syzbot

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0xffffffffffffffff
fault code		= supervisor write data, page not present
instruction pointer	= 0x20:0xffffffff819ca1b0
stack pointer	        = 0x28:0xfffffe0056e58540
frame pointer	        = 0x28:0xfffffe0056e58570
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1062 (syz-executor)
rdi: fffffe00778d6000 rsi: 0000000000000000 rdx: 0000000000000000
rcx: 000000000ef1ac00  r8: 0000000000000000  r9: 0000000000000001
rax: ffffffffffffffff rbx: fffffe00778d6044 rbp: fffffe0056e58570
r10: 0000000000000000 r11: 0000000000000000 r12: ffffffffffffffff
r13: fffffe00778d6250 r14: fffffe00778d6000 r15: fffffe00778d6008
trap number		= 12
panic: page fault
cpuid = 1
time = 11
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056e57d70
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056e57ed0
vpanic() at vpanic+0x257/frame 0xfffffe0056e58090
panic() at panic+0xb5/frame 0xfffffe0056e58150
trap_pfault() at trap_pfault+0xaf2/frame 0xfffffe0056e58290
trap() at trap+0x78e/frame 0xfffffe0056e58470
calltrap() at calltrap+0x8/frame 0xfffffe0056e58470
--- trap 0xc, rip = 0xffffffff819ca1b0, rsp = 0xfffffe0056e58540, rbp = 0xfffffe0056e58570 ---
in_pcbremhash_locked() at in_pcbremhash_locked+0x110/frame 0xfffffe0056e58570
in_pcbdrop() at in_pcbdrop+0x98/frame 0xfffffe0056e58590
tcp_close() at tcp_close+0x177/frame 0xfffffe0056e58660
tcp_disconnect() at tcp_disconnect+0x1ef/frame 0xfffffe0056e58690
tcp_usr_close() at tcp_usr_close+0x189/frame 0xfffffe0056e58770
soclose() at soclose+0x3d0/frame 0xfffffe0056e58860
_fdrop() at _fdrop+0x5c/frame 0xfffffe0056e58890
closef() at closef+0x655/frame 0xfffffe0056e58a70
fdescfree() at fdescfree+0xa5e/frame 0xfffffe0056e58c50
exit1() at exit1+0x887/frame 0xfffffe0056e58cf0
sys__exit() at sys__exit+0x28/frame 0xfffffe0056e58d10
amd64_syscall() at amd64_syscall+0x4e2/frame 0xfffffe0056e58f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0056e58f30
--- syscall (1, FreeBSD ELF64, _exit), rip = 0x3a723a, rsp = 0x820b8ee08, rbp = 0x820b8ee10 ---
KDB: enter: panic
[ thread pid 1062 tid 100240 ]
Stopped at      kdb_enter+0x6e: movq    $0,0x259df67(%rip)
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs                        0x20
ds                        0x3b
es                        0x3b
fs                        0x13
gs                        0x1b
ss                        0x28
rax                       0x12
rcx         0xfffffe0002bf1850
rdx                          0
rbx         0xffffffff8280e800  .str.27
rsp         0xfffffe0056e57eb0
rbp         0xfffffe0056e57ed0
rsi                          0
rdi         0xffffffff81646849  printf+0x149
r8                           0
r9                  0xffffffff
r10                          0
r11                       0x17
r12         0xfffffe005411c000
r13         0xfffffffffffffffd
r14         0xffffffff8280e800  .str.27
r15                          0
rip         0xffffffff8162fc2e  kdb_enter+0x6e
rflags                    0x46
kdb_enter+0x6e: movq    $0,0x259df67(%rip)
db> show proc
Process 1062 (syz-executor) at 0xfffffe0054121000:
 state: NORMAL
 uid: 0 gid: 0 supp gids: 0, 5
 parent: pid 768 at 0xfffffe00540f9ab0
 ABI: FreeBSD ELF64
 flag: 0x10002000  flag2: 0x40000
 arguments: ./syz-executor exec
 reaper: 0xfffffe0007809010 reapsubtree: 1
 sigparent: 20
 vmspace: 0xfffffe000780fdb0
   (map 0xfffffe000780fdb0)
   (map.pmap 0xfffffe000780fe50)
   (pmap 0xfffffe000780fec0)
 threads: 1
100240                   Run     CPU 1                       syz-executor
db>