uvm_fault: NUM TID PID UID PRFLAGS PFLAGS CPU COMMANDNUM(NUM,NUM,NUM,NUM,49b,ADDR) at NUMtimeout_ru

0 views
Skip to first unread message

syzbot

unread,
Apr 23, 2023, 10:35:49 PM4/23/23
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 1e5b016c5082 sync for __syscall removal
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=143d1d20280000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=3a4abb4c4942db7825da

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/452af0b271ef/disk-1e5b016c.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/5145fa4f4c7c/bsd-1e5b016c.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/992507fc6105/kernel-1e5b016c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3a4abb...@syzkaller.appspotmail.com

kernel: page fault trap, code=0
Stopped at 0 TID PID UID PRFLAGS PFLAGS CPU COMMAND
0(0,0,0,0,49b,fffffd80669b7f08) at 0
timeout_run(fffffd80669b7f08) at timeout_run+0x8b sys/kern/kern_timeout.c:641
softclock_process_kclock_timeout(fffffd80669b7f08,0) at softclock_process_kclock_timeout+0x1c6 sys/kern/kern_timeout.c:666
softclock(0) at softclock+0x11a sys/kern/kern_timeout.c:717
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
acpicpu_idle() at acpicpu_idle+0x2ee sys/dev/acpi/acpicpu.c:1206
sched_idle(ffffffff82b9dff0) at sched_idle+0x2ea sys/kern/kern_sched.c:175
end trace frame: 0x0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: attempt to execute user address 0x0 in supervisor mode
ddb> trace
0(0,0,0,0,49b,fffffd80669b7f08) at 0
timeout_run(fffffd80669b7f08) at timeout_run+0x8b sys/kern/kern_timeout.c:641
softclock_process_kclock_timeout(fffffd80669b7f08,0) at softclock_process_kclock_timeout+0x1c6 sys/kern/kern_timeout.c:666
softclock(0) at softclock+0x11a sys/kern/kern_timeout.c:717
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
acpicpu_idle() at acpicpu_idle+0x2ee sys/dev/acpi/acpicpu.c:1206
sched_idle(ffffffff82b9dff0) at sched_idle+0x2ea sys/kern/kern_sched.c:175
end trace frame: 0x0, count: -7
ddb> show registers
rdi 0
rsi 0
rbp 0xffff8000215fe650
rbx 0
rdx 0
rcx 0xffffffff82c10a70 timeout_todo
rax 0x9
r8 0
r9 0
r10 0x1d6d208fea5ef8a3
r11 0
r12 0
r13 0xffffffff82b9dff0 cpu_info_full_primary+0x1ff0
r14 0
r15 0
rip 0
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff8000215fe618
ss 0x10
0
ddb> show proc
PROC (idle0) pid=158150 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
pri=0, usrpri=50, nice=20
forw=0x24e9c31848cb0a6d, list=0xffff8000fffffb30,0xffff8000ffffeaf0
process=0xffff8000ffffc000 user=0xffff8000215f9000, vmspace=0xffffffff82c0a9b0
estcpu=0, cpticks=41951, pctcpu=0.0
user=0, sys=0, intr=1
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
17574 99939 14881 0 3 0x82 piperd syz-executor.0
41156 352538 14881 0 3 0x82 piperd syz-executor.3
71478 476682 14881 0 3 0x82 piperd syz-executor.4
27614 437082 14881 0 3 0x82 nanoslp syz-executor.5
74537 93245 14881 0 3 0x82 piperd syz-executor.2
24575 290399 14881 0 3 0x82 piperd syz-executor.6
76208 187503 0 0 3 0x14200 acct acct
72592 364064 14881 0 3 0x82 piperd syz-executor.7
24765 258515 14881 0 3 0x82 piperd syz-executor.1
84788 210177 0 0 3 0x14280 nfsidl nfsio
49127 355322 0 0 3 0x14280 nfsidl nfsio
3360 388029 0 0 3 0x14200 bored sosplice
14881 14709 79709 0 3 0x82 wait syz-fuzzer
14881 6879 79709 0 3 0x4000082 nanoslp syz-fuzzer
14881 308595 79709 0 3 0x4000082 wait syz-fuzzer
14881 141580 79709 0 3 0x4000082 wait syz-fuzzer
14881 379733 79709 0 3 0x4000082 thrsleep syz-fuzzer
14881 88979 79709 0 3 0x4000082 thrsleep syz-fuzzer
14881 298844 79709 0 3 0x4000082 kqread syz-fuzzer
14881 119902 79709 0 3 0x4000082 thrsleep syz-fuzzer
14881 14625 79709 0 3 0x4000082 wait syz-fuzzer
14881 188574 79709 0 3 0x4000082 thrsleep syz-fuzzer
14881 428581 79709 0 3 0x4000082 wait syz-fuzzer
14881 126018 79709 0 3 0x4000082 wait syz-fuzzer
14881 7954 79709 0 3 0x4000082 wait syz-fuzzer
14881 196283 79709 0 3 0x4000082 wait syz-fuzzer
79709 359367 6223 0 3 0x10008a sigsusp ksh
6223 291310 21438 0 3 0x9a kqread sshd
73815 174296 1 0 3 0x100083 ttyin getty
21438 308640 1 0 3 0x88 kqread sshd
83347 430399 51926 73 3 0x1100090 kqread syslogd
51926 79494 1 0 3 0x100082 netio syslogd
72270 201630 1 0 3 0x100080 kqread resolvd
3018 345325 95063 77 3 0x100092 kqread dhcpleased
25757 123785 95063 77 3 0x100092 kqread dhcpleased
95063 356942 1 0 3 0x80 kqread dhcpleased
194 17627 0 0 3 0x14200 bored smr
62916 166695 0 0 3 0x14200 pgzero zerothread
77771 329887 0 0 3 0x14200 aiodoned aiodoned
80290 298858 0 0 3 0x14200 syncer update
20597 322219 0 0 3 0x14200 cleaner cleaner
22212 161489 0 0 3 0x14200 reaper reaper
33774 204310 0 0 3 0x14200 pgdaemon pagedaemon
17885 203716 0 0 3 0x14200 bored viomb
1285 309658 0 0 3 0x40014200 acpi0 acpi0
93672 168413 0 0 3 0x14200 bored softnet
18919 434009 0 0 3 0x14200 bored softnet
35296 113481 0 0 3 0x14200 bored softnet
9984 452083 0 0 3 0x14200 bored softnet
23217 335175 0 0 3 0x14200 bored systqmp
79195 157514 0 0 3 0x14200 bored systq
31116 499093 0 0 3 0x40014200 bored softclock
*87998 158150 0 0 7 0x40014200 idle0
1 128793 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10214 6437K 8006K 78643K 32633 0
pcb 13 22K 32K 78643K 5365 0
rtable 109 13K 16K 78643K 14879 0
ifaddr 180 52K 59K 78643K 1955 0
sysctl 3 1K 2K 78643K 18 0
counters 23 16K 17K 78643K 654 0
ioctlops 0 0K 4K 78643K 1993 0
iov 0 0K 32K 78643K 3013 0
mount 1 1K 1K 78643K 1 0
log 0 0K 0K 78643K 4 0
vnodes 1771 111K 111K 78643K 13364 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 5K 78643K 109 0
VM map 2 1K 1K 78643K 2 0
sem 20 17K 32K 78643K 3736 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1697 195K 286K 78643K 12548 0
file desc 11 37K 73K 78643K 14082 0
sigio 0 0K 0K 78643K 235 0
proc 66 59K 75K 78643K 4229 0
subproc 104 6K 6K 78643K 1625 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 1130 0
in_multi 31 2K 7K 78643K 1948 0
ether_multi 1 0K 0K 78643K 112 0
mrt 1 0K 0K 78643K 91 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 193 864K 864K 78643K 193 0
exec 0 0K 1K 78643K 3639 0
pfkey data 0 0K 0K 78643K 20 0
tdb 3 0K 0K 78643K 3 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 8 62K 64K 78643K 10 0
UVM amap 295 85K 101K 78643K 89583 0
UVM aobj 131 6K 6K 78643K 141 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 1079 0
NDP 8 0K 1K 78643K 638 0
temp 112 5769K 71434K 78643K 223752 0
kqueue 12 18K 28K 78643K 1413 0
SYN cache 2 16K 16K 78643K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 11886 0 11883 77 75 2 5 0 8 1
rtentry 112 1849 0 1811 8 5 3 4 0 8 0
unpcb 144 18342 0 18329 153 150 3 11 0 8 2
syncache 296 107 0 107 18 18 0 1 0 8 0
sackhl 24 3 0 3 3 3 0 1 0 8 0
tcpqe 32 338 0 338 10 10 0 1 0 8 0
tcpcb 776 5240 0 5236 164 163 1 15 0 8 0
arp 88 288 0 282 1 0 1 1 0 8 0
ipq 40 59 0 59 6 6 0 1 0 8 0
ipqe 40 202 0 202 6 6 0 1 0 8 0
inpcb 336 20461 0 20454 279 270 9 21 0 8 8
ip6q 72 2 0 2 1 1 0 1 0 8 0
ip6af 40 4 0 4 1 1 0 1 0 8 0
nd6 48 413 0 404 1 0 1 1 0 8 0
pkpcb 40 154 0 154 20 20 0 1 0 8 0
kcovpl 48 125 0 117 1 0 1 1 0 8 0
mppekey 1024 18 0 18 5 5 0 1 0 8 0
ppxss 1160 349 0 349 23 23 0 1 0 8 0
pppxif 1360 259 0 259 20 20 0 1 0 8 0
pfstscr 40 62 0 21 1 0 1 1 0 8 0
pfosfp 40 13 0 11 1 0 1 1 0 8 0
pfosfpen 112 13 0 11 1 0 1 1 0 8 0
pfanchor 1280 955 83 443 49 6 43 43 0 8 0
pfqueue 264 75 0 75 2 2 0 1 0 8 0
pfstitem 24 58 0 51 1 0 1 1 0 8 0
pfstkey 128 95 0 70 1 0 1 1 0 8 0
pfstate 352 49 0 20 3 0 3 3 0 8 0
rttmr 136 26 0 25 11 10 1 1 0 8 0
art_heap8 4096 18 0 16 14 12 2 3 0 8 0
art_heap4 256 8216 0 8026 84 62 22 29 0 8 0
art_table 32 8234 0 8042 6 3 3 4 0 8 0
art_node 16 1831 0 1799 1 0 1 1 0 8 0
sysvmsgpl 40 38 0 38 1 1 0 1 0 8 0
semupl 112 3 0 3 2 2 0 1 0 8 0
semapl 112 3724 0 3706 1 0 1 1 0 8 0
shmpl 112 138 0 10 4 0 4 4 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 19872 0 18379 94 0 94 94 0 8 0
ffsino 240 19872 0 18379 89 0 89 89 0 8 0
nchpl 144 38369 0 36736 63 1 62 63 0 8 0
rtmask 32 7 0 7 3 3 0 1 0 8 0
uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0
vnodes 216 5926 0 0 330 0 330 330 0 8 0
namei 1024 154841 0 154841 3 2 1 3 0 8 1
vmpool 664 48 0 48 10 10 0 1 0 8 0
kstatmem 264 736 0 720 2 0 2 2 0 8 0
scsiplug 72 20 0 20 6 6 0 1 0 8 0
scxspl 216 114117 0 114117 34 33 1 8 0 8 1
plimitpl 152 2161 0 2146 1 0 1 1 0 8 0
sigapl 424 14155 0 14113 8 1 7 8 0 8 0
futexpl 64 164822 0 164822 4 3 1 1 0 8 1
knotepl 120 248623 0 248542 136 131 5 18 0 8 1
kqueuepl 184 3640 0 3632 57 56 1 7 0 8 0
pipepl 288 7235 0 7207 110 105 5 11 0 8 2
fdescpl 432 14116 0 14094 4 0 4 4 0 8 0
filepl 120 136080 0 135844 197 183 14 20 0 8 5
lockfpl 104 5211 0 5209 13 11 2 2 0 8 1
lockfspl 48 1416 0 1414 1 0 1 1 0 8 0
sessionpl 144 140 0 124 1 0 1 1 0 8 0
pgrppl 48 175 0 159 1 0 1 1 0 8 0
ucredpl 104 13592 0 13567 1 0 1 1 0 8 0
zombiepl 144 14114 0 14113 2 1 1 1 0 8 0
processpl 1008 14155 0 14113 11 4 7 9 0 8 0
procpl 696 34688 0 34633 17 9 8 10 0 8 0
sosppl 168 134 0 134 25 25 0 1 0 8 0
sockpl 456 50941 0 50918 1251 1234 17 45 0 8 14
mcl64k 65536 678 0 678 22 22 0 1 0 8 0
mcl16k 16384 422 0 422 33 33 0 1 0 8 0
mcl12k 12288 647 0 647 28 27 1 1 0 8 1
mcl9k 9216 149 0 149 35 34 1 1 0 8 1
mcl8k 8192 1896 0 1896 22 21 1 1 0 8 1
mcl4k 4096 2003 0 2003 10 9 1 1 0 8 1
mcl2k2 2112 133 0 133 35 35 0 1 0 8 0
mcl2k 2048 110651 0 110576 75 63 12 31 0 8 0
mtagpl 96 1206 0 1183 15 13 2 6 0 8 0
mbufpl 256 465159 0 464976 2022 1992 30 426 0 8 8
bufpl 288 26449 0 20055 458 0 458 458 0 8 0
anonpl 24 2693437 0 2676037 220 95 125 145 0 188 0
amapchunkpl 152 256964 0 256316 128 85 43 43 0 158 12
amappl16 200 27401 0 26750 159 123 36 49 0 8 0
amappl15 192 9 0 9 1 1 0 1 0 8 0
amappl14 184 544 0 530 2 1 1 2 0 8 0
amappl13 176 11 0 11 2 2 0 1 0 8 0
amappl12 168 1838 0 1831 1 0 1 1 0 8 0
amappl11 160 49 0 38 1 0 1 1 0 8 0
amappl10 152 149 0 140 1 0 1 1 0 8 0
amappl9 144 1028 0 1028 20 20 0 1 0 8 0
amappl8 136 642 0 564 3 0 3 3 0 8 0
amappl7 128 441 0 417 2 0 2 2 0 8 0
amappl6 120 808 0 795 2 1 1 2 0 8 0
amappl5 112 780 0 773 1 0 1 1 0 8 0
amappl4 104 2083 0 2057 2 1 1 2 0 8 0
amappl3 96 38834 0 38793 2 0 2 2 0 8 0
amappl2 88 15741 0 15671 3 1 2 3 0 8 0
amappl1 80 314633 0 314004 39 22 17 26 0 8 0
amappl 88 87779 0 87627 5 0 5 5 0 92 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 140 0 10 3 0 3 3 0 8 0
uaddrrnd 24 14164 0 14142 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 14164 0 14142 1 0 1 1 0 8 0
vmmpekpl 168 122808 0 122753 3 0 3 3 0 8 0
vmmpepl 168 1345136 0 1342716 487 337 150 166 0 357 15
vmsppl 344 14163 0 14142 3 0 3 3 0 8 0
rwobjpl 24 335758 0 328003 56 6 50 50 0 8 0
pdppl 4096 28334 0 28284 1044 980 64 68 0 8 14
pvpl 32 5496924 0 5474507 530 322 208 360 0 265 0
pmappl 216 14163 0 14142 2 0 2 2 0 8 0
extentpl 40 56 0 38 1 0 1 1 0 8 0
phpool 112 4390 0 3598 40 13 27 32 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
0(0,0,0,0,49b,fffffd80669b7f08) at 0
timeout_run(fffffd80669b7f08) at timeout_run+0x8b sys/kern/kern_timeout.c:641
softclock_process_kclock_timeout(fffffd80669b7f08,0) at softclock_process_kclock_timeout+0x1c6 sys/kern/kern_timeout.c:666
softclock(0) at softclock+0x11a sys/kern/kern_timeout.c:717
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
acpicpu_idle() at acpicpu_idle+0x2ee sys/dev/acpi/acpicpu.c:1206
sched_idle(ffffffff82b9dff0) at sched_idle+0x2ea sys/kern/kern_sched.c:175
end trace frame: 0x0, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
0(0,0,0,0,49b,fffffd80669b7f08) at 0
timeout_run(fffffd80669b7f08) at timeout_run+0x8b sys/kern/kern_timeout.c:641
softclock_process_kclock_timeout(fffffd80669b7f08,0) at softclock_process_kclock_timeout+0x1c6 sys/kern/kern_timeout.c:666
softclock(0) at softclock+0x11a sys/kern/kern_timeout.c:717
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
acpicpu_idle() at acpicpu_idle+0x2ee sys/dev/acpi/acpicpu.c:1206
sched_idle(ffffffff82b9dff0) at sched_idle+0x2ea sys/kern/kern_sched.c:175
end trace frame: 0x0, count: -7


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Jul 22, 2023, 10:35:37 PM7/22/23
to syzkaller-o...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages