syzbot


Fatal trap 12: page fault in inp_freemoptions

Status: fixed on 2019/05/15 06:10
Reported-by: syzbot+1b803796ab94d11a46f9@syzkaller.appspotmail.com
Fix commit: 5a1e222bfda7 Close some races in multicast socket option handling.
First crash: 2073d, last: 2020d
Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
Fatal trap 12: page fault while in kernel mode C 103 2074d 2078d 0/2 closed as dup on 2019/03/22 15:29
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
freebsd Fatal trap 12: page fault in inp_freemoptions (2) syz 14 1989d 1998d 2/2 fixed on 2019/10/01 00:28

Sample crash report:
Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x18
fault code		= supervisor read data  , page not present
instruction pointer	= 0x20:0xffffffff812c3df7
stack pointer	        = 0x28:0xfffffe0016ac58c0
frame pointer	        = 0x28:0xfffffe0016ac5900
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 0 (softirq_0)
trap number		= 12
panic: page fault
cpuid = 0
time = 1557289015
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0016ac5520
vpanic() at vpanic+0x1e0/frame 0xfffffe0016ac5580
panic() at panic+0x43/frame 0xfffffe0016ac55e0
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe0016ac5660
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe0016ac56d0
trap() at trap+0x44d/frame 0xfffffe0016ac57f0
calltrap() at calltrap+0x8/frame 0xfffffe0016ac57f0
--- trap 0xc, rip = 0xffffffff812c3df7, rsp = 0xfffffe0016ac58c0, rbp = 0xfffffe0016ac5900 ---
inp_freemoptions() at inp_freemoptions+0x177/frame 0xfffffe0016ac5900
in_pcbfree_deferred() at in_pcbfree_deferred+0x224/frame 0xfffffe0016ac5960
epoch_call_task() at epoch_call_task+0x262/frame 0xfffffe0016ac59c0
gtaskqueue_run_locked() at gtaskqueue_run_locked+0x13e/frame 0xfffffe0016ac5a20
gtaskqueue_thread_loop() at gtaskqueue_thread_loop+0xdd/frame 0xfffffe0016ac5a60
fork_exit() at fork_exit+0xb0/frame 0xfffffe0016ac5ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0016ac5ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 0 tid 100014 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/08 04:20 freebsd 206ba4243146 a7383bfa console log report syz C ci-freebsd-main
2019/04/10 02:47 freebsd fc127242ec6d 65b612b7 console log report syz ci-freebsd-main
2019/03/29 02:38 freebsd f5682a5ff578 14c58f8d console log report syz ci-freebsd-main
2019/03/20 10:52 freebsd 90d8cba8606b 2458c1c6 console log report syz ci-freebsd-main
2019/05/12 22:53 freebsd 94238055e0a2 5f302c04 console log report ci-freebsd-main
2019/05/08 03:47 freebsd 206ba4243146 a7383bfa console log report ci-freebsd-main
2019/05/03 11:35 freebsd 8bebf2c3297f 1bfa09b9 console log report ci-freebsd-main
2019/03/29 10:55 freebsd fb7a2f4237ac 934bb8ca console log report ci-freebsd-main
2019/03/29 02:20 freebsd f5682a5ff578 14c58f8d console log report ci-freebsd-main
2019/03/27 11:50 freebsd 4871e6f10ee5 70d776a2 console log report ci-freebsd-main
2019/03/20 10:31 freebsd 90d8cba8606b 2458c1c6 console log report ci-freebsd-main
* Struck through repros no longer work on HEAD.