syzbot
Fatal trap 12: page fault in vm_page_unhold_pages
Status:
fixed on 2019/06/30 05:55
Reported-by: syzbot+21811cc0a89b2a87a9e7@syzkaller.appspotmail.com
Fix commit:
02476c44c5eb
Fix mutual exclusion in pipe_direct_write().
First crash: 2746d, last: 2652d
Sample crash report:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x30
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff815399ca
stack pointer = 0x28:0xfffffe0020e9a7a0
frame pointer = 0x28:0xfffffe0020e9a7e0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 759 (syz-executor0916855)
trap number = 12
panic: page fault
cpuid = 1
time = 1559983576
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0020e9a400
vpanic() at vpanic+0x1e0/frame 0xfffffe0020e9a460
panic() at panic+0x43/frame 0xfffffe0020e9a4c0
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe0020e9a540
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe0020e9a5b0
trap() at trap+0x44d/frame 0xfffffe0020e9a6d0
calltrap() at calltrap+0x8/frame 0xfffffe0020e9a6d0
--- trap 0xc, rip = 0xffffffff815399ca, rsp = 0xfffffe0020e9a7a0, rbp = 0xfffffe0020e9a7e0 ---
vm_page_unhold_pages() at vm_page_unhold_pages+0x5a/frame 0xfffffe0020e9a7e0
pipe_write() at pipe_write+0x16d8/frame 0xfffffe0020e9a8b0
dofilewrite() at dofilewrite+0xfd/frame 0xfffffe0020e9a910
kern_writev() at kern_writev+0x66/frame 0xfffffe0020e9a950
sys_writev() at sys_writev+0x50/frame 0xfffffe0020e9a980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe0020e9aab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0020e9aab0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x45768a, rsp = 0x7fffdfffdf88, rbp = 0x6b5bc8 ---
KDB: enter: panic
[ thread pid 759 tid 100105 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why
* Struck through repros no longer work on HEAD.