kqueue: knote !QUEUED

0 views

Skip to first unread message

syzbot

unread,

Jan 11, 2020, 11:29:09 PM1/11/20

to syzkaller-o...@googlegroups.com

Hello,

syzbot found the following crash on:

HEAD commit: 3c025a5e debug-> pkg-debug defines It's only used for debu..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=110805e1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=bf87b6915a88cd0d
dashboard link: https://syzkaller.appspot.com/bug?extid=8c174edc00da365121d7

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8c174e...@syzkaller.appspotmail.com

panic: knote_enqueue:1283: kq=0xfffffd80722538f0 kn=0xfffffd806ebfb2a0
knote !QUEUED
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*502635 27741 32767 0x10 0 0 syz-executor.0
464141 7551 32767 0x10 0 1 syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8220d3c6) at panic+0x15c sys/kern/subr_prf.c:207
kqueue_do_check(fffffd80722538f0,ffffffff82250c20,503) at
kqueue_do_check+0x232 sys/kern/kern_event.c:597
knote_enqueue(fffffd806ebfb2a0) at knote_enqueue+0x80
sys/kern/kern_event.c:1284
filt_timerexpire(fffffd806ebfb2a0) at filt_timerexpire+0x5f
sys/kern/kern_event.c:373
timeout_run(ffff8000009ff180) at timeout_run+0xc4 timeout_sync_leave
sys/kern/kern_timeout.c:183 [inline]
timeout_run(ffff8000009ff180) at timeout_run+0xc4
sys/kern/kern_timeout.c:489
softclock(0) at softclock+0x175 sys/kern/kern_timeout.c:532
softintr_dispatch(0) at softintr_dispatch+0x107
sys/arch/amd64/amd64/softintr.c:89
Xsoftclock() at Xsoftclock+0x1f
__sanitizer_cov_trace_const_cmp4(0,8853) at
__sanitizer_cov_trace_const_cmp4+0x1f
nanouptime(ffff800024d9f088) at nanouptime+0x7f binuptime
sys/kern/kern_tc.c:190 [inline]
nanouptime(ffff800024d9f088) at nanouptime+0x7f sys/kern/kern_tc.c:199
clock_gettime(ffff800020ac8508,3,ffff800024d9f088) at clock_gettime+0x8b
sys/kern/kern_time.c:124
sys_clock_gettime(ffff800020ac8508,ffff800024d9f0f0,ffff800024d9f140) at
sys_clock_gettime+0x4c sys/kern/kern_time.c:166
syscall(ffff800024d9f1c0) at syscall+0x4a4 mi_syscall
sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800024d9f1c0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
end trace frame: 0xffff800024d9f240, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
knote_enqueue:1283: kq=0xfffffd80722538f0 kn=0xfffffd806ebfb2a0
knote !QUEUED
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8220d3c6) at panic+0x15c sys/kern/subr_prf.c:207
kqueue_do_check(fffffd80722538f0,ffffffff82250c20,503) at
kqueue_do_check+0x232 sys/kern/kern_event.c:597
knote_enqueue(fffffd806ebfb2a0) at knote_enqueue+0x80
sys/kern/kern_event.c:1284
filt_timerexpire(fffffd806ebfb2a0) at filt_timerexpire+0x5f
sys/kern/kern_event.c:373
timeout_run(ffff8000009ff180) at timeout_run+0xc4 timeout_sync_leave
sys/kern/kern_timeout.c:183 [inline]
timeout_run(ffff8000009ff180) at timeout_run+0xc4
sys/kern/kern_timeout.c:489
softclock(0) at softclock+0x175 sys/kern/kern_timeout.c:532
softintr_dispatch(0) at softintr_dispatch+0x107
sys/arch/amd64/amd64/softintr.c:89
Xsoftclock() at Xsoftclock+0x1f
__sanitizer_cov_trace_const_cmp4(0,8853) at
__sanitizer_cov_trace_const_cmp4+0x1f
nanouptime(ffff800024d9f088) at nanouptime+0x7f binuptime
sys/kern/kern_tc.c:190 [inline]
nanouptime(ffff800024d9f088) at nanouptime+0x7f sys/kern/kern_tc.c:199
clock_gettime(ffff800020ac8508,3,ffff800024d9f088) at clock_gettime+0x8b
sys/kern/kern_time.c:124
sys_clock_gettime(ffff800020ac8508,ffff800024d9f0f0,ffff800024d9f140) at
sys_clock_gettime+0x4c sys/kern/kern_time.c:166
syscall(ffff800024d9f1c0) at syscall+0x4a4 mi_syscall
sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800024d9f1c0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe6ce0, count: -15
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800024d9ebe0
rbx 0xffff800024d9ec90
rdx 0xffffffff82469ff0 cpu_info_full_primary+0x1ff0
rcx 0xffffffff82469ff0 cpu_info_full_primary+0x1ff0
rax 0xffffffff82469ff0 cpu_info_full_primary+0x1ff0
r8 0xffffffff820fb0ef kprintf+0x16f
r9 0x1
r10 0x25
r11 0x7e0c9c7fdeb77e51
r12 0x3000000008
r13 0xffff800024d9ebf0
r14 0x100
r15 0x1
rip 0xffffffff818bce58 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800024d9ebd0
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor.0) pid=502635 stat=onproc
flags process=10<SUGID> proc=0
pri=86, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff800020ac93d8,0xffff800020ac8a08
process=0xffff800020aa2710 user=0xffff800024d9a000,
vmspace=0xfffffd806e8b3b88
estcpu=36, cpticks=5, pctcpu=0.0
user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
*27741 502635 7551 32767 7 0x10 syz-executor.0
27741 136813 7551 32767 3 0x4000090 fsleep syz-executor.0
27741 288984 7551 32767 3 0x4000090 fsleep syz-executor.0
27741 353393 7551 32767 3 0x4000090 fsleep syz-executor.0
27741 211908 7551 32767 3 0x4000090 kqread syz-executor.0
31230 220658 7869 32767 2 0x490 syz-executor.1
7869 111038 66529 0 3 0x82 wait syz-executor.1
7551 464141 28683 32767 7 0x10 syz-executor.0
28683 500677 66529 0 3 0x82 wait syz-executor.0
5155 434769 0 0 3 0x14200 bored sosplice
66529 86762 37287 0 3 0x82 thrsleep syz-fuzzer
66529 268323 37287 0 3 0x4000082 thrsleep syz-fuzzer
66529 175540 37287 0 3 0x4000082 kqread syz-fuzzer
66529 305016 37287 0 3 0x4000082 thrsleep syz-fuzzer
66529 306811 37287 0 3 0x4000082 thrsleep syz-fuzzer
66529 49786 37287 0 3 0x4000082 thrsleep syz-fuzzer
66529 98383 37287 0 3 0x4000082 thrsleep syz-fuzzer
66529 465903 37287 0 3 0x4000082 thrsleep syz-fuzzer
66529 151715 37287 0 3 0x4000082 thrsleep syz-fuzzer
66529 519420 37287 0 3 0x4000082 thrsleep syz-fuzzer
37287 513607 44859 0 3 0x10008a pause ksh
44859 477769 48123 0 3 0x92 select sshd
97605 476018 1 0 3 0x100083 ttyin getty
48123 197620 1 0 3 0x80 select sshd
21413 20722 21631 73 3 0x100090 kqread syslogd
21631 507713 1 0 3 0x100082 netio syslogd
8203 341379 1 77 3 0x100090 poll dhclient
50376 172766 1 0 3 0x80 poll dhclient
43961 382529 0 0 3 0x14200 pgzero zerothread
94792 194095 0 0 3 0x14200 aiodoned aiodoned
20366 85161 0 0 3 0x14200 syncer update
46144 240514 0 0 3 0x14200 cleaner cleaner
38471 353084 0 0 3 0x14200 reaper reaper
15697 322083 0 0 3 0x14200 pgdaemon pagedaemon
96811 366351 0 0 3 0x14200 bored crynlk
72941 198966 0 0 3 0x14200 bored crypto
49928 195521 0 0 3 0x40014200 acpi0 acpi0
65884 103846 0 0 3 0x40014200 idle1
55709 198172 0 0 3 0x14200 bored softnet
65440 34198 0 0 3 0x14200 bored systqmp
16525 416082 0 0 3 0x14200 bored systq
35278 404039 0 0 3 0x40014200 bored softclock
44342 95836 0 0 3 0x40014200 idle0
93227 325722 0 0 3 0x14200 bored smr
1 66237 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
CPU 0:
shared mutex timeout r = 0 (0xffffffff824c6a50)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1163
#1 timeout_run+0xb9 sys/kern/kern_timeout.c:488
#2 softclock+0x175 sys/kern/kern_timeout.c:532
#3 softintr_dispatch+0x107 sys/arch/amd64/amd64/softintr.c:89
#4 Xsoftclock+0x1f
#5 __sanitizer_cov_trace_const_cmp4+0x1f
#6 nanouptime+0x7f binuptime sys/kern/kern_tc.c:190 [inline]
#6 nanouptime+0x7f sys/kern/kern_tc.c:199
#7 clock_gettime+0x8b sys/kern/kern_time.c:124
#8 sys_clock_gettime+0x4c sys/kern/kern_time.c:166
#9 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#9 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#10 Xsyscall+0x128
Process 27741 (syz-executor.0) thread 0xffff800020ac8508 (502635)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82659980)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1163
#1 softintr_dispatch+0x4e sys/arch/amd64/amd64/softintr.c:89
#2 Xsoftclock+0x1f
#3 __sanitizer_cov_trace_const_cmp4+0x1f
#4 nanouptime+0x7f binuptime sys/kern/kern_tc.c:190 [inline]
#4 nanouptime+0x7f sys/kern/kern_tc.c:199
#5 clock_gettime+0x8b sys/kern/kern_time.c:124
#6 sys_clock_gettime+0x4c sys/kern/kern_time.c:166
#7 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#7 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#8 Xsyscall+0x128
shared mutex timeout r = 0 (0xffffffff824c6a50)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1163
#1 timeout_run+0xb9 sys/kern/kern_timeout.c:488
#2 softclock+0x175 sys/kern/kern_timeout.c:532
#3 softintr_dispatch+0x107 sys/arch/amd64/amd64/softintr.c:89
#4 Xsoftclock+0x1f
#5 __sanitizer_cov_trace_const_cmp4+0x1f
#6 nanouptime+0x7f binuptime sys/kern/kern_tc.c:190 [inline]
#6 nanouptime+0x7f sys/kern/kern_tc.c:199
#7 clock_gettime+0x8b sys/kern/kern_time.c:124
#8 sys_clock_gettime+0x4c sys/kern/kern_time.c:166
#9 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#9 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#10 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 9483 6334K 6334K 78643K 11003 0
pcb 13 10K 12K 78643K 15 0
rtable 107 3K 4K 78643K 4659 0
ifaddr 39 11K 12K 78643K 807 0
counters 39 33K 33K 78643K 39 0
ioctlops 0 0K 2K 78643K 196 0
iov 0 0K 32K 78643K 813 0
mount 1 1K 1K 78643K 1 0
vnodes 1215 76K 76K 78643K 3755 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 9K 78643K 55 0
VM map 2 1K 1K 78643K 2 0
sem 12 0K 1K 78643K 1423 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1809 196K 290K 78643K 12766 0
file desc 7 21K 33K 78643K 4706 0
sigio 0 0K 0K 78643K 123 0
proc 48 50K 83K 78643K 5236 0
subproc 34 2K 2K 78643K 1853 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 2 0K 1K 78643K 1161 0
in_multi 33 2K 2K 78643K 1306 0
ether_multi 1 0K 0K 78643K 11 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 139 625K 625K 78643K 139 0
exec 0 0K 1K 78643K 2097 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 7 26K 26K 78643K 7 0
UVM amap 168 25K 41K 78643K 19191 0
UVM aobj 130 4K 4K 78643K 140 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 385 0
NDP 7 0K 0K 78643K 330 0
temp 102 3021K 3117K 78643K 24571 0
kqueue 8 7K 34K 78643K 950 0
SYN cache 2 16K 16K 78643K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 229 0 222 1 0 1 1 0
8 0
plcache 128 20 0 0 1 0 1 1 0
8 0
rtpcb 80 724 0 720 1 0 1 1 0
8 0
rtentry 112 1124 0 1079 2 0 2 2 0
8 0
unpcb 120 4370 0 4358 23 22 1 3 0
8 0
syncache 264 74 0 74 24 24 0 1 0
8 0
sackhl 24 3 0 3 2 2 0 1 0
8 0
tcpqe 32 48 0 48 20 20 0 1 0
8 0
tcpcb 544 2684 0 2676 33 19 14 14 0 8
13
ipq 40 35 0 35 16 15 1 1 0
8 1
ipqe 40 1028 0 1028 16 15 1 1 0
8 1
inpcb 280 5956 0 5943 43 34 9 9 0
8 7
nd6 48 218 0 214 1 0 1 1 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 4957 0 4739 14 0 14 14 0
8 0
art_table 32 4958 0 4739 2 0 2 2 0
8 0
art_node 16 1123 0 1082 1 0 1 1 0
8 0
sysvmsgpl 40 70 0 59 1 0 1 1 0
8 0
semupl 112 4 0 4 2 2 0 1 0
8 0
semapl 112 1419 0 1409 1 0 1 1 0
8 0
shmpl 112 138 0 10 4 0 4 4 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 6222 0 4813 46 0 46 46 0
8 0
ffsino 272 6222 0 4813 95 0 95 95 0
8 0
nchpl 144 12253 0 10651 60 0 60 60 0
8 0
uvmvnodes 72 5926 0 0 108 0 108 108 0
8 0
vnodes 208 5926 0 0 312 0 312 312 0
8 0
namei 1024 60729 0 60729 4 3 1 1 0
8 1
percpumem 16 30 0 0 1 0 1 1 0
8 0
scxspl 192 41879 0 41879 51 49 2 7 0
8 2
plimitpl 152 824 0 815 1 0 1 1 0
8 0
sigapl 432 4556 0 4541 5 3 2 3 0
8 0
futexpl 56 87450 0 87447 3 2 1 1 0
8 0
knotepl 112 2936 0 2914 13 10 3 3 0
8 2
kqueuepl 104 3240 0 3234 6 2 4 4 0
8 3
pipelkpl 48 1810 0 1798 1 0 1 1 0
8 0
pipepl 120 3620 0 3597 24 23 1 2 0
8 0
fdescpl 496 4557 0 4541 3 0 3 3 0
8 0
filepl 152 45772 0 45657 89 78 11 13 0
8 6
lockfpl 104 1828 0 1827 1 0 1 1 0
8 0
lockfspl 48 446 0 445 1 0 1 1 0
8 0
sessionpl 112 124 0 114 1 0 1 1 0
8 0
pgrppl 48 387 0 377 1 0 1 1 0
8 0
ucredpl 96 12424 0 12415 1 0 1 1 0
8 0
zombiepl 144 4541 0 4540 4 3 1 1 0
8 0
processpl 896 4573 0 4540 4 0 4 4 0
8 0
procpl 632 13577 0 13531 7 2 5 5 0
8 1
srpgc 64 214 0 214 26 25 1 1 0
8 1
sosppl 128 136 0 136 34 33 1 1 0
8 1
sockpl 384 11490 0 11461 118 107 11 15 0
8 8
mcl64k 65536 35 0 0 3 0 3 3 0
8 0
mcl16k 16384 17 0 0 3 0 3 3 0
8 0
mcl12k 12288 15 0 0 2 0 2 2 0
8 0
mcl9k 9216 12 0 0 1 0 1 1 0
8 0
mcl8k 8192 33 0 0 4 1 3 3 0
8 0
mcl4k 4096 17 0 0 3 0 3 3 0
8 0
mcl2k2 2112 10 0 0 1 0 1 1 0
8 0
mcl2k 2048 186 0 0 18 2 16 18 0
8 0
mtagpl 80 1 0 0 1 0 1 1 0
8 0
mbufpl 256 827 0 0 21 0 21 21 0
8 0
bufpl 280 19882 0 12816 506 0 506 506 0
8 0
anonpl 16 763570 0 754328 209 134 75 78 0 125
21
amapchunkpl 152 53740 0 53614 178 165 13 20 0
158 7
amappl16 192 30656 0 30003 268 228 40 58 0
8 5
amappl15 184 703 0 697 1 0 1 1 0
8 0
amappl14 176 1825 0 1822 1 0 1 1 0
8 0
amappl13 168 326 0 322 1 0 1 1 0
8 0
amappl12 160 285 0 282 2 1 1 1 0
8 0
amappl11 152 781 0 770 1 0 1 1 0
8 0
amappl10 144 454 0 451 1 0 1 1 0
8 0
amappl9 136 2335 0 2329 1 0 1 1 0
8 0
amappl8 128 1612 0 1532 4 1 3 3 0
8 0
amappl7 120 1144 0 1128 1 0 1 1 0
8 0
amappl6 112 521 0 508 1 0 1 1 0
8 0
amappl5 104 1297 0 1287 1 0 1 1 0
8 0
amappl4 96 4869 0 4829 2 1 1 2 0
8 0
amappl3 88 1121 0 1114 1 0 1 1 0
8 0
amappl2 80 27876 0 27798 3 1 2 3 0
8 0
amappl1 72 138438 0 137986 37 27 10 20 0
8 0
amappl 80 15614 0 15570 2 0 2 2 0
84 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma128 128 253 0 253 1 1 0 1 0
8 0
dma64 64 6 0 6 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 18 0 17 1 0 1 1 0
8 0
aobjpl 64 139 0 10 3 0 3 3 0
8 0
uaddrrnd 24 4557 0 4541 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 4557 0 4541 1 0 1 1 0
8 0
vmmpekpl 168 47696 0 47662 2 0 2 2 0
8 0
vmmpepl 168 646944 0 644975 330 220 110 123 0 357
15
vmsppl 368 4556 0 4541 2 0 2 2 0
8 0
pdppl 4096 9121 0 9082 6 0 6 6 0
8 0
pvpl 32 2066020 0 2053439 474 286 188 191 0 265
55
pmappl 232 4556 0 4541 27 25 2 2 0
8 0
extentpl 40 46 0 29 1 0 1 1 0
8 0
phpool 112 212 0 27 6 0 6 6 0
8 0

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Jan 29, 2020, 8:23:10 AM1/29/20

to syzkaller-o...@googlegroups.com

syzbot has found a reproducer for the following crash on:

HEAD commit: 23b78d59 We are not correctly upgrading from "UNKNOWN" to ..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1531cf66e00000

kernel config: https://syzkaller.appspot.com/x/.config?x=bf87b6915a88cd0d
dashboard link: https://syzkaller.appspot.com/bug?extid=8c174edc00da365121d7

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=142d69a5e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8c174e...@syzkaller.appspotmail.com

Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND

144273 44278 32767 0x10 0 1 syz-executor.0
*230704 44278 32767 0x10 0x4000000 0K syz-executor.0

db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398

panic(ffffffff8220bc89) at panic+0x15c sys/kern/subr_prf.c:207
kqueue_do_check(fffffd806e9f1d68,ffffffff8224fc7f,51c) at kqueue_do_check+0x232 sys/kern/kern_event.c:622
knote_enqueue(fffffd806ed5d700) at knote_enqueue+0x80 sys/kern/kern_event.c:1309
kqueue_register(fffffd806e9f1d68,ffff800020b7ae30,ffff800020aa9398) at kqueue_register+0x820 sys/kern/kern_event.c:795
sys_kevent(ffff800020aa9398,ffff800020b7aff8,ffff800020b7b040) at sys_kevent+0x2b6 sys/kern/kern_event.c:578
syscall(ffff800020b7b0c0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020b7b0c0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570

Xsyscall() at Xsyscall+0x128
end of kernel

end trace frame: 0x5ef7e845010, count: 7

https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic

knote_enqueue:1308: kq=0xfffffd806e9f1d68 kn=0xfffffd806ed5d700 knote !QUEUED

ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398

Xsyscall() at Xsyscall+0x128
end of kernel

end trace frame: 0x5ef7e845010, count: -8

ddb{0}> show registers
rdi 0
rsi 0x1

rbp 0xffff800020b7abf0
rbx 0xffff800020b7aca0
rdx 0x8b
rcx 0x2
rax 0x1
r8 0xffffffff81e0d50f kprintf+0x16f
r9 0x1
r10 0xf6abbc5e2a40ed17
r11 0xbf37856d966b26ec
r12 0x3000000008
r13 0xffff800020b7ac00
r14 0x100
r15 0x1
rip 0xffffffff81e78428 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020b7abe0

ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{0}> show proc

PROC (syz-executor.0) pid=230704 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
pri=72, usrpri=72, nice=20
forw=0xffffffffffffffff, list=0xffff800020aa9608,0xffffffff82645730
process=0xffff800020a90b50 user=0xffff800020b76000, vmspace=0xfffffd806ea18738
estcpu=36, cpticks=1, pctcpu=0.0

user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND

44278 144273 13997 32767 7 0x10 syz-executor.0
44278 343229 13997 32767 3 0x4000090 fsleep syz-executor.0
*44278 230704 13997 32767 7 0x4000010 syz-executor.0
13997 434422 13594 32767 3 0x90 nanosleep syz-executor.0
13594 295727 19715 0 3 0x82 wait syz-executor.0
19715 286207 2485 0 3 0x82 thrsleep syz-execprog
19715 135597 2485 0 3 0x4000082 nanosleep syz-execprog
19715 480908 2485 0 3 0x4000082 thrsleep syz-execprog
19715 152996 2485 0 3 0x4000082 thrsleep syz-execprog
19715 91196 2485 0 3 0x4000082 nanosleep syz-execprog
19715 196643 2485 0 3 0x4000082 kqread syz-execprog
19715 395878 2485 0 3 0x4000082 thrsleep syz-execprog
19715 271701 2485 0 3 0x4000082 thrsleep syz-execprog
19715 429612 2485 0 3 0x4000082 thrsleep syz-execprog
19715 226501 2485 0 3 0x4000082 thrsleep syz-execprog
2485 505635 6426 0 3 0x10008a pause ksh
6426 277217 82559 0 3 0x92 select sshd
79445 505306 1 0 3 0x100083 ttyin getty
82559 261757 1 0 3 0x80 select sshd
64041 386062 34258 73 3 0x100090 kqread syslogd
34258 205903 1 0 3 0x100082 netio syslogd
39897 110441 1 77 3 0x100090 poll dhclient
82493 464933 1 0 3 0x80 poll dhclient
73789 325326 0 0 3 0x14200 pgzero zerothread
93819 328090 0 0 3 0x14200 aiodoned aiodoned
85074 191074 0 0 3 0x14200 syncer update
69597 490108 0 0 3 0x14200 cleaner cleaner
38807 286034 0 0 3 0x14200 reaper reaper
30595 323059 0 0 3 0x14200 pgdaemon pagedaemon
40584 126900 0 0 3 0x14200 bored crynlk
74654 348268 0 0 3 0x14200 bored crypto
31078 399227 0 0 3 0x40014200 acpi0 acpi0
81508 169404 0 0 3 0x40014200 idle1
75733 492604 0 0 3 0x14200 bored softnet
17032 40487 0 0 3 0x14200 bored systqmp
23583 236743 0 0 3 0x14200 bored systq
8238 33311 0 0 3 0x40014200 bored softclock
3299 191235 0 0 3 0x40014200 idle0
76777 132856 0 0 3 0x14200 bored smr
1 116597 0 0 3 0x82 wait init

0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks

Process 44278 (syz-executor.0) thread 0xffff800020aa9398 (230704)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8263ede8)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1164
#1 syscall+0x400 mi_syscall sys/sys/syscall_mi.h:93 [inline]
#1 syscall+0x400 sys/arch/amd64/amd64/trap.c:570
#2 Xsyscall+0x128

ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim

devbuf 9458 6329K 6329K 78643K 10549 0
pcb 13 8K 8K 78643K 13 0
rtable 83 2K 2K 78643K 153 0
ifaddr 32 8K 8K 78643K 32 0
counters 41 33K 33K 78643K 41 0
ioctlops 0 0K 2K 78643K 14 0

mount 1 1K 1K 78643K 1 0

vnodes 1180 74K 74K 78643K 1185 0

UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0

shm 2 1K 1K 78643K 2 0

VM map 2 1K 1K 78643K 2 0

sem 2 0K 0K 78643K 2 0

dirhash 12 2K 2K 78643K 12 0
ACPI 1809 196K 290K 78643K 12766 0

file desc 4 12K 16K 78643K 4459 0
proc 48 50K 70K 78643K 319 0

NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0

in_multi 22 1K 1K 78643K 22 0
ether_multi 1 0K 0K 78643K 1 0

ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0

ttys 19 95K 95K 78643K 19 0
exec 0 0K 1K 78643K 171 0

pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 7 26K 26K 78643K 7 0

UVM amap 81 12K 12K 78643K 14184 0
UVM aobj 2 2K 2K 78643K 2 0

memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0

NDP 4 0K 0K 78643K 6 0
temp 23 3005K 3069K 78643K 10570 0
kqueue 5 5K 5K 78643K 8885 0

SYN cache 2 16K 16K 78643K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle

arp 64 4 0 0 1 0 1 1 0 8 0

plcache 128 20 0 0 1 0 1 1 0 8 0

rtpcb 80 17 0 15 1 0 1 1 0 8 0
rtentry 112 34 0 1 1 0 1 1 0 8 0
unpcb 120 27 0 19 1 0 1 1 0 8 0
syncache 264 5 0 5 2 2 0 1 0 8 0
tcpcb 544 8 0 5 1 0 1 1 0 8 0
inpcb 280 26 0 20 1 0 1 1 0 8 0
nd6 48 2 0 0 1 0 1 1 0 8 0

art_heap8 4096 1 0 0 1 0 1 1 0 8 0

art_heap4 256 168 0 0 11 0 11 11 0 8 0
art_table 32 169 0 0 2 0 2 2 0 8 0
art_node 16 33 0 3 1 0 1 1 0 8 0

dirhash 1024 17 0 0 3 0 3 3 0 8 0

dino1pl 128 5855 0 4459 46 0 46 46 0 8 0
ffsino 272 5855 0 4459 94 0 94 94 0 8 0
nchpl 144 10520 0 8916 60 0 60 60 0 8 0
uvmvnodes 72 5864 0 0 107 0 107 107 0 8 0
vnodes 208 5864 0 0 309 0 309 309 0 8 0
namei 1024 21624 0 21624 2 1 1 1 0 8 1
percpumem 16 31 0 0 1 0 1 1 0 8 0
scxspl 192 31291 0 31291 39 38 1 7 0 8 1
plimitpl 152 15 0 8 1 0 1 1 0 8 0
sigapl 432 4638 0 4625 2 0 2 2 0 8 0
futexpl 56 17005 0 17004 1 0 1 1 0 8 0
knotepl 112 8921 0 8908 1 0 1 1 0 8 0
kqueuepl 104 8884 0 8880 1 0 1 1 0 8 0
pipelkpl 48 67 0 60 2 1 1 1 0 8 0
pipepl 120 134 0 121 2 1 1 1 0 8 0
fdescpl 496 4639 0 4625 2 0 2 2 0 8 0
filepl 152 14319 0 14264 3 0 3 3 0 8 0
lockfpl 104 5 0 4 1 0 1 1 0 8 0
lockfspl 48 3 0 2 1 0 1 1 0 8 0
sessionpl 112 18 0 9 1 0 1 1 0 8 0
pgrppl 48 18 0 9 1 0 1 1 0 8 0
ucredpl 96 50 0 42 1 0 1 1 0 8 0
zombiepl 144 4625 0 4625 2 1 1 1 0 8 1
processpl 960 4654 0 4625 4 0 4 4 0 8 0
procpl 624 13539 0 13499 4 0 4 4 0 8 0
sockpl 400 70 0 54 2 0 2 2 0 8 0
mcl4k 4096 2 0 0 1 0 1 1 0 8 0
mcl2k 2048 77 0 0 10 0 10 10 0 8 0

mtagpl 80 1 0 0 1 0 1 1 0 8 0

mbufpl 256 123 0 0 7 0 7 7 0 8 0
bufpl 280 8164 0 1874 450 0 450 450 0 8 0
anonpl 16 265603 0 263198 18 7 11 13 0 125 0
amapchunkpl 152 22921 0 22829 5 1 4 5 0 158 0
amappl16 192 14126 0 14039 6 1 5 5 0 8 0
amappl15 184 51 0 47 1 0 1 1 0 8 0
amappl14 176 24 0 21 2 1 1 1 0 8 0
amappl13 168 4445 0 4441 2 1 1 1 0 8 0
amappl12 160 4 0 3 2 1 1 1 0 8 0
amappl11 152 43 0 32 1 0 1 1 0 8 0
amappl10 144 10 0 9 1 0 1 1 0 8 0
amappl9 136 404 0 399 1 0 1 1 0 8 0
amappl8 128 91 0 77 1 0 1 1 0 8 0
amappl7 120 87 0 76 1 0 1 1 0 8 0
amappl6 112 54 0 48 1 0 1 1 0 8 0
amappl5 104 133 0 123 1 0 1 1 0 8 0
amappl4 96 9314 0 9289 1 0 1 1 0 8 0
amappl3 88 122 0 115 1 0 1 1 0 8 0
amappl2 80 36378 0 36310 4 2 2 3 0 8 0
amappl1 72 130137 0 129690 25 15 10 20 0 8 0
amappl 80 13739 0 13707 1 0 1 1 0 84 0

dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0

aobjpl 64 1 0 0 1 0 1 1 0 8 0
uaddrrnd 24 4639 0 4625 1 0 1 1 0 8 0

uaddrbest 32 2 0 0 1 0 1 1 0 8 0

uaddr 24 4639 0 4625 1 0 1 1 0 8 0
vmmpekpl 168 32593 0 32572 2 0 2 2 0 8 0
vmmpepl 168 438437 0 437357 92 45 47 78 0 357 0
vmsppl 368 4638 0 4625 2 0 2 2 0 8 0
pdppl 4096 9285 0 9250 5 0 5 5 0 8 0
pvpl 32 764122 0 759208 120 79 41 113 0 265 1
pmappl 232 4638 0 4625 1 0 1 1 0 8 0

extentpl 40 46 0 29 1 0 1 1 0 8 0

phpool 112 145 0 3 5 0 5 5 0 8 0

Greg Steuck

unread,

Feb 15, 2020, 4:35:05 PM2/15/20

to syzbot, Visa Hankala, syzkaller-o...@googlegroups.com

Hi Visa,

Thanks for the patch! I am going to ask syzbot to do the testing:

#syz test: git://github.com/blackgnezdo/src.git knote-fix

I'm simply following the instructions here:

https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches

Let's hear it from the machine itself :)

Thanks
Grg

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-openbsd-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-openbsd...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-openbsd-bugs/000000000000db1ca5059d473dde%40google.com.

--
nest.cx is Gmail hosted, use PGP: https://pgp.key-server.io/0x0B1542BD8DF5A1B0
Fingerprint: 5E2B 2D0E 1E03 2046 BEC3 4D50 0B15 42BD 8DF5 A1B0

syzbot

unread,

Feb 15, 2020, 4:54:03 PM2/15/20

to gr...@nest.cx, syzkaller-o...@googlegroups.com, vi...@openbsd.org

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger crash:

Reported-and-tested-by: syzbot+8c174e...@syzkaller.appspotmail.com

Tested on:

commit: 0e54d65e visa@: possible fix for panic kqueue: knote !QUEUED
git tree: git://github.com/blackgnezdo/src.git knote-fix

kernel config: https://syzkaller.appspot.com/x/.config?x=bf87b6915a88cd0d
dashboard link: https://syzkaller.appspot.com/bug?extid=8c174edc00da365121d7

compiler:

Note: testing is done by a robot and is best-effort only.

Greg Steuck

unread,

Feb 15, 2020, 4:57:35 PM2/15/20

to Visa Hankala, syzkaller-o...@googlegroups.com

I think the robot is saying your patch is good! Thanks for the fix!

Please remember to include the following line into the commit to
automatically resolve the entry on the dashboard:

Reported-by: syzbot+8c174e...@syzkaller.appspotmail.com

Reply all

Reply to author

Forward

0 new messages