Hello,
syzbot found the following crash on:
HEAD commit: 44bcf650 include sys/sensors.h for sensor use
git tree: openbsd
console output:
https://syzkaller.appspot.com/x/log.txt?x=14face15e00000
kernel config:
https://syzkaller.appspot.com/x/.config?x=fe55924c11e64b0a
dashboard link:
https://syzkaller.appspot.com/bug?extid=6b10bbe45a21408b0c3d
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by:
syzbot+6b10bb...@syzkaller.appspotmail.com
panic: unhandled af 255
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*471884 42247 0 0 0x4000000 0 syz-executor.1
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff821b892c) at panic+0x15c sys/kern/subr_prf.c:207
unhandled_af(ff) at unhandled_af+0x16
pf_addrcpy(ffff80001e458888,ffff80001e458b80,ff) at pf_addrcpy+0x99
sys/net/pf.c:409
pfioctl(4900,c0504417,ffff80001e458b80,1,ffff8000ffff2508) at
pfioctl+0x43c0 sys/net/pf_ioctl.c:1827
VOP_IOCTL(fffffd805d68a4e0,c0504417,ffff80001e458b80,1,fffffd806c3beae0,ffff8000ffff2508)
at
VOP_IOCTL+0x88 sys/kern/vfs_vops.c:291
vn_ioctl(fffffd80540fdc38,c0504417,ffff80001e458b80,ffff8000ffff2508) at
vn_ioctl+0xb7 sys/kern/vfs_vnops.c:533
sys_ioctl(ffff8000ffff2508,ffff80001e458c98,ffff80001e458ce0) at
sys_ioctl+0x5b9
syscall(ffff80001e458d60) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa70f8909820, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
unhandled af 255
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff821b892c) at panic+0x15c sys/kern/subr_prf.c:207
unhandled_af(ff) at unhandled_af+0x16
pf_addrcpy(ffff80001e458888,ffff80001e458b80,ff) at pf_addrcpy+0x99
sys/net/pf.c:409
pfioctl(4900,c0504417,ffff80001e458b80,1,ffff8000ffff2508) at
pfioctl+0x43c0 sys/net/pf_ioctl.c:1827
VOP_IOCTL(fffffd805d68a4e0,c0504417,ffff80001e458b80,1,fffffd806c3beae0,ffff8000ffff2508)
at
VOP_IOCTL+0x88 sys/kern/vfs_vops.c:291
vn_ioctl(fffffd80540fdc38,c0504417,ffff80001e458b80,ffff8000ffff2508) at
vn_ioctl+0xb7 sys/kern/vfs_vnops.c:533
sys_ioctl(ffff8000ffff2508,ffff80001e458c98,ffff80001e458ce0) at
sys_ioctl+0x5b9
syscall(ffff80001e458d60) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa70f8909820, count: -10
ddb> show registers
rdi 0xffffffff81da8677 db_enter+0x17
rsi 0xc82
rbp 0xffff80001e458740
rbx 0xffff80001e4587f0
rdx 0xc83
rcx 0xffff800020643000
rax 0xffff800020643000
r8 0xffff80001e458700
r9 0x1
r10 0xffff800000a2f900
r11 0x38504cead0aac386
r12 0x3000000008
r13 0xffff80001e458750
r14 0x100
r15 0x1
rip 0xffffffff81da8678 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff80001e458730
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor.1) pid=471884 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=76, usrpri=76, nice=20
forw=0xffffffffffffffff, list=0xffff8000ffff2290,0xffffffff8256d538
process=0xffff8000ffff6db0 user=0xffff80001e453000,
vmspace=0xfffffd806bc09330
estcpu=36, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
42247 382560 4023 0 2 0 syz-executor.1
*42247 471884 4023 0 7 0x4000000 syz-executor.1
32593 300912 24132 0 2 0x2 syz-executor.0
4023 144263 24132 0 3 0x82 nanosleep syz-executor.1
25091 11256 0 0 3 0x14200 acct acct
24132 283673 60028 0 3 0x82 thrsleep syz-fuzzer
24132 136901 60028 0 3 0x4000082 nanosleep syz-fuzzer
24132 39323 60028 0 3 0x4000082 thrsleep syz-fuzzer
24132 478902 60028 0 3 0x4000082 thrsleep syz-fuzzer
24132 147251 60028 0 3 0x4000082 thrsleep syz-fuzzer
24132 126166 60028 0 3 0x4000082 thrsleep syz-fuzzer
24132 242023 60028 0 3 0x4000082 thrsleep syz-fuzzer
24132 262717 60028 0 3 0x4000082 kqread syz-fuzzer
60028 209311 21679 0 3 0x10008a pause ksh
21679 320377 90311 0 3 0x92 select sshd
50903 172754 1 0 3 0x100083 ttyin getty
90311 92120 1 0 3 0x80 select sshd
36752 28729 48129 73 3 0x100090 kqread syslogd
48129 307525 1 0 3 0x100082 netio syslogd
20869 501068 1 77 3 0x100090 poll dhclient
8752 414488 1 0 3 0x80 poll dhclient
11177 51291 0 0 2 0x14200 zerothread
82986 286359 0 0 3 0x14200 aiodoned aiodoned
17974 24663 0 0 3 0x14200 syncer update
3093 366573 0 0 3 0x14200 cleaner cleaner
31739 193123 0 0 3 0x14200 reaper reaper
13850 21976 0 0 3 0x14200 pgdaemon pagedaemon
39896 451152 0 0 3 0x14200 bored crynlk
5676 167247 0 0 3 0x14200 bored crypto
62814 110302 0 0 3 0x40014200 acpi0 acpi0
53876 186332 0 0 3 0x14200 bored softnet
57711 523256 0 0 3 0x14200 bored systqmp
89742 444009 0 0 3 0x14200 bored systq
97495 460910 0 0 3 0x40014200 bored softclock
62544 156147 0 0 3 0x40014200 idle0
10435 77797 0 0 3 0x14200 bored smr
1 438419 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 9456 6332K 8663K 78643K 49413 0
pcb 13 8K 8K 78643K 762 0
rtable 108 3K 3K 78643K 506 0
ifaddr 40 10K 10K 78643K 90 0
counters 19 16K 16K 78643K 19 0
ioctlops 0 0K 4K 78643K 968 0
iov 0 0K 16K 78643K 406 0
mount 1 1K 1K 78643K 1 0
vnodes 1227 77K 77K 78643K 14588 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 5K 78643K 199 0
VM map 2 0K 0K 78643K 2 0
sem 10 1K 1K 78643K 10 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1794 195K 288K 78643K 12646 0
file desc 5 13K 25K 78643K 36255 0
sigio 0 0K 0K 78643K 128 0
proc 49 38K 63K 78643K 754 0
subproc 32 2K 2K 78643K 153 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 241 0
in_multi 33 2K 2K 78643K 110 0
ether_multi 1 0K 0K 78643K 1 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 73 334K 334K 78643K 73 0
exec 0 0K 1K 78643K 318 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 7 26K 26K 78643K 7 0
UVM amap 166 24K 38K 78643K 75616 0
UVM aobj 130 4K 4K 78643K 346 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 11 0
NDP 5 0K 0K 78643K 30 0
temp 104 3021K 3090K 78643K 436254 0
kqueue 0 0K 0K 78643K 177 0
SYN cache 2 16K 16K 78643K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 20 0 14 1 0 1 1 0
8 0
rtpcb 80 243 0 241 1 0 1 1 0
8 0
rtentry 112 115 0 71 2 0 2 2 0
8 0
unpcb 120 15783 0 15773 2 1 1 2 0
8 0
syncache 264 4 0 4 1 1 0 1 0
8 0
sackhl 24 20 0 20 16 16 0 1 0
8 0
tcpcb 544 959 0 955 1 0 1 1 0
8 0
inpcb 280 11032 0 11025 8 7 1 2 0
8 0
nd6 48 18 0 14 1 0 1 1 0
8 0
pftag 88 2 0 0 1 0 1 1 0
8 0
pfqueue 264 2 0 0 1 0 1 1 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 513 0 301 14 0 14 14 0
8 0
art_table 32 514 0 301 2 0 2 2 0
8 0
art_node 16 114 0 74 1 0 1 1 0
8 0
sysvmsgpl 40 4 0 4 2 2 0 1 0
8 0
semapl 112 8 0 0 1 0 1 1 0
8 0
shmpl 112 344 0 216 4 0 4 4 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 52172 0 50758 46 0 46 46 0
8 0
ffsino 240 52172 0 50758 84 0 84 84 0
8 0
nchpl 144 106595 0 104901 63 0 63 63 0
8 0
uvmvnodes 72 5926 0 0 108 0 108 108 0
8 0
vnodes 208 5926 0 0 312 0 312 312 0
8 0
namei 1024 295245 0 295244 1 0 1 1 0
8 0
vmpool 528 7 0 7 2 2 0 1 0
8 0
scxspl 192 292691 0 292691 1 0 1 1 0
8 1
plimitpl 152 154 0 147 1 0 1 1 0
8 0
sigapl 432 36405 0 36392 2 0 2 2 0
8 0
futexpl 56 331163 0 331163 1 0 1 1 0
8 1
knotepl 112 2043 0 2024 1 0 1 1 0
8 0
kqueuepl 104 5671 0 5669 1 0 1 1 0
8 0
pipepl 112 9718 0 9699 2 1 1 2 0
8 0
fdescpl 424 36406 0 36392 2 0 2 2 0
8 0
filepl 120 176331 0 176229 38 34 4 6 0
8 0
lockfpl 104 11359 0 11357 1 0 1 1 0
8 0
lockfspl 48 3834 0 3832 1 0 1 1 0
8 0
sessionpl 112 24 0 14 1 0 1 1 0
8 0
pgrppl 48 1890 0 1880 1 0 1 1 0
8 0
ucredpl 96 28457 0 28449 1 0 1 1 0
8 0
zombiepl 144 36393 0 36393 1 0 1 1 0
8 1
processpl 872 36422 0 36393 4 0 4 4 0
8 0
procpl 632 74588 0 74551 4 0 4 4 0
8 0
sockpl 384 27059 0 27040 70 67 3 8 0
8 1
mcl64k 65536 299 0 299 15 15 0 1 0
8 0
mcl16k 16384 53 0 53 16 16 0 1 0
8 0
mcl12k 12288 699 0 699 27 27 0 1 0
8 0
mcl9k 9216 648 0 648 23 23 0 1 0
8 0
mcl8k 8192 659 0 659 33 33 0 1 0
8 0
mcl4k 4096 3313 0 3313 44 43 1 1 0
8 1
mcl2k2 2112 119 0 119 53 53 0 1 0
8 0
mcl2k 2048 66597 0 66545 29 22 7 12 0
8 0
mtagpl 80 3950 0 3565 14 6 8 11 0
8 0
mbufpl 256 293318 0 292433 111 52 59 72 0
8 0
bufpl 280 69733 0 63549 442 0 442 442 0
8 0
anonpl 16 2150703 0 2145850 32 3 29 29 0
107 0
amapchunkpl 152 115538 0 115442 32 27 5 18 0
158 0
amappl16 192 144543 0 144201 30 12 18 19 0
8 0
amappl15 184 13749 0 13743 1 0 1 1 0
8 0
amappl14 176 75 0 73 1 0 1 1 0
8 0
amappl13 168 1803 0 1803 2 2 0 1 0
8 0
amappl12 160 15554 0 15553 3 2 1 1 0
8 0
amappl11 152 1181 0 1170 1 0 1 1 0
8 0
amappl10 144 3537 0 3532 1 0 1 1 0
8 0
amappl9 136 1098 0 1095 1 0 1 1 0
8 0
amappl8 128 991 0 914 3 0 3 3 0
8 0
amappl7 120 3659 0 3645 1 0 1 1 0
8 0
amappl6 112 1172 0 1166 1 0 1 1 0
8 0
amappl5 104 16077 0 16067 1 0 1 1 0
8 0
amappl4 96 22684 0 22649 1 0 1 1 0
8 0
amappl3 88 16685 0 16678 1 0 1 1 0
8 0
amappl2 80 299660 0 299586 3 1 2 3 0
8 0
amappl1 72 601048 0 600630 26 17 9 20 0
8 0
amappl 80 74869 0 74832 1 0 1 1 0
84 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma128 128 253 0 253 1 1 0 1 0
8 0
dma64 64 6 0 6 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 18 0 17 1 0 1 1 0
8 0
aobjpl 64 345 0 216 3 0 3 3 0
8 0
uaddrrnd 24 36413 0 36399 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 36413 0 36399 1 0 1 1 0
8 0
vmmpekpl 168 178173 0 178150 2 0 2 2 0
8 0
vmmpepl 168 4016012 0 4014522 161 91 70 78 0
357 0
vmsppl 272 36412 0 36399 2 1 1 2 0
8 0
pdppl 4096 72832 0 72798 6 1 5 6 0
8 0
pvpl 32 6228250 0 6220298 207 125 82 115 0
265 0
pmappl 200 36412 0 36399 1 0 1 1 0
8 0
extentpl 40 46 0 29 1 0 1 1 0
8 0
phpool 112 362 0 185 6 0 6 6 0
8 0
---
This bug is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.