syzbot


Fatal trap 12: page fault in callout_process

Status: auto-closed as invalid on 2020/01/01 04:28
Reported-by: syzbot+f2b37c49b7fea5fe2570@syzkaller.appspotmail.com
First crash: 2005d, last: 1890d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
freebsd Fatal trap 12: page fault in callout_process (2) 7 1304d 1332d 2/2 fixed on 2021/05/14 16:11
freebsd Fatal trap 12: page fault in callout_process (3) 1 1297d 1297d 0/2 auto-closed as invalid on 2021/08/16 03:32

Sample crash report:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x20:0xffffffff81087b7d
stack pointer	        = 0x0:0xfffffe00244a8600
frame pointer	        = 0x0:0xfffffe00244a8680
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= resume, IOPL = 0
current process		= 3580 (syz-executor.1)
trap number		= 12
panic: page fault
cpuid = 1
time = 1570076822
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00244a8250
vpanic() at vpanic+0x1e0/frame 0xfffffe00244a82b0
panic() at panic+0x43/frame 0xfffffe00244a8310
trap_fatal() at trap_fatal+0x4de/frame 0xfffffe00244a8390
trap_pfault() at trap_pfault+0xdc/frame 0xfffffe00244a8410
trap() at trap+0x44f/frame 0xfffffe00244a8530
calltrap() at calltrap+0x8/frame 0xfffffe00244a8530
--- trap 0xc, rip = 0xffffffff81087b7d, rsp = 0xfffffe00244a8600, rbp = 0xfffffe00244a8680 ---
callout_process() at callout_process+0x22d/frame 0xfffffe00244a8680
handleevents() at handleevents+0x314/frame 0xfffffe00244a86e0
timercb() at timercb+0x3a4/frame 0xfffffe00244a8730
lapic_handle_timer() at lapic_handle_timer+0xdf/frame 0xfffffe00244a8770
Xtimerint() at Xtimerint+0xb1/frame 0xfffffe00244a8770
--- interrupt, rip = 0xffffffff810c7acd, rsp = 0xfffffe00244a8848, rbp = 0xfffffe00244a8880 ---
__sanitizer_cov_trace_const_cmp4() at __sanitizer_cov_trace_const_cmp4+0xd/frame 0xfffffe00244a8880
do_wait() at do_wait+0x3d4/frame 0xfffffe00244a8910
__umtx_op_wait_uint_private_compat32() at __umtx_op_wait_uint_private_compat32+0x91/frame 0xfffffe00244a8970
ia32_syscall() at ia32_syscall+0x46a/frame 0xfffffe00244a8ab0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xffffdb2c
KDB: enter: panic
[ thread pid 3580 tid 100238 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/03 04:27 freebsd 2e55322e1afc 2e29b534 console log report ci-freebsd-i386
2019/06/10 08:22 freebsd c93a14fd8c6e 0159583c console log report ci-freebsd-i386
* Struck through repros no longer work on HEAD.