panic: Caught invalid memory access at ADDR size NUM op NUM

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5f617609345c kasan/kcov: don't let the two runtimes instru..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=1121d832580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=f028f6e8a734a5e8de11

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/907cdf453028/disk-5f617609.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/79dfb8e64566/bsd-5f617609.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5a5ed1ebcca5/kernel-5f617609.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f028f6...@syzkaller.appspotmail.com

panic: Caught invalid memory access at ffff8000012f0d60 size 1 op 0
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
319343 43200 0 0 0 1 syz-executor
*258429 93280 0 0 0x4000000 0K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff82a63def) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load1_noabort(ffff8000012f0d60) at __asan_load1_noabort+0xed
strlcpy(ffff800000f4c650,ffff8000012f0928,40) at strlcpy+0x19b sys/lib/libkern/strlcpy.c:44
pf_rule_copyin(ffff8000012f0810,ffff800000f4c538) at pf_rule_copyin+0x52b sys/net/pf_ioctl.c:4047
pfioctl(24900,cd604404,ffff8000012f0000,2,ffff80003533ad28) at pfioctl+0x1b3d sys/net/pf_ioctl.c:-1
VOP_IOCTL(ffff800000faad88,cd604404,ffff8000012f0000,2,ffff800000039478,ffff80003533ad28) at VOP_IOCTL+0x131 sys/kern/vfs_vops.c:264
vn_ioctl(ffff800001024650,cd604404,ffff8000012f0000,ffff80003533ad28) at vn_ioctl+0x18c sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003533ad28,ffff80003c3b2f70,ffff80003c3b2ee0) at sys_ioctl+0x868 sys/kern/sys_generic.c:510
syscall(ffff80003c3b2f70) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3b2f70) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x82f0de2a240, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff8000012f0d60 size 1 op 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff82a63def) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load1_noabort(ffff8000012f0d60) at __asan_load1_noabort+0xed
strlcpy(ffff800000f4c650,ffff8000012f0928,40) at strlcpy+0x19b sys/lib/libkern/strlcpy.c:44
pf_rule_copyin(ffff8000012f0810,ffff800000f4c538) at pf_rule_copyin+0x52b sys/net/pf_ioctl.c:4047
pfioctl(24900,cd604404,ffff8000012f0000,2,ffff80003533ad28) at pfioctl+0x1b3d sys/net/pf_ioctl.c:-1
VOP_IOCTL(ffff800000faad88,cd604404,ffff8000012f0000,2,ffff800000039478,ffff80003533ad28) at VOP_IOCTL+0x131 sys/kern/vfs_vops.c:264
vn_ioctl(ffff800001024650,cd604404,ffff8000012f0000,ffff80003533ad28) at vn_ioctl+0x18c sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003533ad28,ffff80003c3b2f70,ffff80003c3b2ee0) at sys_ioctl+0x868 sys/kern/sys_generic.c:510
syscall(ffff80003c3b2f70) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3b2f70) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x82f0de2a240, count: -11
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff80003c3b23f0
rbx 0xffff80003c3b2460
rdx 0
rcx 0xffffffff82f0bff0 cpu_info_full_primary+0x1ff0
rax 0xffff80000008d700
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff80003c3b23b8
r11 0xffffffff813f8360 x86_bus_space_io_read_1
r12 0xffffffff82a63def .str.5+0x4fcaf
r13 0xffffffff82f0cc08 cpu_info_full_primary+0x2c08
r14 0xffffffff82f0ce07 cpu_info_full_primary+0x2e07
r15 0x1
rip 0xffffffff814dc617 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff80003c3b23f0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=258429 pid=93280 tcnt=2 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80003533a2c8,0xffff80003533aaa0
process=0xffff80003c429368 user=0xffff80003c3ae000, vmspace=0xffff8000012be3f0
estcpu=36, cpticks=15, pctcpu=0.0, user=0, sys=15, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
21302 92811 54014 0 2 0 syz-executor
43200 319343 19992 0 7 0 syz-executor
54130 141778 25512 0 2 0 syz-executor
54130 279702 25512 0 3 0x4000080 fsleep syz-executor
98130 279738 19849 0 2 0 syz-executor
75042 245749 70094 0 2 0 syz-executor
75042 43282 70094 0 3 0x4000080 fsleep syz-executor
93280 153058 37281 0 2 0 syz-executor
*93280 258429 37281 0 7 0x4000000 syz-executor
19286 238366 63438 0 2 0 syz-executor
19286 439663 63438 0 3 0x4000080 fsleep syz-executor
578 33378 1 0 3 0x100083 ttyin getty
63685 373781 0 0 3 0x14280 nfsidl nfsio
87450 51728 0 0 3 0x14280 nfsidl nfsio
48804 301392 0 0 3 0x14280 nfsidl nfsio
47730 129588 0 0 3 0x14280 nfsidl nfsio
75660 43561 0 0 3 0x14280 nfsidl nfsio
94894 34875 0 0 3 0x14280 nfsidl nfsio
60933 523427 0 0 3 0x14280 nfsidl nfsio
33024 429476 0 0 3 0x14280 nfsidl nfsio
35834 466483 0 0 3 0x14280 nfsidl nfsio
83657 229539 0 0 3 0x14280 nfsidl nfsio
67064 4648 0 0 3 0x14280 nfsidl nfsio
19957 23351 0 0 3 0x14280 nfsidl nfsio
5369 218346 0 0 3 0x14280 nfsidl nfsio
87365 408356 0 0 3 0x14280 nfsidl nfsio
69589 185732 0 0 3 0x14280 nfsidl nfsio
73790 287603 0 0 3 0x14280 nfsidl nfsio
63289 392939 0 0 3 0x14280 nfsidl nfsio
9392 193450 0 0 3 0x14280 nfsidl nfsio
71656 80871 0 0 3 0x14280 nfsidl nfsio
67747 402321 0 0 3 0x14280 nfsidl nfsio
25512 465057 59912 0 2 0xc82 syz-executor
19992 69690 59912 0 2 0xc82 syz-executor
54014 510411 59912 0 2 0xc82 syz-executor
37281 399153 59912 0 2 0xc82 syz-executor
70094 232683 59912 0 2 0xc82 syz-executor
63438 404093 59912 0 2 0xc82 syz-executor
19849 20116 59912 0 2 0xc82 syz-executor
61617 209598 59912 0 2 0x2 syz-executor
59912 109410 1 0 3 0x82 kqread syz-executor
95362 112377 0 0 3 0x14200 bored smr
73705 367299 0 0 2 0x14200 zerothread
86971 422404 0 0 3 0x14200 aiodoned aiodoned
48323 106477 0 0 3 0x14200 syncer update
96496 406147 0 0 3 0x14200 cleaner cleaner
3690 192019 0 0 3 0x14200 reaper reaper
57042 92808 0 0 3 0x14200 pgdaemon pagedaemon
12624 350319 0 0 3 0x14200 bored viomb
58905 327948 0 0 3 0x40014200 acpi0 acpi0
75638 478140 0 0 3 0x40014200 idle1
386 90695 0 0 3 0x14200 bored softnet1
92679 112313 0 0 3 0x14200 bored softnet0
7765 196077 0 0 3 0x14200 bored systqmp
10400 455269 0 0 3 0x14200 bored systq
17545 220180 0 0 3 0x14200 tmoslp softclockmp
50416 505789 0 0 3 0x40014200 tmoslp softclock
17923 139354 0 0 3 0x40014200 idle0
1 5110 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 93280 (syz-executor) thread 0xffff80003533ad28 (258429)
exclusive rwlock pfioctl_rw r = 0 (0xffffffff83138d38)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 pfioctl+0x256 sys/net/pf_ioctl.c:2075
#3 VOP_IOCTL+0x131 sys/kern/vfs_vops.c:264
#4 vn_ioctl+0x18c sys/kern/vfs_vnops.c:537
#5 sys_ioctl+0x868 sys/kern/sys_generic.c:510
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xfff


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup