uvm_fault: x86_send_ipi (2)
1 view
Skip to first unread message
syzbot
May 7, 2020, 5:58:17 PM5/7/20
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 30e1cf84 openssh-8.3; ok deraadt@
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15de9770100000
kernel config: https://syzkaller.appspot.com/x/.config?x=bf87b6915a88cd0d
dashboard link: https://syzkaller.appspot.com/bug?extid=fdcaab5b43855e9b9bf2
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fdcaab...@syzkaller.appspotmail.com
uvm_fault(0xfffffd807efff450, 0x648, 0, 2) -> e
kernel: page fault trap, code=0
Stopped at x86_send_ipi+0x24: lock orl %r15d,0x648(%r14)
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xfffffd807efff450, 0x648, 0, 2) -> e
x86_send_ipi(0,2) at x86_send_ipi+0x24 x86_atomic_setbits_u32 machine/atomic.h:292 [inline]
x86_send_ipi(0,2) at x86_send_ipi+0x24 sys/arch/amd64/amd64/ipi.c:48
end trace frame: 0xffff800023fbb780, count: 0
ddb{0}> trace
x86_send_ipi(0,2) at x86_send_ipi+0x24 x86_atomic_setbits_u32 machine/atomic.h:292 [inline]
x86_send_ipi(0,2) at x86_send_ipi+0x24 sys/arch/amd64/amd64/ipi.c:48
vm_intr_pending(ffff800023fbb950) at vm_intr_pending+0x225 sys/arch/amd64/amd64/vmm.c:688
VOP_IOCTL(fffffd806e38ba90,800c5606,ffff800023fbb950,1,fffffd807f7bf960,ffff800020ec69d8) at VOP_IOCTL+0x88 sys/kern/vfs_vops.c:290
vn_ioctl(fffffd80671a2ef0,800c5606,ffff800023fbb950,ffff800020ec69d8) at vn_ioctl+0xba sys/kern/vfs_vnops.c:531
sys_ioctl(ffff800020ec69d8,ffff800023fbba68,ffff800023fbbab0) at sys_ioctl+0x4a5
syscall(ffff800023fbbb30) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800023fbbb30) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x88e7c37ac10, count: -7
ddb{0}> show registers
rdi 0xffffffff8197aec4 x86_send_ipi+0x24
rsi 0x123
rbp 0xffff800023fbb720
rbx 0x1
rdx 0x124
rcx 0xffff80002216c000
rax 0xffff80002216c000
r8 0xffffffff81adf1f7 witness_assert+0x207
r9 0x5
r10 0x6150212045b2f773
r11 0xa1c573f2bdf60eb7
r12 0
r13 0xffff800020e92020
r14 0
r15 0x2
rip 0xffffffff8197aec4 x86_send_ipi+0x24
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff800023fbb6f0
ss 0x10
x86_send_ipi+0x24: lock orl %r15d,0x648(%r14)
ddb{0}> show proc
PROC (syz-executor.0) pid=103348 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=32, usrpri=82, nice=20
forw=0xffffffffffffffff, list=0xffff800020ec6018,0xffff800020ec73a8
process=0xffff800020e92020 user=0xffff800023fb6000, vmspace=0xfffffd807efff450
estcpu=36, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
66961 110210 6267 0 2 0 syz-executor.0
*66961 103348 6267 0 7 0x4000000 syz-executor.0
98394 254466 433 0 7 0 syz-executor.1
98394 157929 433 0 2 0x4000000 syz-executor.1
13081 21138 0 0 3 0x14200 acct acct
36759 328338 0 0 3 0x14200 bored sosplice
6267 515554 95194 0 3 0x82 nanosleep syz-executor.0
84301 499001 1 0 3 0x100083 ttyin getty
433 355658 95194 0 3 0x82 nanosleep syz-executor.1
95194 349543 34812 0 3 0x82 thrsleep syz-fuzzer
95194 346343 34812 0 3 0x4000082 nanosleep syz-fuzzer
95194 152986 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 39072 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 6621 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 494459 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 34096 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 436467 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 212002 34812 0 3 0x4000082 kqread syz-fuzzer
95194 234957 34812 0 3 0x4000082 thrsleep syz-fuzzer
34812 216267 53211 0 3 0x10008a pause ksh
53211 372362 64323 0 3 0x92 select sshd
64323 400351 1 0 3 0x80 select sshd
67950 79210 28757 74 3 0x100092 bpf pflogd
28757 202308 1 0 3 0x80 netio pflogd
99529 18102 42167 73 3 0x100090 kqread syslogd
42167 93116 1 0 3 0x100082 netio syslogd
15575 385899 1 77 3 0x100090 poll dhclient
32266 400730 1 0 3 0x80 poll dhclient
36466 87903 0 0 3 0x14200 bored smr
54552 86295 0 0 2 0x14200 zerothread
42004 98212 0 0 3 0x14200 aiodoned aiodoned
78619 281554 0 0 3 0x14200 syncer update
95450 2586 0 0 3 0x14200 cleaner cleaner
14807 100355 0 0 3 0x14200 reaper reaper
7981 459877 0 0 3 0x14200 pgdaemon pagedaemon
57998 148846 0 0 3 0x14200 bored crynlk
23941 274110 0 0 3 0x14200 bored crypto
50859 236961 0 0 3 0x40014200 acpi0 acpi0
16256 173002 0 0 3 0x40014200 idle1
65202 72688 0 0 3 0x14200 bored softnet
5052 392793 0 0 3 0x14200 bored systqmp
17997 128781 0 0 3 0x14200 bored systq
72158 352108 0 0 3 0x40014200 bored softclock
87275 415480 0 0 3 0x40014200 idle0
1 155855 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 66961 (syz-executor.0) thread 0xffff800020ec69d8 (103348)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff82662e18)
#0 witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0 witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1 vn_ioctl+0x40 sys/kern/vfs_vnops.c:514
#2 sys_ioctl+0x4a5
#3 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#3 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#4 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 9484 6409K 6665K 78643K 10835 0
pcb 13 8K 8K 78643K 31 0
rtable 105 3K 3K 78643K 244 0
ifaddr 49 11K 11K 78643K 60 0
counters 43 33K 33K 78643K 45 0
ioctlops 0 0K 4K 78643K 2598 0
iov 0 0K 32K 78643K 82 0
mount 1 1K 1K 78643K 1 0
vnodes 1218 77K 77K 78643K 1332 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 5K 78643K 40 0
VM map 2 1K 1K 78643K 2 0
sem 12 0K 0K 78643K 355 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1809 196K 290K 78643K 12766 0
file desc 6 17K 25K 78643K 2383 0
proc 62 63K 95K 78643K 527 0
subproc 32 2K 2K 78643K 51 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 9 0
in_multi 33 2K 2K 78643K 49 0
ether_multi 1 0K 0K 78643K 3 0
mrt 0 0K 0K 78643K 2 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 43 201K 201K 78643K 43 0
exec 0 0K 1K 78643K 255 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 7 26K 26K 78643K 7 0
UVM amap 140 40K 40K 78643K 7274 0
UVM aobj 81 3K 3K 78643K 95 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 8 0
NDP 7 0K 0K 78643K 14 0
temp 94 3041K 3105K 78643K 13405 0
kqueue 3 4K 10K 78643K 14 0
SYN cache 2 16K 16K 78643K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 8 0 2 1 0 1 1 0 8 0
plcache 128 20 0 0 1 0 1 1 0 8 0
rtpcb 80 23 0 21 1 0 1 1 0 8 0
rtentry 112 57 0 13 2 0 2 2 0 8 0
unpcb 120 710 0 700 1 0 1 1 0 8 0
syncache 264 9 0 9 3 3 0 1 0 8 0
sackhl 24 1 0 1 1 1 0 1 0 8 0
tcpqe 32 414 0 414 3 3 0 1 0 8 0
tcpcb 544 53 0 48 1 0 1 1 0 8 0
inpcb 280 146 0 138 2 1 1 2 0 8 0
rttmr 72 1 0 1 1 1 0 1 0 8 0
nd6 48 9 0 3 1 0 1 1 0 8 0
pkpcb 40 2 0 2 1 1 0 1 0 8 0
pfosfp 40 846 0 423 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 14 0 7 1 0 1 1 0 8 0
pfstkey 112 14 0 7 1 0 1 1 0 8 0
pfstate 328 14 0 7 2 1 1 2 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 232 0 44 12 0 12 12 0 8 0
art_table 32 233 0 44 2 0 2 2 0 8 0
art_node 16 56 0 16 1 0 1 1 0 8 0
sysvmsgpl 40 6 0 2 1 0 1 1 0 8 0
semapl 112 353 0 343 1 0 1 1 0 8 0
shmpl 112 93 0 15 3 0 3 3 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 3864 0 2456 89 0 89 89 0 8 0
ffsino 272 3864 0 2456 95 0 95 95 0 8 0
nchpl 144 8502 0 6907 60 0 60 60 0 8 0
uvmvnodes 72 3992 0 0 73 0 73 73 0 8 0
vnodes 208 3992 0 0 211 0 211 211 0 8 0
namei 1024 21746 0 21746 1 0 1 1 0 8 1
percpumem 16 33 0 1 1 0 1 1 0 8 0
vcpupl 1984 1 0 0 1 0 1 1 0 8 0
vmpool 560 2 0 1 1 0 1 1 0 8 0
scxspl 192 18867 0 18867 8 7 1 7 0 8 1
plimitpl 152 23 0 15 1 0 1 1 0 8 0
sigapl 424 2598 0 2564 4 0 4 4 0 8 0
futexpl 56 17782 0 17782 1 0 1 1 0 8 1
knotepl 112 91 0 72 1 0 1 1 0 8 0
kqueuepl 144 70 0 68 1 0 1 1 0 8 0
pipelkpl 48 232 0 222 1 0 1 1 0 8 0
pipepl 120 464 0 445 1 0 1 1 0 8 0
fdescpl 496 2581 0 2564 3 0 3 3 0 8 0
filepl 152 11836 0 11735 6 1 5 5 0 8 1
lockfpl 104 147 0 146 1 0 1 1 0 8 0
lockfspl 48 49 0 48 1 0 1 1 0 8 0
sessionpl 112 20 0 9 1 0 1 1 0 8 0
pgrppl 48 34 0 23 1 0 1 1 0 8 0
ucredpl 96 232 0 223 1 0 1 1 0 8 0
zombiepl 144 2564 0 2564 1 0 1 1 0 8 1
processpl 984 2598 0 2564 5 0 5 5 0 8 0
procpl 624 6402 0 6357 4 0 4 4 0 8 0
sosppl 128 15 0 15 1 1 0 1 0 8 0
sockpl 400 881 0 861 5 2 3 4 0 8 0
mcl64k 65536 5 0 0 1 0 1 1 0 8 0
mcl16k 16384 2 0 0 1 0 1 1 0 8 0
mcl12k 12288 11 0 0 2 0 2 2 0 8 0
mcl9k 9216 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 4 0 0 1 0 1 1 0 8 0
mcl4k 4096 14 0 0 2 0 2 2 0 8 0
mcl2k2 2112 3 0 0 1 0 1 1 0 8 0
mcl2k 2048 159 0 0 19 0 19 19 0 8 0
mtagpl 80 9 0 0 1 0 1 1 0 8 0
mbufpl 256 199 0 0 13 1 12 12 0 8 0
bufpl 280 5748 0 133 402 0 402 402 0 8 0
anonpl 16 179074 0 165767 57 1 56 56 0 124 0
amapchunkpl 152 11246 0 11108 8 1 7 8 0 158 0
amappl16 192 10645 0 9906 40 2 38 39 0 8 1
amappl15 184 10 0 8 1 0 1 1 0 8 0
amappl14 176 1130 0 1122 1 0 1 1 0 8 0
amappl13 168 40 0 38 1 0 1 1 0 8 0
amappl12 160 8 0 5 1 0 1 1 0 8 0
amappl11 152 59 0 44 1 0 1 1 0 8 0
amappl10 144 1223 0 1216 1 0 1 1 0 8 0
amappl9 136 418 0 416 1 0 1 1 0 8 0
amappl8 128 445 0 395 2 0 2 2 0 8 0
amappl7 120 1328 0 1314 1 0 1 1 0 8 0
amappl6 112 23 0 19 2 1 1 1 0 8 0
amappl5 104 2492 0 2474 1 0 1 1 0 8 0
amappl4 96 517 0 488 1 0 1 1 0 8 0
amappl3 88 1237 0 1230 1 0 1 1 0 8 0
amappl2 80 19638 0 19562 2 0 2 2 0 8 0
amappl1 72 56133 0 55693 24 14 10 18 0 8 0
amappl 80 6704 0 6658 2 0 2 2 0 84 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 64 94 0 14 2 0 2 2 0 8 0
uaddrrnd 24 2583 0 2565 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 2583 0 2565 1 0 1 1 0 8 0
vmmpekpl 168 18737 0 18705 2 0 2 2 0 8 0
vmmpepl 168 300593 0 298590 110 21 89 103 0 357 1
vmsppl 368 2582 0 2565 2 0 2 2 0 8 0
pdppl 4096 5174 0 5131 6 0 6 6 0 8 0
pvpl 32 531721 0 515170 144 3 141 142 0 265 2
pmappl 232 2582 0 2565 2 0 2 2 0 8 1
extentpl 40 46 0 29 1 0 1 1 0 8 0
phpool 112 260 0 6 8 0 8 8 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
x86_send_ipi(0,2) at x86_send_ipi+0x24 x86_atomic_setbits_u32 machine/atomic.h:292 [inline]
x86_send_ipi(0,2) at x86_send_ipi+0x24 sys/arch/amd64/amd64/ipi.c:48
vm_intr_pending(ffff800023fbb950) at vm_intr_pending+0x225 sys/arch/amd64/amd64/vmm.c:688
VOP_IOCTL(fffffd806e38ba90,800c5606,ffff800023fbb950,1,fffffd807f7bf960,ffff800020ec69d8) at VOP_IOCTL+0x88 sys/kern/vfs_vops.c:290
vn_ioctl(fffffd80671a2ef0,800c5606,ffff800023fbb950,ffff800020ec69d8) at vn_ioctl+0xba sys/kern/vfs_vnops.c:531
sys_ioctl(ffff800020ec69d8,ffff800023fbba68,ffff800023fbbab0) at sys_ioctl+0x4a5
syscall(ffff800023fbbb30) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800023fbbb30) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x88e7c37ac10, count: -7
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x1a: addq $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff800020e00ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x57 sys/dev/kcov.c:103
syscall(ffff800023faf8f0) at syscall+0x55f mi_syscall_return sys/sys/syscall_mi.h:129 [inline]
syscall(ffff800023faf8f0) at syscall+0x55f sys/arch/amd64/amd64/trap.c:592
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe8a70, count: -6
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 30e1cf84 openssh-8.3; ok deraadt@
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15de9770100000
kernel config: https://syzkaller.appspot.com/x/.config?x=bf87b6915a88cd0d
dashboard link: https://syzkaller.appspot.com/bug?extid=fdcaab5b43855e9b9bf2
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fdcaab...@syzkaller.appspotmail.com
uvm_fault(0xfffffd807efff450, 0x648, 0, 2) -> e
kernel: page fault trap, code=0
Stopped at x86_send_ipi+0x24: lock orl %r15d,0x648(%r14)
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xfffffd807efff450, 0x648, 0, 2) -> e
x86_send_ipi(0,2) at x86_send_ipi+0x24 x86_atomic_setbits_u32 machine/atomic.h:292 [inline]
x86_send_ipi(0,2) at x86_send_ipi+0x24 sys/arch/amd64/amd64/ipi.c:48
end trace frame: 0xffff800023fbb780, count: 0
ddb{0}> trace
x86_send_ipi(0,2) at x86_send_ipi+0x24 x86_atomic_setbits_u32 machine/atomic.h:292 [inline]
x86_send_ipi(0,2) at x86_send_ipi+0x24 sys/arch/amd64/amd64/ipi.c:48
vm_intr_pending(ffff800023fbb950) at vm_intr_pending+0x225 sys/arch/amd64/amd64/vmm.c:688
VOP_IOCTL(fffffd806e38ba90,800c5606,ffff800023fbb950,1,fffffd807f7bf960,ffff800020ec69d8) at VOP_IOCTL+0x88 sys/kern/vfs_vops.c:290
vn_ioctl(fffffd80671a2ef0,800c5606,ffff800023fbb950,ffff800020ec69d8) at vn_ioctl+0xba sys/kern/vfs_vnops.c:531
sys_ioctl(ffff800020ec69d8,ffff800023fbba68,ffff800023fbbab0) at sys_ioctl+0x4a5
syscall(ffff800023fbbb30) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800023fbbb30) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x88e7c37ac10, count: -7
ddb{0}> show registers
rdi 0xffffffff8197aec4 x86_send_ipi+0x24
rsi 0x123
rbp 0xffff800023fbb720
rbx 0x1
rdx 0x124
rcx 0xffff80002216c000
rax 0xffff80002216c000
r8 0xffffffff81adf1f7 witness_assert+0x207
r9 0x5
r10 0x6150212045b2f773
r11 0xa1c573f2bdf60eb7
r12 0
r13 0xffff800020e92020
r14 0
r15 0x2
rip 0xffffffff8197aec4 x86_send_ipi+0x24
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff800023fbb6f0
ss 0x10
x86_send_ipi+0x24: lock orl %r15d,0x648(%r14)
ddb{0}> show proc
PROC (syz-executor.0) pid=103348 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=32, usrpri=82, nice=20
forw=0xffffffffffffffff, list=0xffff800020ec6018,0xffff800020ec73a8
process=0xffff800020e92020 user=0xffff800023fb6000, vmspace=0xfffffd807efff450
estcpu=36, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
66961 110210 6267 0 2 0 syz-executor.0
*66961 103348 6267 0 7 0x4000000 syz-executor.0
98394 254466 433 0 7 0 syz-executor.1
98394 157929 433 0 2 0x4000000 syz-executor.1
13081 21138 0 0 3 0x14200 acct acct
36759 328338 0 0 3 0x14200 bored sosplice
6267 515554 95194 0 3 0x82 nanosleep syz-executor.0
84301 499001 1 0 3 0x100083 ttyin getty
433 355658 95194 0 3 0x82 nanosleep syz-executor.1
95194 349543 34812 0 3 0x82 thrsleep syz-fuzzer
95194 346343 34812 0 3 0x4000082 nanosleep syz-fuzzer
95194 152986 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 39072 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 6621 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 494459 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 34096 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 436467 34812 0 3 0x4000082 thrsleep syz-fuzzer
95194 212002 34812 0 3 0x4000082 kqread syz-fuzzer
95194 234957 34812 0 3 0x4000082 thrsleep syz-fuzzer
34812 216267 53211 0 3 0x10008a pause ksh
53211 372362 64323 0 3 0x92 select sshd
64323 400351 1 0 3 0x80 select sshd
67950 79210 28757 74 3 0x100092 bpf pflogd
28757 202308 1 0 3 0x80 netio pflogd
99529 18102 42167 73 3 0x100090 kqread syslogd
42167 93116 1 0 3 0x100082 netio syslogd
15575 385899 1 77 3 0x100090 poll dhclient
32266 400730 1 0 3 0x80 poll dhclient
36466 87903 0 0 3 0x14200 bored smr
54552 86295 0 0 2 0x14200 zerothread
42004 98212 0 0 3 0x14200 aiodoned aiodoned
78619 281554 0 0 3 0x14200 syncer update
95450 2586 0 0 3 0x14200 cleaner cleaner
14807 100355 0 0 3 0x14200 reaper reaper
7981 459877 0 0 3 0x14200 pgdaemon pagedaemon
57998 148846 0 0 3 0x14200 bored crynlk
23941 274110 0 0 3 0x14200 bored crypto
50859 236961 0 0 3 0x40014200 acpi0 acpi0
16256 173002 0 0 3 0x40014200 idle1
65202 72688 0 0 3 0x14200 bored softnet
5052 392793 0 0 3 0x14200 bored systqmp
17997 128781 0 0 3 0x14200 bored systq
72158 352108 0 0 3 0x40014200 bored softclock
87275 415480 0 0 3 0x40014200 idle0
1 155855 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 66961 (syz-executor.0) thread 0xffff800020ec69d8 (103348)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff82662e18)
#0 witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0 witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1 vn_ioctl+0x40 sys/kern/vfs_vnops.c:514
#2 sys_ioctl+0x4a5
#3 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#3 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#4 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 9484 6409K 6665K 78643K 10835 0
pcb 13 8K 8K 78643K 31 0
rtable 105 3K 3K 78643K 244 0
ifaddr 49 11K 11K 78643K 60 0
counters 43 33K 33K 78643K 45 0
ioctlops 0 0K 4K 78643K 2598 0
iov 0 0K 32K 78643K 82 0
mount 1 1K 1K 78643K 1 0
vnodes 1218 77K 77K 78643K 1332 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 5K 78643K 40 0
VM map 2 1K 1K 78643K 2 0
sem 12 0K 0K 78643K 355 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1809 196K 290K 78643K 12766 0
file desc 6 17K 25K 78643K 2383 0
proc 62 63K 95K 78643K 527 0
subproc 32 2K 2K 78643K 51 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 9 0
in_multi 33 2K 2K 78643K 49 0
ether_multi 1 0K 0K 78643K 3 0
mrt 0 0K 0K 78643K 2 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 43 201K 201K 78643K 43 0
exec 0 0K 1K 78643K 255 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 7 26K 26K 78643K 7 0
UVM amap 140 40K 40K 78643K 7274 0
UVM aobj 81 3K 3K 78643K 95 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 8 0
NDP 7 0K 0K 78643K 14 0
temp 94 3041K 3105K 78643K 13405 0
kqueue 3 4K 10K 78643K 14 0
SYN cache 2 16K 16K 78643K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 8 0 2 1 0 1 1 0 8 0
plcache 128 20 0 0 1 0 1 1 0 8 0
rtpcb 80 23 0 21 1 0 1 1 0 8 0
rtentry 112 57 0 13 2 0 2 2 0 8 0
unpcb 120 710 0 700 1 0 1 1 0 8 0
syncache 264 9 0 9 3 3 0 1 0 8 0
sackhl 24 1 0 1 1 1 0 1 0 8 0
tcpqe 32 414 0 414 3 3 0 1 0 8 0
tcpcb 544 53 0 48 1 0 1 1 0 8 0
inpcb 280 146 0 138 2 1 1 2 0 8 0
rttmr 72 1 0 1 1 1 0 1 0 8 0
nd6 48 9 0 3 1 0 1 1 0 8 0
pkpcb 40 2 0 2 1 1 0 1 0 8 0
pfosfp 40 846 0 423 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 14 0 7 1 0 1 1 0 8 0
pfstkey 112 14 0 7 1 0 1 1 0 8 0
pfstate 328 14 0 7 2 1 1 2 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 232 0 44 12 0 12 12 0 8 0
art_table 32 233 0 44 2 0 2 2 0 8 0
art_node 16 56 0 16 1 0 1 1 0 8 0
sysvmsgpl 40 6 0 2 1 0 1 1 0 8 0
semapl 112 353 0 343 1 0 1 1 0 8 0
shmpl 112 93 0 15 3 0 3 3 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 3864 0 2456 89 0 89 89 0 8 0
ffsino 272 3864 0 2456 95 0 95 95 0 8 0
nchpl 144 8502 0 6907 60 0 60 60 0 8 0
uvmvnodes 72 3992 0 0 73 0 73 73 0 8 0
vnodes 208 3992 0 0 211 0 211 211 0 8 0
namei 1024 21746 0 21746 1 0 1 1 0 8 1
percpumem 16 33 0 1 1 0 1 1 0 8 0
vcpupl 1984 1 0 0 1 0 1 1 0 8 0
vmpool 560 2 0 1 1 0 1 1 0 8 0
scxspl 192 18867 0 18867 8 7 1 7 0 8 1
plimitpl 152 23 0 15 1 0 1 1 0 8 0
sigapl 424 2598 0 2564 4 0 4 4 0 8 0
futexpl 56 17782 0 17782 1 0 1 1 0 8 1
knotepl 112 91 0 72 1 0 1 1 0 8 0
kqueuepl 144 70 0 68 1 0 1 1 0 8 0
pipelkpl 48 232 0 222 1 0 1 1 0 8 0
pipepl 120 464 0 445 1 0 1 1 0 8 0
fdescpl 496 2581 0 2564 3 0 3 3 0 8 0
filepl 152 11836 0 11735 6 1 5 5 0 8 1
lockfpl 104 147 0 146 1 0 1 1 0 8 0
lockfspl 48 49 0 48 1 0 1 1 0 8 0
sessionpl 112 20 0 9 1 0 1 1 0 8 0
pgrppl 48 34 0 23 1 0 1 1 0 8 0
ucredpl 96 232 0 223 1 0 1 1 0 8 0
zombiepl 144 2564 0 2564 1 0 1 1 0 8 1
processpl 984 2598 0 2564 5 0 5 5 0 8 0
procpl 624 6402 0 6357 4 0 4 4 0 8 0
sosppl 128 15 0 15 1 1 0 1 0 8 0
sockpl 400 881 0 861 5 2 3 4 0 8 0
mcl64k 65536 5 0 0 1 0 1 1 0 8 0
mcl16k 16384 2 0 0 1 0 1 1 0 8 0
mcl12k 12288 11 0 0 2 0 2 2 0 8 0
mcl9k 9216 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 4 0 0 1 0 1 1 0 8 0
mcl4k 4096 14 0 0 2 0 2 2 0 8 0
mcl2k2 2112 3 0 0 1 0 1 1 0 8 0
mcl2k 2048 159 0 0 19 0 19 19 0 8 0
mtagpl 80 9 0 0 1 0 1 1 0 8 0
mbufpl 256 199 0 0 13 1 12 12 0 8 0
bufpl 280 5748 0 133 402 0 402 402 0 8 0
anonpl 16 179074 0 165767 57 1 56 56 0 124 0
amapchunkpl 152 11246 0 11108 8 1 7 8 0 158 0
amappl16 192 10645 0 9906 40 2 38 39 0 8 1
amappl15 184 10 0 8 1 0 1 1 0 8 0
amappl14 176 1130 0 1122 1 0 1 1 0 8 0
amappl13 168 40 0 38 1 0 1 1 0 8 0
amappl12 160 8 0 5 1 0 1 1 0 8 0
amappl11 152 59 0 44 1 0 1 1 0 8 0
amappl10 144 1223 0 1216 1 0 1 1 0 8 0
amappl9 136 418 0 416 1 0 1 1 0 8 0
amappl8 128 445 0 395 2 0 2 2 0 8 0
amappl7 120 1328 0 1314 1 0 1 1 0 8 0
amappl6 112 23 0 19 2 1 1 1 0 8 0
amappl5 104 2492 0 2474 1 0 1 1 0 8 0
amappl4 96 517 0 488 1 0 1 1 0 8 0
amappl3 88 1237 0 1230 1 0 1 1 0 8 0
amappl2 80 19638 0 19562 2 0 2 2 0 8 0
amappl1 72 56133 0 55693 24 14 10 18 0 8 0
amappl 80 6704 0 6658 2 0 2 2 0 84 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 64 94 0 14 2 0 2 2 0 8 0
uaddrrnd 24 2583 0 2565 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 2583 0 2565 1 0 1 1 0 8 0
vmmpekpl 168 18737 0 18705 2 0 2 2 0 8 0
vmmpepl 168 300593 0 298590 110 21 89 103 0 357 1
vmsppl 368 2582 0 2565 2 0 2 2 0 8 0
pdppl 4096 5174 0 5131 6 0 6 6 0 8 0
pvpl 32 531721 0 515170 144 3 141 142 0 265 2
pmappl 232 2582 0 2565 2 0 2 2 0 8 1
extentpl 40 46 0 29 1 0 1 1 0 8 0
phpool 112 260 0 6 8 0 8 8 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
x86_send_ipi(0,2) at x86_send_ipi+0x24 x86_atomic_setbits_u32 machine/atomic.h:292 [inline]
x86_send_ipi(0,2) at x86_send_ipi+0x24 sys/arch/amd64/amd64/ipi.c:48
vm_intr_pending(ffff800023fbb950) at vm_intr_pending+0x225 sys/arch/amd64/amd64/vmm.c:688
VOP_IOCTL(fffffd806e38ba90,800c5606,ffff800023fbb950,1,fffffd807f7bf960,ffff800020ec69d8) at VOP_IOCTL+0x88 sys/kern/vfs_vops.c:290
vn_ioctl(fffffd80671a2ef0,800c5606,ffff800023fbb950,ffff800020ec69d8) at vn_ioctl+0xba sys/kern/vfs_vnops.c:531
sys_ioctl(ffff800020ec69d8,ffff800023fbba68,ffff800023fbbab0) at sys_ioctl+0x4a5
syscall(ffff800023fbbb30) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800023fbbb30) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x88e7c37ac10, count: -7
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x1a: addq $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff800020e00ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x57 sys/dev/kcov.c:103
syscall(ffff800023faf8f0) at syscall+0x55f mi_syscall_return sys/sys/syscall_mi.h:129 [inline]
syscall(ffff800023faf8f0) at syscall+0x55f sys/arch/amd64/amd64/trap.c:592
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffe8a70, count: -6
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Aug 17, 2020, 8:27:16 AM8/17/20
to syzkaller-o...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages