syzbot


Fatal trap 12: page fault in uipc_send

Status: fixed on 2019/10/09 11:23
Reported-by: syzbot+1b5cced0f7fad26ae382@syzkaller.appspotmail.com
Fix commit: 4013d7268446 Fix handling of empty SCM_RIGHTS messages.
First crash: 1783d, last: 1652d

Sample crash report:
Fatal trap 12: page fault while in kernel mode
linker_load_file: /boot/kernel/if_tap.ko - unsupported file type
cpuid = 0; apic id = 00
fault virtual address	= 0x0
fault code		= supervisor write data, page not present
instruction pointer	= 0x20:0xffffffff8112deca
stack pointer	        = 0x0:0xfffffe0020eb85f0
frame pointer	        = 0x0:0xfffffe0020eb86a0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 790 (syz-executor.0)
trap number		= 12
panic: page fault
cpuid = 0
time = 1559293506
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0020eb8250
vpanic() at vpanic+0x1e0/frame 0xfffffe0020eb82b0
panic() at panic+0x43/frame 0xfffffe0020eb8310
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe0020eb8390
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe0020eb8400
trap() at trap+0x44d/frame 0xfffffe0020eb8520
calltrap() at calltrap+0x8/frame 0xfffffe0020eb8520
--- trap 0xc, rip = 0xffffffff8112deca, rsp = 0xfffffe0020eb85f0, rbp = 0xfffffe0020eb86a0 ---
uipc_send() at uipc_send+0x5fa/frame 0xfffffe0020eb86a0
sosend_generic() at sosend_generic+0x73d/frame 0xfffffe0020eb8770
sosend() at sosend+0xc6/frame 0xfffffe0020eb87e0
kern_sendit() at kern_sendit+0x35e/frame 0xfffffe0020eb8890
freebsd32_sendmsg() at freebsd32_sendmsg+0x26b/frame 0xfffffe0020eb8970
ia32_syscall() at ia32_syscall+0x452/frame 0xfffffe0020eb8ab0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0x8142e1f
KDB: enter: panic
[ thread pid 790 tid 100111 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (123):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/31 09:08 freebsd 66fe45284525 d9aaf3c2 console log report syz ci-freebsd-i386
2019/05/31 07:35 freebsd 66fe45284525 d9aaf3c2 console log report syz ci-freebsd-i386
2019/05/31 00:10 freebsd a25b408b0459 d9aaf3c2 console log report syz ci-freebsd-i386
2019/05/30 11:16 freebsd 03c5d90f7c16 d9aaf3c2 console log report syz ci-freebsd-i386
2019/05/30 09:09 freebsd 03c5d90f7c16 d9aaf3c2 console log report syz ci-freebsd-i386
2019/05/30 05:03 freebsd 03c5d90f7c16 d9aaf3c2 console log report syz ci-freebsd-i386
2019/05/30 04:03 freebsd 03c5d90f7c16 d9aaf3c2 console log report syz ci-freebsd-i386
2019/05/29 20:16 freebsd 13c96c4bd700 2c7afa51 console log report syz ci-freebsd-i386
2019/05/29 15:27 freebsd 13c96c4bd700 2c7afa51 console log report syz ci-freebsd-i386
2019/05/29 15:04 freebsd 13c96c4bd700 2c7afa51 console log report syz ci-freebsd-i386
2019/10/08 06:29 freebsd 1b78566aece1 28ac6e64 console log report ci-freebsd-i386
2019/10/07 05:37 freebsd f1dc1802093e f3f7d9c8 console log report ci-freebsd-i386
2019/10/05 06:24 freebsd 5dab8f30b640 f3f7d9c8 console log report ci-freebsd-i386
2019/10/04 22:11 freebsd 64f4d792c140 b2f369e5 console log report ci-freebsd-i386
2019/10/01 08:02 freebsd 27a9e100abe6 c7a4fb99 console log report ci-freebsd-i386
2019/09/30 14:50 freebsd b66d6defe2e2 c7a4fb99 console log report ci-freebsd-i386
2019/09/30 08:58 freebsd 2e8c47f81195 c1ad5441 console log report ci-freebsd-i386
2019/09/28 17:10 freebsd 4ed8c797237c eb6b9855 console log report ci-freebsd-i386
2019/09/28 15:39 freebsd 4ed8c797237c eb6b9855 console log report ci-freebsd-i386
2019/09/28 09:53 freebsd d130e737a23b d8074e0b console log report ci-freebsd-i386
2019/09/27 18:14 freebsd 0eeddc2571a9 d8074e0b console log report ci-freebsd-i386
2019/09/26 10:11 freebsd 4b17c31383e5 24d405a3 console log report ci-freebsd-i386
2019/09/25 22:51 freebsd 967c0718849e a3355dba console log report ci-freebsd-i386
2019/09/23 23:48 freebsd 58ff07f14771 1e9788a0 console log report ci-freebsd-i386
2019/09/22 06:39 freebsd 14aef6dfca96 d96e88f3 console log report ci-freebsd-i386
2019/09/17 20:34 freebsd c187267b8783 13dcda9b console log report ci-freebsd-i386
2019/09/17 03:01 freebsd 0917480bfdfa 51ca0454 console log report ci-freebsd-i386
2019/09/12 06:31 freebsd add96fb8ab06 f4e53c10 console log report ci-freebsd-i386
2019/09/11 09:48 freebsd 90935defee1d a60cb4cd console log report ci-freebsd-i386
2019/09/09 12:49 freebsd 752098d2d559 a60cb4cd console log report ci-freebsd-i386
2019/09/09 05:43 freebsd 00598670aeac a60cb4cd console log report ci-freebsd-i386
2019/09/09 00:24 freebsd 00598670aeac a60cb4cd console log report ci-freebsd-i386
2019/09/06 10:01 freebsd 5c5f385b1b95 c16be727 console log report ci-freebsd-i386
2019/09/05 09:26 freebsd a57d7dbb6cb5 040fda58 console log report ci-freebsd-i386
2019/09/04 08:01 freebsd e9cd6db8f438 526709ff console log report ci-freebsd-i386
2019/09/01 12:27 freebsd 5d15f9ad7512 bad3cce2 console log report ci-freebsd-i386
2019/08/31 21:07 freebsd 2a0e79362033 bad3cce2 console log report ci-freebsd-i386
2019/08/29 05:29 freebsd c17eb3d289cd 40203c15 console log report ci-freebsd-i386
2019/08/25 23:29 freebsd 6c54dfdc8e30 d21c5d9d console log report ci-freebsd-i386
2019/08/25 03:33 freebsd 4e8090e4b586 d21c5d9d console log report ci-freebsd-i386
2019/08/24 07:27 freebsd 7ed91a6e6f69 78ded196 console log report ci-freebsd-i386
2019/08/22 09:16 freebsd 0c80a33415fe 984250d5 console log report ci-freebsd-i386
2019/08/16 02:58 freebsd f53c2107a8ce faeffb00 console log report ci-freebsd-i386
2019/08/15 11:18 freebsd fdacbd035829 0d298d6b console log report ci-freebsd-i386
2019/08/14 09:43 freebsd 604e65334e19 ef801a3e console log report ci-freebsd-i386
2019/08/11 16:43 freebsd eb6bc012a07e acb51638 console log report ci-freebsd-i386
2019/08/11 09:55 freebsd eb6bc012a07e acb51638 console log report ci-freebsd-i386
2019/08/10 20:20 freebsd b654b03de47a acb51638 console log report ci-freebsd-i386
2019/08/10 06:32 freebsd f01ed61a3914 acb51638 console log report ci-freebsd-i386
2019/08/06 12:10 freebsd 9a9a33398db6 6affd8e8 console log report ci-freebsd-i386
2019/08/05 22:17 freebsd 17a1fc80d578 6affd8e8 console log report ci-freebsd-i386
2019/08/05 17:11 freebsd 17a1fc80d578 6affd8e8 console log report ci-freebsd-i386
2019/08/04 16:24 freebsd b0ce147d61cc 6affd8e8 console log report ci-freebsd-i386
2019/05/29 14:42 freebsd 13c96c4bd700 2c7afa51 console log report ci-freebsd-i386
* Struck through repros no longer work on HEAD.