 47 0
357 2
vmsppl 264 173 0 163 1 0 1 1 0
8 0
pdppl 4096 354 0 326 5 0 5 5 0
8 0
pvpl 32 69777 0 67046 36 10 26 26 0
265 3
pmappl 192 173 0 163 1 0 1 1 0
8 0
8 0
ddb>
HEAD commit: 269c2856b78e sentences start with capital letters;
git tree: openbsd
kernel config: https://syzkaller.appspot.com/x/.config?x=ffa1da4399f74b2b
dashboard link: https://syzkaller.appspot.com/bug?extid=1632ffc147e7585697a8
compiler:
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1577bcc4c00000
dashboard link: https://syzkaller.appspot.com/bug?extid=1632ffc147e7585697a8
compiler:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15459098c00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1632ff...@syzkaller.appspotmail.com
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*211443 73897 0 0x2 0 0 syz-executor2444
TID PID UID PRFLAGS PFLAGS CPU COMMAND
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x154 sys/kern/subr_prf.c:208
mallocarray(6272ade2300c7486,7fffffff,80000000,82) at mallocarray+0xec
panic() at panic+0x154 sys/kern/subr_prf.c:208
wsmux_getmux(19d433a91bf8ed67) at wsmux_getmux+0x6f
sys/dev/wscons/wsmux.c:135
wsmux_do_ioctl(1ea22aad786082f4,80085761,fffffd80355b18a0,82,fffffd803f7c7ba0)
a
t wsmux_do_ioctl+0x268
VOP_IOCTL(4100270dde7ab8cb,80085761,fffffd80361ca0f8,ffff80001496c268,fffffd80355b18a0,ffff80001496c268)
at
VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290
vn_ioctl(b72d78449c0c7fe6,fffffd80361ca0f8,ffff80001496c268,8) at
vn_ioctl+0xc5 sys/kern/vfs_vnops.c:512
sys_ioctl(10a1d4d71c3c052c,2,ffff80001496c268) at sys_ioctl+0x639
syscall(3a6a3d0078531698) at syscall+0x528
Xsyscall(6,0,7f7ffffdbbd8,0,1,7f7ffffdbbe8) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffdbb70, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> show panic
mallocarray: overflow 18446744071562067968 * 8
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x154 sys/kern/subr_prf.c:208
mallocarray(6272ade2300c7486,7fffffff,80000000,82) at mallocarray+0xec
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> show panic
mallocarray: overflow 18446744071562067968 * 8
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x154 sys/kern/subr_prf.c:208
wsmux_getmux(19d433a91bf8ed67) at wsmux_getmux+0x6f
sys/dev/wscons/wsmux.c:135
wsmux_do_ioctl(1ea22aad786082f4,80085761,fffffd80355b18a0,82,fffffd803f7c7ba0)
at
wsmux_do_ioctl+0x268 wsmux_add_mux sys/dev/wscons/wsmux.c:563 [inline]
wsmux_do_ioctl(1ea22aad786082f4,80085761,fffffd80355b18a0,82,fffffd803f7c7ba0)
wsmux_do_ioctl+0x268 wsmux_add_mux sys/dev/wscons/wsmux.c:563 [inline]
at
wsmux_do_ioctl+0x268 sys/dev/wscons/wsmux.c:424
VOP_IOCTL(4100270dde7ab8cb,80085761,fffffd80361ca0f8,ffff80001496c268,fffffd80355b18a0,ffff80001496c268)
at
VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290
vn_ioctl(b72d78449c0c7fe6,fffffd80361ca0f8,ffff80001496c268,8) at
vn_ioctl+0xc5
sys/kern/vfs_vnops.c:512sys_ioctl(10a1d4d71c3c052c,2,ffff80001496c268) at
sys_ioctl+0x639
syscall(3a6a3d0078531698) at syscall+0x528
Xsyscall(6,0,7f7ffffdbbd8,0,1,7f7ffffdbbe8) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffdbb70, count: -10
ddb> show registers
rdi 0
rsi 0x1
rdi 0
rbp 0xffff8000149a3b40
rbx 0xffff8000149a3be0
rdx 0x8b
rcx 0x1
rax 0x1
r8 0xffffffff813e1344 kprintf+0x184
r9 0x1
r10 0xf1904ef1063f3204
r9 0x1
r11 0xeceda87443a9fab4
r12 0x3000000008
r13 0xffff8000149a3b50
r14 0x100
r15 0x1
rip 0xffffffff8111eb78 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff8000149a3b30
r15 0x1
rip 0xffffffff8111eb78 db_enter+0x18
cs 0x8
rflags 0x246
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor2444) pid=211443 stat=onproc
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
flags process=2<EXEC> proc=0
pri=50, usrpri=50, nice=20
forw=0xffffffffffffffff, list=0xffff80001496c970,0xffffffff82229718
process=0xffff8000ffff73c0 user=0xffff80001499f000,
vmspace=0xfffffd803f015210
estcpu=0, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
*73897 211443 32311 0 7 0x2 syz-executor2444
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
32311 479400 9047 0 3 0x10008a pause ksh
9047 312248 30285 0 3 0x92 select sshd
48289 132453 1 0 3 0x100083 ttyin getty
30285 349563 1 0 3 0x80 select sshd
108 187453 84761 73 3 0x100090 kqread syslogd
84761 396966 1 0 3 0x100082 netio syslogd
27777 98359 1 77 3 0x100090 poll dhclient
61280 342652 1 0 3 0x80 poll dhclient
57114 460914 0 0 3 0x14200 pgzero zerothread
86401 182935 0 0 3 0x14200 aiodoned aiodoned
57196 21747 0 0 3 0x14200 syncer update
17205 347434 0 0 3 0x14200 cleaner cleaner
62155 130196 0 0 3 0x14200 reaper reaper
81790 389862 0 0 3 0x14200 pgdaemon pagedaemon
63064 94284 0 0 3 0x14200 bored crynlk
54065 293878 0 0 3 0x14200 bored crypto
60252 14071 0 0 3 0x40014200 acpi0 acpi0
97731 173904 0 0 3 0x14200 bored softnet
81814 495473 0 0 3 0x14200 bored systqmp
32188 304465 0 0 3 0x14200 bored systq
96910 218540 0 0 3 0x40014200 bored softclock
98254 208307 0 0 3 0x40014200 idle0
1 266194 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9426 6306K 6307K 78643K 10519 0 0
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
pcb 23 9K 9K 78643K 55 0 0
rtable 61 1K 2K 78643K 115 0 0
ifaddr 21 7K 7K 78643K 21 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 13 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1166 73K 73K 78643K 1172 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 1K 78643K 2 0 0
UFS mount 5 36K 36K 78643K 5 0 0
VM map 2 0K 0K 78643K 2 0 0
sem 2 0K 0K 78643K 2 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1777 193K 286K 78643K 12501 0 0
file desc 1 0K 0K 78643K 1 0 0
ACPI 1777 193K 286K 78643K 12501 0 0
proc 40 30K 38K 78643K 201 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
in_multi 11 0K 0K 78643K 11 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ether_multi 1 0K 0K 78643K 1 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 18 79K 79K 78643K 18 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
exec 0 0K 1K 78643K 149 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 46 2K 3K 78643K 649 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
NDP 3 0K 0K 78643K 3 0 0
crypto data 1 1K 1K 78643K 1 0 0
temp 30 2327K 2391K 78643K 1690 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 2 0 0 1 0 1 1 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
8 0
inpcbpl 280 22 0 16 1 0 1 1 0
8 0
plimitpl 152 13 0 8 1 0 1 1 0
8 0
rtentry 112 23 0 1 1 0 1 1 0
8 0
syncache 264 5 0 5 2 1 1 1 0
8 1
tcpcb 544 8 0 5 1 0 1 1 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 96 0 0 6 0 6 6 0
8 0
8 0
art_table 32 97 0 0 1 0 1 1 0
8 0
art_node 16 22 0 2 1 0 1 1 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 1383 0 18 45 0 45 45 0
8 0
8 0
ffsino 240 1383 0 18 81 0 81 81 0
8 0
nchpl 144 1554 0 30 57 0 57 57 0
8 0
uvmvnodes 72 1392 0 0 26 0 26 26 0
8 0
vnodes 200 1392 0 0 74 0 74 74 0
8 0
namei 1024 3257 0 3257 3 2 1 1 0
8 1
scxspl 192 2337 0 2337 8 7 1 6 0
8 1
sigapl 432 173 0 163 2 0 2 2 0
8 0
knotepl 112 5 0 0 1 0 1 1 0
8 0
kqueuepl 104 1 0 0 1 0 1 1 0
8 0
pipepl 112 114 0 107 3 2 1 1 0
8 0
fdescpl 424 174 0 163 2 0 2 2 0
8 0
filepl 120 808 0 765 2 0 2 2 0
8 0
lockfpl 96 7 0 6 2 1 1 1 0
8 0
lockfspl 24 4 0 3 2 1 1 1 0
8 0
sessionpl 112 17 0 9 1 0 1 1 0
8 0
pgrppl 48 17 0 9 1 0 1 1 0
8 0
ucredpl 96 47 0 40 1 0 1 1 0
8 0
zombiepl 144 163 0 163 3 2 1 1 0
8 1
processpl 840 187 0 163 4 1 3 4 0
8 0
procpl 600 187 0 163 3 0 3 3 0
8 0
sockpl 384 64 0 48 2 0 2 2 0
8 0
mcl4k 4096 10 0 10 2 1 1 1 0
8 1
mcl2k 2048 5504 0 5476 6 0 6 6 0
8 2
mtagpl 80 2 0 2 1 1 0 1 0
8 0
mbufpl 256 9452 0 9415 6 2 4 4 0
8 1
bufpl 256 1997 0 261 109 0 109 109 0
8 0
anonpl 16 16659 0 15558 7 2 5 7 0
62 0
amapchunkpl 152 491 0 456 2 0 2 2 0
158 0
amappl16 192 67 0 62 1 0 1 1 0
8 0
amappl15 184 1 0 0 1 0 1 1 0
8 0
amappl14 176 1 0 1 1 1 0 1 0
8 0
amappl13 168 15 0 12 1 0 1 1 0
8 0
amappl12 160 6 0 6 2 1 1 1 0
8 1
amappl11 152 172 0 163 1 0 1 1 0
8 0
amappl10 144 45 0 44 1 0 1 1 0
8 0
8 0
amappl9 136 193 0 192 1 0 1 1 0
8 0
amappl8 128 101 0 95 1 0 1 1 0
8 0
amappl7 120 30 0 26 1 0 1 1 0
8 0
amappl6 112 42 0 38 1 0 1 1 0
8 0
amappl5 104 154 0 143 1 0 1 1 0
8 0
amappl4 96 252 0 234 1 0 1 1 0
8 0
amappl3 88 111 0 106 1 0 1 1 0
8 0
amappl2 80 552 0 517 1 0 1 1 0
8 0
amappl1 72 11524 0 11133 16 6 10 16 0
8 0
amappl 72 366 0 347 1 0 1 1 0
75 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 1 0 0 1 0 1 1 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
8 0
uaddrrnd 24 174 0 163 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 174 0 163 1 0 1 1 0
8 0
8 0
vmmpekpl 168 5174 0 5160 1 0 1 1 0
8 0
vmmpepl 168 23283 0 22593 53 19 34 47 0
357 2
vmsppl 264 173 0 163 1 0 1 1 0
8 0
pdppl 4096 354 0 326 5 0 5 5 0
8 0
pvpl 32 69777 0 67046 36 10 26 26 0
265 3
pmappl 192 173 0 163 1 0 1 1 0
8 0
extentpl 40 39 0 25 1 0 1 1 0
8 0
phpool 112 225 0 7 7 0 7 7 0
8 0
8 0
ddb>
Anton Lindqvist
Jan 27, 2019, 4:51:40 PM1/27/19
to syzbot, syzkaller-o...@googlegroups.com
#syz dup: panic: malloc: allocation too large, type = 2, size = ADDR
Reply all
Reply to author
Forward
0 new messages