syzbot


Fatal trap 12: page fault in vm_page_unhold_pages

Status: fixed on 2019/06/30 05:55
Reported-by: syzbot+21811cc0a89b2a87a9e7@syzkaller.appspotmail.com
Fix commit: 02476c44c5eb Fix mutual exclusion in pipe_direct_write().
First crash: 1836d, last: 1742d
Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
panic: vm_page_unhold: hold count < 0!!! syz 114 1747d 1838d 0/2 closed as dup on 2019/07/02 14:54

Sample crash report:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x30
fault code		= supervisor read data, page not present
instruction pointer	= 0x20:0xffffffff815399ca
stack pointer	        = 0x28:0xfffffe0020e9a7a0
frame pointer	        = 0x28:0xfffffe0020e9a7e0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 759 (syz-executor0916855)
trap number		= 12
panic: page fault
cpuid = 1
time = 1559983576
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0020e9a400
vpanic() at vpanic+0x1e0/frame 0xfffffe0020e9a460
panic() at panic+0x43/frame 0xfffffe0020e9a4c0
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe0020e9a540
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe0020e9a5b0
trap() at trap+0x44d/frame 0xfffffe0020e9a6d0
calltrap() at calltrap+0x8/frame 0xfffffe0020e9a6d0
--- trap 0xc, rip = 0xffffffff815399ca, rsp = 0xfffffe0020e9a7a0, rbp = 0xfffffe0020e9a7e0 ---
vm_page_unhold_pages() at vm_page_unhold_pages+0x5a/frame 0xfffffe0020e9a7e0
pipe_write() at pipe_write+0x16d8/frame 0xfffffe0020e9a8b0
dofilewrite() at dofilewrite+0xfd/frame 0xfffffe0020e9a910
kern_writev() at kern_writev+0x66/frame 0xfffffe0020e9a950
sys_writev() at sys_writev+0x50/frame 0xfffffe0020e9a980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe0020e9aab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0020e9aab0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x45768a, rsp = 0x7fffdfffdf88, rbp = 0x6b5bc8 ---
KDB: enter: panic
[ thread pid 759 tid 100105 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (1169):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/08 08:50 freebsd 2374f8977455 cf9c3a50 console log report syz C ci-freebsd-main
2019/04/18 05:20 freebsd a93250da7537 b0e8efcb console log report syz C ci-freebsd-main
2019/03/20 04:36 freebsd 90d8cba8606b 2458c1c6 console log report syz C ci-freebsd-main
2019/06/22 03:33 freebsd 1eab0f965fe9 34bf9440 console log report ci-freebsd-main
2019/06/21 16:00 freebsd 4292f60c907d 34bf9440 console log report ci-freebsd-main
2019/06/20 13:02 freebsd 395e29f3c036 34bf9440 console log report ci-freebsd-main
2019/06/19 06:32 freebsd b96ef4b59c4f 34bf9440 console log report ci-freebsd-main
2019/06/19 01:51 freebsd b96ef4b59c4f 34bf9440 console log report ci-freebsd-main
2019/06/18 19:17 freebsd ad062d552df4 e3f76baa console log report ci-freebsd-main
2019/06/18 16:52 freebsd ad062d552df4 e3f76baa console log report ci-freebsd-main
2019/06/18 14:50 freebsd ad062d552df4 e3f76baa console log report ci-freebsd-main
2019/06/18 13:41 freebsd ad062d552df4 e3f76baa console log report ci-freebsd-main
2019/06/18 00:54 freebsd 8ba06c8b811e 442206d7 console log report ci-freebsd-main
2019/06/17 22:37 freebsd 8ba06c8b811e 442206d7 console log report ci-freebsd-main
2019/06/17 16:12 freebsd 13d77c26ac6e 442206d7 console log report ci-freebsd-main
2019/06/17 08:43 freebsd 13d77c26ac6e 442206d7 console log report ci-freebsd-main
2019/06/16 22:38 freebsd e79b1eca2af2 442206d7 console log report ci-freebsd-main
2019/06/16 21:11 freebsd e79b1eca2af2 442206d7 console log report ci-freebsd-main
2019/06/16 12:35 freebsd daabb062f048 442206d7 console log report ci-freebsd-main
2019/06/16 06:27 freebsd daabb062f048 442206d7 console log report ci-freebsd-main
2019/06/15 23:16 freebsd 2a22d4279f79 442206d7 console log report ci-freebsd-main
2019/06/15 12:08 freebsd 4b2d667e890c 442206d7 console log report ci-freebsd-main
2019/06/15 09:17 freebsd 4b2d667e890c 442206d7 console log report ci-freebsd-main
2019/06/15 06:50 freebsd 4b2d667e890c 442206d7 console log report ci-freebsd-main
2019/06/15 05:42 freebsd 4b2d667e890c 442206d7 console log report ci-freebsd-main
2019/06/15 00:11 freebsd 4b2d667e890c 442206d7 console log report ci-freebsd-main
2019/06/14 12:41 freebsd 4fd6fe044c74 998ccc76 console log report ci-freebsd-main
2019/06/14 10:42 freebsd 4fd6fe044c74 998ccc76 console log report ci-freebsd-main
2019/06/14 07:21 freebsd 4fd6fe044c74 998ccc76 console log report ci-freebsd-main
2019/06/14 02:08 freebsd 13a313ede7b5 d25bb7ad console log report ci-freebsd-main
2019/06/14 00:10 freebsd 13a313ede7b5 d25bb7ad console log report ci-freebsd-main
2019/06/13 22:55 freebsd 13a313ede7b5 d25bb7ad console log report ci-freebsd-main
2019/06/13 18:54 freebsd 13a313ede7b5 d25bb7ad console log report ci-freebsd-main
2019/06/13 09:57 freebsd 48cf3d0825d2 3f4e812b console log report ci-freebsd-main
2019/06/13 08:48 freebsd 48cf3d0825d2 3f4e812b console log report ci-freebsd-main
2019/06/13 06:09 freebsd 48cf3d0825d2 3f4e812b console log report ci-freebsd-main
2019/06/13 04:14 freebsd 48cf3d0825d2 3f4e812b console log report ci-freebsd-main
2019/06/13 02:59 freebsd 48cf3d0825d2 3f4e812b console log report ci-freebsd-main
2019/06/12 19:46 freebsd 1f3b25e11df9 794a1ad7 console log report ci-freebsd-main
2019/06/12 18:01 freebsd 1f3b25e11df9 794a1ad7 console log report ci-freebsd-main
2019/06/12 15:49 freebsd 1f3b25e11df9 794a1ad7 console log report ci-freebsd-main
2019/06/12 13:40 freebsd 1f3b25e11df9 794a1ad7 console log report ci-freebsd-main
2019/06/12 11:34 freebsd 1f3b25e11df9 794a1ad7 console log report ci-freebsd-main
2019/06/12 08:36 freebsd f47bc88408ff ea2f4006 console log report ci-freebsd-main
2019/06/12 03:33 freebsd f47bc88408ff ea2f4006 console log report ci-freebsd-main
2019/06/11 22:43 freebsd f47bc88408ff ea2f4006 console log report ci-freebsd-main
2019/06/11 20:39 freebsd 300397edf326 5b5826d0 console log report ci-freebsd-main
2019/06/11 19:17 freebsd 300397edf326 5b5826d0 console log report ci-freebsd-main
2019/06/11 16:10 freebsd 300397edf326 5b5826d0 console log report ci-freebsd-main
2019/06/11 14:58 freebsd 300397edf326 5b5826d0 console log report ci-freebsd-main
2019/03/20 01:07 freebsd 90d8cba8606b 2458c1c6 console log report ci-freebsd-main
* Struck through repros no longer work on HEAD.