syzbot


Fatal trap 12: page fault in uma_dbg_alloc

Status: auto-closed as invalid on 2019/10/25 08:42
Reported-by: syzbot+90fe3f1177593e6ad819@syzkaller.appspotmail.com
First crash: 1813d, last: 1813d

Sample crash report:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x5c
fault code		= supervisor read data  , page not present
instruction pointer	= 0x20:0xffffffff815382fb
stack pointer	        = 0x28:0xfffffe002285e2b0
frame pointer	        = 0x28:0xfffffe002285e2f0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 5757 (syz-executor.2)
trap number		= 12
panic: page fault
cpuid = 1
time = 269
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002285df10
vpanic() at vpanic+0x1e0/frame 0xfffffe002285df70
panic() at panic+0x43/frame 0xfffffe002285dfd0
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe002285e050
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe002285e0c0
trap() at trap+0x44d/frame 0xfffffe002285e1e0
calltrap() at calltrap+0x8/frame 0xfffffe002285e1e0
--- trap 0xc, rip = 0xffffffff815382fb, rsp = 0xfffffe002285e2b0, rbp = 0xfffffe002285e2f0 ---
uma_dbg_alloc() at uma_dbg_alloc+0x13b/frame 0xfffffe002285e2f0
uma_zalloc_arg() at uma_zalloc_arg+0x10cb/frame 0xfffffe002285e3a0
m_getm2() at m_getm2+0x1c0/frame 0xfffffe002285e410
sctp_get_mbuf_for_msg() at sctp_get_mbuf_for_msg+0x4a/frame 0xfffffe002285e450
sctp_send_abort_tcb() at sctp_send_abort_tcb+0x17a/frame 0xfffffe002285e4c0
sctp_abort_an_association() at sctp_abort_an_association+0x38/frame 0xfffffe002285e500
sctp_lower_sosend() at sctp_lower_sosend+0x2b12/frame 0xfffffe002285e6d0
sctp_sosend() at sctp_sosend+0x510/frame 0xfffffe002285e800
sosend() at sosend+0xc6/frame 0xfffffe002285e870
soo_write() at soo_write+0x61/frame 0xfffffe002285e8b0
dofilewrite() at dofilewrite+0xfd/frame 0xfffffe002285e910
kern_writev() at kern_writev+0x66/frame 0xfffffe002285e950
sys_writev() at sys_writev+0x50/frame 0xfffffe002285e980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe002285eab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe002285eab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x41309a, rsp = 0x7fffdffdcf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 5757 tid 100680 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/11 00:07 freebsd fbc304aae0ef 46caad94 console log report ci-freebsd-main
* Struck through repros no longer work on HEAD.