panic: receive 1: so ADDR, so_type 3, sb_cc 7509

0 views
Skip to first unread message

syzbot

unread,
Oct 30, 2019, 12:16:08 AM10/30/19
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 78f4ad60 merge documentation for several macros EVP_PKEY_C..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=136e33e4e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0fe83f82fe104d4
dashboard link: https://syzkaller.appspot.com/bug?extid=bdadb2a95cd6c45755cb

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bdadb2...@syzkaller.appspotmail.com

panic: receive 1: so 0xfffffd8037012180, so_type 3, sb_cc 7509
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*131816 3240 0 0 0 0 dhclient
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
soreceive(fffffd8037012180,0,ffff800014886318,0,0,ffff800014886224) at
soreceive+0x16ac sys/kern/uipc_socket.c:798
soo_read(fffffd8037562690,ffff800014886318,0) at soo_read+0x53
sys/kern/sys_socket.c:70
dofilereadv(ffff8000ffff8008,6,ffff800014886318,0,ffff800014886400) at
dofilereadv+0x1a2 sys/kern/sys_generic.c:236
sys_read(ffff8000ffff8008,ffff8000148863b0,ffff800014886400) at
sys_read+0x83 sys/kern/sys_generic.c:156
syscall(ffff800014886480) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,3,7f7ffffe43e8,3,7e66531e,1a372656d000) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe4120, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
receive 1: so 0xfffffd8037012180, so_type 3, sb_cc 7509
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
soreceive(fffffd8037012180,0,ffff800014886318,0,0,ffff800014886224) at
soreceive+0x16ac sys/kern/uipc_socket.c:798
soo_read(fffffd8037562690,ffff800014886318,0) at soo_read+0x53
sys/kern/sys_socket.c:70
dofilereadv(ffff8000ffff8008,6,ffff800014886318,0,ffff800014886400) at
dofilereadv+0x1a2 sys/kern/sys_generic.c:236
sys_read(ffff8000ffff8008,ffff8000148863b0,ffff800014886400) at
sys_read+0x83 sys/kern/sys_generic.c:156
syscall(ffff800014886480) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,3,7f7ffffe43e8,3,7e66531e,1a372656d000) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe4120, count: -8
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff800014886060
rbx 0xffff800014886110
rdx 0x2
rcx 0
rax 0
r8 0xffff800014886020
r9 0x1
r10 0
r11 0xa36715e7616f3ff0
r12 0x3000000008
r13 0xffff800014886070
r14 0x100
r15 0x1
rip 0xffffffff8204e208 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800014886050
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
PROC (dhclient) pid=131816 stat=onproc
flags process=0 proc=0
pri=51, usrpri=51, nice=20
forw=0xffffffffffffffff, list=0xffff8000ffff9150,0xffff8000ffff89f8
process=0xffff8000ffff66d0 user=0xffff800014881000,
vmspace=0xfffffd803f013220
estcpu=1, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
37380 40705 8531 0 2 0 syz-executor.0
30398 395896 80431 0 2 0 syz-executor.1
30398 315493 80431 0 2 0x4000000 syz-executor.1
80431 257665 26844 0 3 0x82 nanosleep syz-executor.1
8531 359639 26844 0 3 0x82 nanosleep syz-executor.0
54309 273083 1 0 3 0x100083 ttyin getty
87846 75630 0 0 3 0x14200 bored sosplice
26844 240611 13302 0 3 0x82 thrsleep syz-fuzzer
26844 124734 13302 0 2 0x4000482 syz-fuzzer
26844 65840 13302 0 3 0x4000082 kqread syz-fuzzer
26844 393573 13302 0 3 0x4000082 thrsleep syz-fuzzer
26844 107302 13302 0 3 0x4000082 thrsleep syz-fuzzer
26844 117609 13302 0 3 0x4000082 thrsleep syz-fuzzer
26844 443468 13302 0 3 0x4000082 thrsleep syz-fuzzer
13302 40680 3760 0 3 0x10008a pause ksh
3760 377261 15773 0 3 0x92 select sshd
15773 503159 1 0 3 0x80 select sshd
7038 255521 56127 73 3 0x100090 kqread syslogd
56127 94625 1 0 3 0x100082 netio syslogd
45435 44831 1 77 2 0x100010 dhclient
* 3240 131816 1 0 7 0 dhclient
23278 87285 0 0 2 0x14200 zerothread
77903 13821 0 0 3 0x14200 aiodoned aiodoned
25413 46043 0 0 3 0x14200 syncer update
17017 96743 0 0 3 0x14200 cleaner cleaner
11336 285727 0 0 3 0x14200 reaper reaper
29728 378363 0 0 3 0x14200 pgdaemon pagedaemon
6285 449917 0 0 3 0x14200 bored crynlk
2348 449838 0 0 3 0x14200 bored crypto
91372 33324 0 0 3 0x40014200 acpi0 acpi0
16795 302842 0 0 2 0x14200 softnet
1132 258540 0 0 3 0x14200 bored systqmp
21581 291270 0 0 3 0x14200 bored systq
64143 387104 0 0 3 0x40014200 bored softclock
23537 375829 0 0 3 0x40014200 idle0
21760 67997 0 0 3 0x14200 bored smr
1 100181 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9626 6530K 7694K 78643K 31754 0 0
pcb 13 12K 14K 78643K 1565 0 0
rtable 162 16K 16K 78643K 5556 0 0
ifaddr 124 31K 33K 78643K 1517 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 826 0 0
iov 0 0K 32K 78643K 4764 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1219 77K 77K 78643K 11218 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 9K 78643K 192 0 0
VM map 56 14K 14K 78643K 99 0 0
sem 12 0K 1K 78643K 9588 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1793 195K 288K 78643K 12645 0 0
file desc 6 17K 25K 78643K 14240 0 0
sigio 0 0K 0K 78643K 269 0 0
proc 50 38K 63K 78643K 4933 0 0
subproc 32 2K 2K 78643K 1009 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 635 0 0
in_multi 37 2K 3K 78643K 953 0 0
ether_multi 1 0K 0K 78643K 75 0 0
mrt 1 0K 0K 78643K 37 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 144 636K 636K 78643K 144 0 0
exec 0 0K 1K 78643K 1671 0 0
pfkey data 0 0K 4K 78643K 2 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 184 382K 383K 78643K 34044 0 0
UVM aobj 130 4K 4K 78643K 130 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 1K 78643K 1448 0 0
NDP 25 0K 1K 78643K 426 0 0
temp 262 3541K 4181K 78643K 391832 0 0
kqueue 0 0K 0K 78643K 88 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 156 0 152 1 0 1 1 0
8 0
rtpcb 80 1114 0 1112 1 0 1 1 0
8 0
rtentry 112 1074 0 1011 2 0 2 2 0
8 0
unpcb 120 7783 0 7766 8 6 2 2 0
8 1
syncache 264 37 0 37 18 18 0 1 0
8 0
sackhl 24 1 0 1 1 1 0 1 0
8 0
tcpqe 32 216 0 216 5 5 0 1 0
8 0
tcpcb 544 5746 0 5742 27 26 1 15 0
8 0
ipq 40 78 0 78 26 26 0 1 0
8 0
ipqe 40 1448 0 1448 26 26 0 1 0
8 0
inpcb 280 14895 0 14888 57 55 2 13 0
8 1
rttmr 72 9 0 8 8 7 1 1 0
8 0
ip6q 72 9 0 9 5 5 0 1 0
8 0
ip6af 40 27 0 27 5 5 0 1 0
8 0
nd6 48 136 0 134 4 3 1 1 0
8 0
pkpcb 40 24 0 24 10 10 0 1 0
8 0
swfcl 56 4 0 0 1 0 1 1 0
8 0
ppxss 1128 123 0 122 32 31 1 1 0
8 0
art_heap8 4096 20 0 18 10 8 2 4 0
8 0
art_heap4 256 3678 0 3426 41 21 20 20 0
8 0
art_table 32 3698 0 3444 3 0 3 3 0
8 0
art_node 16 939 0 899 1 0 1 1 0
8 0
sysvmsgpl 40 394 0 391 1 0 1 1 0
8 0
semapl 112 9586 0 9576 1 0 1 1 0
8 0
shmpl 112 128 0 0 4 0 4 4 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 23671 0 22256 46 0 46 46 0
8 0
ffsino 240 23671 0 22256 84 0 84 84 0
8 0
nchpl 144 51069 0 50574 60 39 21 60 0
8 0
uvmvnodes 72 9234 0 0 168 0 168 168 0
8 0
vnodes 208 9234 0 0 486 0 486 486 0
8 0
namei 1024 183912 0 183912 6 5 1 1 0
8 1
vcpupl 1984 54 0 0 7 0 7 7 0
8 0
vmpool 520 97 0 43 7 3 4 4 0
8 0
scsiplug 64 7 0 7 5 5 0 1 0
8 0
scxspl 192 139583 0 139583 42 41 1 7 0
8 1
plimitpl 152 648 0 641 1 0 1 1 0
8 0
sigapl 432 14242 0 14228 2 0 2 2 0
8 0
futexpl 56 416304 0 416304 7 6 1 1 0
8 1
knotepl 112 2513 0 2494 4 3 1 2 0
8 0
kqueuepl 104 3612 0 3610 4 3 1 4 0
8 0
pipepl 112 6392 0 6373 14 12 2 2 0
8 1
fdescpl 424 14243 0 14228 2 0 2 2 0
8 0
filepl 120 125142 0 125046 50 45 5 11 0
8 2
lockfpl 104 7691 0 7690 1 0 1 1 0
8 0
lockfspl 48 2110 0 2109 1 0 1 1 0
8 0
sessionpl 112 77 0 67 1 0 1 1 0
8 0
pgrppl 48 161 0 151 1 0 1 1 0
8 0
ucredpl 96 36338 0 36330 1 0 1 1 0
8 0
zombiepl 144 14238 0 14238 2 1 1 1 0
8 1
processpl 864 14268 0 14238 4 0 4 4 0
8 0
procpl 632 30288 0 30251 8 4 4 5 0
8 0
sosppl 128 132 0 132 28 28 0 1 0
8 0
sockpl 384 25353 0 25327 74 69 5 22 0
8 1
mcl64k 65536 1939 0 1939 143 142 1 33 0
8 1
mcl16k 16384 121 0 121 41 40 1 1 0
8 1
mcl12k 12288 346 0 346 25 24 1 1 0
8 1
mcl9k 9216 252 0 252 35 34 1 1 0
8 1
mcl8k 8192 2251 0 2251 15 14 1 1 0
8 1
mcl4k 4096 1519 0 1519 11 10 1 1 0
8 1
mcl2k2 2112 99 0 99 37 36 1 1 0
8 1
mcl2k 2048 95747 0 95702 28 21 7 16 0
8 0
mtagpl 80 302 0 300 11 10 1 1 0
8 0
mbufpl 256 254665 0 254473 172 139 33 37 0
8 8
bufpl 256 44214 0 34986 578 0 578 578 0
8 0
anonpl 16 1400277 0 1380296 321 224 97 97 0 62
12
amapchunkpl 152 62695 0 62563 108 100 8 19 0
158 0
amappl16 192 75594 0 74438 433 363 70 71 0 8
11
amappl15 184 1926 0 1926 9 9 0 1 0
8 0
amappl14 176 2911 0 2904 1 0 1 1 0
8 0
amappl13 168 1746 0 1745 1 0 1 1 0
8 0
amappl12 160 1572 0 1567 1 0 1 1 0
8 0
amappl11 152 3460 0 3445 1 0 1 1 0
8 0
amappl10 144 1648 0 1648 11 11 0 1 0
8 0
amappl9 136 2289 0 2286 1 0 1 1 0
8 0
amappl8 128 1824 0 1769 2 0 2 2 0
8 0
amappl7 120 1884 0 1877 1 0 1 1 0
8 0
amappl6 112 3291 0 3282 1 0 1 1 0
8 0
amappl5 104 2214 0 2204 1 0 1 1 0
8 0
amappl4 96 14506 0 14472 1 0 1 1 0
8 0
amappl3 88 3992 0 3986 1 0 1 1 0
8 0
amappl2 80 113133 0 113061 3 1 2 3 0
8 0
amappl1 72 255007 0 254607 27 18 9 20 0
8 0
amappl 80 31467 0 31406 2 0 2 2 0
84 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma128 128 253 0 253 1 1 0 1 0
8 0
dma64 64 6 0 6 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 129 0 0 3 0 3 3 0
8 0
uaddrrnd 24 14340 0 14228 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 14340 0 14228 1 0 1 1 0
8 0
vmmpekpl 168 85249 0 85206 3 0 3 3 0
8 0
vmmpepl 168 1683032 0 1680626 631 493 138 169 0 357
28
vmsppl 272 14242 0 14228 8 7 1 2 0
8 0
pdppl 4096 28686 0 28596 18 6 12 12 0
8 0
pvpl 32 3991004 0 3968058 785 561 224 324 0 265
33
pmappl 200 14339 0 14271 5 1 4 4 0
8 0
extentpl 40 41 0 26 1 0 1 1 0
8 0
phpool 112 1187 0 441 23 1 22 22 0
8 0
ddb>


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

Anton Lindqvist

unread,
Oct 30, 2019, 4:04:22 AM10/30/19
to syzbot, syzkaller-o...@googlegroups.com
#syz dup: panic: receive 1: so ADDR, so_type 3, sb_cc 176
Reply all
Reply to author
Forward
0 new messages