syzbot
Fatal trap 12: page fault in uipc_send
Status:
fixed on 2019/10/09 11:23
Reported-by: syzbot+1b5cced0f7fad26ae382@syzkaller.appspotmail.com
Fix commit:
4013d7268446
Fix handling of empty SCM_RIGHTS messages.
First crash: 2635d, last: 2504d
Sample crash report:
Fatal trap 12: page fault while in kernel mode
linker_load_file: /boot/kernel/if_tap.ko - unsupported file type
cpuid = 0; apic id = 00
fault virtual address = 0x0
fault code = supervisor write data, page not present
instruction pointer = 0x20:0xffffffff8112deca
stack pointer = 0x0:0xfffffe0020eb85f0
frame pointer = 0x0:0xfffffe0020eb86a0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 790 (syz-executor.0)
trap number = 12
panic: page fault
cpuid = 0
time = 1559293506
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0020eb8250
vpanic() at vpanic+0x1e0/frame 0xfffffe0020eb82b0
panic() at panic+0x43/frame 0xfffffe0020eb8310
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe0020eb8390
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe0020eb8400
trap() at trap+0x44d/frame 0xfffffe0020eb8520
calltrap() at calltrap+0x8/frame 0xfffffe0020eb8520
--- trap 0xc, rip = 0xffffffff8112deca, rsp = 0xfffffe0020eb85f0, rbp = 0xfffffe0020eb86a0 ---
uipc_send() at uipc_send+0x5fa/frame 0xfffffe0020eb86a0
sosend_generic() at sosend_generic+0x73d/frame 0xfffffe0020eb8770
sosend() at sosend+0xc6/frame 0xfffffe0020eb87e0
kern_sendit() at kern_sendit+0x35e/frame 0xfffffe0020eb8890
freebsd32_sendmsg() at freebsd32_sendmsg+0x26b/frame 0xfffffe0020eb8970
ia32_syscall() at ia32_syscall+0x452/frame 0xfffffe0020eb8ab0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0x8142e1f
KDB: enter: panic
[ thread pid 790 tid 100111 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why
Struck through repros no longer work on HEAD.