Hello,
syzbot found the following issue on:
HEAD commit: bf8f637750de sync
git tree: openbsd
console output:
https://syzkaller.appspot.com/x/log.txt?x=10eb1eb4580000
kernel config:
https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link:
https://syzkaller.appspot.com/bug?extid=ce0ac31779384faecf8b
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image:
https://storage.googleapis.com/syzbot-assets/ed8ba5807488/disk-bf8f6377.raw.xz
bsd.gdb:
https://storage.googleapis.com/syzbot-assets/86d04e4de645/bsd-bf8f6377.gdb.xz
kernel image:
https://storage.googleapis.com/syzbot-assets/f8df0913ed04/kernel-bf8f6377.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+ce0ac3...@syzkaller.appspotmail.com
uvm_fault(0xffffffff839b9bc0, 0xffff800029f25000, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at pvclock_get+83: movl 0(%r15),%r12d
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*229355 38117 0 0 0x4000000 0 syz-executor
pvclock_get(ffffffff838739a0) at pvclock_get+83
nanouptime(ffff80002ed1bd80) at nanouptime+97
clock_gettime(ffff80002a7b1240,3,ffff80002ed1bd80) at clock_gettime+171
sys_clock_gettime(ffff80002a7b1240,ffff80002ed1bea0,ffff80002ed1bdf0) at sys_clock_gettime+87
syscall(ffff80002ed1bea0) at syscall+2402
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xbbc3fefb200, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff839b9bc0, 0xffff800029f25000, 0, 1) -> e
ddb> trace
pvclock_get(ffffffff838739a0) at pvclock_get+83
nanouptime(ffff80002ed1bd80) at nanouptime+97
clock_gettime(ffff80002a7b1240,3,ffff80002ed1bd80) at clock_gettime+171
sys_clock_gettime(ffff80002a7b1240,ffff80002ed1bea0,ffff80002ed1bdf0) at sys_clock_gettime+87
syscall(ffff80002ed1bea0) at syscall+2402
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xbbc3fefb200, count: -6
ddb> show registers
rdi 18446603336972967936
rsi 211744 acpi_pdirpa+129425
rbp 18446603337006693456
rbx 18446744071621074056 th1
rdx 18446603336972967936
rcx 211743 acpi_pdirpa+129424
rax 0
r8 18446744071610483760 uvm_map_inentry_sp
r9 1
r10 0
r11 17813562323508626023
r12 3
r13 6810 __ALIGN_SIZE+2714
r14 18446744071621261728 pvclock_timecounter
r15 18446603336924942336
rip 18446744071614991027 pvclock_get+83
cs 8
rflags 66118 __ALIGN_SIZE+62022
rsp 18446603337006693376
ss 16
pvclock_get+83: movl 0(%r15),%r12d
ddb> show proc
PROC (syz-executor) tid=229355 pid=38117 tcnt=2 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=50, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a7b07e0,0xffffffff8395f738
process=0xffff80002a7dd690 user=0xffff80002ed16000, vmspace=0xfffffd80723d2a28
estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
38117 464358 14559 0 2 0 syz-executor
*38117 229355 14559 0 7 0x4000000 syz-executor
56029 508888 13304 0 2 0 syz-executor
56029 249172 13304 0 3 0x4000080 fsleep syz-executor
31742 497475 98754 0 3 0x80 nanoslp syz-executor
31742 468275 98754 0 3 0x4000080 kqsel syz-executor
31742 519249 98754 0 3 0x4000080 fsleep syz-executor
31742 501788 98754 0 3 0x4000080 fsleep syz-executor
89578 80423 73676 0 2 0 syz-executor
89578 54649 73676 0 3 0x4000080 fsleep syz-executor
89578 55536 73676 0 3 0x4000080 fsleep syz-executor
39186 160750 36696 0 2 0 syz-executor
39186 294191 36696 0 3 0x4000080 ttyout syz-executor
39186 209326 36696 0 3 0x4000080 kqread syz-executor
66784 245325 33903 0 2 0 syz-executor
66784 465554 33903 0 3 0x4000080 fsleep syz-executor
66812 430825 43881 0 3 0x80 nanoslp syz-executor
66812 488481 43881 0 3 0x4000080 kqsel syz-executor
66812 256360 43881 0 3 0x4000080 fsleep syz-executor
98754 476518 78298 0 3 0x82 nanoslp syz-executor
13304 472525 78298 0 3 0x82 nanoslp syz-executor
14559 187355 78298 0 3 0x82 nanoslp syz-executor
8176 118038 1 0 3 0x100083 ttyin getty
36069 82578 78298 0 3 0x82 wait syz-executor
36696 200555 78298 0 3 0x82 nanoslp syz-executor
11764 454740 0 0 3 0x14280 nfsidl nfsio
31045 398564 0 0 3 0x14280 nfsidl nfsio
17837 321023 0 0 3 0x14280 nfsidl nfsio
89467 140548 0 0 3 0x14280 nfsidl nfsio
22019 116979 0 0 3 0x14280 nfsidl nfsio
19518 125354 0 0 3 0x14280 nfsidl nfsio
23069 501645 0 0 3 0x14280 nfsidl nfsio
54474 481511 0 0 3 0x14280 nfsidl nfsio
18284 160563 0 0 3 0x14280 nfsidl nfsio
26686 251675 0 0 3 0x14280 nfsidl nfsio
79359 260806 0 0 3 0x14280 nfsidl nfsio
66653 495442 0 0 3 0x14280 nfsidl nfsio
88508 236068 0 0 3 0x14280 nfsidl nfsio
37668 226076 0 0 3 0x14280 nfsidl nfsio
36421 18892 0 0 3 0x14280 nfsidl nfsio
79472 67862 0 0 3 0x14280 nfsidl nfsio
88378 181730 0 0 3 0x14280 nfsidl nfsio
9491 50445 0 0 3 0x14280 nfsidl nfsio
38958 363855 0 0 3 0x14280 nfsidl nfsio
18075 58398 0 0 3 0x14280 nfsidl nfsio
33903 394302 78298 0 3 0x82 nanoslp syz-executor
43881 220708 78298 0 3 0x82 nanoslp syz-executor
73676 347193 78298 0 3 0x82 nanoslp syz-executor
78298 2795 77360 0 3 0x82 kqread syz-executor
77360 417723 16276 0 3 0x10008a sigsusp ksh
16276 394983 36839 0 3 0x98 kqread sshd-session
36839 2216 3378 0 3 0x92 kqread sshd-session
3378 192937 1 0 3 0x88 kqread sshd
22168 391096 10144 73 3 0x1100090 kqread syslogd
10144 147083 1 0 3 0x100082 sbwait syslogd
58308 521129 1 0 3 0x100080 kqread resolvd
19872 223379 8599 77 3 0x100092 kqread dhcpleased
88406 168999 8599 77 3 0x100092 kqread dhcpleased
8599 99298 1 0 3 0x80 kqread dhcpleased
74456 450484 0 0 3 0x14200 bored smr
34620 403623 0 0 2 0x14200 zerothread
84346 80514 0 0 3 0x14200 aiodoned aiodoned
91571 293930 0 0 3 0x14200 syncer update
40638 219579 0 0 3 0x14200 cleaner cleaner
7059 301205 0 0 3 0x14200 reaper reaper
61074 330970 0 0 3 0x14200 pgdaemon pagedaemon
83413 513863 0 0 3 0x14200 bored viomb
14297 123892 0 0 3 0x40014200 acpi0 acpi0
43566 305588 0 0 3 0x14200 bored softnet0
43740 189056 0 0 3 0x14200 bored systqmp
91462 175095 0 0 3 0x14200 bored systq
31135 384491 0 0 3 0x40014200 tmoslp softclock
95641 458684 0 0 3 0x40014200 idle0
1 302830 0 0 3 0x80082 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10206 11121K 11656K 166960K 13806 0
pcb 21 16K 17K 166960K 507 0
rtable 208 9K 9K 166960K 727 0
pf 26 12K 14K 166960K 136 0
ifaddr 35 6K 8K 166960K 128 0
ifgroup 42 1K 2K 166960K 197 0
sysctl 4 1K 9K 166960K 15 0
counters 31 17K 18K 166960K 106 0
ioctlops 0 0K 4K 166960K 428 0
iov 0 0K 38K 166960K 110 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1487 93K 93K 166960K 2474 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 25 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 0K 166960K 103 0
dirhash 87 15K 16K 166960K 1761 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 18 65K 240K 166960K 1472 0
sigio 0 0K 0K 166960K 19 0
proc 61 59K 91K 166960K 780 0
subproc 72 4K 4K 166960K 135 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 256 0
in_multi 79 5K 7K 166960K 232 0
ether_multi 1 0K 0K 166960K 15 0
mrt 0 0K 0K 166960K 8 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 271 1208K 1208K 166960K 271 0
exec 0 0K 1K 166960K 677 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 4 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 238 153K 173K 166960K 13908 0
UVM aobj 31 10K 10K 166960K 49 0
pinsyscall 39 78K 94K 166960K 2719 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 96 0
NDP 9 0K 2K 166960K 87 0
temp 74 8670K 8742K 166960K 48106 0
kqueue 15 24K 30K 166960K 253 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 205 0 201 3 0 3 3 0 8 2
rtentry 136 219 0 141 4 0 4 4 0 8 0
unpcb 144 1512 0 1496 11 2 9 11 0 8 8
syncache 336 7 0 7 1 0 1 1 0 8 1
tcpcb 736 699 0 693 7 0 7 7 0 8 6
arp 96 34 0 20 1 0 1 1 0 8 0
ipq 40 4 0 3 1 0 1 1 0 8 0
ipqe 40 7 0 6 1 0 1 1 0 8 0
inpcb 328 1744 0 1731 10 1 9 10 0 8 7
ip6q 72 3 0 1 1 0 1 1 0 8 0
ip6af 40 4 0 2 1 0 1 1 0 8 0
nd6 112 49 0 32 1 0 1 1 0 8 0
pkpcb 40 9 0 8 1 0 1 1 0 8 0
kcovpl 48 15 0 7 1 0 1 1 0 8 0
mppekey 1024 6 0 6 1 0 1 1 0 8 1
ppxss 1072 53 0 53 1 0 1 1 0 8 1
pppxif 1384 9 0 9 1 0 1 1 0 8 1
rttmr 136 2 0 2 1 0 1 1 0 8 1
art_heap8 4096 3 0 0 3 0 3 3 0 8 0
art_heap4 256 958 0 601 33 3 30 33 0 8 7
art_table 40 961 0 601 6 0 6 6 0 8 0
art_node 32 215 0 144 1 0 1 1 0 8 0
sysvmsgpl 40 16 0 10 1 0 1 1 0 8 0
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 112 100 0 90 1 0 1 1 0 8 0
shmpl 112 41 0 17 1 0 1 1 0 8 0
dirhash 1024 601 0 559 6 0 6 6 0 8 0
dino2pl 256 3877 0 2362 95 0 95 95 0 8 0
ffsino 256 3877 0 2362 95 0 95 95 0 8 0
nchpl 144 5782 0 4071 64 0 64 64 0 8 0
rtmask 32 6 0 6 1 0 1 1 0 8 1
vnodes 216 4614 0 0 257 0 257 257 0 8 0
namei 1024 21152 0 21152 1 0 1 1 0 8 1
vcpupl 3904 4 0 0 1 0 1 1 0 8 0
vmpool 800 5 0 1 1 0 1 1 0 8 0
kstatmem 264 114 0 96 2 0 2 2 0 8 0
scsiplug 72 9 0 9 1 0 1 1 0 8 1
scxspl 216 18419 0 18419 8 0 8 8 1 8 8
plimitpl 152 432 0 414 1 0 1 1 0 8 0
sigapl 424 1745 0 1682 8 0 8 8 0 8 0
knotepl 120 53834 0 53781 16 6 10 16 0 8 8
kqueuepl 184 719 0 706 4 0 4 4 0 8 3
pipepl 304 309 0 281 3 0 3 3 0 8 0
fdescpl 448 1710 0 1680 5 0 5 5 0 8 1
filepl 120 11837 0 11611 17 0 17 17 0 8 8
lockfpl 104 547 0 544 1 0 1 1 0 8 0
lockfspl 48 173 0 170 1 0 1 1 0 8 0
sessionpl 144 31 0 23 1 0 1 1 0 8 0
pgrppl 48 92 0 75 1 0 1 1 0 8 0
ucredpl 104 1642 0 1631 1 0 1 1 0 8 0
zombiepl 144 1683 0 1682 1 0 1 1 0 8 0
processpl 1152 1745 0 1682 5 0 5 5 0 8 0
procpl 664 3568 0 3493 7 0 7 7 0 8 0
sosppl 176 11 0 11 1 0 1 1 0 8 1
sockpl 552 3504 0 3470 29 19 10 26 0 8 7
mcl64k 65536 92 0 91 1 0 1 1 0 8 0
mcl16k 16384 1 0 1 1 0 1 1 0 8 1
mcl12k 12288 5 0 5 1 0 1 1 0 8 1
mcl8k 8192 85 0 85 1 0 1 1 0 8 1
mcl4k 4096 4118 0 4065 14 0 14 14 0 8 6
mcl2k 2048 2153 0 2145 5 0 5 5 0 8 4
mtagpl 96 41 0 23 1 0 1 1 0 8 0
mbufpl 256 18146 0 18012 19 0 19 19 0 8 4
bufpl 280 6838 0 617 445 0 445 445 0 8 0
anonpl 24 236242 0 232958 51 0 51 51 0 187 25
amapchunkpl 152 47689 0 46994 34 0 34 34 0 158 7
amappl16 200 3787 0 3752 25 14 11 15 0 8 8
amappl15 192 5 0 5 1 0 1 1 0 8 1
amappl14 184 2 0 2 1 0 1 1 0 8 1
amappl13 176 491 0 490 1 0 1 1 0 8 0
amappl12 168 2102 0 2063 2 0 2 2 0 8 0
amappl11 160 23 0 23 1 0 1 1 0 8 1
amappl10 152 44 0 33 1 0 1 1 0 8 0
amappl9 144 253 0 253 1 0 1 1 0 8 1
amappl8 136 26 0 24 1 0 1 1 0 8 0
amappl7 128 104 0 103 1 0 1 1 0 8 0
amappl6 120 372 0 359 1 0 1 1 0 8 0
amappl5 112 97 0 89 1 0 1 1 0 8 0
amappl4 104 429 0 402 1 0 1 1 0 8 0
amappl3 96 9436 0 9326 4 0 4 4 0 8 1
amappl2 88 590 0 536 2 0 2 2 0 8 0
amappl1 80 15133 0 14588 13 0 13 13 0 8 0
amappl 88 12860 0 12691 5 0 5 5 0 92 1
uvmvnodes 80 134 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 257 0 257 1 0 1 1 0 8 1
dma64 64 7 0 7 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 19 0 18 1 0 1 1 0 8 0
aobjpl 72 48 0 18 1 0 1 1 0 8 0
uaddrrnd 24 1710 0 1680 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1710 0 1680 1 0 1 1 0 8 0
vmmpekpl 168 13985 0 13936 3 0 3 3 0 8 0
vmmpepl 168 110989 0 109127 92 0 92 92 0 357 9
vmsppl 368 1709 0 1680 4 0 4 4 0 8 1
rwobjpl 40 28653 0 27630 13 0 13 13 0 8 1
pdppl 4096 3437 0 3366 104 33 71 81 0 8 0
pvpl 32 690021 0 680936 132 0 132 132 0 265 52
pmappl 216 1714 0 1681 3 0 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 399 0 36 11 0 11 11 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
pvclock_get(ffffffff838739a0) at pvclock_get+83
nanouptime(ffff80002ed1bd80) at nanouptime+97
clock_gettime(ffff80002a7b1240,3,ffff80002ed1bd80) at clock_gettime+171
sys_clock_gettime(ffff80002a7b1240,ffff80002ed1bea0,ffff80002ed1bdf0) at sys_clock_gettime+87
syscall(ffff80002ed1bea0) at syscall+2402
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xbbc3fefb200, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
pvclock_get(ffffffff838739a0) at pvclock_get+83
nanouptime(ffff80002ed1bd80) at nanouptime+97
clock_gettime(ffff80002a7b1240,3,ffff80002ed1bd80) at clock_gettime+171
sys_clock_gettime(ffff80002a7b1240,ffff80002ed1bea0,ffff80002ed1bdf0) at sys_clock_gettime+87
syscall(ffff80002ed1bea0) at syscall+2402
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xbbc3fefb200, count: -6
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup