uvm_fault: rtable_l2
0 views
Skip to first unread message
syzbot
Jul 14, 2026, 12:48:35 PM (2 days ago) Jul 14
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: ddde2be8d3c6 Increase peer->errcnt when sending out notifi..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=14e468b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=90fd80835bd8f1c44ee3
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c1783aef62f8/disk-ddde2be8.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/0bc5e6c42f0b/bsd-ddde2be8.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5bdc2d2c9ac4/kernel-ddde2be8.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+90fd80...@syzkaller.appspotmail.com
uvm_fault(0xffffffff83a82c40, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at rtable_l2+0x6b: movzbl 0(%rax,%rcx,4),%eax
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 35520 2546 0 0x14000 0x200 0 softnet0
rtable_l2(0) at rtable_l2+0x6b sys/net/rtable.c:315
in_pcblookup_lock(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0,398f9b8ed56e5694) at in_pcblookup_lock+0x59 sys/netinet/in_pcb.c:-1
in_pcblookup(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0) at in_pcblookup+0x68 sys/netinet/in_pcb.c:1238
tcp_input_solocked(ffff80002a70baa0,ffff80002a70baac,0,2,ffff80002a70ba98) at tcp_input_solocked+0xc20 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839b1150,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff8000002a3058,ffff80002a70bb88,0) at if_input_process+0x536 sys/net/if.c:1086
ifiq_process(ffff8000002a3490) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83a82c40, 0x0, 0, 1) -> e
ddb> show kasan
No such command
ddb> trace
rtable_l2(0) at rtable_l2+0x6b sys/net/rtable.c:315
in_pcblookup_lock(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0,398f9b8ed56e5694) at in_pcblookup_lock+0x59 sys/netinet/in_pcb.c:-1
in_pcblookup(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0) at in_pcblookup+0x68 sys/netinet/in_pcb.c:1238
tcp_input_solocked(ffff80002a70baa0,ffff80002a70baac,0,2,ffff80002a70ba98) at tcp_input_solocked+0xc20 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839b1150,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff8000002a3058,ffff80002a70bb88,0) at if_input_process+0x536 sys/net/if.c:1086
ifiq_process(ffff8000002a3490) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -8
ddb> show registers
rdi 0x4
rsi 0
rbp 0xffff80002a70b760
rbx 0xeb0f800a
rdx 0
rcx 0
rax 0
r8 0x493b __ALIGN_SIZE+0x393b
r9 0
r10 0x9350148877104eb6
r11 0xacaf97d102318575
r12 0xffff800000c57a40
r13 0x3075 __ALIGN_SIZE+0x2075
r14 0
r15 0x4
rip 0xffffffff8335194b rtable_l2+0x6b
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff80002a70b730
ss 0
rtable_l2+0x6b: movzbl 0(%rax,%rcx,4),%eax
ddb> show proc
PROC (softnet0) tid=35520 pid=2546 tcnt=1 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
runpri=32, usrpri=50, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a6ec000,0xffff80002a6ec540
process=0xffff800045ffc000 user=0xffff80002a706000, vmspace=0xffffffff83a82c40
estcpu=0, cpticks=4, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
83506 386335 87737 0 2 0 syz-executor
83506 6681 87737 0 3 0x4000080 fsleep syz-executor
24426 215583 53503 60929 2 0x10 syz-executor
24426 70882 53503 60929 3 0x4000090 fsleep syz-executor
43227 112921 94086 0 2 0 syz-executor
43227 78417 94086 0 3 0x4000080 fsleep syz-executor
46826 79235 46 -1 3 0x90 nanoslp syz-executor
46826 118221 46 -1 3 0x4000010 smrbar syz-executor
46826 356639 46 -1 3 0x4000090 fsleep syz-executor
5794 326166 48151 0 3 0x80 nanoslp syz-executor
5794 19315 48151 0 3 0x4000080 kqsel syz-executor
5794 329535 48151 0 3 0x4000080 fsleep syz-executor
50221 53938 0 0 3 0x14280 nfsidl nfsio
33303 50861 0 0 3 0x14280 nfsidl nfsio
96995 136069 0 0 3 0x14280 nfsidl nfsio
28575 234401 0 0 3 0x14280 nfsidl nfsio
26789 481705 0 0 3 0x14280 nfsidl nfsio
33197 495227 0 0 3 0x14280 nfsidl nfsio
21078 41900 0 0 3 0x14280 nfsidl nfsio
41358 73899 0 0 3 0x14280 nfsidl nfsio
76746 455181 0 0 3 0x14280 nfsidl nfsio
56061 373085 0 0 3 0x14280 nfsidl nfsio
64737 100449 0 0 3 0x14280 nfsidl nfsio
49278 134377 0 0 3 0x14280 nfsidl nfsio
1924 154297 0 0 3 0x14280 nfsidl nfsio
62303 231385 0 0 3 0x14280 nfsidl nfsio
66644 67391 0 0 3 0x14280 nfsidl nfsio
98064 143964 0 0 3 0x14280 nfsidl nfsio
28343 478202 0 0 3 0x14280 nfsidl nfsio
22099 179801 0 0 3 0x14280 nfsidl nfsio
12480 516776 0 0 3 0x14280 nfsidl nfsio
92189 418118 0 0 3 0x14280 nfsidl nfsio
83838 522265 96878 0 3 0x82 wait syz-executor
94086 324310 96878 0 2 0xc82 syz-executor
48151 428851 96878 0 3 0x82 nanoslp syz-executor
53503 490039 96878 0 2 0xc82 syz-executor
87737 406839 96878 0 3 0x82 nanoslp syz-executor
97374 473272 96878 0 3 0x82 nanoslp syz-executor
46 245592 96878 0 3 0x82 nanoslp syz-executor
3772 451908 96878 0 3 0x2 biowait syz-executor
96878 115399 81022 0 3 0x82 kqread syz-executor
81022 296985 76374 0 3 0x10008a sigsusp ksh
76374 11240 9625 0 3 0x98 kqread sshd-session
9625 520526 43026 0 3 0x92 kqread sshd-session
94626 378678 1 0 3 0x100083 ttyin getty
43026 220892 1 0 3 0x88 kqread sshd
75798 45588 16968 73 3 0x1100090 kqread syslogd
16968 431792 1 0 3 0x100082 sbwait syslogd
54404 192290 1 0 3 0x100080 kqread resolvd
9858 353980 67881 77 3 0x100092 kqread dhcpleased
45928 252519 67881 77 3 0x100092 kqread dhcpleased
67881 473403 1 0 3 0x80 kqread dhcpleased
38616 39245 0 0 2 0x14200 smr
80810 12006 0 0 2 0x14200 zerothread
73409 495430 0 0 3 0x14200 aiodoned aiodoned
12356 37504 0 0 3 0x14200 syncer update
16935 62914 0 0 3 0x14200 cleaner cleaner
95874 382066 0 0 3 0x14200 reaper reaper
45530 61786 0 0 3 0x14200 pgdaemon pagedaemon
67286 434547 0 0 3 0x14200 bored viomb
68838 325763 0 0 3 0x40014200 acpi0 acpi0
* 2546 35520 0 0 7 0x14200 softnet0
53396 78839 0 0 3 0x14200 bored systqmp
31497 147598 0 0 3 0x14200 bored systq
17126 491150 0 0 3 0x40014200 tmoslp softclock
36080 239394 0 0 3 0x40014200 idle0
1 330877 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11073 12126K 12382K 166960K 12410 0
pcb 18 12K 12K 166960K 54 0
rtable 241 9K 10K 166960K 401 0
pf 32 13K 17K 166960K 70 0
ifaddr 40 7K 7K 166960K 61 0
ifgroup 48 2K 2K 166960K 87 0
sysctl 3 1K 9K 166960K 8 0
counters 34 17K 18K 166960K 53 0
ioctlops 0 0K 4K 166960K 96 0
iov 0 0K 16K 166960K 78 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1305 82K 82K 166960K 1571 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 9K 166960K 10 0
VM map 2 1K 1K 166960K 2 0
sem 8 0K 0K 166960K 10 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 17 61K 89K 166960K 357 0
sigio 0 0K 0K 166960K 6 0
proc 60 59K 108K 166960K 522 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 2 0K 0K 166960K 25 0
in_multi 88 6K 7K 166960K 113 0
ether_multi 1 0K 0K 166960K 2 0
mrt 0 0K 0K 166960K 10 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 253 1129K 1129K 166960K 253 0
exec 0 0K 1K 166960K 391 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 222 151K 165K 166960K 4835 0
UVM aobj 44 2K 2K 166960K 45 0
pinsyscall 38 76K 92K 166960K 1457 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 12 0
NDP 11 0K 2K 166960K 39 0
temp 39 9111K 9174K 166960K 16624 0
kqueue 17 26K 30K 166960K 70 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 45 0 42 1 0 1 1 0 8 0
rtentry 136 117 0 14 4 0 4 4 0 8 0
unpcb 144 153 0 134 1 0 1 1 0 8 0
syncache 336 6 0 6 1 0 1 1 0 8 1
tcpqe 32 4 0 4 1 0 1 1 0 8 1
tcpcb 736 164 0 156 4 0 4 4 0 8 3
arp 96 19 0 2 1 0 1 1 0 8 0
ipq 40 1 0 0 1 0 1 1 0 8 0
ipqe 40 3 0 2 1 0 1 1 0 8 0
inpcb 328 372 0 358 8 0 8 8 0 8 6
nd6 112 24 0 3 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
ppxss 1072 15 0 13 1 0 1 1 0 8 0
pppxif 1416 2 0 2 1 0 1 1 0 8 1
pfosfp 40 1 0 0 1 0 1 1 0 8 0
pfosfpen 112 1 0 0 1 0 1 1 0 8 0
pfrktable 1344 4 0 1 1 0 1 1 0 8 0
pfanchor 1288 1 0 0 1 0 1 1 0 8 0
pftag 88 4 0 0 1 0 1 1 0 8 0
pfrule 1360 6 0 5 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 493 0 50 29 0 29 29 0 8 1
art_table 40 494 0 50 5 0 5 5 0 8 0
art_node 32 117 0 24 1 0 1 1 0 8 0
semapl 72 8 0 2 1 0 1 1 0 8 0
shmpl 112 42 0 1 2 0 2 2 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 2014 0 555 92 0 92 92 0 8 0
ffsino 256 2014 0 555 92 0 92 92 0 8 0
nchpl 144 2534 0 838 64 0 64 64 0 8 0
rtmask 32 3 0 3 1 0 1 1 0 8 1
vnodes 216 2199 0 0 123 0 123 123 0 8 0
namei 1024 8104 0 8103 2 0 2 2 0 8 1
pfiaddrpl 120 1 0 0 1 0 1 1 0 8 0
acpiwqpl 32 1 0 1 1 0 1 1 1 8 1
kstatmem 264 47 0 24 2 0 2 2 0 8 0
scsiplug 72 3 0 3 1 0 1 1 0 8 1
scxspl 216 7962 0 7961 3 0 3 3 1 8 2
plimitpl 152 87 0 71 1 0 1 1 0 8 0
sigapl 424 672 0 610 8 0 8 8 0 8 0
knotepl 120 11046 0 10742 10 0 10 10 0 8 0
kqueuepl 184 120 0 106 3 0 3 3 0 8 2
pipepl 304 173 0 146 6 0 6 6 0 8 3
fdescpl 448 639 0 610 5 0 5 5 0 8 1
filepl 120 3564 0 3350 10 0 10 10 0 8 1
lockfpl 104 121 0 119 1 0 1 1 0 8 0
lockfspl 48 55 0 53 1 0 1 1 0 8 0
sessionpl 144 43 0 35 1 0 1 1 0 8 0
pgrppl 48 56 0 40 1 0 1 1 0 8 0
ucredpl 104 647 0 634 1 0 1 1 0 8 0
zombiepl 144 612 0 610 1 0 1 1 0 8 0
processpl 1152 672 0 610 5 0 5 5 0 8 0
procpl 664 1007 0 938 8 0 8 8 0 8 1
sockpl 552 574 0 538 9 0 9 9 0 8 6
mcl64k 65536 10 0 10 1 0 1 1 0 8 1
mcl16k 16384 1 0 1 1 0 1 1 0 8 1
mcl8k 8192 5 0 5 1 0 1 1 0 8 1
mcl4k 4096 2814 0 2762 14 0 14 14 0 8 6
mcl2k 2048 278 0 278 1 0 1 1 0 8 1
mextrefs 64 138 0 138 1 0 1 1 0 8 1
mtagpl 96 5 0 4 1 0 1 1 0 8 0
mbufpl 256 6664 0 6509 17 0 17 17 0 8 6
bufpl 272 2694 0 102 173 0 173 173 0 8 0
anonpl 24 119227 0 116041 45 0 45 45 0 187 23
amapchunkpl 152 15019 0 14545 28 0 28 28 0 158 7
amappl16 200 2058 0 2033 14 4 10 14 0 8 8
amappl15 192 7 0 7 1 0 1 1 0 8 1
amappl14 184 411 0 410 1 0 1 1 0 8 0
amappl13 176 118 0 108 1 0 1 1 0 8 0
amappl12 168 877 0 849 2 0 2 2 0 8 0
amappl11 160 93 0 93 1 0 1 1 0 8 1
amappl10 152 59 0 49 1 0 1 1 0 8 0
amappl9 144 270 0 270 1 0 1 1 0 8 1
amappl8 136 93 0 92 1 0 1 1 0 8 0
amappl7 128 142 0 130 1 0 1 1 0 8 0
amappl6 120 149 0 148 1 0 1 1 0 8 0
amappl5 112 91 0 82 1 0 1 1 0 8 0
amappl4 104 261 0 244 1 0 1 1 0 8 0
amappl3 96 2834 0 2723 4 0 4 4 0 8 0
amappl2 88 562 0 507 2 0 2 2 0 8 0
amappl1 80 11043 0 10495 13 0 13 13 0 8 1
amappl 88 4104 0 3946 5 0 5 5 0 92 0
uvmvnodes 80 107 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 3 0 2 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 254 0 254 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 44 0 1 1 0 1 1 0 8 0
uaddrrnd 24 639 0 610 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 639 0 610 1 0 1 1 0 8 0
vmmpekpl 168 7011 0 6976 3 0 3 3 0 8 0
vmmpepl 168 48994 0 47213 91 0 91 91 0 357 11
vmsppl 368 638 0 610 4 0 4 4 0 8 1
rwobjpl 40 16722 0 15727 13 0 13 13 0 8 2
pdppl 4096 1284 0 1220 92 26 66 78 0 8 2
pvpl 32 295188 0 286358 104 0 104 104 0 265 27
pmappl 216 638 0 610 2 0 2 2 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 537 0 26 15 0 15 15 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
rtable_l2(0) at rtable_l2+0x6b sys/net/rtable.c:315
in_pcblookup_lock(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0,398f9b8ed56e5694) at in_pcblookup_lock+0x59 sys/netinet/in_pcb.c:-1
in_pcblookup(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0) at in_pcblookup+0x68 sys/netinet/in_pcb.c:1238
tcp_input_solocked(ffff80002a70baa0,ffff80002a70baac,0,2,ffff80002a70ba98) at tcp_input_solocked+0xc20 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839b1150,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff8000002a3058,ffff80002a70bb88,0) at if_input_process+0x536 sys/net/if.c:1086
ifiq_process(ffff8000002a3490) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
rtable_l2(0) at rtable_l2+0x6b sys/net/rtable.c:315
in_pcblookup_lock(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0,398f9b8ed56e5694) at in_pcblookup_lock+0x59 sys/netinet/in_pcb.c:-1
in_pcblookup(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0) at in_pcblookup+0x68 sys/netinet/in_pcb.c:1238
tcp_input_solocked(ffff80002a70baa0,ffff80002a70baac,0,2,ffff80002a70ba98) at tcp_input_solocked+0xc20 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839b1150,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff8000002a3058,ffff80002a70bb88,0) at if_input_process+0x536 sys/net/if.c:1086
ifiq_process(ffff8000002a3490) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -8
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: ddde2be8d3c6 Increase peer->errcnt when sending out notifi..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=14e468b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=90fd80835bd8f1c44ee3
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c1783aef62f8/disk-ddde2be8.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/0bc5e6c42f0b/bsd-ddde2be8.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5bdc2d2c9ac4/kernel-ddde2be8.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+90fd80...@syzkaller.appspotmail.com
uvm_fault(0xffffffff83a82c40, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at rtable_l2+0x6b: movzbl 0(%rax,%rcx,4),%eax
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 35520 2546 0 0x14000 0x200 0 softnet0
rtable_l2(0) at rtable_l2+0x6b sys/net/rtable.c:315
in_pcblookup_lock(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0,398f9b8ed56e5694) at in_pcblookup_lock+0x59 sys/netinet/in_pcb.c:-1
in_pcblookup(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0) at in_pcblookup+0x68 sys/netinet/in_pcb.c:1238
tcp_input_solocked(ffff80002a70baa0,ffff80002a70baac,0,2,ffff80002a70ba98) at tcp_input_solocked+0xc20 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839b1150,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff8000002a3058,ffff80002a70bb88,0) at if_input_process+0x536 sys/net/if.c:1086
ifiq_process(ffff8000002a3490) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83a82c40, 0x0, 0, 1) -> e
ddb> show kasan
No such command
ddb> trace
rtable_l2(0) at rtable_l2+0x6b sys/net/rtable.c:315
in_pcblookup_lock(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0,398f9b8ed56e5694) at in_pcblookup_lock+0x59 sys/netinet/in_pcb.c:-1
in_pcblookup(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0) at in_pcblookup+0x68 sys/netinet/in_pcb.c:1238
tcp_input_solocked(ffff80002a70baa0,ffff80002a70baac,0,2,ffff80002a70ba98) at tcp_input_solocked+0xc20 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839b1150,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff8000002a3058,ffff80002a70bb88,0) at if_input_process+0x536 sys/net/if.c:1086
ifiq_process(ffff8000002a3490) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -8
ddb> show registers
rdi 0x4
rsi 0
rbp 0xffff80002a70b760
rbx 0xeb0f800a
rdx 0
rcx 0
rax 0
r8 0x493b __ALIGN_SIZE+0x393b
r9 0
r10 0x9350148877104eb6
r11 0xacaf97d102318575
r12 0xffff800000c57a40
r13 0x3075 __ALIGN_SIZE+0x2075
r14 0
r15 0x4
rip 0xffffffff8335194b rtable_l2+0x6b
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff80002a70b730
ss 0
rtable_l2+0x6b: movzbl 0(%rax,%rcx,4),%eax
ddb> show proc
PROC (softnet0) tid=35520 pid=2546 tcnt=1 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
runpri=32, usrpri=50, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a6ec000,0xffff80002a6ec540
process=0xffff800045ffc000 user=0xffff80002a706000, vmspace=0xffffffff83a82c40
estcpu=0, cpticks=4, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
83506 386335 87737 0 2 0 syz-executor
83506 6681 87737 0 3 0x4000080 fsleep syz-executor
24426 215583 53503 60929 2 0x10 syz-executor
24426 70882 53503 60929 3 0x4000090 fsleep syz-executor
43227 112921 94086 0 2 0 syz-executor
43227 78417 94086 0 3 0x4000080 fsleep syz-executor
46826 79235 46 -1 3 0x90 nanoslp syz-executor
46826 118221 46 -1 3 0x4000010 smrbar syz-executor
46826 356639 46 -1 3 0x4000090 fsleep syz-executor
5794 326166 48151 0 3 0x80 nanoslp syz-executor
5794 19315 48151 0 3 0x4000080 kqsel syz-executor
5794 329535 48151 0 3 0x4000080 fsleep syz-executor
50221 53938 0 0 3 0x14280 nfsidl nfsio
33303 50861 0 0 3 0x14280 nfsidl nfsio
96995 136069 0 0 3 0x14280 nfsidl nfsio
28575 234401 0 0 3 0x14280 nfsidl nfsio
26789 481705 0 0 3 0x14280 nfsidl nfsio
33197 495227 0 0 3 0x14280 nfsidl nfsio
21078 41900 0 0 3 0x14280 nfsidl nfsio
41358 73899 0 0 3 0x14280 nfsidl nfsio
76746 455181 0 0 3 0x14280 nfsidl nfsio
56061 373085 0 0 3 0x14280 nfsidl nfsio
64737 100449 0 0 3 0x14280 nfsidl nfsio
49278 134377 0 0 3 0x14280 nfsidl nfsio
1924 154297 0 0 3 0x14280 nfsidl nfsio
62303 231385 0 0 3 0x14280 nfsidl nfsio
66644 67391 0 0 3 0x14280 nfsidl nfsio
98064 143964 0 0 3 0x14280 nfsidl nfsio
28343 478202 0 0 3 0x14280 nfsidl nfsio
22099 179801 0 0 3 0x14280 nfsidl nfsio
12480 516776 0 0 3 0x14280 nfsidl nfsio
92189 418118 0 0 3 0x14280 nfsidl nfsio
83838 522265 96878 0 3 0x82 wait syz-executor
94086 324310 96878 0 2 0xc82 syz-executor
48151 428851 96878 0 3 0x82 nanoslp syz-executor
53503 490039 96878 0 2 0xc82 syz-executor
87737 406839 96878 0 3 0x82 nanoslp syz-executor
97374 473272 96878 0 3 0x82 nanoslp syz-executor
46 245592 96878 0 3 0x82 nanoslp syz-executor
3772 451908 96878 0 3 0x2 biowait syz-executor
96878 115399 81022 0 3 0x82 kqread syz-executor
81022 296985 76374 0 3 0x10008a sigsusp ksh
76374 11240 9625 0 3 0x98 kqread sshd-session
9625 520526 43026 0 3 0x92 kqread sshd-session
94626 378678 1 0 3 0x100083 ttyin getty
43026 220892 1 0 3 0x88 kqread sshd
75798 45588 16968 73 3 0x1100090 kqread syslogd
16968 431792 1 0 3 0x100082 sbwait syslogd
54404 192290 1 0 3 0x100080 kqread resolvd
9858 353980 67881 77 3 0x100092 kqread dhcpleased
45928 252519 67881 77 3 0x100092 kqread dhcpleased
67881 473403 1 0 3 0x80 kqread dhcpleased
38616 39245 0 0 2 0x14200 smr
80810 12006 0 0 2 0x14200 zerothread
73409 495430 0 0 3 0x14200 aiodoned aiodoned
12356 37504 0 0 3 0x14200 syncer update
16935 62914 0 0 3 0x14200 cleaner cleaner
95874 382066 0 0 3 0x14200 reaper reaper
45530 61786 0 0 3 0x14200 pgdaemon pagedaemon
67286 434547 0 0 3 0x14200 bored viomb
68838 325763 0 0 3 0x40014200 acpi0 acpi0
* 2546 35520 0 0 7 0x14200 softnet0
53396 78839 0 0 3 0x14200 bored systqmp
31497 147598 0 0 3 0x14200 bored systq
17126 491150 0 0 3 0x40014200 tmoslp softclock
36080 239394 0 0 3 0x40014200 idle0
1 330877 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11073 12126K 12382K 166960K 12410 0
pcb 18 12K 12K 166960K 54 0
rtable 241 9K 10K 166960K 401 0
pf 32 13K 17K 166960K 70 0
ifaddr 40 7K 7K 166960K 61 0
ifgroup 48 2K 2K 166960K 87 0
sysctl 3 1K 9K 166960K 8 0
counters 34 17K 18K 166960K 53 0
ioctlops 0 0K 4K 166960K 96 0
iov 0 0K 16K 166960K 78 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1305 82K 82K 166960K 1571 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 9K 166960K 10 0
VM map 2 1K 1K 166960K 2 0
sem 8 0K 0K 166960K 10 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 17 61K 89K 166960K 357 0
sigio 0 0K 0K 166960K 6 0
proc 60 59K 108K 166960K 522 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 2 0K 0K 166960K 25 0
in_multi 88 6K 7K 166960K 113 0
ether_multi 1 0K 0K 166960K 2 0
mrt 0 0K 0K 166960K 10 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 253 1129K 1129K 166960K 253 0
exec 0 0K 1K 166960K 391 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 222 151K 165K 166960K 4835 0
UVM aobj 44 2K 2K 166960K 45 0
pinsyscall 38 76K 92K 166960K 1457 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 12 0
NDP 11 0K 2K 166960K 39 0
temp 39 9111K 9174K 166960K 16624 0
kqueue 17 26K 30K 166960K 70 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 45 0 42 1 0 1 1 0 8 0
rtentry 136 117 0 14 4 0 4 4 0 8 0
unpcb 144 153 0 134 1 0 1 1 0 8 0
syncache 336 6 0 6 1 0 1 1 0 8 1
tcpqe 32 4 0 4 1 0 1 1 0 8 1
tcpcb 736 164 0 156 4 0 4 4 0 8 3
arp 96 19 0 2 1 0 1 1 0 8 0
ipq 40 1 0 0 1 0 1 1 0 8 0
ipqe 40 3 0 2 1 0 1 1 0 8 0
inpcb 328 372 0 358 8 0 8 8 0 8 6
nd6 112 24 0 3 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
ppxss 1072 15 0 13 1 0 1 1 0 8 0
pppxif 1416 2 0 2 1 0 1 1 0 8 1
pfosfp 40 1 0 0 1 0 1 1 0 8 0
pfosfpen 112 1 0 0 1 0 1 1 0 8 0
pfrktable 1344 4 0 1 1 0 1 1 0 8 0
pfanchor 1288 1 0 0 1 0 1 1 0 8 0
pftag 88 4 0 0 1 0 1 1 0 8 0
pfrule 1360 6 0 5 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 493 0 50 29 0 29 29 0 8 1
art_table 40 494 0 50 5 0 5 5 0 8 0
art_node 32 117 0 24 1 0 1 1 0 8 0
semapl 72 8 0 2 1 0 1 1 0 8 0
shmpl 112 42 0 1 2 0 2 2 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 2014 0 555 92 0 92 92 0 8 0
ffsino 256 2014 0 555 92 0 92 92 0 8 0
nchpl 144 2534 0 838 64 0 64 64 0 8 0
rtmask 32 3 0 3 1 0 1 1 0 8 1
vnodes 216 2199 0 0 123 0 123 123 0 8 0
namei 1024 8104 0 8103 2 0 2 2 0 8 1
pfiaddrpl 120 1 0 0 1 0 1 1 0 8 0
acpiwqpl 32 1 0 1 1 0 1 1 1 8 1
kstatmem 264 47 0 24 2 0 2 2 0 8 0
scsiplug 72 3 0 3 1 0 1 1 0 8 1
scxspl 216 7962 0 7961 3 0 3 3 1 8 2
plimitpl 152 87 0 71 1 0 1 1 0 8 0
sigapl 424 672 0 610 8 0 8 8 0 8 0
knotepl 120 11046 0 10742 10 0 10 10 0 8 0
kqueuepl 184 120 0 106 3 0 3 3 0 8 2
pipepl 304 173 0 146 6 0 6 6 0 8 3
fdescpl 448 639 0 610 5 0 5 5 0 8 1
filepl 120 3564 0 3350 10 0 10 10 0 8 1
lockfpl 104 121 0 119 1 0 1 1 0 8 0
lockfspl 48 55 0 53 1 0 1 1 0 8 0
sessionpl 144 43 0 35 1 0 1 1 0 8 0
pgrppl 48 56 0 40 1 0 1 1 0 8 0
ucredpl 104 647 0 634 1 0 1 1 0 8 0
zombiepl 144 612 0 610 1 0 1 1 0 8 0
processpl 1152 672 0 610 5 0 5 5 0 8 0
procpl 664 1007 0 938 8 0 8 8 0 8 1
sockpl 552 574 0 538 9 0 9 9 0 8 6
mcl64k 65536 10 0 10 1 0 1 1 0 8 1
mcl16k 16384 1 0 1 1 0 1 1 0 8 1
mcl8k 8192 5 0 5 1 0 1 1 0 8 1
mcl4k 4096 2814 0 2762 14 0 14 14 0 8 6
mcl2k 2048 278 0 278 1 0 1 1 0 8 1
mextrefs 64 138 0 138 1 0 1 1 0 8 1
mtagpl 96 5 0 4 1 0 1 1 0 8 0
mbufpl 256 6664 0 6509 17 0 17 17 0 8 6
bufpl 272 2694 0 102 173 0 173 173 0 8 0
anonpl 24 119227 0 116041 45 0 45 45 0 187 23
amapchunkpl 152 15019 0 14545 28 0 28 28 0 158 7
amappl16 200 2058 0 2033 14 4 10 14 0 8 8
amappl15 192 7 0 7 1 0 1 1 0 8 1
amappl14 184 411 0 410 1 0 1 1 0 8 0
amappl13 176 118 0 108 1 0 1 1 0 8 0
amappl12 168 877 0 849 2 0 2 2 0 8 0
amappl11 160 93 0 93 1 0 1 1 0 8 1
amappl10 152 59 0 49 1 0 1 1 0 8 0
amappl9 144 270 0 270 1 0 1 1 0 8 1
amappl8 136 93 0 92 1 0 1 1 0 8 0
amappl7 128 142 0 130 1 0 1 1 0 8 0
amappl6 120 149 0 148 1 0 1 1 0 8 0
amappl5 112 91 0 82 1 0 1 1 0 8 0
amappl4 104 261 0 244 1 0 1 1 0 8 0
amappl3 96 2834 0 2723 4 0 4 4 0 8 0
amappl2 88 562 0 507 2 0 2 2 0 8 0
amappl1 80 11043 0 10495 13 0 13 13 0 8 1
amappl 88 4104 0 3946 5 0 5 5 0 92 0
uvmvnodes 80 107 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 3 0 2 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 254 0 254 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 44 0 1 1 0 1 1 0 8 0
uaddrrnd 24 639 0 610 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 639 0 610 1 0 1 1 0 8 0
vmmpekpl 168 7011 0 6976 3 0 3 3 0 8 0
vmmpepl 168 48994 0 47213 91 0 91 91 0 357 11
vmsppl 368 638 0 610 4 0 4 4 0 8 1
rwobjpl 40 16722 0 15727 13 0 13 13 0 8 2
pdppl 4096 1284 0 1220 92 26 66 78 0 8 2
pvpl 32 295188 0 286358 104 0 104 104 0 265 27
pmappl 216 638 0 610 2 0 2 2 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 537 0 26 15 0 15 15 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
rtable_l2(0) at rtable_l2+0x6b sys/net/rtable.c:315
in_pcblookup_lock(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0,398f9b8ed56e5694) at in_pcblookup_lock+0x59 sys/netinet/in_pcb.c:-1
in_pcblookup(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0) at in_pcblookup+0x68 sys/netinet/in_pcb.c:1238
tcp_input_solocked(ffff80002a70baa0,ffff80002a70baac,0,2,ffff80002a70ba98) at tcp_input_solocked+0xc20 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839b1150,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff8000002a3058,ffff80002a70bb88,0) at if_input_process+0x536 sys/net/if.c:1086
ifiq_process(ffff8000002a3490) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
rtable_l2(0) at rtable_l2+0x6b sys/net/rtable.c:315
in_pcblookup_lock(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0,398f9b8ed56e5694) at in_pcblookup_lock+0x59 sys/netinet/in_pcb.c:-1
in_pcblookup(ffffffff83a82138,eb0f800a,3075,7c00800a,493b,0) at in_pcblookup+0x68 sys/netinet/in_pcb.c:1238
tcp_input_solocked(ffff80002a70baa0,ffff80002a70baac,0,2,ffff80002a70ba98) at tcp_input_solocked+0xc20 sys/netinet/tcp_input.c:-1
tcp_input_mlist(ffffffff839b1150,2) at tcp_input_mlist+0x93 sys/netinet/tcp_input.c:-1
if_input_process(ffff8000002a3058,ffff80002a70bb88,0) at if_input_process+0x536 sys/net/if.c:1086
ifiq_process(ffff8000002a3490) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -8
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages