panic: vrele: v_writecount != 0

1 view
Skip to first unread message

syzbot

unread,
Jul 30, 2019, 11:35:06 PM7/30/19
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 75866a61 shorten the failure message, it should not wrap a..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=10c7308a600000
kernel config: https://syzkaller.appspot.com/x/.config?x=60e2b7157576c8d7
dashboard link: https://syzkaller.appspot.com/bug?extid=4724df09d9ab0fdca28a

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4724df...@syzkaller.appspotmail.com

panic: vrele: v_writecount != 0
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*112587 23432 0 0 0x4000000 0 syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
vrele(fffffd802f2af000) at vrele+0x188 sys/kern/vfs_subr.c:797
diskmapioctl(5a00,c0106477,ffff8000149b6a20,1,ffff800014940780) at
diskmapioctl+0x2a8 sys/dev/diskmap.c:140
VOP_IOCTL(fffffd80374133f0,c0106477,ffff8000149b6a20,1,fffffd803f7c6b40,ffff800014940780)
at
VOP_IOCTL+0x88 sys/kern/vfs_vops.c:290
vn_ioctl(fffffd802f92fcb8,c0106477,ffff8000149b6a20,ffff800014940780) at
vn_ioctl+0xb6 sys/kern/vfs_vnops.c:519
sys_ioctl(ffff800014940780,ffff8000149b6b38,ffff8000149b6ba0) at
sys_ioctl+0x5b8
syscall(ffff8000149b6c00) at syscall+0x508
Xsyscall(6,0,ffffffffffffff1f,0,3,19b13fb6010) at Xsyscall+0x128
end of kernel
end trace frame: 0x19da62e4bb0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
vrele: v_writecount != 0
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
vrele(fffffd802f2af000) at vrele+0x188 sys/kern/vfs_subr.c:797
diskmapioctl(5a00,c0106477,ffff8000149b6a20,1,ffff800014940780) at
diskmapioctl+0x2a8 sys/dev/diskmap.c:140
VOP_IOCTL(fffffd80374133f0,c0106477,ffff8000149b6a20,1,fffffd803f7c6b40,ffff800014940780)
at
VOP_IOCTL+0x88 sys/kern/vfs_vops.c:290
vn_ioctl(fffffd802f92fcb8,c0106477,ffff8000149b6a20,ffff800014940780) at
vn_ioctl+0xb6 sys/kern/vfs_vnops.c:519
sys_ioctl(ffff800014940780,ffff8000149b6b38,ffff8000149b6ba0) at
sys_ioctl+0x5b8
syscall(ffff8000149b6c00) at syscall+0x508
Xsyscall(6,0,ffffffffffffff1f,0,3,19b13fb6010) at Xsyscall+0x128
end of kernel
end trace frame: 0x19da62e4bb0, count: -9
ddb> show registers
rdi 0xffffffff8141a407 db_enter+0x17
rsi 0x8cc2 __ALIGN_SIZE+0x7cc2
rbp 0xffff8000149b65e0
rbx 0xffff8000149b6690
rdx 0x8cc3 __ALIGN_SIZE+0x7cc3
rcx 0xffff800016be9000
rax 0xffff800016be9000
r8 0xffff8000149b65a0
r9 0x1
r10 0xffff800000998e80
r11 0xadcdb6d4bf27fb40
r12 0x3000000008
r13 0xffff8000149b65f0
r14 0x100
r15 0x1
rip 0xffffffff8141a408 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff8000149b65d0
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor.0) pid=112587 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=24, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff800014940290,0xffff800014941b50
process=0xffff8000ffff7b10 user=0xffff8000149b1000,
vmspace=0xfffffd803f00cee0
estcpu=36, cpticks=3, pctcpu=0.0
user=0, sys=3, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
23432 447876 98074 0 2 0 syz-executor.0
*23432 112587 98074 0 7 0x4000000 syz-executor.0
23432 315992 98074 0 3 0x4000080 nanosleep syz-executor.0
23432 19114 98074 0 2 0x4000000 syz-executor.0
48198 513523 1 0 3 0x100083 ttyin getty
95293 83259 83626 0 2 0x2 syz-executor.1
79068 50081 0 0 3 0x14200 bored sosplice
98074 409738 83626 0 2 0x482 syz-executor.0
83626 485515 61624 0 3 0x82 thrsleep syz-fuzzer
83626 251608 61624 0 2 0x4000482 syz-fuzzer
83626 342353 61624 0 3 0x4000082 thrsleep syz-fuzzer
83626 353134 61624 0 3 0x4000082 thrsleep syz-fuzzer
83626 175856 61624 0 3 0x4000082 thrsleep syz-fuzzer
83626 319014 61624 0 3 0x4000082 kqread syz-fuzzer
83626 361138 61624 0 3 0x4000082 thrsleep syz-fuzzer
83626 117396 61624 0 3 0x4000082 thrsleep syz-fuzzer
61624 8690 36617 0 3 0x10008a pause ksh
36617 51432 43354 0 3 0x92 select sshd
43354 407258 1 0 3 0x80 select sshd
35453 51958 58730 73 2 0x100090 syslogd
58730 329609 1 0 3 0x100082 netio syslogd
67151 438936 1 77 3 0x100090 poll dhclient
73758 222764 1 0 3 0x80 poll dhclient
48588 252196 0 0 2 0x14200 zerothread
48447 40082 0 0 3 0x14200 aiodoned aiodoned
98938 233496 0 0 3 0x14200 syncer update
51008 288634 0 0 3 0x14200 cleaner cleaner
16612 371568 0 0 3 0x14200 reaper reaper
8872 297272 0 0 3 0x14200 pgdaemon pagedaemon
866 296935 0 0 3 0x14200 bored crynlk
69476 272833 0 0 3 0x14200 bored crypto
91173 142015 0 0 3 0x40014200 acpi0 acpi0
14252 487350 0 0 3 0x14200 bored softnet
31041 415972 0 0 3 0x14200 bored systqmp
92696 515667 0 0 3 0x14200 bored systq
47919 8178 0 0 3 0x40014200 bored softclock
49308 104337 0 0 3 0x40014200 idle0
37430 481356 0 0 3 0x14200 bored smr
1 403681 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9559 6370K 7141K 78643K 25337 0 0
pcb 13 8K 8K 78643K 409 0 0
rtable 117 4K 5K 78643K 1137 0 0
ifaddr 73 16K 17K 78643K 441 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 254 0 0
iov 0 0K 24K 78643K 607 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1205 76K 77K 78643K 6406 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 5K 78643K 96 0 0
VM map 2 0K 0K 78643K 2 0 0
sem 12 1K 1K 78643K 14 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1793 195K 288K 78643K 12645 0 0
file desc 5 13K 25K 78643K 5226 0 0
sigio 1 0K 0K 78643K 112 0 0
proc 41 30K 54K 78643K 1027 0 0
subproc 32 2K 2K 78643K 123 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 466 0 0
in_multi 33 2K 2K 78643K 228 0 0
ether_multi 1 0K 0K 78643K 23 0 0
mrt 0 0K 0K 78643K 17 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 90 397K 397K 78643K 90 0 0
exec 0 0K 1K 78643K 760 0 0
pfkey data 0 0K 0K 78643K 4 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 96 21K 37K 78643K 13262 0 0
UVM aobj 130 4K 4K 78643K 139 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 0K 78643K 213 0 0
NDP 17 0K 0K 78643K 123 0 0
temp 206 2728K 2798K 78643K 19480 0 0
kqueue 0 0K 0K 78643K 27 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 18 0 12 1 0 1 1 0
8 0
rtpcb 80 245 0 243 1 0 1 1 0
8 0
rtentry 112 116 0 71 2 0 2 2 0
8 0
unpcb 120 1889 0 1877 1 0 1 1 0
8 0
syncache 264 4 0 4 1 1 0 1 0
8 0
sackhl 24 1 0 1 1 1 0 1 0
8 0
tcpqe 32 2842 0 2842 2 2 0 1 0
8 0
tcpcb 544 683 0 679 1 0 1 1 0
8 0
inpcb 280 2109 0 2102 4 3 1 2 0
8 0
nd6 48 21 0 15 1 0 1 1 0
8 0
pkpcb 40 26 0 26 10 9 1 1 0
8 1
swfcl 56 5 0 0 1 0 1 1 0
8 0
ppxss 1128 79 0 79 25 25 0 1 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 425 0 234 15 3 12 13 0
8 0
art_table 32 426 0 234 2 0 2 2 0
8 0
art_node 16 102 0 62 1 0 1 1 0
8 0
sysvmsgpl 40 25 0 13 1 0 1 1 0
8 0
semapl 112 12 0 2 1 0 1 1 0
8 0
shmpl 112 137 0 9 4 0 4 4 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 9973 0 8570 46 0 46 46 0
8 0
ffsino 240 9973 0 8570 84 0 84 84 0
8 0
nchpl 144 17224 0 15593 61 0 61 61 0
8 0
uvmvnodes 72 7766 0 0 142 0 142 142 0
8 0
vnodes 200 7766 0 0 409 0 409 409 0
8 0
namei 1024 54937 0 54937 2 1 1 1 0
8 1
scsiplug 64 5 0 5 4 4 0 1 0
8 0
scxspl 192 54977 0 54977 28 27 1 6 0
8 1
plimitpl 152 410 0 403 1 0 1 1 0
8 0
sigapl 432 5385 0 5372 2 0 2 2 0
8 0
futexpl 56 83507 0 83507 1 0 1 1 0
8 1
knotepl 112 1039 0 1020 1 0 1 1 0
8 0
kqueuepl 104 1201 0 1199 1 0 1 1 0
8 0
pipepl 112 2990 0 2971 5 4 1 2 0
8 0
fdescpl 424 5386 0 5372 2 0 2 2 0
8 0
filepl 120 31877 0 31779 7 3 4 5 0
8 1
lockfpl 104 1691 0 1691 6 5 1 1 0
8 1
lockfspl 48 594 0 594 6 5 1 1 0
8 1
sessionpl 112 25 0 15 1 0 1 1 0
8 0
pgrppl 48 73 0 63 1 0 1 1 0
8 0
ucredpl 96 6366 0 6359 1 0 1 1 0
8 0
zombiepl 144 5372 0 5372 2 1 1 1 0
8 1
processpl 864 5401 0 5372 4 0 4 4 0
8 0
procpl 632 12164 0 12125 4 0 4 4 0
8 0
sosppl 128 60 0 60 15 15 0 1 0
8 0
sockpl 384 4309 0 4288 8 5 3 3 0
8 0
mcl64k 65536 2428 0 2428 212 212 0 33 0
8 0
mcl16k 16384 9 0 9 7 7 0 1 0
8 0
mcl12k 12288 82 0 82 18 17 1 1 0
8 1
mcl9k 9216 85 0 85 20 20 0 1 0
8 0
mcl8k 8192 65 0 65 17 17 0 1 0
8 0
mcl4k 4096 213 0 213 7 6 1 1 0
8 1
mcl2k2 2112 30 0 30 15 15 0 1 0
8 0
mcl2k 2048 60259 0 60200 19 11 8 14 0
8 0
mtagpl 80 319 0 73 7 1 6 6 0
8 0
mbufpl 256 122962 0 122386 141 103 38 52 0
8 0
bufpl 256 22375 0 14612 486 0 486 486 0
8 0
anonpl 16 497066 0 485291 232 167 65 65 0 62
14
amapchunkpl 152 24126 0 24008 82 63 19 19 0 158
13
amappl16 192 29788 0 29147 229 188 41 45 0
8 8
amappl15 184 12 0 11 3 2 1 1 0
8 0
amappl14 176 94 0 89 1 0 1 1 0
8 0
amappl13 168 412 0 412 3 3 0 1 0
8 0
amappl12 160 13 0 12 2 1 1 1 0
8 0
amappl11 152 66 0 55 1 0 1 1 0
8 0
amappl10 144 4781 0 4777 1 0 1 1 0
8 0
amappl9 136 608 0 605 1 0 1 1 0
8 0
amappl8 128 183 0 166 1 0 1 1 0
8 0
amappl7 120 4765 0 4757 1 0 1 1 0
8 0
amappl6 112 55 0 49 1 0 1 1 0
8 0
amappl5 104 228 0 218 1 0 1 1 0
8 0
amappl4 96 5635 0 5610 1 0 1 1 0
8 0
amappl3 88 351 0 341 1 0 1 1 0
8 0
amappl2 80 42260 0 42191 3 1 2 3 0
8 0
amappl1 72 100657 0 100253 25 16 9 19 0
8 0
amappl 80 12532 0 12493 1 0 1 1 0
84 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 138 0 9 3 0 3 3 0
8 0
uaddrrnd 24 5386 0 5372 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 5386 0 5372 1 0 1 1 0
8 0
vmmpekpl 168 35769 0 35744 2 0 2 2 0
8 0
vmmpepl 168 629262 0 627582 225 135 90 94 0 357
15
vmsppl 272 5385 0 5372 2 1 1 2 0
8 0
pdppl 4096 10779 0 10744 6 1 5 6 0
8 0
pvpl 32 1474372 0 1459507 483 321 162 259 0 265
38
pmappl 200 5385 0 5372 1 0 1 1 0
8 0
extentpl 40 41 0 26 1 0 1 1 0
8 0
phpool 112 1005 0 364 21 1 20 20 0
8 0


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Jul 31, 2019, 12:10:07 AM7/31/19
to syzkaller-o...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 75866a61 shorten the failure message, it should not wrap a..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=13279d92600000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14d506d8600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108809cc600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4724df...@syzkaller.appspotmail.com

panic: vrele: v_writecount != 0
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*429714 44852 0 0x2 0x4000000 0 syz-executor0213
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
vrele(fffffd803b532710) at vrele+0x188 sys/kern/vfs_subr.c:797
diskmapioctl(5a00,c0106477,ffff80001497fea0,1,ffff8000ffff5648) at
diskmapioctl+0x2a8 sys/dev/diskmap.c:140
VOP_IOCTL(fffffd80374158a0,c0106477,ffff80001497fea0,1,fffffd803f7c6ae0,ffff8000ffff5648)
at
VOP_IOCTL+0x88 sys/kern/vfs_vops.c:290
vn_ioctl(fffffd8036535080,c0106477,ffff80001497fea0,ffff8000ffff5648) at
vn_ioctl+0xb6 sys/kern/vfs_vnops.c:519
sys_ioctl(ffff8000ffff5648,ffff80001497ffb8,ffff800014980020) at
sys_ioctl+0x5b8
syscall(ffff800014980080) at syscall+0x508
Xsyscall(6,0,509131d80c8,0,509131d80a8,509131d80a0) at Xsyscall+0x128
end of kernel
end trace frame: 0x50bab258d20, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
vrele: v_writecount != 0
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
vrele(fffffd803b532710) at vrele+0x188 sys/kern/vfs_subr.c:797
diskmapioctl(5a00,c0106477,ffff80001497fea0,1,ffff8000ffff5648) at
diskmapioctl+0x2a8 sys/dev/diskmap.c:140
VOP_IOCTL(fffffd80374158a0,c0106477,ffff80001497fea0,1,fffffd803f7c6ae0,ffff8000ffff5648)
at
VOP_IOCTL+0x88 sys/kern/vfs_vops.c:290
vn_ioctl(fffffd8036535080,c0106477,ffff80001497fea0,ffff8000ffff5648) at
vn_ioctl+0xb6 sys/kern/vfs_vnops.c:519
sys_ioctl(ffff8000ffff5648,ffff80001497ffb8,ffff800014980020) at
sys_ioctl+0x5b8
syscall(ffff800014980080) at syscall+0x508
Xsyscall(6,0,509131d80c8,0,509131d80a8,509131d80a0) at Xsyscall+0x128
end of kernel
end trace frame: 0x50bab258d20, count: -9
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff80001497fa60
rbx 0xffff80001497fb10
rdx 0x2
rcx 0x1
rax 0x1
r8 0xffff80001497fa20
r9 0x1
r10 0x5582f37ff1e16aa8
r11 0xba385b527345ccae
r12 0x3000000008
r13 0xffff80001497fa70
r14 0x100
r15 0x1
rip 0xffffffff8141a408 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff80001497fa50
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor0213) pid=429714 stat=onproc
flags process=2<EXEC> proc=4000000<THREAD>
pri=24, usrpri=50, nice=20
forw=0xffffffffffffffff, list=0xffff8000ffff5b38,0xffff8000ffff4020
process=0xffff800014942018 user=0xffff80001497b000,
vmspace=0xfffffd803f00c220
estcpu=0, cpticks=2, pctcpu=0.0
user=0, sys=2, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
44852 35757 1804 0 2 0x2 syz-executor0213
*44852 429714 1804 0 7 0x4000002 syz-executor0213
44852 101060 1804 0 2 0x4000002 syz-executor0213
1804 210316 54369 0 3 0x10008a pause ksh
54369 107265 59454 0 3 0x92 select sshd
20252 105870 1 0 3 0x100083 ttyin getty
59454 328956 1 0 3 0x80 select sshd
29507 288062 52125 73 2 0x100090 syslogd
52125 459546 1 0 3 0x100082 netio syslogd
20059 343245 1 77 3 0x100090 poll dhclient
32781 124896 1 0 3 0x80 poll dhclient
77079 320766 0 0 2 0x14200 zerothread
52403 171623 0 0 3 0x14200 aiodoned aiodoned
16238 196056 0 0 3 0x14200 syncer update
37961 393319 0 0 3 0x14200 cleaner cleaner
89618 240927 0 0 3 0x14200 reaper reaper
68647 214 0 0 3 0x14200 pgdaemon pagedaemon
52448 173219 0 0 3 0x14200 bored crynlk
12848 441366 0 0 3 0x14200 bored crypto
85245 302917 0 0 3 0x40014200 acpi0 acpi0
15503 468649 0 0 3 0x14200 bored softnet
45423 405801 0 0 3 0x14200 bored systqmp
34818 509738 0 0 3 0x14200 bored systq
10821 221791 0 0 3 0x40014200 bored softclock
39128 99366 0 0 3 0x40014200 idle0
90799 31366 0 0 3 0x14200 bored smr
1 507578 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9429 6308K 6308K 78643K 10522 0 0
pcb 13 8K 8K 78643K 13 0 0
rtable 61 1K 2K 78643K 115 0 0
ifaddr 21 7K 7K 78643K 21 0 0
counters 19 16K 16K 78643K 19 0 0
ioctlops 0 0K 2K 78643K 13 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1181 74K 74K 78643K 1186 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 1K 78643K 2 0 0
VM map 2 0K 0K 78643K 2 0 0
sem 2 0K 0K 78643K 2 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1793 195K 288K 78643K 12645 0 0
file desc 1 0K 0K 78643K 1 0 0
proc 40 30K 38K 78643K 257 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
in_multi 11 0K 0K 78643K 11 0 0
ether_multi 1 0K 0K 78643K 1 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 18 79K 79K 78643K 18 0 0
exec 0 0K 1K 78643K 152 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 58 3K 3K 78643K 706 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
NDP 3 0K 0K 78643K 3 0 0
temp 30 2707K 2771K 78643K 1716 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 2 0 0 1 0 1 1 0
8 0
rtpcb 80 15 0 13 1 0 1 1 0
8 0
rtentry 112 23 0 1 1 0 1 1 0
8 0
unpcb 120 29 0 19 1 0 1 1 0
8 0
syncache 264 5 0 5 1 0 1 1 0
8 1
tcpcb 544 8 0 5 1 0 1 1 0
8 0
inpcb 280 22 0 16 1 0 1 1 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 97 0 0 7 0 7 7 0
8 0
art_table 32 98 0 0 1 0 1 1 0
8 0
art_node 16 22 0 2 1 0 1 1 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 1393 0 17 45 0 45 45 0
8 0
ffsino 240 1393 0 17 81 0 81 81 0
8 0
nchpl 144 1578 0 43 57 0 57 57 0
8 0
uvmvnodes 72 1402 0 0 26 0 26 26 0
8 0
vnodes 200 1402 0 0 74 0 74 74 0
8 0
namei 1024 3368 0 3368 2 1 1 1 0
8 1
scxspl 192 2266 0 2266 2 1 1 2 0
8 1
plimitpl 152 13 0 8 1 0 1 1 0
8 0
sigapl 432 176 0 166 2 0 2 2 0
8 0
futexpl 56 4 0 4 1 0 1 1 0
8 1
knotepl 112 5 0 0 1 0 1 1 0
8 0
kqueuepl 104 1 0 0 1 0 1 1 0
8 0
pipepl 112 118 0 111 2 1 1 1 0
8 0
fdescpl 424 177 0 166 2 0 2 2 0
8 0
filepl 120 840 0 796 2 0 2 2 0
8 0
lockfpl 104 6 0 6 1 1 0 1 0
8 0
lockfspl 48 3 0 3 1 1 0 1 0
8 0
sessionpl 112 17 0 9 1 0 1 1 0
8 0
pgrppl 48 17 0 9 1 0 1 1 0
8 0
ucredpl 96 47 0 40 1 0 1 1 0
8 0
zombiepl 144 166 0 166 2 1 1 1 0
8 1
processpl 864 191 0 166 4 0 4 4 0
8 0
procpl 632 193 0 166 3 0 3 3 0
8 0
sockpl 384 66 0 48 2 0 2 2 0
8 0
mcl4k 4096 10 0 10 1 0 1 1 0
8 1
mcl2k 2048 6072 0 6044 6 0 6 6 0
8 2
mtagpl 80 2 0 2 1 1 0 1 0
8 0
mbufpl 256 10382 0 10339 5 1 4 4 0
8 0
bufpl 256 2078 0 262 114 0 114 114 0
8 0
anonpl 16 17986 0 16794 8 2 6 7 0
62 1
amapchunkpl 152 480 0 441 2 0 2 2 0
158 0
amappl16 192 73 0 66 1 0 1 1 0
8 0
amappl14 176 37 0 33 1 0 1 1 0
8 0
amappl12 160 9 0 9 1 0 1 1 0
8 1
amappl11 152 36 0 25 1 0 1 1 0
8 0
amappl10 144 44 0 44 2 1 1 1 0
8 1
amappl9 136 363 0 362 1 0 1 1 0
8 0
amappl8 128 84 0 79 1 0 1 1 0
8 0
amappl7 120 18 0 16 1 0 1 1 0
8 0
amappl6 112 43 0 39 1 0 1 1 0
8 0
amappl5 104 189 0 178 1 0 1 1 0
8 0
amappl4 96 403 0 378 1 0 1 1 0
8 0
amappl3 88 147 0 136 1 0 1 1 0
8 0
amappl2 80 720 0 664 3 1 2 2 0
8 0
amappl1 72 12015 0 11615 16 8 8 16 0
8 0
amappl 80 366 0 345 1 0 1 1 0
84 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 1 0 0 1 0 1 1 0
8 0
uaddrrnd 24 177 0 166 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 177 0 166 1 0 1 1 0
8 0
vmmpekpl 168 5316 0 5300 1 0 1 1 0
8 0
vmmpepl 168 25741 0 24936 48 12 36 48 0
357 1
vmsppl 272 176 0 166 1 0 1 1 0
8 0
pdppl 4096 361 0 332 5 0 5 5 0
8 0
pvpl 32 71246 0 68431 30 4 26 26 0
265 3
pmappl 200 176 0 166 1 0 1 1 0
8 0
extentpl 40 41 0 26 1 0 1 1 0
8 0
phpool 112 229 0 4 7 0 7 7 0
8 0

Anton Lindqvist

unread,
Aug 2, 2019, 12:00:34 PM8/2/19
to syzbot, syzkaller-o...@googlegroups.com

syzbot

unread,
Aug 2, 2019, 12:32:01 PM8/2/19
to an...@basename.se, syzkaller-o...@googlegroups.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger
crash:

Reported-and-tested-by:
syzbot+4724df...@syzkaller.appspotmail.com

Tested on:

commit: 5fc8cb76 potential diskmap fix
git tree: https://github.com/mptre/openbsd-src diskmap
kernel config: https://syzkaller.appspot.com/x/.config?x=60e2b7157576c8d7
compiler:

Note: testing is done by a robot and is best-effort only.
Reply all
Reply to author
Forward
0 new messages