syzbot


Fatal trap 12: page fault in inp_freemoptions (2)

Status: fixed on 2019/10/01 00:28
Reported-by: syzbot+195c396f06b3d19e25db@syzkaller.appspotmail.com
Fix commit: Convert all IPv4 and IPv6 multicast memberships into using a STAILQ instead of a linear array.
First crash: 1344d, last: 1335d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
freebsd Fatal trap 12: page fault in inp_freemoptions C 11 1366d 1419d 1/2 fixed on 2019/05/15 06:10

Sample crash report:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x18
fault code		= supervisor read data, page not present
instruction pointer	= 0x20:0xffffffff81298047
stack pointer	        = 0x28:0xfffffe0016b338c0
frame pointer	        = 0x28:0xfffffe0016b33900
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 0 (softirq_1)
trap number		= 12
panic: page fault
cpuid = 1
time = 1559899146
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0016b33520
vpanic() at vpanic+0x1e0/frame 0xfffffe0016b33580
panic() at panic+0x43/frame 0xfffffe0016b335e0
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe0016b33660
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe0016b336d0
trap() at trap+0x44d/frame 0xfffffe0016b337f0
calltrap() at calltrap+0x8/frame 0xfffffe0016b337f0
--- trap 0xc, rip = 0xffffffff81298047, rsp = 0xfffffe0016b338c0, rbp = 0xfffffe0016b33900 ---
inp_freemoptions() at inp_freemoptions+0x177/frame 0xfffffe0016b33900
in_pcbfree_deferred() at in_pcbfree_deferred+0x2a9/frame 0xfffffe0016b33960
epoch_call_task() at epoch_call_task+0x262/frame 0xfffffe0016b339c0
gtaskqueue_run_locked() at gtaskqueue_run_locked+0x13e/frame 0xfffffe0016b33a20
gtaskqueue_thread_loop() at gtaskqueue_thread_loop+0xdd/frame 0xfffffe0016b33a60
fork_exit() at fork_exit+0xb0/frame 0xfffffe0016b33ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0016b33ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 0 tid 100016 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (14):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-freebsd-main 2019/06/07 09:24 freebsd d539480f53f3 698773cb console log report syz
ci-freebsd-main 2019/06/05 12:01 freebsd 54eb1c14c26e bfb4a51e console log report syz
ci-freebsd-main 2019/06/04 05:06 freebsd 2b3f398e4e92 ce07a7ae console log report syz
ci-freebsd-i386 2019/06/07 09:43 freebsd d539480f53f3 698773cb console log report syz
ci-freebsd-i386 2019/06/05 12:44 freebsd 54eb1c14c26e bfb4a51e console log report syz
ci-freebsd-i386 2019/06/04 05:27 freebsd 2b3f398e4e92 ce07a7ae console log report syz
ci-freebsd-main 2019/06/13 06:33 freebsd 48cf3d0825d2 3f4e812b console log report
ci-freebsd-main 2019/06/09 22:13 freebsd af823c22958c 0159583c console log report
ci-freebsd-main 2019/06/07 09:00 freebsd d539480f53f3 698773cb console log report
ci-freebsd-main 2019/06/05 10:35 freebsd 54eb1c14c26e bfb4a51e console log report
ci-freebsd-main 2019/06/04 03:50 freebsd 2b3f398e4e92 ce07a7ae console log report
ci-freebsd-main 2019/06/03 22:42 freebsd c7cdb4a80779 63bf051f console log report
ci-freebsd-main 2019/06/03 21:28 freebsd c7cdb4a80779 63bf051f console log report
ci-freebsd-i386 2019/06/08 00:01 freebsd 2374f8977455 cf9c3a50 console log report
* Struck through repros no longer work on HEAD.