syzbot
Fatal trap 18: integer divide fault in kern_fcntl
Status:
fixed on 2019/10/02 23:07
Reported-by: syzbot+e4b682208761aa5bc53a@syzkaller.appspotmail.com
Fix commit:
4a7b33ecf4d8
Disallow fcntl(F_READAHEAD) when the vnode is not a regular file.
First crash: 2554d, last: 2528d
Sample crash report:
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff80fd5f90
stack pointer = 0x28:0xfffffe001f8e0850
frame pointer = 0x28:0xfffffe001f8e08f0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 30814 (syz-executor.0)
trap number = 18
panic: integer divide fault
cpuid = 0
time = 1566226220
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe001f8e0520
vpanic() at vpanic+0x1e0/frame 0xfffffe001f8e0580
panic() at panic+0x43/frame 0xfffffe001f8e05e0
trap_fatal() at trap_fatal+0x4de/frame 0xfffffe001f8e0660
trap() at trap+0xba/frame 0xfffffe001f8e0780
calltrap() at calltrap+0x8/frame 0xfffffe001f8e0780
--- trap 0x12, rip = 0xffffffff80fd5f90, rsp = 0xfffffe001f8e0850, rbp = 0xfffffe001f8e08f0 ---
kern_fcntl() at kern_fcntl+0xa30/frame 0xfffffe001f8e08f0
kern_fcntl_freebsd() at kern_fcntl_freebsd+0x14f/frame 0xfffffe001f8e0980
amd64_syscall() at amd64_syscall+0x479/frame 0xfffffe001f8e0ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe001f8e0ab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x41328a, rsp = 0x7fffdfffdf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 30814 tid 100945 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why
* Struck through repros no longer work on HEAD.