uvm_fault: ADDR: movb $0xaa,%clddb> ddb> set $lines = 0ddb> set $maxwidth = 0ddb> show panickernel page faul

1 view
Skip to first unread message

syzbot

unread,
Sep 25, 2019, 12:36:07 PM9/25/19
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 9bfe40da adjust for U-Boot RK3288 changes
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=17511f29600000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0fe83f82fe104d4
dashboard link: https://syzkaller.appspot.com/bug?extid=cc3a6394fd2e573a4417

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+cc3a63...@syzkaller.appspotmail.com

uvm_fault(0xffffffff8251f028, 0xfffffd802e36bed8, 0, 4) -> e
kernel: page fault trap, code=0
Stopped at 0xfffffd802e36bed8: movb $0xaa,%cl
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff8251f028, 0xfffffd802e36bed8, 0, 4) -> e
fffffd802e36bed8(b,ffff80001697e158,83,ffff80001697e1f8,0,b) at
0xfffffd802e36bed8
end trace frame: 0xffff80001697e250, count: 0
ddb> trace
fffffd802e36bed8(b,ffff80001697e158,83,ffff80001697e1f8,0,b) at
0xfffffd802e36bed8
rt_match(fffffd8039414da0,0,1,0) at rt_match+0xbe rt_clone
sys/net/route.c:266 [inline]
rt_match(fffffd8039414da0,0,1,0) at rt_match+0xbe sys/net/route.c:242
in_pcbselsrc(ffff80001697e2d0,fffffd802ad93820,fffffd8039414d20) at
in_pcbselsrc+0x219 sys/netinet/in_pcb.c:934
in_pcbconnect(fffffd8039414d20,fffffd802ad93800) at in_pcbconnect+0x107
sys/netinet/in_pcb.c:492
udp_usrreq(fffffd802b68b600,4,0,fffffd802ad93800,0,ffff800014934290) at
udp_usrreq+0x560
sys_connect(ffff800014934290,ffff80001697e458,ffff80001697e4a0) at
sys_connect+0x3df sys/kern/uipc_syscalls.c:388
syscall(ffff80001697e520) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,fffffffffffffed2,0,3,9c98d923010) at Xsyscall+0x128
end of kernel
end trace frame: 0x9cc342548e0, count: -8
ddb> show registers
rdi 0xffff800000a80800
rsi 0xb
rbp 0xffff80001697e140
rbx 0xfffffd8038e8a2a8
rdx 0xfffffd8038e8a2a8
rcx 0xffff800014936000
rax 0xffff800014936000
r8 0x100
r9 0x7
r10 0x5e9354f3a0f52174
r11 0xfffffd802e36bed8
r12 0xfffffd8038e8a2a8
r13 0xffff80001697e158
r14 0xffff80001697e1f8
r15 0xffff8000000252b0
rip 0xfffffd802e36bed8
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff80001697e048
ss 0x10
0xfffffd802e36bed8: movb $0xaa,%cl
ddb> show proc
PROC (syz-executor.1) pid=346344 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=83, usrpri=83, nice=20
forw=0xffffffffffffffff, list=0xffff800014935650,0xffffffff8255bd20
process=0xffff8000ffff70f0 user=0xffff800016979000,
vmspace=0xfffffd803f013dd0
estcpu=36, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
72786 147434 55024 0 2 0 syz-executor.1
*72786 346344 55024 0 7 0x4000000 syz-executor.1
63148 111937 50018 0 2 0x2 syz-executor.0
55024 105515 50018 0 3 0x82 nanosleep syz-executor.1
30574 204551 1 0 3 0x100083 ttyin getty
25299 448498 0 0 3 0x14200 acct acct
93610 471559 0 0 3 0x14200 bored sosplice
50018 486284 28228 0 3 0x82 thrsleep syz-fuzzer
50018 226569 28228 0 3 0x4000082 thrsleep syz-fuzzer
50018 302330 28228 0 3 0x4000082 thrsleep syz-fuzzer
50018 285053 28228 0 3 0x4000082 thrsleep syz-fuzzer
50018 430493 28228 0 3 0x4000082 thrsleep syz-fuzzer
50018 463374 28228 0 3 0x4000082 thrsleep syz-fuzzer
50018 61158 28228 0 3 0x4000082 thrsleep syz-fuzzer
50018 150356 28228 0 3 0x4000082 kqread syz-fuzzer
28228 102311 54237 0 3 0x10008a pause ksh
54237 181249 64567 0 3 0x92 select sshd
64567 237845 1 0 3 0x80 select sshd
1636 200532 8710 73 3 0x100090 kqread syslogd
8710 299876 1 0 3 0x100082 netio syslogd
627 335515 1 77 3 0x100090 poll dhclient
63233 73591 1 0 3 0x80 poll dhclient
89566 315287 0 0 2 0x14200 zerothread
80485 54809 0 0 3 0x14200 aiodoned aiodoned
10192 369105 0 0 3 0x14200 syncer update
2434 23761 0 0 3 0x14200 cleaner cleaner
74138 342453 0 0 3 0x14200 reaper reaper
77219 289339 0 0 3 0x14200 pgdaemon pagedaemon
85367 138902 0 0 3 0x14200 bored crynlk
66936 158644 0 0 3 0x14200 bored crypto
61478 188316 0 0 3 0x40014200 acpi0 acpi0
60195 392732 0 0 3 0x14200 bored softnet
38416 378055 0 0 3 0x14200 bored systqmp
47900 512615 0 0 3 0x14200 bored systq
44367 295998 0 0 3 0x40014200 bored softclock
62273 228110 0 0 3 0x40014200 idle0
42169 473931 0 0 3 0x14200 bored smr
1 78099 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9595 7025K 7034K 78643K 16141 0 0
pcb 13 8K 8K 78643K 923 0 0
rtable 112 12K 14K 78643K 2559 0 0
ifaddr 93 20K 21K 78643K 710 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 246 0 0
iov 0 0K 32K 78643K 1335 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1204 76K 77K 78643K 4055 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 9K 78643K 54 0 0
VM map 2 0K 0K 78643K 22 0 0
sem 12 0K 1K 78643K 528 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1793 195K 288K 78643K 12645 0 0
file desc 5 13K 25K 78643K 4663 0 0
sigio 0 0K 0K 78643K 644 0 0
proc 50 38K 63K 78643K 1757 0 0
subproc 32 2K 2K 78643K 425 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 243 0 0
in_multi 25 1K 2K 78643K 491 0 0
ether_multi 1 0K 0K 78643K 23 0 0
mrt 0 0K 0K 78643K 28 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 102 450K 450K 78643K 102 0 0
exec 0 0K 1K 78643K 946 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 120 22K 32K 78643K 12555 0 0
UVM aobj 130 4K 4K 78643K 138 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 1K 78643K 839 0 0
NDP 23 0K 1K 78643K 234 0 0
temp 247 3537K 4179K 78643K 136670 0 0
kqueue 0 0K 0K 78643K 22 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 93 0 88 1 0 1 1 0
8 0
rtpcb 80 363 0 361 1 0 1 1 0
8 0
rtentry 112 480 0 442 2 0 2 2 0
8 0
unpcb 120 2046 0 2034 1 0 1 1 0
8 0
syncache 264 19 0 19 7 6 1 1 0
8 1
tcpqe 32 7691 0 7691 4 4 0 2 0
8 0
tcpcb 544 2513 0 2509 17 15 2 3 0
8 1
ipq 40 21 0 21 8 8 0 1 0
8 0
ipqe 40 48 0 48 8 8 0 1 0
8 0
inpcb 280 5329 0 5320 18 16 2 3 0
8 1
rttmr 72 9 0 8 2 1 1 1 0
8 0
nd6 48 67 0 65 3 2 1 1 0
8 0
pkpcb 40 16 0 16 5 5 0 1 0
8 0
swfcl 56 1 0 0 1 0 1 1 0
8 0
ppxss 1128 75 0 75 14 13 1 1 0
8 1
art_heap8 4096 3 0 2 3 2 1 3 0
8 0
art_heap4 256 2024 0 1815 31 15 16 17 0
8 0
art_table 32 2027 0 1817 3 0 3 3 0
8 0
art_node 16 472 0 438 1 0 1 1 0
8 0
sysvmsgpl 40 24 0 10 1 0 1 1 0
8 0
semupl 112 1 0 1 1 1 0 1 0
8 0
semapl 112 526 0 516 1 0 1 1 0
8 0
shmpl 112 136 0 8 4 0 4 4 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 10725 0 9327 46 0 46 46 0
8 0
ffsino 240 10725 0 9327 83 0 83 83 0
8 0
nchpl 144 18238 0 16620 61 0 61 61 0
8 0
uvmvnodes 72 6596 0 0 120 0 120 120 0
8 0
vnodes 208 6596 0 0 348 0 348 348 0
8 0
namei 1024 63386 0 63386 5 4 1 1 0
8 1
vmpool 520 20 0 20 10 9 1 1 0
8 1
scsiplug 64 4 0 4 3 3 0 1 0
8 0
scxspl 192 64877 0 64877 30 29 1 7 0
8 1
plimitpl 152 354 0 347 1 0 1 1 0
8 0
sigapl 432 4768 0 4755 2 0 2 2 0
8 0
futexpl 56 120329 0 120329 4 3 1 1 0
8 1
knotepl 112 1060 0 1041 3 2 1 2 0
8 0
kqueuepl 104 1170 0 1168 1 0 1 1 0
8 0
pipepl 112 2728 0 2709 10 8 2 2 0
8 1
fdescpl 424 4769 0 4755 2 0 2 2 0
8 0
filepl 120 41653 0 41555 15 11 4 5 0
8 0
lockfpl 104 1865 0 1864 1 0 1 1 0
8 0
lockfspl 48 637 0 636 1 0 1 1 0
8 0
sessionpl 112 43 0 33 1 0 1 1 0
8 0
pgrppl 48 77 0 67 1 0 1 1 0
8 0
ucredpl 96 5075 0 5066 1 0 1 1 0
8 0
zombiepl 144 4756 0 4756 4 3 1 1 0
8 1
processpl 864 4786 0 4756 4 0 4 4 0
8 0
procpl 632 10623 0 10585 6 2 4 5 0
8 0
sosppl 128 58 0 58 14 14 0 1 0
8 0
sockpl 384 7802 0 7779 20 16 4 6 0
8 0
mcl64k 65536 2045 0 2045 168 167 1 33 0
8 1
mcl16k 16384 38 0 38 16 15 1 1 0
8 1
mcl12k 12288 128 0 128 11 10 1 1 0
8 1
mcl9k 9216 65 0 65 13 12 1 1 0
8 1
mcl8k 8192 214 0 214 6 5 1 1 0
8 1
mcl4k 4096 567 0 567 6 5 1 1 0
8 1
mcl2k2 2112 46 0 46 17 17 0 1 0
8 0
mcl2k 2048 60185 0 60144 37 30 7 24 0
8 1
mtagpl 80 279 0 279 6 6 0 4 0
8 0
mbufpl 256 132645 0 132566 119 110 9 45 0
8 0
bufpl 256 26037 0 18735 457 0 457 457 0
8 0
anonpl 16 590335 0 575779 174 96 78 88 0 62
13
amapchunkpl 152 25576 0 25472 72 54 18 18 0 158
13
amappl16 192 29739 0 28861 236 189 47 64 0
8 2
amappl15 184 1520 0 1519 5 4 1 1 0
8 0
amappl14 176 704 0 700 1 0 1 1 0
8 0
amappl13 168 834 0 832 4 3 1 1 0
8 0
amappl12 160 718 0 716 1 0 1 1 0
8 0
amappl11 152 139 0 128 1 0 1 1 0
8 0
amappl10 144 252 0 249 1 0 1 1 0
8 0
amappl9 136 2129 0 2122 1 0 1 1 0
8 0
amappl8 128 1669 0 1623 2 0 2 2 0
8 0
amappl7 120 364 0 355 1 0 1 1 0
8 0
amappl6 112 105 0 94 1 0 1 1 0
8 0
amappl5 104 1036 0 1026 1 0 1 1 0
8 0
amappl4 96 4582 0 4548 1 0 1 1 0
8 0
amappl3 88 836 0 831 1 0 1 1 0
8 0
amappl2 80 37441 0 37372 3 1 2 3 0
8 0
amappl1 72 96617 0 96206 26 17 9 20 0
8 0
amappl 80 11267 0 11232 1 0 1 1 0
84 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma128 128 253 0 253 1 1 0 1 0
8 0
dma64 64 6 0 6 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 137 0 8 3 0 3 3 0
8 0
uaddrrnd 24 4789 0 4755 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 4789 0 4755 1 0 1 1 0
8 0
vmmpekpl 168 32991 0 32964 2 0 2 2 0
8 0
vmmpepl 168 587454 0 585496 317 198 119 124 0 357
28
vmsppl 272 4768 0 4755 5 4 1 2 0
8 0
pdppl 4096 9584 0 9550 7 2 5 6 0
8 0
pvpl 32 1539939 0 1522269 465 195 270 290 0 265
112
pmappl 200 4788 0 4775 1 0 1 1 0
8 0
extentpl 40 41 0 26 1 0 1 1 0
8 0
phpool 112 965 0 376 19 0 19 19 0
8 0


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

Anton Lindqvist

unread,
Sep 26, 2019, 4:37:58 AM9/26/19
to syzbot, syzkaller-o...@googlegroups.com
#syz dup: panic: attempt to execute user address 0x1 in supervisor mode
Reply all
Reply to author
Forward
0 new messages