uvm_fault: pmap_enter

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: a30f5dcbf70f Abstract allocation and initialization of con..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11b3b090c00000
kernel config: https://syzkaller.appspot.com/x/.config?x=67702c30ce8f1b56
dashboard link: https://syzkaller.appspot.com/bug?extid=58c727024b6b39df2b34
compiler:

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+58c727...@syzkaller.appspotmail.com

login: uvm_fault(0xffffff007f124108, 0x7f8000100008, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at pmap_enter+0x22a: movq
__ALIGN_SIZE+0x3000(%rcx,%rsi,8),%rdx
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xffffff007f124108, 0x7f8000100008, 0, 1) -> e
pmap_enter(32176cc2ef95acc,0,20,3,2) at pmap_enter+0x22a
sys/arch/amd64/amd64/pmap.c:2498
end trace frame: 0xffff8000211490d0, count: 0
ddb{0}> trace
pmap_enter(32176cc2ef95acc,0,20,3,2) at pmap_enter+0x22a
sys/arch/amd64/amd64/pmap.c:2498
uvm_fault(a66ce94f18bc165e,ffff8000210624c8,ffff800021144000,20000080) at
uvm_fault+0x934 sys/uvm/uvm_fault.c:803
pageflttrap() at pageflttrap+0x18d sys/arch/amd64/amd64/trap.c:200
kerntrap(be84cb944ca29f96) at kerntrap+0x9b sys/arch/amd64/amd64/trap.c:294
alltraps_kern(6,11,20000080,2,11,ffff800021149470) at alltraps_kern+0x7b
copyout(988fe1096dddda83,ffff800021149470,8,11,0,ffffff006fd05e00) at
copyout+0x53
spec_read(cf2c4f03fcbefe5d) at spec_read+0x2eb sys/kern/spec_vnops.c:260
VOP_READ(3a9d9008cbb3927,ffff800021149470,ffffff00634f50a0,ffffff0068a3bbc8)
at
VOP_READ+0x66 sys/kern/vfs_vops.c:247
vn_read(cdcca4c919defa8c,ffffff0068a3bbc8,ffff8000210624c8) at
vn_read+0x140 sys/kern/vfs_vnops.c:365
dofilereadv(a9449b00ed7a3286,ffff8000210624c8,ffff800021149520,11,ffff800021149538)
at
dofilereadv+0x156 sys/kern/sys_generic.c:235
sys_read(480056ad3aa92eb6,30,ffff8000210624c8) at sys_read+0x7b
sys/kern/sys_generic.c:155
syscall(98f09522d2f159af) at syscall+0x473 mi_syscall
sys/sys/syscall_mi.h:99 [inline]
syscall(98f09522d2f159af) at syscall+0x473 sys/arch/amd64/amd64/trap.c:583
Xsyscall(6,0,ffffffffffffffb9,0,3,6fc198b0010) at Xsyscall+0x128
end of kernel
end trace frame: 0x6fea0190bb0, count: -13
ddb{0}> show registers
rdi 0xffffff0002263b80
rsi 0x20001 acpi_pdirpa+0xbe69
rbp 0xffff800021148ec0
rbx 0
rdx 0xffff800000ad9000
rcx 0x7f7fffffc000
rax 0x20001 acpi_pdirpa+0xbe69
r8 0x1
r9 0
r10 0x989af247059c5780
r11 0xa98adad67a14dfa0
r12 0x20001000
r13 0
r14 0x7c7b2000
r15 0xffffff007f123240
rip 0xffffffff81790f7a pmap_enter+0x22a
cs 0x8
rflags 0x10202 __ALIGN_SIZE+0xf202
rsp 0xffff800021148e00
ss 0x10
pmap_enter+0x22a: movq __ALIGN_SIZE+0x3000(%rcx,%rsi,8),%rdx
ddb{0}> show proc
PROC (syz-executor0) pid=320227 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=79, usrpri=79, nice=20
forw=0xffffffffffffffff, list=0xffff800021063c38,0xffff800021063798
process=0xffff800021065708 user=0xffff800021144000,
vmspace=0xffffff007f124108
estcpu=36, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
16382 515562 24171 0 2 0 syz-executor0
*16382 320227 24171 0 7 0x4000000 syz-executor0
16382 322891 24171 0 3 0x4000080 fsleep syz-executor0
13000 281301 1 0 3 0x100083 ttyin getty
55063 341279 0 0 3 0x14200 bored sosplice
40913 331654 75695 0 3 0x82 nanosleep syz-executor1
24171 231036 75695 0 3 0x82 nanosleep syz-executor0
75695 408195 56205 0 3 0x82 thrsleep syz-fuzzer
75695 186482 56205 0 3 0x4000082 thrsleep syz-fuzzer
75695 411726 56205 0 3 0x4000082 thrsleep syz-fuzzer
75695 259370 56205 0 3 0x4000082 thrsleep syz-fuzzer
75695 1100 56205 0 3 0x4000082 thrsleep syz-fuzzer
75695 208618 56205 0 3 0x4000082 thrsleep syz-fuzzer
75695 239236 56205 0 3 0x4000082 thrsleep syz-fuzzer
75695 72870 56205 0 3 0x4000082 thrsleep syz-fuzzer
75695 62779 56205 0 3 0x4000082 thrsleep syz-fuzzer
75695 229619 56205 0 3 0x4000082 kqread syz-fuzzer
56205 153845 17207 0 3 0x10008a pause ksh
17207 387770 70644 0 3 0x92 select sshd
70644 184453 1 0 3 0x80 select sshd
71372 45347 98977 73 7 0x100090 syslogd
98977 55962 1 0 3 0x100082 netio syslogd
41314 20846 1 77 3 0x100090 poll dhclient
59353 85263 1 0 3 0x80 poll dhclient
15975 9746 0 0 3 0x14200 pgzero zerothread
44523 491958 0 0 3 0x14200 aiodoned aiodoned
38653 30647 0 0 3 0x14200 syncer update
19145 464345 0 0 3 0x14200 cleaner cleaner
81478 148707 0 0 3 0x14200 reaper reaper
47569 246785 0 0 3 0x14200 pgdaemon pagedaemon
22030 504395 0 0 3 0x14200 bored crynlk
32049 56518 0 0 3 0x14200 bored crypto
83438 366208 0 0 3 0x40014200 acpi0 acpi0
15584 97424 0 0 3 0x40014200 idle1
56323 147093 0 0 3 0x14200 bored softnet
46925 438840 0 0 3 0x14200 bored systqmp
50641 281731 0 0 3 0x14200 bored systq
18466 205549 0 0 3 0x40014200 bored softclock
88738 247622 0 0 3 0x40014200 idle0
1 481732 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 3d8e9378a5b1 Add missing prototype for tls13_handshake_act..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1687e108c00000

kernel config: https://syzkaller.appspot.com/x/.config?x=67702c30ce8f1b56
dashboard link: https://syzkaller.appspot.com/bug?extid=58c727024b6b39df2b34
compiler:

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=115dc117400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+58c727...@syzkaller.appspotmail.com

login: uvm_fault(0xffffff007f00ca50, 0x7f8000100008, 0, 1) -> e

kernel: page fault trap, code=0
Stopped at pmap_enter+0x22a: movq
__ALIGN_SIZE+0x3000(%rcx,%rsi,8),%rdx
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> show panic
kernel page fault

uvm_fault(0xffffff007f00ca50, 0x7f8000100008, 0, 1) -> e
pmap_enter(41340e6f448a20c1,0,20,3,2) at pmap_enter+0x22a
sys/arch/amd64/amd64/pmap.c:2543
end trace frame: 0xffff800021159610, count: 0
ddb{0}> trace
pmap_enter(41340e6f448a20c1,0,20,3,2) at pmap_enter+0x22a
sys/arch/amd64/amd64/pmap.c:2543
uvm_fault(eb6423ca37aa4fa7,ffff80002108b9e0,ffff800021154000,20000000) at

uvm_fault+0x934 sys/uvm/uvm_fault.c:803
pageflttrap() at pageflttrap+0x18d sys/arch/amd64/amd64/trap.c:200

kerntrap(cc2edd6a6bf8bdb8) at kerntrap+0x9b sys/arch/amd64/amd64/trap.c:294
alltraps_kern(6,8,ffffff007f7c6b98,2,ffff80002108b9e0,0) at
alltraps_kern+0x7b
copyout(eb6423ca37aa527c,650,ffff80002108b9e0,0,ffff8000211598e0,7f898b44f48)
at
copyout+0x53
syscall(f67bcd662abc987c) at syscall+0x496 mi_syscall
sys/sys/syscall_mi.h:99 [inline]
syscall(f67bcd662abc987c) at syscall+0x496 sys/arch/amd64/amd64/trap.c:583
Xsyscall(6,0,ffffffffffffffb4,0,2,7f6908140d8) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f898b44fd0, count: -8
ddb{0}> show registers
rdi 0xffffff000547ad80
rsi 0x20001 acpi_pdirpa+0xbe69
rbp 0xffff800021159400
rbx 0
rdx 0xffffff000547ad80

rcx 0x7f7fffffc000
rax 0x20001 acpi_pdirpa+0xbe69
r8 0x1
r9 0

r10 0xbe80f92f0322753a
r11 0x33d12295ea3fbc03
r12 0x20001000
r13 0
r14 0x6c59b000
r15 0xffffff007f00b300
rip 0xffffffff81678ada pmap_enter+0x22a

cs 0x8
rflags 0x10202 __ALIGN_SIZE+0xf202

rsp 0xffff800021159340

ss 0x10
pmap_enter+0x22a: movq __ALIGN_SIZE+0x3000(%rcx,%rsi,8),%rdx
ddb{0}> show proc

PROC (syz-executor1) pid=41415 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=86, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff80002108a720,0xffffffff81fc4b08
process=0xffff8000210653c0 user=0xffff800021154000,
vmspace=0xffffff007f00ca50

estcpu=36, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND

25913 265263 22843 0 2 0 syz-executor1
25913 52373 22843 0 3 0x4000080 fsleep syz-executor1
*25913 41415 22843 0 7 0x4000000 syz-executor1
22843 343296 32918 0 3 0x82 nanosleep syz-executor1
97170 47843 32918 0 3 0x2 biowait syz-executor0
32918 107499 1441 0 3 0x82 thrsleep syz-execprog
32918 160672 1441 0 3 0x4000082 nanosleep syz-execprog
32918 56716 1441 0 3 0x4000082 thrsleep syz-execprog
32918 22994 1441 0 3 0x4000082 thrsleep syz-execprog
32918 355784 1441 0 3 0x4000082 kqread syz-execprog
32918 279570 1441 0 3 0x4000082 thrsleep syz-execprog
32918 370236 1441 0 3 0x4000082 thrsleep syz-execprog
32918 359027 1441 0 3 0x4000082 thrsleep syz-execprog
32918 205356 1441 0 3 0x4000082 thrsleep syz-execprog
32918 510660 1441 0 3 0x4000082 thrsleep syz-execprog
1441 347584 40115 0 3 0x10008a pause ksh
40115 438325 21606 0 3 0x92 select sshd
79104 205590 1 0 3 0x100083 ttyin getty
21606 467297 1 0 3 0x80 select sshd
18043 462490 6970 73 7 0x100090 syslogd
6970 130257 1 0 3 0x100082 netio syslogd
57084 25996 1 77 3 0x100090 poll dhclient
3125 430622 1 0 3 0x80 poll dhclient
13448 367124 0 0 3 0x14200 pgzero zerothread
92776 404929 0 0 3 0x14200 aiodoned aiodoned
92067 431196 0 0 3 0x14200 syncer update
31242 421451 0 0 3 0x14200 cleaner cleaner
37090 135377 0 0 3 0x14200 reaper reaper
82251 361919 0 0 3 0x14200 pgdaemon pagedaemon
65670 357986 0 0 3 0x14200 bored crynlk
21583 238358 0 0 3 0x14200 bored crypto
51532 160930 0 0 3 0x40014200 acpi0 acpi0
87215 361595 0 0 3 0x40014200 idle1
17217 384068 0 0 3 0x14200 bored softnet
46272 25150 0 0 3 0x14200 bored systqmp
88996 393598 0 0 3 0x14200 bored systq
81067 554 0 0 3 0x40014200 bored softclock
19729 331686 0 0 3 0x40014200 idle0
1 128335 0 0 3 0x82 wait init

[Anton Lindqvist]

#syz invalid

This one is operating on the swap partition (0x401 -> major=4, minor=1)
which by now is prevented by the sanitizer:

https://github.com/google/syzkaller/commit/c017728b48d0996df3928156621be26383186a27