corrupted report (4)

0 views
Skip to first unread message

syzbot

unread,
Aug 5, 2020, 5:32:29 AM8/5/20
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 455c25c8 MTREE is not used
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=12f9b258900000
kernel config: https://syzkaller.appspot.com/x/.config?x=fe55924c11e64b0a
dashboard link: https://syzkaller.appspot.com/bug?extid=329cf7645b77d1c9b13e

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+329cf7...@syzkaller.appspotmail.com

uvm_fault(0xfffffd806bc09cc0, 0x7b8, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at pfsync_state_import+271: movq 0(%r15,%rbx,8),%r15
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xfffffd806bc09cc0, 0x7b8, 0, 1) -> e
pfsync_state_import(ffff800000b27000,1) at pfsync_state_import+271
end trace frame: 0xffff8000208710c0, count: 0
ddb> trace
pfsync_state_import(ffff800000b27000,1) at pfsync_state_import+271
pfioctl(4900,c1084425,ffff800000b27000,3,ffff80001d6be290) at pfioctl+10314
VOP_IOCTL(fffffd805d84a410,c1084425,ffff800000b27000,3,fffffd806c3bf9c0,ffff80001d6be290) at VOP_IOCTL+136
vn_ioctl(fffffd80570ab3d0,c1084425,ffff800000b27000,ffff80001d6be290) at vn_ioctl+181
sys_ioctl(ffff80001d6be290,ffff8000208713a8,ffff8000208713f0) at sys_ioctl+1185
syscall(ffff800020871470) at syscall+1287
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0x649097f7a90, count: -7
ddb> show registers
rdi 18446603336719761408
rsi 941
rbp 18446603336766918496
rbx 247
rdx 18446603336719761408
rcx 940
rax 18446744071594382399 pfsync_state_import+271
r8 18446603336714805904
r9 18446744071592887582 pfioctl+366
r10 7
r11 4490091608701173671
r12 18446603336233080832
r13 18446603336232890368
r14 1
r15 0
rip 18446744071594382399 pfsync_state_import+271
cs 8
rflags 66118 __ALIGN_SIZE+62022
rsp 18446603336766918368
ss 16
pfsync_state_import+271: movq 0(%r15,%rbx,8),%r15
ddb> show proc
PROC (syz-executor.1) pid=320395 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=32, usrpri=81, nice=20
forw=0xffffffffffffffff, list=0xffff80001d6be018,0xffffffff827fbfa8
process=0xffff80001d6ec3e0 user=0xffff80002086c000, vmspace=0xfffffd806bc09cc0
estcpu=31, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
27130 360328 88355 0 2 0 syz-executor.1
*27130 320395 88355 0 7 0x4000000 syz-executor.1
88355 402830 3681 0 3 0x82 nanosleep syz-executor.1
54749 310445 3681 0 3 0x82 piperd syz-executor.0
11594 172108 1 0 3 0x100083 ttyin getty
25683 49328 0 0 3 0x14280 nfsidl nfsio
98971 507436 0 0 3 0x14280 nfsidl nfsio
40124 359169 0 0 3 0x14280 nfsidl nfsio
64417 211680 0 0 3 0x14280 nfsidl nfsio
24759 447926 0 0 3 0x14280 nfsidl nfsio
48382 246738 0 0 3 0x14280 nfsidl nfsio
17448 368758 0 0 3 0x14280 nfsidl nfsio
26783 86337 0 0 3 0x14280 nfsidl nfsio
76157 373456 0 0 3 0x14280 nfsidl nfsio
67176 363647 0 0 3 0x14280 nfsidl nfsio
61402 515284 0 0 3 0x14280 nfsidl nfsio
84065 236022 0 0 3 0x14280 nfsidl nfsio
8148 349964 0 0 3 0x14280 nfsidl nfsio
7866 6123 0 0 3 0x14280 nfsidl nfsio
36785 462024 0 0 3 0x14280 nfsidl nfsio
70836 193179 0 0 3 0x14280 nfsidl nfsio
55779 439312 0 0 3 0x14280 nfsidl nfsio
44950 277527 0 0 3 0x14280 nfsidl nfsio
27445 171227 0 0 3 0x14280 nfsidl nfsio
50255 520918 0 0 3 0x14280 nfsidl nfsio
33115 424177 0 0 3 0x14200 bored sosplice
3681 238031 58831 0 3 0x82 thrsleep syz-fuzzer
3681 436562 58831 0 3 0x4000082 nanosleep syz-fuzzer
3681 428113 58831 0 2 0x4000002 syz-fuzzer
3681 2245 58831 0 3 0x4000082 thrsleep syz-fuzzer
3681 59548 58831 0 3 0x4000082 thrsleep syz-fuzzer
3681 37350 58831 0 3 0x4000082 thrsleep syz-fuzzer
3681 82630 58831 0 3 0x4000082 thrsleep syz-fuzzer
58831 169974 30624 0 3 0x10008a pause ksh
30624 206567 19836 0 3 0x92 select sshd
19836 70715 1 0 3 0x80 select sshd
74042 504043 71759 73 3 0x100090 kqread syslogd
71759 165002 1 0 3 0x100082 netio syslogd
70830 294828 1 77 3 0x100090 poll dhclient
95758 414470 1 0 3 0x80 poll dhclient
31908 321486 0 0 3 0x14200 bored smr
80954 73777 0 0 2 0x14200 zerothread
90049 412150 0 0 3 0x14200 aiodoned aiodoned
3239 214526 0 0 3 0x14200 syncer update
10785 231004 0 0 3 0x14200 cleaner cleaner
58140 445978 0 0 3 0x14200 reaper reaper
62206 111858 0 0 3 0x14200 pgdaemon pagedaemon
50965 258036 0 0 3 0x14200 bored crynlk
23276 344887 0 0 3 0x14200 bored crypto
88189 455170 0 0 3 0x40014200 acpi0 acpi0
17326 271818 0 0 3 0x14200 bored softnet
74968 301522 0 0 3 0x14200 bored systqmp
61956 275431 0 0 3 0x14200 bored systq
48564 15251 0 0 3 0x40014200 bored softclock
9151 239626 0 0 3 0x40014200 idle0
1 363860 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 9553 6389K 7040K 78643K 19213 0
pcb 13 8K 9K 78643K 7900 0
rtable 145 26K 28K 78643K 8707 0
ifaddr 150 31K 34K 78643K 2456 0
sysctl 2 0K 0K 78643K 4 0
counters 21 16K 17K 78643K 125 0
ioctlops 1 0K 4K 78643K 5893 0
iov 0 0K 24K 78643K 629 0
mount 1 1K 1K 78643K 1 0
vnodes 1221 77K 78K 78643K 4896 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 5K 78643K 107 0
VM map 2 0K 0K 78643K 2 0
sem 12 0K 0K 78643K 2273 0
dirhash 6 1K 2K 78643K 12 0
ACPI 1809 195K 288K 78643K 12938 0
file desc 5 13K 25K 78643K 11183 0
sigio 0 0K 0K 78643K 97 0
proc 58 39K 55K 78643K 1843 0
subproc 32 2K 3K 78643K 510 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 512 0
in_multi 16 1K 2K 78643K 3597 0
ether_multi 1 0K 0K 78643K 125 0
mrt 0 0K 0K 78643K 19 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 97 440K 440K 78643K 97 0
exec 0 0K 1K 78643K 943 0
pfkey data 0 0K 1K 78643K 4 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 7 26K 26K 78643K 7 0
UVM amap 261 305K 306K 78643K 27135 0
UVM aobj 131 4K 4K 78643K 143 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 622 0
NDP 18 0K 1K 78643K 668 0
temp 183 3925K 3991K 78643K 154087 0
kqueue 6 10K 16K 78643K 211 0
SYN cache 2 16K 16K 78643K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 77 0 72 1 0 1 1 0 8 0
rtpcb 88 593 0 591 1 0 1 1 0 8 0
rtentry 112 1665 0 1640 2 0 2 2 0 8 0
unpcb 120 5778 0 5767 1 0 1 1 0 8 0
syncache 272 76 0 76 25 25 0 1 0 8 0
tcpqe 32 48 0 48 6 6 0 1 0 8 0
tcpcb 592 2504 0 2500 33 32 1 3 0 8 0
ipq 40 20 0 20 9 9 0 1 0 8 0
ipqe 40 519 0 519 9 9 0 1 0 8 0
inpcb 296 20656 0 20649 28 26 2 3 0 8 1
rttmr 72 8 0 8 5 5 0 1 0 8 0
ip6q 72 7 0 7 5 5 0 1 0 8 0
ip6af 40 16 0 16 5 5 0 1 0 8 0
nd6 48 740 0 739 1 0 1 1 0 8 0
pkpcb 40 53 0 53 15 15 0 1 0 8 0
ppxss 1136 15 0 15 13 13 0 1 0 8 0
pfstscr 40 2684 0 2684 2 2 0 1 0 8 0
pffrag 232 14 0 14 3 3 0 1 0 482 0
pffrnode 88 14 0 14 3 3 0 1 0 8 0
pffrent 40 460 0 460 4 4 0 1 0 8 0
pfosfp 40 5 0 0 1 0 1 1 0 8 0
pfosfpen 112 6 0 0 1 0 1 1 0 8 0
pfrktable 1344 2010 0 1979 13 10 3 3 0 8 0
pftag 88 156 0 148 3 2 1 1 0 8 0
pfqueue 264 2 0 0 1 0 1 1 0 8 0
pfstitem 24 599 0 599 2 2 0 1 0 8 0
pfstkey 112 2628 0 2628 2 2 0 1 0 8 0
pfstate 328 1359 0 1359 2 2 0 1 0 8 0
pfrule 1360 1270 0 830 40 3 37 37 0 8 0
art_heap8 4096 3 0 1 3 1 2 2 0 8 0
art_heap4 256 6529 0 6428 27 18 9 16 0 8 0
art_table 32 6532 0 6429 2 0 2 2 0 8 0
art_node 16 1664 0 1644 1 0 1 1 0 8 0
sysvmsgpl 40 48 0 43 1 0 1 1 0 8 0
semupl 112 2 0 2 1 1 0 1 0 8 0
semapl 112 2263 0 2253 1 0 1 1 0 8 0
shmpl 112 140 0 12 4 0 4 4 0 8 0
dirhash 1024 17 0 13 3 1 2 3 0 8 0
dino2pl 256 15459 0 14071 88 0 88 88 0 8 0
ffsino 240 15459 0 14071 83 0 83 83 0 8 0
nchpl 144 31280 0 29696 60 0 60 60 0 8 0
uvmvnodes 72 17905 0 0 326 0 326 326 0 8 0
vnodes 208 17905 0 0 943 0 943 943 0 8 0
namei 1024 93471 0 93471 17 16 1 1 0 8 1
vcpupl 1984 31 0 0 4 0 4 4 0 8 0
vmpool 528 51 0 20 4 1 3 3 0 8 0
pfiaddrpl 120 1014 0 937 6 3 3 3 0 8 0
scsiplug 72 6 0 6 6 6 0 1 0 8 0
scxspl 200 136057 0 136057 10 9 1 1 0 8 1
plimitpl 152 404 0 397 1 0 1 1 0 8 0
sigapl 424 11311 0 11262 6 0 6 6 0 8 0
futexpl 56 208974 0 208974 17 16 1 1 0 8 1
knotepl 112 665 0 645 1 0 1 1 0 8 0
kqueuepl 152 1366 0 1350 1 0 1 1 0 8 0
pipepl 272 1040 0 1029 23 22 1 2 0 8 0
fdescpl 432 11273 0 11259 2 0 2 2 0 8 0
filepl 120 72417 0 72318 7 3 4 5 0 8 1
lockfpl 104 6372 0 6371 1 0 1 1 0 8 0
lockfspl 48 1755 0 1754 1 0 1 1 0 8 0
sessionpl 120 47 0 37 1 0 1 1 0 8 0
pgrppl 48 106 0 96 1 0 1 1 0 8 0
ucredpl 96 10822 0 10814 1 0 1 1 0 8 0
zombiepl 144 11262 0 11262 2 1 1 1 0 8 1
processpl 944 11311 0 11262 7 0 7 7 0 8 0
procpl 632 24737 0 24681 34 29 5 6 0 8 0
sosppl 144 43 0 43 15 15 0 1 0 8 0
sockpl 400 27151 0 27130 37 33 4 5 0 8 0
mcl64k 65536 314 0 314 41 40 1 1 0 8 1
mcl16k 16384 49 0 49 23 22 1 1 0 8 1
mcl12k 12288 209 0 209 41 40 1 1 0 8 1
mcl9k 9216 95 0 95 41 41 0 1 0 8 0
mcl8k 8192 837 0 837 44 43 1 1 0 8 1
mcl4k 4096 730 0 730 37 36 1 1 0 8 1
mcl2k2 2112 52 0 52 30 30 0 1 0 8 0
mcl2k 2048 104958 0 104920 23 17 6 12 0 8 0
mtagpl 96 891 0 839 10 8 2 4 0 8 0
mbufpl 256 257428 0 257243 156 139 17 57 0 8 0
bufpl 280 31703 0 26349 383 0 383 383 0 8 0
anonpl 16 1028009 0 1007439 249 161 88 102 0 107 0
amapchunkpl 152 48701 0 48471 145 135 10 24 0 158 0
amappl16 192 52393 0 51212 254 194 60 71 0 8 0
amappl15 184 610 0 608 1 0 1 1 0 8 0
amappl14 176 1310 0 1305 2 1 1 1 0 8 0
amappl13 168 743 0 739 1 0 1 1 0 8 0
amappl12 160 1602 0 1599 1 0 1 1 0 8 0
amappl11 152 1931 0 1922 1 0 1 1 0 8 0
amappl10 144 1016 0 1014 1 0 1 1 0 8 0
amappl9 136 5848 0 5844 1 0 1 1 0 8 0
amappl8 128 3583 0 3484 5 1 4 4 0 8 0
amappl7 120 1278 0 1267 1 0 1 1 0 8 0
amappl6 112 1513 0 1502 1 0 1 1 0 8 0
amappl5 104 10858 0 10845 1 0 1 1 0 8 0
amappl4 96 3340 0 3309 1 0 1 1 0 8 0
amappl3 88 770 0 760 1 0 1 1 0 8 0
amappl2 80 88865 0 88778 2 0 2 2 0 8 0
amappl1 72 270760 0 270348 24 15 9 17 0 8 0
amappl 80 25407 0 25332 2 0 2 2 0 84 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 64 142 0 12 3 0 3 3 0 8 0
uaddrrnd 24 11324 0 11279 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 11324 0 11279 1 0 1 1 0 8 0
vmmpekpl 168 55691 0 55653 3 0 3 3 0 8 0
vmmpepl 168 1373930 0 1371382 613 494 119 157 0 357 0
vmsppl 272 11323 0 11279 3 0 3 3 0 8 0
pdppl 4096 22654 0 22589 17 8 9 9 0 8 0
pvpl 32 2777804 0 2756393 617 433 184 273 0 265 0
pmappl 200 11323 0 11279 5 2 3 3 0 8 0
extentpl 40 53 0 36 1 0 1 1 0 8 0
phpool 112 692 0 426 9 1 8 8 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
pfsync_state_import(ffff800000b27000,1) at pfsync_state_import+271
pfioctl(4900,c1084425,ffff800000b27000,3,ffff80001d6be290) at pfioctl+10314
VOP_IOCTL(fffffd805d84a410,c1084425,ffff800000b27000,3,fffffd806c3bf9c0,ffff80001d6be290) at VOP_IOCTL+136
vn_ioctl(fffffd80570ab3d0,c1084425,ffff800000b27000,ffff80001d6be290) at vn_ioctl+181
sys_ioctl(ffff80001d6be290,ffff8000208713a8,ffff8000208713f0) at sys_ioctl+1185
syscall(ffff800020871470) at syscall+1287
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0x649097f7a90, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
pfsync_state_import(ffff800000b27000,1) at pfsync_state_import+271
pfioctl(4900,c1084425,ffff800000b27000,3,ffff80001d6be290) at pfioctl+10314
VOP_IOCTL(fffffd805d84a410,c1084425,ffff800000b27000,3,fffffd806c3bf9c0,ffff80001d6be290) at VOP_IOCTL+136
vn_ioctl(fffffd80570ab3d0,c1084425,ffff800000b27000,ffff80001d6be290) at vn_ioctl+181
sys_ioctl(ffff80001d6be290,ffff8000208713a8,ffff8000208713f0) at sys_ioctl+1185
syscall(ffff800020871470) at syscall+1287
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0x649097f7a90, count: -7


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Apr 20, 2021, 6:19:09 PM4/20/21
to syzkaller-o...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages