syzbot

 sign-in | mailing list | source | docs
🐞 Open [52] 🐞 Fixed [314] 🐞 Invalid [326] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

Fatal trap 12: page fault in __mtx_assert

Status: fixed on 2019/03/26 17:44
Reported-by: syzbot+179a1ad49f3c4c215fa2@syzkaller.appspotmail.com
Fix commit: 7854c63d6fbe Fix a small bug in the tcp_log_id where the bucket was unlocked and yet the bucket-unlock flag was not changed to false. This can cause a panic if INVARIANTS is on and we go through the right path (though rare).
First crash: 1858d, last: 1857d
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
freebsd Fatal trap 12: page fault in __mtx_assert (3) 3 1271d 1306d 0/2 auto-closed as invalid on 2021/01/28 09:02
freebsd Fatal trap 12: page fault in __mtx_assert (4) 2 1162d 1177d 0/2 auto-closed as invalid on 2021/05/17 14:41
freebsd Fatal trap 12: page fault in __mtx_assert (5) 7 1031d 1064d 0/2 auto-closed as invalid on 2021/09/26 00:34
freebsd Fatal trap 12: page fault in __mtx_assert (2) 1 1805d 1805d 0/2 auto-closed as invalid on 2019/10/25 08:47

Sample crash report:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x80
fault code		= supervisor read data  , page not present
instruction pointer	= 0x20:0xffffffff8103c6f9
stack pointer	        = 0x28:0xfffffe001fa785e0
frame pointer	        = 0x28:0xfffffe001fa78610
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 804 (syz-executor.0)
trap number		= 12
panic: page fault
cpuid = 1
time = 1553454447
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe001fa78240
vpanic() at vpanic+0x1e0/frame 0xfffffe001fa782a0
panic() at panic+0x43/frame 0xfffffe001fa78300
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe001fa78380
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe001fa783f0
trap() at trap+0x44d/frame 0xfffffe001fa78510
calltrap() at calltrap+0x8/frame 0xfffffe001fa78510
--- trap 0xc, rip = 0xffffffff8103c6f9, rsp = 0xfffffe001fa785e0, rbp = 0xfffffe001fa78610 ---
__mtx_assert() at __mtx_assert+0xb9/frame 0xfffffe001fa78610
tcp_log_set_id() at tcp_log_set_id+0x819/frame 0xfffffe001fa78680
tcp_default_ctloutput() at tcp_default_ctloutput+0x13a4/frame 0xfffffe001fa787d0
tcp_ctloutput() at tcp_ctloutput+0x30f/frame 0xfffffe001fa78850
sosetopt() at sosetopt+0x101/frame 0xfffffe001fa788d0
kern_setsockopt() at kern_setsockopt+0x158/frame 0xfffffe001fa78950
sys_setsockopt() at sys_setsockopt+0x33/frame 0xfffffe001fa78980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe001fa78ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe001fa78ab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x412e7a, rsp = 0x7fffdffdcf38, rbp = 0x5 ---
KDB: enter: panic
[ thread pid 804 tid 100137 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/24 19:11 freebsd 46b48062555a acbc5b7d console log report syz ci-freebsd-main
2019/03/23 08:47 freebsd 0d79d351f864 3361bde5 console log report syz ci-freebsd-main
2019/03/24 18:46 freebsd 46b48062555a acbc5b7d console log report ci-freebsd-main
2019/03/23 08:30 freebsd 0d79d351f864 3361bde5 console log report ci-freebsd-main
* Struck through repros no longer work on HEAD.