uvm_fault: ip_freemoptions
2 views
Skip to first unread message
syzbot
Aug 1, 2026, 7:53:40 AMAug 1
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 59ec3ab4d107 Enable 40-bit/48-bit addressing mode if the h..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=14f40db9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=ec01acf6834775886975
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d19ae433978e/disk-59ec3ab4.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/c82eeb44eef0/bsd-59ec3ab4.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1de0b82554dc/kernel-59ec3ab4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec01ac...@syzkaller.appspotmail.com
uvm_fault(0xfffff5007ee325e8, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at ip_freemoptions+0x63: movq 0xfffffffffffffff8(%rax,%r15,8),%rdi
TID PID UID PRFLAGS PFLAGS CPU COMMAND
168629 45384 32767 0x10 0x4000000 1 syz-executor
ip_freemoptions(ffff800000c438e0) at ip_freemoptions+0x63 sys/netinet/ip_output.c:1742
in_pcbdetach(fffff5006fed6a40) at in_pcbdetach+0xec sys/netinet/in_pcb.c:605
udp_detach(ffff80000163a330) at udp_detach+0x5a sys/netinet/udp_usrreq.c:1158
soclose(ffff80000163a330,0) at soclose+0xb0 pru_detach sys/sys/protosw.h:281 [inline]
soclose(ffff80000163a330,0) at soclose+0xb0 sys/kern/uipc_socket.c:403
soo_close(fffff5005e749ba0,ffff800045fe6550) at soo_close+0x56 sys/kern/sys_socket.c:-1
fdrop(fffff5005e749ba0,ffff800045fe6550) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff5005e749ba0,ffff800045fe6550) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045fe6550) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045fe6550,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045fe6550,ffff800038fb8000,ffff800038fb7f50) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800038fb8000) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800038fb8000) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c1b96e57b00, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xfffff5007ee325e8, 0x0, 0, 1) -> e
ddb{0}> show kasan
No such command
ddb{0}> trace
ip_freemoptions(ffff800000c438e0) at ip_freemoptions+0x63 sys/netinet/ip_output.c:1742
in_pcbdetach(fffff5006fed6a40) at in_pcbdetach+0xec sys/netinet/in_pcb.c:605
udp_detach(ffff80000163a330) at udp_detach+0x5a sys/netinet/udp_usrreq.c:1158
soclose(ffff80000163a330,0) at soclose+0xb0 pru_detach sys/sys/protosw.h:281 [inline]
soclose(ffff80000163a330,0) at soclose+0xb0 sys/kern/uipc_socket.c:403
soo_close(fffff5005e749ba0,ffff800045fe6550) at soo_close+0x56 sys/kern/sys_socket.c:-1
fdrop(fffff5005e749ba0,ffff800045fe6550) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff5005e749ba0,ffff800045fe6550) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045fe6550) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045fe6550,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045fe6550,ffff800038fb8000,ffff800038fb7f50) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800038fb8000) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800038fb8000) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c1b96e57b00, count: -12
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800038fb7c60
rbx 0x5
rdx 0
rcx 0xffff800045fe6550
rax 0
r8 0x90
r9 0
r10 0x62fac183913d55c
r11 0xa7c6f2f821eb95f1
r12 0
r13 0
r14 0xffff800000c438e0
r15 0x1
rip 0xffffffff829d9ec3 ip_freemoptions+0x63
cs 0x8
rflags 0x10202 __ALIGN_SIZE+0xf202
rsp 0xffff800038fb7c30
ss 0x10
ip_freemoptions+0x63: movq 0xfffffffffffffff8(%rax,%r15,8),%rdi
ddb{0}> show proc
PROC (syz-executor) tid=181795 pid=7394 tcnt=0 stat=onproc
flags process=1018<EXITING,SUGID,SINGLEEXIT> proc=2000<WEXIT>
runpri=32, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0xffff800045fe6550 scnt=-1 ecnt=1
forw=0xffffffffffffffff, list=0xffff80003c3f5250,0xffff800045fe7258
process=0xffff80003c3cf510 user=0xffff800038fb3000, vmspace=0xfffff5007ee325e8
estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
45384 284656 2546 32767 2 0x10 0 syz-executor
45384 168629 2546 32767 7 0x10 0x4000000 syz-executor
85943 66304 54422 32767 3 0x10 0x80 nanoslp syz-executor
85943 313312 54422 32767 3 0x10 0x4000080 netcon syz-executor
85943 282857 54422 32767 3 0x10 0x4000080 fsleep syz-executor
41042 418784 26182 32767 2 0x10 0xc80 syz-executor
41042 354269 26182 32767 3 0x10 0x4000080 piperd syz-executor
41042 54872 26182 32767 3 0x10 0x4000080 fsleep syz-executor
54422 314434 12562 32767 2 0x10 0xc80 syz-executor
29643 394728 36082 32767 2 0x10 0xc80 syz-executor
92224 475791 32736 32767 2 0x10 0xc80 syz-executor
2546 504687 93586 32767 3 0x10 0x80 nanoslp syz-executor
88258 424372 15726 32767 2 0x10 0xc80 syz-executor
26182 514075 92026 32767 2 0x10 0xc80 syz-executor
87713 244710 50521 32767 3 0x10 0x80 wait syz-executor
50602 63221 98936 32767 3 0x10 0x80 wait syz-executor
93586 385537 53310 0 3 0x2 0x80 wait syz-executor
12562 101916 53310 0 3 0x2 0x80 wait syz-executor
15726 77629 53310 0 3 0x2 0x80 wait syz-executor
32736 389677 53310 0 3 0x2 0x80 wait syz-executor
36082 54121 53310 0 3 0x2 0x80 wait syz-executor
50521 290895 53310 0 3 0x2 0x80 wait syz-executor
92026 26400 53310 0 3 0x2 0x80 wait syz-executor
98936 200142 53310 0 3 0x2 0x80 wait syz-executor
53310 235263 12919 0 3 0x2 0x80 kqread syz-executor
12919 338946 95802 0 3 0x100002 0x88 sigsusp ksh
95802 300226 69491 0 3 0x10 0x88 kqread sshd-session
69491 445500 35590 0 3 0x12 0x80 kqread sshd-session
52829 190171 1 0 3 0x100003 0x80 ttyin getty
35590 45217 1 0 3 0 0x88 kqread sshd
75818 454210 39779 73 3 0x1100010 0x80 kqread syslogd
39779 338988 1 0 3 0x100002 0x80 sbwait syslogd
2748 154078 1 0 3 0x100000 0x80 kqread resolvd
16544 72352 38259 77 3 0x100012 0x80 kqread dhcpleased
12885 294178 38259 77 3 0x100012 0x80 kqread dhcpleased
38259 249483 1 0 3 0 0x80 kqread dhcpleased
42183 87036 0 0 3 0x14000 0x200 bored smr
41136 412853 0 0 3 0x14000 0x200 pgzero zerothread
55035 51835 0 0 3 0x14000 0x200 aiodoned aiodoned
26466 172106 0 0 3 0x14000 0x200 syncer update
67380 266350 0 0 3 0x14000 0x200 cleaner cleaner
38967 330919 0 0 3 0x14000 0x200 reaper reaper
82745 41887 0 0 3 0x14000 0x200 pgdaemon pagedaemon
1010 441513 0 0 3 0x14000 0x200 bored viomb
10328 311611 0 0 3 0x14000 0x40000200 acpi0 acpi0
98515 387412 0 0 3 0x14000 0x40000200 idle1
54706 207311 0 0 3 0x14000 0x200 bored softnet1
16017 47273 0 0 3 0x14000 0x200 bored softnet0
4972 229344 0 0 3 0x14000 0x200 smrbar systqmp
32461 167256 0 0 3 0x14000 0x200 bored systq
1258 120200 0 0 2 0x14000 0x200 softclockmp
36371 146640 0 0 3 0x14000 0x40000200 tmoslp softclock
10480 7146 0 0 3 0x14000 0x40000200 idle0
1 107918 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 4972 (systqmp) thread 0xffff800045ffecf8 (229344)
shared rwlock systqmp r = 0 (0xffffffff838f5c48)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x12a sys/kern/kern_task.c:442
#2 proc_trampoline+0x10
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11053 12018K 12034K 166960K 12144 0
pcb 17 14K 16K 166960K 19 0
rtable 243 6K 7K 166960K 376 0
pf 31 16K 16K 166960K 31 0
ifaddr 42 7K 7K 166960K 44 0
ifgroup 50 2K 2K 166960K 50 0
sysctl 1 1K 9K 166960K 5 0
counters 70 37K 37K 166960K 70 0
ioctlops 0 0K 4K 166960K 38 0
iov 1 1K 8K 166960K 11 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1287 81K 81K 166960K 1408 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 8 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 16 0
dirhash 12 2K 2K 166960K 18 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 26 97K 121K 166960K 398 0
sigio 0 0K 0K 166960K 5 0
proc 61 115K 147K 166960K 546 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 2 0K 0K 166960K 81 0
in_multi 101 6K 7K 166960K 115 0
ether_multi 1 0K 0K 166960K 5 0
mrt 2 0K 0K 166960K 14 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 79 360K 360K 166960K 79 0
exec 0 0K 1K 166960K 388 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 258 168K 186K 166960K 5286 0
UVM aobj 12 2K 4K 166960K 14 0
pinsyscall 47 94K 110K 166960K 1508 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 6 0
NDP 11 0K 2K 166960K 27 0
temp 47 9121K 9130K 166960K 4323 0
kqueue 13 20K 30K 166960K 94 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 57 0 54 1 0 1 1 0 8 0
rtentry 176 117 0 4 6 0 6 6 0 8 0
unpcb 144 305 0 290 4 0 4 4 0 8 3
syncache 336 7 0 7 1 0 1 1 0 8 1
tcpqe 32 1 0 1 1 0 1 1 0 8 1
tcpcb 736 148 0 142 2 0 2 2 0 8 1
arp 136 19 0 0 1 0 1 1 0 8 0
ipq 40 4 0 1 1 0 1 1 0 8 0
ipqe 40 6 0 3 1 0 1 1 0 8 0
inpcb 328 555 0 541 12 2 10 12 0 8 8
ip6q 72 2 0 0 1 0 1 1 0 8 0
ip6af 40 2 0 0 1 0 1 1 0 8 0
nd6 152 29 0 4 2 0 2 2 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 482 0 12 31 0 31 31 0 8 0
art_table 40 483 0 12 5 0 5 5 0 8 0
art_node 32 117 0 14 1 0 1 1 0 8 0
sysvmsgpl 40 11 0 5 1 0 1 1 0 8 0
semapl 72 12 0 2 1 0 1 1 0 8 0
shmpl 112 11 0 2 1 0 1 1 0 8 0
dirhash 1024 21 0 4 3 0 3 3 0 8 0
dino2pl 256 1967 0 500 92 0 92 92 0 8 0
ffsino 296 1967 0 500 114 0 114 114 0 8 0
nchpl 144 2530 0 838 63 0 63 63 0 8 0
vnodes 216 2048 0 0 114 0 114 114 0 8 0
namei 1024 8185 0 8185 2 0 2 2 0 8 2
percpumem 16 51 0 0 1 0 1 1 0 8 0
kstatmem 264 25 0 0 2 0 2 2 0 8 0
scxspl 216 8469 0 8469 10 2 8 8 1 8 8
plimitpl 152 147 0 122 2 0 2 2 0 8 0
sigapl 424 698 0 644 7 0 7 7 0 8 0
knotepl 120 527 0 0 16 0 16 16 0 8 0
kqueuepl 224 172 0 163 1 0 1 1 0 8 0
pipepl 344 145 0 117 3 0 3 3 0 8 0
fdescpl 528 682 0 644 3 0 3 3 0 8 0
filepl 160 3462 0 3239 16 0 16 16 0 8 5
lockfpl 104 175 0 173 1 0 1 1 0 8 0
lockfspl 48 42 0 40 1 0 1 1 0 8 0
sessionpl 144 106 0 89 1 0 1 1 0 8 0
pgrppl 48 179 0 154 1 0 1 1 0 8 0
ucredpl 104 629 0 610 1 0 1 1 0 8 0
zombiepl 144 649 0 644 1 0 1 1 0 8 0
processpl 1232 698 0 644 5 0 5 5 0 8 0
procpl 664 1114 0 1055 7 0 7 7 0 8 1
sosppl 176 1 0 1 1 0 1 1 0 8 1
sockpl 752 920 0 888 16 4 12 16 0 8 8
mcl64k 65536 6 0 0 1 0 1 1 0 8 0
mcl16k 16384 4 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl9k128 9344 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 129 0 0 17 0 17 17 0 8 0
mcl2k2 2112 1 0 0 1 0 1 1 0 8 0
mcl2k 2048 22 0 0 3 0 3 3 0 8 0
mextrefs 64 21 0 0 1 0 1 1 0 8 0
mtagpl 96 4 0 0 1 0 1 1 0 8 0
mbufpl 256 1362 0 0 86 0 86 86 0 8 0
bufpl 272 2733 0 103 176 0 176 176 0 8 0
anonpl 32 13541 0 0 110 0 110 110 0 247 0
amapchunkpl 152 16885 0 16314 33 0 33 33 0 158 9
amappl16 200 2525 0 2500 31 20 11 27 0 8 8
amappl15 192 2 0 2 1 1 0 1 0 8 0
amappl14 184 405 0 404 1 0 1 1 0 8 0
amappl13 176 137 0 127 1 0 1 1 0 8 0
amappl12 168 920 0 883 2 0 2 2 0 8 0
amappl11 160 5 0 4 1 0 1 1 0 8 0
amappl10 152 57 0 47 1 0 1 1 0 8 0
amappl9 144 274 0 274 1 1 0 1 0 8 0
amappl8 136 97 0 95 1 0 1 1 0 8 0
amappl7 128 141 0 130 1 0 1 1 0 8 0
amappl6 120 145 0 144 1 0 1 1 0 8 0
amappl5 112 96 0 88 1 0 1 1 0 8 0
amappl4 104 271 0 255 1 0 1 1 0 8 0
amappl3 96 3132 0 2998 5 1 4 4 0 8 0
amappl2 88 546 0 491 2 0 2 2 0 8 0
amappl1 80 11586 0 11007 16 0 16 16 0 8 1
amappl 88 4528 0 4335 5 0 5 5 0 92 0
uvmvnodes 80 113 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 13 0 2 1 0 1 1 0 8 0
uaddrrnd 24 683 0 645 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 683 0 645 1 0 1 1 0 8 0
vmmpekpl 168 7373 0 7339 2 0 2 2 0 8 0
vmmpepl 168 52274 0 50158 113 0 113 113 0 357 12
vmsppl 488 682 0 645 7 1 6 6 0 8 0
rwobjpl 80 17854 0 16879 31 1 30 30 0 8 2
pdppl 4096 1373 0 1290 113 26 87 95 0 8 4
pvpl 32 21415 0 0 173 0 173 173 0 265 0
pmappl 256 682 0 645 4 1 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 537 0 29 15 0 15 15 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
ip_freemoptions(ffff800000c438e0) at ip_freemoptions+0x63 sys/netinet/ip_output.c:1742
in_pcbdetach(fffff5006fed6a40) at in_pcbdetach+0xec sys/netinet/in_pcb.c:605
udp_detach(ffff80000163a330) at udp_detach+0x5a sys/netinet/udp_usrreq.c:1158
soclose(ffff80000163a330,0) at soclose+0xb0 pru_detach sys/sys/protosw.h:281 [inline]
soclose(ffff80000163a330,0) at soclose+0xb0 sys/kern/uipc_socket.c:403
soo_close(fffff5005e749ba0,ffff800045fe6550) at soo_close+0x56 sys/kern/sys_socket.c:-1
fdrop(fffff5005e749ba0,ffff800045fe6550) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff5005e749ba0,ffff800045fe6550) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045fe6550) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045fe6550,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045fe6550,ffff800038fb8000,ffff800038fb7f50) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800038fb8000) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800038fb8000) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c1b96e57b00, count: -12
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x27: addq $0x8,%rsp
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839eddc0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff839eddc0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
end trace frame: 0x0, count: 11
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839eddc0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff839eddc0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
end trace frame: 0x0, count: -4
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 59ec3ab4d107 Enable 40-bit/48-bit addressing mode if the h..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=14f40db9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=ec01acf6834775886975
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d19ae433978e/disk-59ec3ab4.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/c82eeb44eef0/bsd-59ec3ab4.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1de0b82554dc/kernel-59ec3ab4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec01ac...@syzkaller.appspotmail.com
uvm_fault(0xfffff5007ee325e8, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at ip_freemoptions+0x63: movq 0xfffffffffffffff8(%rax,%r15,8),%rdi
TID PID UID PRFLAGS PFLAGS CPU COMMAND
168629 45384 32767 0x10 0x4000000 1 syz-executor
ip_freemoptions(ffff800000c438e0) at ip_freemoptions+0x63 sys/netinet/ip_output.c:1742
in_pcbdetach(fffff5006fed6a40) at in_pcbdetach+0xec sys/netinet/in_pcb.c:605
udp_detach(ffff80000163a330) at udp_detach+0x5a sys/netinet/udp_usrreq.c:1158
soclose(ffff80000163a330,0) at soclose+0xb0 pru_detach sys/sys/protosw.h:281 [inline]
soclose(ffff80000163a330,0) at soclose+0xb0 sys/kern/uipc_socket.c:403
soo_close(fffff5005e749ba0,ffff800045fe6550) at soo_close+0x56 sys/kern/sys_socket.c:-1
fdrop(fffff5005e749ba0,ffff800045fe6550) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff5005e749ba0,ffff800045fe6550) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045fe6550) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045fe6550,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045fe6550,ffff800038fb8000,ffff800038fb7f50) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800038fb8000) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800038fb8000) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c1b96e57b00, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xfffff5007ee325e8, 0x0, 0, 1) -> e
ddb{0}> show kasan
No such command
ddb{0}> trace
ip_freemoptions(ffff800000c438e0) at ip_freemoptions+0x63 sys/netinet/ip_output.c:1742
in_pcbdetach(fffff5006fed6a40) at in_pcbdetach+0xec sys/netinet/in_pcb.c:605
udp_detach(ffff80000163a330) at udp_detach+0x5a sys/netinet/udp_usrreq.c:1158
soclose(ffff80000163a330,0) at soclose+0xb0 pru_detach sys/sys/protosw.h:281 [inline]
soclose(ffff80000163a330,0) at soclose+0xb0 sys/kern/uipc_socket.c:403
soo_close(fffff5005e749ba0,ffff800045fe6550) at soo_close+0x56 sys/kern/sys_socket.c:-1
fdrop(fffff5005e749ba0,ffff800045fe6550) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff5005e749ba0,ffff800045fe6550) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045fe6550) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045fe6550,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045fe6550,ffff800038fb8000,ffff800038fb7f50) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800038fb8000) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800038fb8000) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c1b96e57b00, count: -12
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800038fb7c60
rbx 0x5
rdx 0
rcx 0xffff800045fe6550
rax 0
r8 0x90
r9 0
r10 0x62fac183913d55c
r11 0xa7c6f2f821eb95f1
r12 0
r13 0
r14 0xffff800000c438e0
r15 0x1
rip 0xffffffff829d9ec3 ip_freemoptions+0x63
cs 0x8
rflags 0x10202 __ALIGN_SIZE+0xf202
rsp 0xffff800038fb7c30
ss 0x10
ip_freemoptions+0x63: movq 0xfffffffffffffff8(%rax,%r15,8),%rdi
ddb{0}> show proc
PROC (syz-executor) tid=181795 pid=7394 tcnt=0 stat=onproc
flags process=1018<EXITING,SUGID,SINGLEEXIT> proc=2000<WEXIT>
runpri=32, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0xffff800045fe6550 scnt=-1 ecnt=1
forw=0xffffffffffffffff, list=0xffff80003c3f5250,0xffff800045fe7258
process=0xffff80003c3cf510 user=0xffff800038fb3000, vmspace=0xfffff5007ee325e8
estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
45384 284656 2546 32767 2 0x10 0 syz-executor
45384 168629 2546 32767 7 0x10 0x4000000 syz-executor
85943 66304 54422 32767 3 0x10 0x80 nanoslp syz-executor
85943 313312 54422 32767 3 0x10 0x4000080 netcon syz-executor
85943 282857 54422 32767 3 0x10 0x4000080 fsleep syz-executor
41042 418784 26182 32767 2 0x10 0xc80 syz-executor
41042 354269 26182 32767 3 0x10 0x4000080 piperd syz-executor
41042 54872 26182 32767 3 0x10 0x4000080 fsleep syz-executor
54422 314434 12562 32767 2 0x10 0xc80 syz-executor
29643 394728 36082 32767 2 0x10 0xc80 syz-executor
92224 475791 32736 32767 2 0x10 0xc80 syz-executor
2546 504687 93586 32767 3 0x10 0x80 nanoslp syz-executor
88258 424372 15726 32767 2 0x10 0xc80 syz-executor
26182 514075 92026 32767 2 0x10 0xc80 syz-executor
87713 244710 50521 32767 3 0x10 0x80 wait syz-executor
50602 63221 98936 32767 3 0x10 0x80 wait syz-executor
93586 385537 53310 0 3 0x2 0x80 wait syz-executor
12562 101916 53310 0 3 0x2 0x80 wait syz-executor
15726 77629 53310 0 3 0x2 0x80 wait syz-executor
32736 389677 53310 0 3 0x2 0x80 wait syz-executor
36082 54121 53310 0 3 0x2 0x80 wait syz-executor
50521 290895 53310 0 3 0x2 0x80 wait syz-executor
92026 26400 53310 0 3 0x2 0x80 wait syz-executor
98936 200142 53310 0 3 0x2 0x80 wait syz-executor
53310 235263 12919 0 3 0x2 0x80 kqread syz-executor
12919 338946 95802 0 3 0x100002 0x88 sigsusp ksh
95802 300226 69491 0 3 0x10 0x88 kqread sshd-session
69491 445500 35590 0 3 0x12 0x80 kqread sshd-session
52829 190171 1 0 3 0x100003 0x80 ttyin getty
35590 45217 1 0 3 0 0x88 kqread sshd
75818 454210 39779 73 3 0x1100010 0x80 kqread syslogd
39779 338988 1 0 3 0x100002 0x80 sbwait syslogd
2748 154078 1 0 3 0x100000 0x80 kqread resolvd
16544 72352 38259 77 3 0x100012 0x80 kqread dhcpleased
12885 294178 38259 77 3 0x100012 0x80 kqread dhcpleased
38259 249483 1 0 3 0 0x80 kqread dhcpleased
42183 87036 0 0 3 0x14000 0x200 bored smr
41136 412853 0 0 3 0x14000 0x200 pgzero zerothread
55035 51835 0 0 3 0x14000 0x200 aiodoned aiodoned
26466 172106 0 0 3 0x14000 0x200 syncer update
67380 266350 0 0 3 0x14000 0x200 cleaner cleaner
38967 330919 0 0 3 0x14000 0x200 reaper reaper
82745 41887 0 0 3 0x14000 0x200 pgdaemon pagedaemon
1010 441513 0 0 3 0x14000 0x200 bored viomb
10328 311611 0 0 3 0x14000 0x40000200 acpi0 acpi0
98515 387412 0 0 3 0x14000 0x40000200 idle1
54706 207311 0 0 3 0x14000 0x200 bored softnet1
16017 47273 0 0 3 0x14000 0x200 bored softnet0
4972 229344 0 0 3 0x14000 0x200 smrbar systqmp
32461 167256 0 0 3 0x14000 0x200 bored systq
1258 120200 0 0 2 0x14000 0x200 softclockmp
36371 146640 0 0 3 0x14000 0x40000200 tmoslp softclock
10480 7146 0 0 3 0x14000 0x40000200 idle0
1 107918 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 4972 (systqmp) thread 0xffff800045ffecf8 (229344)
shared rwlock systqmp r = 0 (0xffffffff838f5c48)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x12a sys/kern/kern_task.c:442
#2 proc_trampoline+0x10
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11053 12018K 12034K 166960K 12144 0
pcb 17 14K 16K 166960K 19 0
rtable 243 6K 7K 166960K 376 0
pf 31 16K 16K 166960K 31 0
ifaddr 42 7K 7K 166960K 44 0
ifgroup 50 2K 2K 166960K 50 0
sysctl 1 1K 9K 166960K 5 0
counters 70 37K 37K 166960K 70 0
ioctlops 0 0K 4K 166960K 38 0
iov 1 1K 8K 166960K 11 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1287 81K 81K 166960K 1408 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 8 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 16 0
dirhash 12 2K 2K 166960K 18 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 26 97K 121K 166960K 398 0
sigio 0 0K 0K 166960K 5 0
proc 61 115K 147K 166960K 546 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 2 0K 0K 166960K 81 0
in_multi 101 6K 7K 166960K 115 0
ether_multi 1 0K 0K 166960K 5 0
mrt 2 0K 0K 166960K 14 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 79 360K 360K 166960K 79 0
exec 0 0K 1K 166960K 388 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 258 168K 186K 166960K 5286 0
UVM aobj 12 2K 4K 166960K 14 0
pinsyscall 47 94K 110K 166960K 1508 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 6 0
NDP 11 0K 2K 166960K 27 0
temp 47 9121K 9130K 166960K 4323 0
kqueue 13 20K 30K 166960K 94 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 57 0 54 1 0 1 1 0 8 0
rtentry 176 117 0 4 6 0 6 6 0 8 0
unpcb 144 305 0 290 4 0 4 4 0 8 3
syncache 336 7 0 7 1 0 1 1 0 8 1
tcpqe 32 1 0 1 1 0 1 1 0 8 1
tcpcb 736 148 0 142 2 0 2 2 0 8 1
arp 136 19 0 0 1 0 1 1 0 8 0
ipq 40 4 0 1 1 0 1 1 0 8 0
ipqe 40 6 0 3 1 0 1 1 0 8 0
inpcb 328 555 0 541 12 2 10 12 0 8 8
ip6q 72 2 0 0 1 0 1 1 0 8 0
ip6af 40 2 0 0 1 0 1 1 0 8 0
nd6 152 29 0 4 2 0 2 2 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 482 0 12 31 0 31 31 0 8 0
art_table 40 483 0 12 5 0 5 5 0 8 0
art_node 32 117 0 14 1 0 1 1 0 8 0
sysvmsgpl 40 11 0 5 1 0 1 1 0 8 0
semapl 72 12 0 2 1 0 1 1 0 8 0
shmpl 112 11 0 2 1 0 1 1 0 8 0
dirhash 1024 21 0 4 3 0 3 3 0 8 0
dino2pl 256 1967 0 500 92 0 92 92 0 8 0
ffsino 296 1967 0 500 114 0 114 114 0 8 0
nchpl 144 2530 0 838 63 0 63 63 0 8 0
vnodes 216 2048 0 0 114 0 114 114 0 8 0
namei 1024 8185 0 8185 2 0 2 2 0 8 2
percpumem 16 51 0 0 1 0 1 1 0 8 0
kstatmem 264 25 0 0 2 0 2 2 0 8 0
scxspl 216 8469 0 8469 10 2 8 8 1 8 8
plimitpl 152 147 0 122 2 0 2 2 0 8 0
sigapl 424 698 0 644 7 0 7 7 0 8 0
knotepl 120 527 0 0 16 0 16 16 0 8 0
kqueuepl 224 172 0 163 1 0 1 1 0 8 0
pipepl 344 145 0 117 3 0 3 3 0 8 0
fdescpl 528 682 0 644 3 0 3 3 0 8 0
filepl 160 3462 0 3239 16 0 16 16 0 8 5
lockfpl 104 175 0 173 1 0 1 1 0 8 0
lockfspl 48 42 0 40 1 0 1 1 0 8 0
sessionpl 144 106 0 89 1 0 1 1 0 8 0
pgrppl 48 179 0 154 1 0 1 1 0 8 0
ucredpl 104 629 0 610 1 0 1 1 0 8 0
zombiepl 144 649 0 644 1 0 1 1 0 8 0
processpl 1232 698 0 644 5 0 5 5 0 8 0
procpl 664 1114 0 1055 7 0 7 7 0 8 1
sosppl 176 1 0 1 1 0 1 1 0 8 1
sockpl 752 920 0 888 16 4 12 16 0 8 8
mcl64k 65536 6 0 0 1 0 1 1 0 8 0
mcl16k 16384 4 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl9k128 9344 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 129 0 0 17 0 17 17 0 8 0
mcl2k2 2112 1 0 0 1 0 1 1 0 8 0
mcl2k 2048 22 0 0 3 0 3 3 0 8 0
mextrefs 64 21 0 0 1 0 1 1 0 8 0
mtagpl 96 4 0 0 1 0 1 1 0 8 0
mbufpl 256 1362 0 0 86 0 86 86 0 8 0
bufpl 272 2733 0 103 176 0 176 176 0 8 0
anonpl 32 13541 0 0 110 0 110 110 0 247 0
amapchunkpl 152 16885 0 16314 33 0 33 33 0 158 9
amappl16 200 2525 0 2500 31 20 11 27 0 8 8
amappl15 192 2 0 2 1 1 0 1 0 8 0
amappl14 184 405 0 404 1 0 1 1 0 8 0
amappl13 176 137 0 127 1 0 1 1 0 8 0
amappl12 168 920 0 883 2 0 2 2 0 8 0
amappl11 160 5 0 4 1 0 1 1 0 8 0
amappl10 152 57 0 47 1 0 1 1 0 8 0
amappl9 144 274 0 274 1 1 0 1 0 8 0
amappl8 136 97 0 95 1 0 1 1 0 8 0
amappl7 128 141 0 130 1 0 1 1 0 8 0
amappl6 120 145 0 144 1 0 1 1 0 8 0
amappl5 112 96 0 88 1 0 1 1 0 8 0
amappl4 104 271 0 255 1 0 1 1 0 8 0
amappl3 96 3132 0 2998 5 1 4 4 0 8 0
amappl2 88 546 0 491 2 0 2 2 0 8 0
amappl1 80 11586 0 11007 16 0 16 16 0 8 1
amappl 88 4528 0 4335 5 0 5 5 0 92 0
uvmvnodes 80 113 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 13 0 2 1 0 1 1 0 8 0
uaddrrnd 24 683 0 645 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 683 0 645 1 0 1 1 0 8 0
vmmpekpl 168 7373 0 7339 2 0 2 2 0 8 0
vmmpepl 168 52274 0 50158 113 0 113 113 0 357 12
vmsppl 488 682 0 645 7 1 6 6 0 8 0
rwobjpl 80 17854 0 16879 31 1 30 30 0 8 2
pdppl 4096 1373 0 1290 113 26 87 95 0 8 4
pvpl 32 21415 0 0 173 0 173 173 0 265 0
pmappl 256 682 0 645 4 1 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 537 0 29 15 0 15 15 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
ip_freemoptions(ffff800000c438e0) at ip_freemoptions+0x63 sys/netinet/ip_output.c:1742
in_pcbdetach(fffff5006fed6a40) at in_pcbdetach+0xec sys/netinet/in_pcb.c:605
udp_detach(ffff80000163a330) at udp_detach+0x5a sys/netinet/udp_usrreq.c:1158
soclose(ffff80000163a330,0) at soclose+0xb0 pru_detach sys/sys/protosw.h:281 [inline]
soclose(ffff80000163a330,0) at soclose+0xb0 sys/kern/uipc_socket.c:403
soo_close(fffff5005e749ba0,ffff800045fe6550) at soo_close+0x56 sys/kern/sys_socket.c:-1
fdrop(fffff5005e749ba0,ffff800045fe6550) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff5005e749ba0,ffff800045fe6550) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045fe6550) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045fe6550,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045fe6550,ffff800038fb8000,ffff800038fb7f50) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800038fb8000) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800038fb8000) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c1b96e57b00, count: -12
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x27: addq $0x8,%rsp
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839eddc0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff839eddc0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
end trace frame: 0x0, count: 11
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839eddc0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff839eddc0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
end trace frame: 0x0, count: -4
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages