uvm_fault: spec_getattr (2)
0 views
Skip to first unread message
syzbot
Oct 10, 2025, 11:39:26 PM (4 days ago) Oct 10
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: ba3be980ae71 const correct X509_VERIFY_PARAM_get_hostflags()
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11265304580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=c553d0bd0068271f9e30
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f7191b14301d/disk-ba3be980.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/077211669b42/bsd-ba3be980.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8fd45f85f1a2/kernel-ba3be980.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c553d0...@syzkaller.appspotmail.com
uvm_fault(0xfffffd806c02c468, 0x30, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at spec_getattr+0x9f: movq 0x30(%rax),%rdi
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*228526 24488 0 0 0x4000000 0 syz-executor
spec_getattr(ffff80002a8bec48) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd806c5bbbd0,ffff80002a8becc0,fffffd8007bfb410,ffff80002a8e7790) at VOP_GETATTR+0x7f sys/kern/vfs_vops.c:191
fill_file(ffff800001627800,fffffd806c076878,fffffd806c3bd550,3,0,ffff8000ffffb618,4e6175b70dea45fd,b9d,3) at fill_file+0x5d0 sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a8bf118,4,200000000100,ffff80002a8bf148,ffff80002a8e7790) at sysctl_file+0x144a sys/kern/kern_sysctl.c:1826
kern_sysctl(ffff80002a8bf114,5,200000000100,ffff80002a8bf148,0,37,26b0f1089f90c3a2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80002a8e7790,ffff80002a8bf270,ffff80002a8bf1c0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8bf270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8bf270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79013647bb0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd806c02c468, 0x30, 0, 1) -> e
ddb> trace
spec_getattr(ffff80002a8bec48) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd806c5bbbd0,ffff80002a8becc0,fffffd8007bfb410,ffff80002a8e7790) at VOP_GETATTR+0x7f sys/kern/vfs_vops.c:191
fill_file(ffff800001627800,fffffd806c076878,fffffd806c3bd550,3,0,ffff8000ffffb618,4e6175b70dea45fd,b9d,3) at fill_file+0x5d0 sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a8bf118,4,200000000100,ffff80002a8bf148,ffff80002a8e7790) at sysctl_file+0x144a sys/kern/kern_sysctl.c:1826
kern_sysctl(ffff80002a8bf114,5,200000000100,ffff80002a8bf148,0,37,26b0f1089f90c3a2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80002a8e7790,ffff80002a8bf270,ffff80002a8bf1c0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8bf270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8bf270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79013647bb0, count: -8
ddb> show registers
rdi 0xffff80003a932000
rsi 0x3812 __ALIGN_SIZE+0x2812
rbp 0xffff80002a8bec30
rbx 0xfffffd806c5bbbd0
rdx 0xffff80003a932000
rcx 0x3811 __ALIGN_SIZE+0x2811
rax 0
r8 0xffffffffffffffff
r9 0
r10 0xd8b194690aa2d49e
r11 0x6fca8935cb1ccf7b
r12 0x8000 __ALIGN_SIZE+0x7000
r13 0xffff80002a8becc0
r14 0xffff80002a8bec48
r15 0xfffffd806c5bbbd0
rip 0xffffffff8101908f spec_getattr+0x9f
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff80002a8bec00
ss 0x10
spec_getattr+0x9f: movq 0x30(%rax),%rdi
ddb> show proc
PROC (syz-executor) tid=228526 pid=24488 tcnt=3 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=81, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a8e6800,0xffff800033d25cc0
process=0xffff8000ffffb618 user=0xffff80002a8ba000, vmspace=0xfffffd806c02c468
estcpu=31, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
73900 300315 13764 0 2 0 syz-executor
73900 226975 13764 0 2 0x4000000 syz-executor
8503 256284 12307 0 2 0 syz-executor
8503 500980 12307 0 3 0x4000080 fsleep syz-executor
28984 450495 49009 0 2 0 syz-executor
28984 474224 49009 0 3 0x4000080 fsleep syz-executor
28984 244699 49009 0 2 0x4000000 syz-executor
24488 206377 63807 0 2 0 syz-executor
24488 292236 63807 0 2 0x4000000 syz-executor
*24488 228526 63807 0 7 0x4000000 syz-executor
37860 88259 65803 0 2 0 syz-executor
37860 183755 65803 0 2 0x4000000 syz-executor
37860 177278 65803 0 3 0x4000080 fsleep syz-executor
37860 510246 65803 0 2 0x4000000 syz-executor
2235 63137 23619 0 2 0 syz-executor
2235 354600 23619 0 2 0x4000000 syz-executor
2235 506393 23619 0 3 0x4000080 fsleep syz-executor
65803 460561 45905 0 3 0x82 nanoslp syz-executor
63807 195351 45905 0 2 0x3 syz-executor
82634 437152 0 0 3 0x14280 nfsidl nfsio
90249 203272 0 0 3 0x14280 nfsidl nfsio
59954 486310 0 0 3 0x14280 nfsidl nfsio
86857 205349 0 0 3 0x14280 nfsidl nfsio
17697 234503 0 0 3 0x14280 nfsidl nfsio
13523 153051 0 0 3 0x14280 nfsidl nfsio
39938 339217 0 0 3 0x14280 nfsidl nfsio
48378 499442 0 0 3 0x14280 nfsidl nfsio
16313 438186 0 0 3 0x14280 nfsidl nfsio
86107 115438 0 0 3 0x14280 nfsidl nfsio
31623 213783 0 0 3 0x14280 nfsidl nfsio
36846 517609 0 0 3 0x14280 nfsidl nfsio
51721 287070 0 0 3 0x14280 nfsidl nfsio
6795 194901 0 0 3 0x14280 nfsidl nfsio
68208 146208 0 0 3 0x14280 nfsidl nfsio
16549 241335 0 0 3 0x14280 nfsidl nfsio
5562 402742 0 0 3 0x14280 nfsidl nfsio
4756 377956 0 0 3 0x14280 nfsidl nfsio
65697 62679 0 0 3 0x14280 nfsidl nfsio
35848 175129 0 0 3 0x14280 nfsidl nfsio
53529 12203 0 0 3 0x14200 bored sosplice
12307 307967 45905 0 2 0x3 syz-executor
14939 266462 45905 0 2 0x2 syz-executor
49009 15465 45905 0 2 0x3 syz-executor
13764 92004 45905 0 2 0x3 syz-executor
53255 355648 45905 0 2 0x2 syz-executor
23619 137346 45905 0 2 0x3 syz-executor
45905 393575 83670 0 3 0x82 kqread syz-executor
83670 142047 20271 0 3 0x10008a sigsusp ksh
20271 515622 2796 0 3 0x98 kqread sshd-session
2796 303526 29749 0 3 0x92 kqread sshd-session
34062 244309 1 0 3 0x100083 ttyopn getty
29749 102162 1 0 3 0x88 kqread sshd
10786 5152 725 73 3 0x1100090 kqread syslogd
725 475552 1 0 3 0x100082 sbwait syslogd
53003 51303 1 0 3 0x100080 kqread resolvd
3471 159326 44472 77 3 0x100092 kqread dhcpleased
73593 269611 44472 77 3 0x100092 kqread dhcpleased
44472 384733 1 0 3 0x80 kqread dhcpleased
4478 320054 0 0 3 0x14200 bored smr
24413 233563 0 0 2 0x14200 zerothread
70427 47250 0 0 3 0x14200 aiodoned aiodoned
74683 73891 0 0 3 0x14200 syncer update
9706 328274 0 0 3 0x14200 cleaner cleaner
94111 377192 0 0 3 0x14200 reaper reaper
50352 78350 0 0 3 0x14200 pgdaemon pagedaemon
26393 507401 0 0 3 0x14200 bored viomb
88953 494117 0 0 3 0x40014200 acpi0 acpi0
89456 176049 0 0 3 0x14200 bored softnet0
39278 491253 0 0 3 0x14200 smrbar systqmp
10880 484834 0 0 3 0x14200 bored systq
30187 330694 0 0 3 0x40014200 tmoslp softclock
84725 56454 0 0 3 0x40014200 idle0
1 428438 0 0 3 0x80082 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11047 12172K 12639K 166960K 13988 0
pcb 17 16K 17K 166960K 372 0
rtable 220 9K 10K 166960K 856 0
pf 30 13K 18K 166960K 179 0
ifaddr 34 6K 8K 166960K 117 0
ifgroup 46 2K 2K 166960K 207 0
sysctl 4 1K 9K 166960K 15 0
counters 31 17K 18K 166960K 108 0
ioctlops 0 0K 4K 166960K 350 0
iov 0 0K 20K 166960K 92 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1416 89K 90K 166960K 2812 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 3 5K 17K 166960K 32 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 0K 166960K 93 0
dirhash 12 2K 3K 166960K 57 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 16 57K 93K 166960K 1652 0
sigio 0 0K 0K 166960K 60 0
proc 60 59K 91K 166960K 663 0
subproc 72 4K 4K 166960K 91 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 335 0
in_multi 73 5K 7K 166960K 194 0
ether_multi 1 0K 0K 166960K 25 0
mrt 1 0K 0K 166960K 27 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 109 493K 493K 166960K 109 0
exec 0 0K 1K 166960K 575 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 4 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 226 143K 165K 166960K 16903 0
UVM aobj 29 4K 4K 166960K 31 0
pinsyscall 37 74K 96K 166960K 2822 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 121 0
NDP 10 0K 2K 166960K 83 0
temp 81 8649K 8716K 166960K 51296 0
kqueue 14 22K 32K 166960K 306 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 179 0 175 1 0 1 1 0 8 0
rtentry 136 295 0 208 4 0 4 4 0 8 0
unpcb 144 1250 0 1233 7 5 2 6 0 8 1
syncache 336 13 0 13 2 1 1 1 0 8 1
tcpqe 32 7 0 7 2 1 1 1 0 8 1
tcpcb 736 703 0 697 13 5 8 8 0 8 7
arp 96 85 0 69 1 0 1 1 0 8 0
ipq 40 5 0 5 1 0 1 1 0 8 1
ipqe 40 7 0 7 1 0 1 1 0 8 1
inpcb 328 1916 0 1904 11 4 7 7 0 8 4
ip6q 72 6 0 6 1 0 1 1 0 8 1
ip6af 40 10 0 10 1 0 1 1 0 8 1
nd6 112 41 0 22 1 0 1 1 0 8 0
pkpcb 40 9 0 9 2 1 1 1 0 8 1
kcovpl 48 10 0 2 1 0 1 1 0 8 0
mppekey 1024 1 0 1 1 1 0 1 0 8 0
ppxss 1072 54 0 54 1 0 1 1 0 8 1
pppxif 1384 10 0 10 2 1 1 1 0 8 1
pfstscr 40 3 0 2 1 0 1 1 0 8 0
pfrktable 1344 6 0 6 2 1 1 1 0 8 1
pfstitem 24 4 0 0 1 0 1 1 0 8 0
pfstkey 128 7 0 3 1 0 1 1 0 8 0
pfstate 384 4 0 2 1 0 1 1 0 8 0
rttmr 136 6 0 6 2 1 1 1 0 8 1
art_heap8 4096 3 0 0 3 0 3 3 0 8 0
art_heap4 256 742 0 337 33 5 28 33 0 8 2
art_table 40 745 0 337 6 0 6 6 0 8 0
art_node 32 290 0 200 2 0 2 2 0 8 0
sysvmsgpl 40 4 0 1 1 0 1 1 0 8 0
semupl 112 3 0 3 1 1 0 1 0 8 0
semapl 112 90 0 80 1 0 1 1 0 8 0
shmpl 112 28 0 2 1 0 1 1 0 8 0
dirhash 1024 49 0 32 3 0 3 3 0 8 0
dino2pl 256 4571 0 3081 95 0 95 95 0 8 0
ffsino 256 4571 0 3081 95 0 95 95 0 8 0
nchpl 144 6923 0 5231 64 0 64 64 0 8 0
rtmask 32 10 0 10 2 1 1 1 0 8 1
vnodes 216 5390 0 0 300 0 300 300 0 8 0
namei 1024 23217 0 23216 4 2 2 2 0 8 1
kstatmem 264 122 0 102 2 0 2 2 0 8 0
scsiplug 72 4 0 4 2 1 1 1 0 8 1
scxspl 216 26389 0 26389 15 7 8 8 1 8 8
plimitpl 152 368 0 351 1 0 1 1 0 8 0
sigapl 424 1989 0 1927 8 0 8 8 0 8 0
knotepl 120 79678 0 79629 44 34 10 24 0 8 5
kqueuepl 184 792 0 782 7 3 4 4 0 8 3
pipepl 304 361 0 334 10 2 8 8 0 8 5
fdescpl 448 1932 0 1904 5 1 4 5 0 8 0
filepl 120 13199 0 12985 23 8 15 17 0 8 8
lockfpl 104 780 0 777 3 1 2 2 0 8 1
lockfspl 48 249 0 246 1 0 1 1 0 8 0
sessionpl 144 31 0 23 1 0 1 1 0 8 0
pgrppl 48 68 0 52 1 0 1 1 0 8 0
ucredpl 104 2527 0 2516 1 0 1 1 0 8 0
zombiepl 144 2449 0 2449 1 0 1 1 0 8 1
processpl 1152 1989 0 1927 5 0 5 5 0 8 0
procpl 664 4487 0 4413 8 0 8 8 0 8 0
sosppl 168 7 0 7 2 1 1 1 0 8 1
sockpl 552 3446 0 3413 17 9 8 13 0 8 5
mcl64k 65536 233 0 233 2 1 1 1 0 8 1
mcl16k 16384 15 0 15 2 1 1 1 0 8 1
mcl12k 12288 5 0 5 2 1 1 1 0 8 1
mcl9k 9216 2 0 2 2 1 1 1 0 8 1
mcl8k 8192 25 0 25 2 1 1 1 0 8 1
mcl4k 4096 4638 0 4582 15 6 9 13 0 8 1
mcl2k 2048 2595 0 2582 6 4 2 6 0 8 0
mtagpl 96 13 0 12 1 0 1 1 0 8 0
mbufpl 256 21218 0 21021 32 8 24 32 0 8 5
bufpl 280 9696 0 3474 445 0 445 445 0 8 0
anonpl 24 303949 0 300353 87 33 54 72 0 187 14
amapchunkpl 152 57093 0 56613 36 9 27 36 0 158 7
amappl16 200 6362 0 6327 48 34 14 28 0 8 8
amappl15 192 5 0 5 1 1 0 1 0 8 0
amappl14 184 64 0 64 1 1 0 1 0 8 0
amappl13 176 433 0 432 1 0 1 1 0 8 0
amappl12 168 2303 0 2266 2 0 2 2 0 8 0
amappl11 160 6 0 6 1 1 0 1 0 8 0
amappl10 152 46 0 36 1 0 1 1 0 8 0
amappl9 144 249 0 249 1 1 0 1 0 8 0
amappl8 136 28 0 26 1 0 1 1 0 8 0
amappl7 128 89 0 87 1 0 1 1 0 8 0
amappl6 120 292 0 280 1 0 1 1 0 8 0
amappl5 112 77 0 68 1 0 1 1 0 8 0
amappl4 104 436 0 410 1 0 1 1 0 8 0
amappl3 96 10111 0 10024 3 0 3 3 0 8 0
amappl2 88 2118 0 2048 2 0 2 2 0 8 0
amappl1 80 17206 0 16667 13 0 13 13 0 8 0
amappl 88 15825 0 15668 5 0 5 5 0 92 1
uvmvnodes 80 5390 0 0 110 0 110 110 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 7 0 7 1 1 0 1 0 8 0
dma128 128 256 0 256 2 1 1 1 0 8 1
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 30 0 2 1 0 1 1 0 8 0
uaddrrnd 24 1932 0 1904 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1932 0 1904 1 0 1 1 0 8 0
vmmpekpl 168 16898 0 16857 3 0 3 3 0 8 0
vmmpepl 168 129048 0 127278 113 17 96 103 0 357 10
vmsppl 368 1931 0 1904 4 1 3 4 0 8 0
rwobjpl 40 40806 0 34532 65 0 65 65 0 8 0
pdppl 4096 3871 0 3808 115 50 65 81 0 8 2
pvpl 32 860931 0 852081 183 59 124 152 0 265 25
pmappl 216 1931 0 1904 3 1 2 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 435 0 89 11 0 11 11 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
spec_getattr(ffff80002a8bec48) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd806c5bbbd0,ffff80002a8becc0,fffffd8007bfb410,ffff80002a8e7790) at VOP_GETATTR+0x7f sys/kern/vfs_vops.c:191
fill_file(ffff800001627800,fffffd806c076878,fffffd806c3bd550,3,0,ffff8000ffffb618,4e6175b70dea45fd,b9d,3) at fill_file+0x5d0 sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a8bf118,4,200000000100,ffff80002a8bf148,ffff80002a8e7790) at sysctl_file+0x144a sys/kern/kern_sysctl.c:1826
kern_sysctl(ffff80002a8bf114,5,200000000100,ffff80002a8bf148,0,37,26b0f1089f90c3a2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80002a8e7790,ffff80002a8bf270,ffff80002a8bf1c0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8bf270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8bf270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79013647bb0, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
spec_getattr(ffff80002a8bec48) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd806c5bbbd0,ffff80002a8becc0,fffffd8007bfb410,ffff80002a8e7790) at VOP_GETATTR+0x7f sys/kern/vfs_vops.c:191
fill_file(ffff800001627800,fffffd806c076878,fffffd806c3bd550,3,0,ffff8000ffffb618,4e6175b70dea45fd,b9d,3) at fill_file+0x5d0 sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a8bf118,4,200000000100,ffff80002a8bf148,ffff80002a8e7790) at sysctl_file+0x144a sys/kern/kern_sysctl.c:1826
kern_sysctl(ffff80002a8bf114,5,200000000100,ffff80002a8bf148,0,37,26b0f1089f90c3a2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80002a8e7790,ffff80002a8bf270,ffff80002a8bf1c0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8bf270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8bf270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79013647bb0, count: -8
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: ba3be980ae71 const correct X509_VERIFY_PARAM_get_hostflags()
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11265304580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=c553d0bd0068271f9e30
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f7191b14301d/disk-ba3be980.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/077211669b42/bsd-ba3be980.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8fd45f85f1a2/kernel-ba3be980.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c553d0...@syzkaller.appspotmail.com
uvm_fault(0xfffffd806c02c468, 0x30, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at spec_getattr+0x9f: movq 0x30(%rax),%rdi
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*228526 24488 0 0 0x4000000 0 syz-executor
spec_getattr(ffff80002a8bec48) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd806c5bbbd0,ffff80002a8becc0,fffffd8007bfb410,ffff80002a8e7790) at VOP_GETATTR+0x7f sys/kern/vfs_vops.c:191
fill_file(ffff800001627800,fffffd806c076878,fffffd806c3bd550,3,0,ffff8000ffffb618,4e6175b70dea45fd,b9d,3) at fill_file+0x5d0 sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a8bf118,4,200000000100,ffff80002a8bf148,ffff80002a8e7790) at sysctl_file+0x144a sys/kern/kern_sysctl.c:1826
kern_sysctl(ffff80002a8bf114,5,200000000100,ffff80002a8bf148,0,37,26b0f1089f90c3a2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80002a8e7790,ffff80002a8bf270,ffff80002a8bf1c0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8bf270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8bf270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79013647bb0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd806c02c468, 0x30, 0, 1) -> e
ddb> trace
spec_getattr(ffff80002a8bec48) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd806c5bbbd0,ffff80002a8becc0,fffffd8007bfb410,ffff80002a8e7790) at VOP_GETATTR+0x7f sys/kern/vfs_vops.c:191
fill_file(ffff800001627800,fffffd806c076878,fffffd806c3bd550,3,0,ffff8000ffffb618,4e6175b70dea45fd,b9d,3) at fill_file+0x5d0 sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a8bf118,4,200000000100,ffff80002a8bf148,ffff80002a8e7790) at sysctl_file+0x144a sys/kern/kern_sysctl.c:1826
kern_sysctl(ffff80002a8bf114,5,200000000100,ffff80002a8bf148,0,37,26b0f1089f90c3a2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80002a8e7790,ffff80002a8bf270,ffff80002a8bf1c0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8bf270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8bf270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79013647bb0, count: -8
ddb> show registers
rdi 0xffff80003a932000
rsi 0x3812 __ALIGN_SIZE+0x2812
rbp 0xffff80002a8bec30
rbx 0xfffffd806c5bbbd0
rdx 0xffff80003a932000
rcx 0x3811 __ALIGN_SIZE+0x2811
rax 0
r8 0xffffffffffffffff
r9 0
r10 0xd8b194690aa2d49e
r11 0x6fca8935cb1ccf7b
r12 0x8000 __ALIGN_SIZE+0x7000
r13 0xffff80002a8becc0
r14 0xffff80002a8bec48
r15 0xfffffd806c5bbbd0
rip 0xffffffff8101908f spec_getattr+0x9f
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff80002a8bec00
ss 0x10
spec_getattr+0x9f: movq 0x30(%rax),%rdi
ddb> show proc
PROC (syz-executor) tid=228526 pid=24488 tcnt=3 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=81, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a8e6800,0xffff800033d25cc0
process=0xffff8000ffffb618 user=0xffff80002a8ba000, vmspace=0xfffffd806c02c468
estcpu=31, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
73900 300315 13764 0 2 0 syz-executor
73900 226975 13764 0 2 0x4000000 syz-executor
8503 256284 12307 0 2 0 syz-executor
8503 500980 12307 0 3 0x4000080 fsleep syz-executor
28984 450495 49009 0 2 0 syz-executor
28984 474224 49009 0 3 0x4000080 fsleep syz-executor
28984 244699 49009 0 2 0x4000000 syz-executor
24488 206377 63807 0 2 0 syz-executor
24488 292236 63807 0 2 0x4000000 syz-executor
*24488 228526 63807 0 7 0x4000000 syz-executor
37860 88259 65803 0 2 0 syz-executor
37860 183755 65803 0 2 0x4000000 syz-executor
37860 177278 65803 0 3 0x4000080 fsleep syz-executor
37860 510246 65803 0 2 0x4000000 syz-executor
2235 63137 23619 0 2 0 syz-executor
2235 354600 23619 0 2 0x4000000 syz-executor
2235 506393 23619 0 3 0x4000080 fsleep syz-executor
65803 460561 45905 0 3 0x82 nanoslp syz-executor
63807 195351 45905 0 2 0x3 syz-executor
82634 437152 0 0 3 0x14280 nfsidl nfsio
90249 203272 0 0 3 0x14280 nfsidl nfsio
59954 486310 0 0 3 0x14280 nfsidl nfsio
86857 205349 0 0 3 0x14280 nfsidl nfsio
17697 234503 0 0 3 0x14280 nfsidl nfsio
13523 153051 0 0 3 0x14280 nfsidl nfsio
39938 339217 0 0 3 0x14280 nfsidl nfsio
48378 499442 0 0 3 0x14280 nfsidl nfsio
16313 438186 0 0 3 0x14280 nfsidl nfsio
86107 115438 0 0 3 0x14280 nfsidl nfsio
31623 213783 0 0 3 0x14280 nfsidl nfsio
36846 517609 0 0 3 0x14280 nfsidl nfsio
51721 287070 0 0 3 0x14280 nfsidl nfsio
6795 194901 0 0 3 0x14280 nfsidl nfsio
68208 146208 0 0 3 0x14280 nfsidl nfsio
16549 241335 0 0 3 0x14280 nfsidl nfsio
5562 402742 0 0 3 0x14280 nfsidl nfsio
4756 377956 0 0 3 0x14280 nfsidl nfsio
65697 62679 0 0 3 0x14280 nfsidl nfsio
35848 175129 0 0 3 0x14280 nfsidl nfsio
53529 12203 0 0 3 0x14200 bored sosplice
12307 307967 45905 0 2 0x3 syz-executor
14939 266462 45905 0 2 0x2 syz-executor
49009 15465 45905 0 2 0x3 syz-executor
13764 92004 45905 0 2 0x3 syz-executor
53255 355648 45905 0 2 0x2 syz-executor
23619 137346 45905 0 2 0x3 syz-executor
45905 393575 83670 0 3 0x82 kqread syz-executor
83670 142047 20271 0 3 0x10008a sigsusp ksh
20271 515622 2796 0 3 0x98 kqread sshd-session
2796 303526 29749 0 3 0x92 kqread sshd-session
34062 244309 1 0 3 0x100083 ttyopn getty
29749 102162 1 0 3 0x88 kqread sshd
10786 5152 725 73 3 0x1100090 kqread syslogd
725 475552 1 0 3 0x100082 sbwait syslogd
53003 51303 1 0 3 0x100080 kqread resolvd
3471 159326 44472 77 3 0x100092 kqread dhcpleased
73593 269611 44472 77 3 0x100092 kqread dhcpleased
44472 384733 1 0 3 0x80 kqread dhcpleased
4478 320054 0 0 3 0x14200 bored smr
24413 233563 0 0 2 0x14200 zerothread
70427 47250 0 0 3 0x14200 aiodoned aiodoned
74683 73891 0 0 3 0x14200 syncer update
9706 328274 0 0 3 0x14200 cleaner cleaner
94111 377192 0 0 3 0x14200 reaper reaper
50352 78350 0 0 3 0x14200 pgdaemon pagedaemon
26393 507401 0 0 3 0x14200 bored viomb
88953 494117 0 0 3 0x40014200 acpi0 acpi0
89456 176049 0 0 3 0x14200 bored softnet0
39278 491253 0 0 3 0x14200 smrbar systqmp
10880 484834 0 0 3 0x14200 bored systq
30187 330694 0 0 3 0x40014200 tmoslp softclock
84725 56454 0 0 3 0x40014200 idle0
1 428438 0 0 3 0x80082 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11047 12172K 12639K 166960K 13988 0
pcb 17 16K 17K 166960K 372 0
rtable 220 9K 10K 166960K 856 0
pf 30 13K 18K 166960K 179 0
ifaddr 34 6K 8K 166960K 117 0
ifgroup 46 2K 2K 166960K 207 0
sysctl 4 1K 9K 166960K 15 0
counters 31 17K 18K 166960K 108 0
ioctlops 0 0K 4K 166960K 350 0
iov 0 0K 20K 166960K 92 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1416 89K 90K 166960K 2812 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 3 5K 17K 166960K 32 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 0K 166960K 93 0
dirhash 12 2K 3K 166960K 57 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 16 57K 93K 166960K 1652 0
sigio 0 0K 0K 166960K 60 0
proc 60 59K 91K 166960K 663 0
subproc 72 4K 4K 166960K 91 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 335 0
in_multi 73 5K 7K 166960K 194 0
ether_multi 1 0K 0K 166960K 25 0
mrt 1 0K 0K 166960K 27 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 109 493K 493K 166960K 109 0
exec 0 0K 1K 166960K 575 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 4 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 226 143K 165K 166960K 16903 0
UVM aobj 29 4K 4K 166960K 31 0
pinsyscall 37 74K 96K 166960K 2822 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 121 0
NDP 10 0K 2K 166960K 83 0
temp 81 8649K 8716K 166960K 51296 0
kqueue 14 22K 32K 166960K 306 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 179 0 175 1 0 1 1 0 8 0
rtentry 136 295 0 208 4 0 4 4 0 8 0
unpcb 144 1250 0 1233 7 5 2 6 0 8 1
syncache 336 13 0 13 2 1 1 1 0 8 1
tcpqe 32 7 0 7 2 1 1 1 0 8 1
tcpcb 736 703 0 697 13 5 8 8 0 8 7
arp 96 85 0 69 1 0 1 1 0 8 0
ipq 40 5 0 5 1 0 1 1 0 8 1
ipqe 40 7 0 7 1 0 1 1 0 8 1
inpcb 328 1916 0 1904 11 4 7 7 0 8 4
ip6q 72 6 0 6 1 0 1 1 0 8 1
ip6af 40 10 0 10 1 0 1 1 0 8 1
nd6 112 41 0 22 1 0 1 1 0 8 0
pkpcb 40 9 0 9 2 1 1 1 0 8 1
kcovpl 48 10 0 2 1 0 1 1 0 8 0
mppekey 1024 1 0 1 1 1 0 1 0 8 0
ppxss 1072 54 0 54 1 0 1 1 0 8 1
pppxif 1384 10 0 10 2 1 1 1 0 8 1
pfstscr 40 3 0 2 1 0 1 1 0 8 0
pfrktable 1344 6 0 6 2 1 1 1 0 8 1
pfstitem 24 4 0 0 1 0 1 1 0 8 0
pfstkey 128 7 0 3 1 0 1 1 0 8 0
pfstate 384 4 0 2 1 0 1 1 0 8 0
rttmr 136 6 0 6 2 1 1 1 0 8 1
art_heap8 4096 3 0 0 3 0 3 3 0 8 0
art_heap4 256 742 0 337 33 5 28 33 0 8 2
art_table 40 745 0 337 6 0 6 6 0 8 0
art_node 32 290 0 200 2 0 2 2 0 8 0
sysvmsgpl 40 4 0 1 1 0 1 1 0 8 0
semupl 112 3 0 3 1 1 0 1 0 8 0
semapl 112 90 0 80 1 0 1 1 0 8 0
shmpl 112 28 0 2 1 0 1 1 0 8 0
dirhash 1024 49 0 32 3 0 3 3 0 8 0
dino2pl 256 4571 0 3081 95 0 95 95 0 8 0
ffsino 256 4571 0 3081 95 0 95 95 0 8 0
nchpl 144 6923 0 5231 64 0 64 64 0 8 0
rtmask 32 10 0 10 2 1 1 1 0 8 1
vnodes 216 5390 0 0 300 0 300 300 0 8 0
namei 1024 23217 0 23216 4 2 2 2 0 8 1
kstatmem 264 122 0 102 2 0 2 2 0 8 0
scsiplug 72 4 0 4 2 1 1 1 0 8 1
scxspl 216 26389 0 26389 15 7 8 8 1 8 8
plimitpl 152 368 0 351 1 0 1 1 0 8 0
sigapl 424 1989 0 1927 8 0 8 8 0 8 0
knotepl 120 79678 0 79629 44 34 10 24 0 8 5
kqueuepl 184 792 0 782 7 3 4 4 0 8 3
pipepl 304 361 0 334 10 2 8 8 0 8 5
fdescpl 448 1932 0 1904 5 1 4 5 0 8 0
filepl 120 13199 0 12985 23 8 15 17 0 8 8
lockfpl 104 780 0 777 3 1 2 2 0 8 1
lockfspl 48 249 0 246 1 0 1 1 0 8 0
sessionpl 144 31 0 23 1 0 1 1 0 8 0
pgrppl 48 68 0 52 1 0 1 1 0 8 0
ucredpl 104 2527 0 2516 1 0 1 1 0 8 0
zombiepl 144 2449 0 2449 1 0 1 1 0 8 1
processpl 1152 1989 0 1927 5 0 5 5 0 8 0
procpl 664 4487 0 4413 8 0 8 8 0 8 0
sosppl 168 7 0 7 2 1 1 1 0 8 1
sockpl 552 3446 0 3413 17 9 8 13 0 8 5
mcl64k 65536 233 0 233 2 1 1 1 0 8 1
mcl16k 16384 15 0 15 2 1 1 1 0 8 1
mcl12k 12288 5 0 5 2 1 1 1 0 8 1
mcl9k 9216 2 0 2 2 1 1 1 0 8 1
mcl8k 8192 25 0 25 2 1 1 1 0 8 1
mcl4k 4096 4638 0 4582 15 6 9 13 0 8 1
mcl2k 2048 2595 0 2582 6 4 2 6 0 8 0
mtagpl 96 13 0 12 1 0 1 1 0 8 0
mbufpl 256 21218 0 21021 32 8 24 32 0 8 5
bufpl 280 9696 0 3474 445 0 445 445 0 8 0
anonpl 24 303949 0 300353 87 33 54 72 0 187 14
amapchunkpl 152 57093 0 56613 36 9 27 36 0 158 7
amappl16 200 6362 0 6327 48 34 14 28 0 8 8
amappl15 192 5 0 5 1 1 0 1 0 8 0
amappl14 184 64 0 64 1 1 0 1 0 8 0
amappl13 176 433 0 432 1 0 1 1 0 8 0
amappl12 168 2303 0 2266 2 0 2 2 0 8 0
amappl11 160 6 0 6 1 1 0 1 0 8 0
amappl10 152 46 0 36 1 0 1 1 0 8 0
amappl9 144 249 0 249 1 1 0 1 0 8 0
amappl8 136 28 0 26 1 0 1 1 0 8 0
amappl7 128 89 0 87 1 0 1 1 0 8 0
amappl6 120 292 0 280 1 0 1 1 0 8 0
amappl5 112 77 0 68 1 0 1 1 0 8 0
amappl4 104 436 0 410 1 0 1 1 0 8 0
amappl3 96 10111 0 10024 3 0 3 3 0 8 0
amappl2 88 2118 0 2048 2 0 2 2 0 8 0
amappl1 80 17206 0 16667 13 0 13 13 0 8 0
amappl 88 15825 0 15668 5 0 5 5 0 92 1
uvmvnodes 80 5390 0 0 110 0 110 110 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 7 0 7 1 1 0 1 0 8 0
dma128 128 256 0 256 2 1 1 1 0 8 1
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 30 0 2 1 0 1 1 0 8 0
uaddrrnd 24 1932 0 1904 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1932 0 1904 1 0 1 1 0 8 0
vmmpekpl 168 16898 0 16857 3 0 3 3 0 8 0
vmmpepl 168 129048 0 127278 113 17 96 103 0 357 10
vmsppl 368 1931 0 1904 4 1 3 4 0 8 0
rwobjpl 40 40806 0 34532 65 0 65 65 0 8 0
pdppl 4096 3871 0 3808 115 50 65 81 0 8 2
pvpl 32 860931 0 852081 183 59 124 152 0 265 25
pmappl 216 1931 0 1904 3 1 2 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 435 0 89 11 0 11 11 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
spec_getattr(ffff80002a8bec48) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd806c5bbbd0,ffff80002a8becc0,fffffd8007bfb410,ffff80002a8e7790) at VOP_GETATTR+0x7f sys/kern/vfs_vops.c:191
fill_file(ffff800001627800,fffffd806c076878,fffffd806c3bd550,3,0,ffff8000ffffb618,4e6175b70dea45fd,b9d,3) at fill_file+0x5d0 sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a8bf118,4,200000000100,ffff80002a8bf148,ffff80002a8e7790) at sysctl_file+0x144a sys/kern/kern_sysctl.c:1826
kern_sysctl(ffff80002a8bf114,5,200000000100,ffff80002a8bf148,0,37,26b0f1089f90c3a2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80002a8e7790,ffff80002a8bf270,ffff80002a8bf1c0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8bf270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8bf270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79013647bb0, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
spec_getattr(ffff80002a8bec48) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd806c5bbbd0,ffff80002a8becc0,fffffd8007bfb410,ffff80002a8e7790) at VOP_GETATTR+0x7f sys/kern/vfs_vops.c:191
fill_file(ffff800001627800,fffffd806c076878,fffffd806c3bd550,3,0,ffff8000ffffb618,4e6175b70dea45fd,b9d,3) at fill_file+0x5d0 sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a8bf118,4,200000000100,ffff80002a8bf148,ffff80002a8e7790) at sysctl_file+0x144a sys/kern/kern_sysctl.c:1826
kern_sysctl(ffff80002a8bf114,5,200000000100,ffff80002a8bf148,0,37,26b0f1089f90c3a2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80002a8e7790,ffff80002a8bf270,ffff80002a8bf1c0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8bf270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8bf270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79013647bb0, count: -8
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages