uvm_fault: rtable_satoplen

3 views
Skip to first unread message

syzbot

unread,
Mar 5, 2019, 7:29:05 AM3/5/19
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: da8fceb276ba After vmm(4) max name length has been increas..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=14a4049d200000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffa1da4399f74b2b
dashboard link: https://syzkaller.appspot.com/bug?extid=8e29400e09a351f17884

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8e2940...@syzkaller.appspotmail.com

uvm_fault(0xffffffff822438d8, 0xffff80000196c02c, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at rtable_satoplen+0x14d: movzbl
0xffffffffffffffff(%r12),%ebx
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff822438d8, 0xffff80000196c02c, 0, 1) -> e
rtable_satoplen(2,ffff80000196bf42) at rtable_satoplen+0x14d
sys/net/rtable.c:888
end trace frame: 0xffff800014a1fd50, count: 0
ddb> trace
rtable_satoplen(2,ffff80000196bf42) at rtable_satoplen+0x14d
sys/net/rtable.c:888
rtable_lookup(0,ffff80000196bf02,ffff80000196bf42,ffff80000196bf0a,31) at
rtable_lookup+0xed sys/net/rtable.c:391
rtm_output(ffff80000196bf00,ffff800014a1fe40,ffff800014a1fe48,31,0) at
rtm_output+0xa4 sys/net/rtsock.c:895
route_output(fffffd803c3a8900,fffffd8036ffc780,0,0) at route_output+0x78b
sys/net/rtsock.c:806
route_usrreq(fffffd8036ffc780,9,fffffd803c3a8900,0,0,ffff8000ffff4010) at
route_usrreq+0x35d sys/net/rtsock.c:271
sosend(fffffd8036ffc780,0,ffff800014a20108,0,0,0) at sosend+0x6e3
sys/kern/uipc_socket.c:513
sendit(ffff8000ffff4010,4,ffff800014a201c8,0,ffff800014a20290) at
sendit+0x58f sys/kern/uipc_syscalls.c:662
sys_sendto(ffff8000ffff4010,ffff800014a202a8,ffff800014a20290) at
sys_sendto+0x92
syscall(ffff800014a20340) at syscall+0x541
Xsyscall(6,0,ffffffffffffffd8,0,6,f874dd72010) at Xsyscall+0x128
end of kernel
end trace frame: 0xf89751cd7c0, count: -10
ddb> show registers
rdi 0
rsi 0xeb
rbp 0xffff800014a1fcb0
rbx 0xffff80000196bf42
rdx 0x117
rcx 0xffff80000093b000
rax 0xeb
r8 0x31
r9 0x1
r10 0xffff800000936e00
r11 0xe163fde8700322e5
r12 0xffff80000196c02d
r13 0xffffffffffffff19
r14 0xffffffff821d4330 inetdomain
r15 0x4
rip 0xffffffff8190b52d rtable_satoplen+0x14d
cs 0x8
rflags 0x10293 __ALIGN_SIZE+0xf293
rsp 0xffff800014a1fc60
ss 0x10
rtable_satoplen+0x14d: movzbl 0xffffffffffffffff(%r12),%ebx
ddb> show proc
PROC (syz-executor.1) pid=349815 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=86, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff8000ffff5780,0xffffffff8224f498
process=0xffff8000ffff6d30 user=0xffff800014a1b000,
vmspace=0xfffffd803f013d68
estcpu=36, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
36445 235237 32000 0 2 0 syz-executor.1
*36445 349815 32000 0 7 0x4000000 syz-executor.1
53411 63408 0 0 3 0x14200 bored sosplice
47614 275414 11316 0 2 0x2 syz-executor.0
32000 329796 11316 0 3 0x82 nanosleep syz-executor.1
11316 490286 16613 0 3 0x82 kqread syz-fuzzer
11316 174820 16613 0 3 0x4000082 nanosleep syz-fuzzer
11316 45649 16613 0 3 0x4000082 thrsleep syz-fuzzer
11316 336131 16613 0 3 0x4000082 thrsleep syz-fuzzer
11316 282149 16613 0 3 0x4000082 thrsleep syz-fuzzer
11316 165906 16613 0 3 0x4000082 thrsleep syz-fuzzer
11316 208919 16613 0 3 0x4000082 thrsleep syz-fuzzer
16613 200966 54538 0 3 0x10008a pause ksh
54538 210079 36029 0 3 0x92 select sshd
64806 405659 1 0 3 0x100083 ttyopn getty
36029 274646 1 0 3 0x80 select sshd
83744 469057 58804 73 2 0x100090 syslogd
58804 312932 1 0 3 0x100082 netio syslogd
55487 395516 1 77 3 0x100090 poll dhclient
61543 43501 1 0 3 0x80 poll dhclient
17136 224212 0 0 2 0x14200 zerothread
37372 224824 0 0 3 0x14200 aiodoned aiodoned
78310 495888 0 0 3 0x14200 syncer update
7725 244976 0 0 3 0x14200 cleaner cleaner
4571 458152 0 0 3 0x14200 reaper reaper
39468 400227 0 0 3 0x14200 pgdaemon pagedaemon
81 283899 0 0 3 0x14200 bored crynlk
53145 69473 0 0 3 0x14200 bored crypto
51389 350945 0 0 3 0x40014200 acpi0 acpi0
62386 315612 0 0 3 0x14200 bored softnet
95191 318906 0 0 2 0x14200 systqmp
10382 44332 0 0 3 0x14200 bored systq
26462 70900 0 0 2 0x40014200 softclock
33118 248659 0 0 3 0x40014200 idle0
61947 164238 0 0 3 0x14200 bored smr
1 87983 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9458 6313K 6333K 78643K 10618 0 0
pcb 25 9K 10K 78643K 4729 0 0
rtable 101 3K 3K 78643K 3990 0 0
ifaddr 42 11K 11K 78643K 55 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 19 0 0
iov 0 0K 12K 78643K 26 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1206 76K 76K 78643K 1312 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 5K 78643K 8 0 0
VM map 2 0K 0K 78643K 2 0 0
sem 12 0K 0K 78643K 48 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1793 195K 288K 78643K 12537 0 0
file desc 5 13K 25K 78643K 2800 0 0
sigio 0 0K 0K 78643K 6 0 0
proc 41 30K 54K 78643K 277 0 0
subproc 64 65538K 69634K 78643K 70 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 16 0 0
in_multi 33 2K 2K 78643K 36 0 0
ether_multi 1 0K 0K 78643K 4 0 0
mrt 0 0K 0K 78643K 5 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 48 212K 212K 78643K 48 0 0
exec 0 0K 1K 78643K 187 0 0
pfkey data 0 0K 0K 78643K 4 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 70 20K 20K 78643K 6422 0 0
UVM aobj 28 2K 2K 78643K 32 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 0K 78643K 4 0 0
NDP 7 0K 0K 78643K 14 0 0
temp 102 2350K 2416K 78643K 8489 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 4 0 0 1 0 1 1 0
8 0
inpcbpl 280 112 0 105 1 0 1 1 0
8 0
plimitpl 152 19 0 12 1 0 1 1 0
8 0
rtentry 112 41 0 1 2 0 2 2 0
8 0
syncache 264 4 0 4 1 1 0 1 0
8 0
tcpqe 32 20 0 20 1 1 0 1 0
8 0
tcpcb 544 40 0 36 1 0 1 1 0
8 0
nd6 48 4 0 0 1 0 1 1 0
8 0
ppxss 1128 3 0 3 1 1 0 1 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 186 0 0 12 0 12 12 0
8 0
art_table 32 187 0 0 2 0 2 2 0
8 0
art_node 16 40 0 6 1 0 1 1 0
8 0
semapl 112 38 0 28 1 0 1 1 0
8 0
shmpl 112 30 0 4 1 0 1 1 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 4390 0 2984 46 0 46 46 0
8 0
ffsino 240 4390 0 2984 84 0 84 84 0
8 0
nchpl 144 7608 0 5988 61 0 61 61 0
8 0
uvmvnodes 72 4455 0 0 81 0 81 81 0
8 0
vnodes 200 4455 0 0 235 0 235 235 0
8 0
namei 1024 16628 0 16627 3 2 1 1 0
8 0
scsiplug 64 3 0 3 2 2 0 1 0
8 0
scxspl 192 21947 0 21947 8 7 1 6 0
8 1
sigapl 432 2968 0 2955 2 0 2 2 0
8 0
futexpl 56 15723 0 15723 1 0 1 1 0
8 1
knotepl 112 95 0 68 2 1 1 2 0
8 0
kqueuepl 104 65 0 63 1 0 1 1 0
8 0
pipepl 112 398 0 379 2 1 1 1 0
8 0
fdescpl 424 2969 0 2955 2 0 2 2 0
8 0
filepl 120 9605 0 9509 6 2 4 4 0
8 1
lockfpl 104 131 0 131 4 3 1 1 0
8 1
lockfspl 32 159 0 159 4 3 1 1 0
8 1
sessionpl 112 17 0 7 1 0 1 1 0
8 0
pgrppl 48 25 0 15 1 0 1 1 0
8 0
ucredpl 96 367 0 360 1 0 1 1 0
8 0
zombiepl 144 2955 0 2955 3 2 1 1 0
8 1
processpl 840 2984 0 2955 4 0 4 4 0
8 0
procpl 600 5851 0 5815 6 2 4 4 0
8 1
sosppl 128 2 0 2 1 1 0 1 0
8 0
sockpl 384 4813 0 4794 3 0 3 3 0
8 1
mcl64k 65536 6 0 6 2 1 1 1 0
8 1
mcl16k 16384 1 0 1 1 0 1 1 0
8 1
mcl12k 12288 16 0 16 3 2 1 1 0
8 1
mcl9k 9216 7 0 7 5 4 1 1 0
8 1
mcl8k 8192 17 0 17 3 2 1 1 0
8 1
mcl4k 4096 26 0 26 4 3 1 1 0
8 1
mcl2k2 2112 9 0 9 4 4 0 1 0
8 0
mcl2k 2048 49211 0 49174 14 8 6 11 0
8 1
mtagpl 80 2 0 2 1 1 0 1 0
8 0
mbufpl 256 98803 0 98602 20 5 15 16 0
8 1
bufpl 256 8282 0 3992 269 0 269 269 0
8 0
anonpl 16 195788 0 187306 51 16 35 49 0
62 0
amapchunkpl 152 9270 0 9191 8 4 4 6 0
158 0
amappl16 192 12483 0 12031 36 13 23 34 0
8 0
amappl15 184 1 0 0 1 0 1 1 0
8 0
amappl14 176 1407 0 1401 1 0 1 1 0
8 0
amappl13 168 28 0 24 1 0 1 1 0
8 0
amappl12 160 10 0 9 2 1 1 1 0
8 0
amappl11 152 176 0 167 1 0 1 1 0
8 0
amappl10 144 2859 0 2857 2 1 1 1 0
8 0
amappl9 136 344 0 340 1 0 1 1 0
8 0
amappl8 128 122 0 104 1 0 1 1 0
8 0
amappl7 120 23 0 20 1 0 1 1 0
8 0
amappl6 112 1431 0 1423 1 0 1 1 0
8 0
amappl5 104 153 0 142 1 0 1 1 0
8 0
amappl4 96 263 0 242 1 0 1 1 0
8 0
amappl3 88 148 0 143 1 0 1 1 0
8 0
amappl2 80 28395 0 28346 3 1 2 2 0
8 0
amappl1 72 62599 0 62187 26 17 9 19 0
8 0
amappl 72 6058 0 6027 1 0 1 1 0
75 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 31 0 4 1 0 1 1 0
8 0
uaddrrnd 24 2969 0 2955 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 2969 0 2955 1 0 1 1 0
8 0
vmmpekpl 168 19645 0 19629 1 0 1 1 0
8 0
vmmpepl 168 293028 0 291660 89 24 65 70 0
357 5
vmsppl 264 2968 0 2955 2 1 1 2 0
8 0
pdppl 4096 5944 0 5910 6 1 5 6 0
8 0
pvpl 32 567833 0 556373 142 44 98 126 0
265 5
pmappl 192 2968 0 2955 1 0 1 1 0
8 0
extentpl 40 39 0 25 1 0 1 1 0
8 0
phpool 112 425 0 24 12 0 12 12 0
8 0


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
Reply all
Reply to author
Forward
0 new messages