syzbot


kernel panic: Proc-ful Page Fault in the Kernel at ADDR!Proc-ful Page Fault in the Kernel at ADDR

Status: closed as invalid on 2018/07/19 20:25
Reported-by: syzbot+af7d262ba7923b53b5f3@syzkaller.appspotmail.com
First crash: 2119d, last: 2119d

Sample crash report:
kernel panic at kern/arch/x86/trap.c:309, from core 1: Proc-ful Page Fault in the Kernel at 0x000000000000001b!Proc-ful Page Fault in the Kernel at 0x0000000000
0H0001b!nbuf 147WSTAT_FIX_LEN_9P 49 fffff0000f4d30 on core 1
,  rax  0x0000000000000000
   rrbx  0bxxf  fff800001xf59d4f260f
f  rcx  0xfffffff0000f4ea0
f  rdx  0xfffffff0000f4d6c
ff0000f IT16SZ 2, GBIT16(buf) 0 
B  rsi  0x0000000000000000
   rdi  0xfffffff0000f4ea0
r  r8   0x0000000000000001
8  r9   0xffffffffc8790880
   r10  0x0000000000000030
  0xffff800004942ea0 his is bad!
This is bad!
800004942ea0
W  r12  0xffff800002176dc0
   r13  0x00000000200003c0
r  r14  0x0000000000000073
1  r15  0x00000000000000f1
5  trapp 0x0000 000e Page Fault
o which procs:
------------------
0Core 00, prov: 0(0x0000000000000000) alloc: 0(0x0000000000000000 )
prov: 0(0x0000000000C gsbs 0xffffffffc8667c40
000000000)   gsbs 0xffffffffc8667c40
alloc: 142(0xffff800002176d c0)
0re 02, prov: 0(0x0000000C err  0x--------00000000
000000000) alloc: 149(0xffff8000142b2ac0)
 ore 03, prov: 0(0x0000000C rip  0x ffffffffc20583b4
 rip  0xffffffffc20583b4
000000000) alloc: 144(0xffff8000142baa 0)
   0cx------0)
------0008
n  flag 0x0000000000010246
   rsp  0xfffffff0000rfsp  0xfffffff0000f4df8
4df8
  IT16SZ 2, GBIT16(BIT16SZ 2, GBIT16(buf) 0 buf) 0 
T
BBacktrace of kernel context on Core 1:
a [<0xfffff#01 [ cores are provisioned to which procs:W02 [<0xffffffffc20593c9>] in syscall
rocs:
#02 [<0xffffffffc20593c9>] in syscall at src/syscall.c:2528
-ll
--------------
#Core 00, prov: 0(0x0000000000000000) alloc: 0(0x0000000000000000)
oCore 01, prov: 0(0x0000000000000000) alloc: 142(re 00xffff800002176d1, prov: 0(0x0000000000000000) alloc: 142(c04 #ore 02, prov: 0(0x00000000Core 02, prov: 0(0x0000000000000000) alloc: 149(0xffff8000142b2a00000000) alloc: c05 #ore 03, prov: 0(0x000000Core 03, prov: 0(0x0000000000000000000000) alloc: 144(0xf0000) alloc
:kernel panic at kern/arch/x86/trap.c:309, from core 3: r0000000001b!00142baaP0)c
0-ful Page Fault in the Kernel at 0x000000000000001b!)
nHWW TRAP frame at 0xfffffff000 16SZ 2, GBIT16(buf) 0 f000118d30 on core 3
B  rax  0x0000000000000000
  rbx  0xffff800015a01860 This is bad!
is is bad!
05:47:38 executing program 1:
r0 = openat$net_udp_0_listen(0xffffffffffffff9c, &(0x7f0000000000)='/net/udp/0/listen\x00', 0x12, 0x3, 0x0)
openat$dev_urandom(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0xd, 0x1, 0x0)
r1 = openat$proc_self_note(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/note\x00', 0x10, 0x1, 0x0)
openat$net_tcp_1_status(0xffffffffffffff9c, &(0x7f00000000c0)='/net/tcp/1/status\x00', 0x12, 0x1, 0x0)
access(&(0x7f0000000100)='./file0\x00', 0x8, 0x88)
openat$net_ether0_2_stats(0xffffffffffffff9c, &(0x7f0000000140)='/net/ether0/2/stats\x00', 0x14, 0x1, 0x0)
openat$proc_self_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/ctl\x00', 0xf, 0x3, 0x0)
fd2path(r0, &(0x7f00000001c0)=""/4096, 0x1000)
openat$proc_self_segment(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/self/segment\x00', 0x13, 0x1, 0x0)
openat$net_ipifc_1_local(0xffffffffffffff9c, &(0x7f0000001200)='/net/ipifc/1/local\x00', 0x13, 0x1, 0x0)
openat$dev_drivers(0xffffffffffffff9c, &(0x7f0000001240)='/dev/drivers\x00', 0xd, 0x1, 0x0)
r2 = openat$net_tcp_0_status(0xffffffffffffff9c, &(0x7f0000001280)='/net/tcp/0/status\x00', 0x12, 0x1, 0x0)
openat$dev_bintime(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/bintime\x00', 0xd, 0x3, 0x0)
mkdir(&(0x7f0000001300)='./file0\x00', 0x8, 0x60)
openat$net_ipifc_1_ctl(0xffffffffffffff9c, &(0x7f0000001340)='/net/ipifc/1/ctl\x00', 0x11, 0x3, 0x0)
openat$proc_self_maps(0xffffffffffffff9c, &(0x7f0000001380)='/proc/self/maps\x00', 0x10, 0x1, 0x0)
openat$dev_stdout(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/stdout\x00', 0xc, 0x3, 0x0)
openat(0xffffffffffffffff, &(0x7f0000001400)='./file0\x00', 0x8, 0x80080, 0x10)
openat$prof_kptrace(0xffffffffffffff9c, &(0x7f0000001440)='/prof/kptrace\x00', 0xe, 0x3, 0x0)
fwstat(r2, &(0x7f0000001480)=""/147, 0x93, 0x0)
nbind(&(0x7f0000001540)='./file0\x00', 0x8, &(0x7f0000001580)='./file0\x00', 0x8, 0x16)
openat$dev_stdout(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/stdout\x00', 0xc, 0x3, 0x0)
openat$dev_sysname(0xffffffffffffff9c, &(0x7f0000001600)='/dev/sysname\x00', 0xd, 0x3, 0x0)
r3 = openat$net_ether0_1_ctl(0xffffffffffffff9c, &(0x7f0000001640)='/net/ether0/1/ctl\x00', 0x12, 0x3, 0x0)
openat$net_udp_clone(0xffffffffffffff9c, &(0x7f0000001680)='/net/udp/clone\x00', 0xf, 0x3, 0x0)
openat$net_ether0_stats(0xffffffffffffff9c, &(0x7f00000016c0)='/net/ether0/stats\x00', 0x12, 0x1, 0x0)
openat$dev_kprint(0xffffffffffffff9c, &(0x7f0000001700)='/dev/kprint\x00', 0xc, 0x1, 0x0)
fchdir(0xffffffffffffffff, r1)
proc_create(&(0x7f0000001740)='./file0\x00', 0x8, &(0x7f0000001780)='/dev/sysname\x00', 0xd, 0x0)
nmount(r3, &(0x7f00000017c0)='./file0\x00', 0x8, 0x1)
nFIXb_uf 0, STAT_FIX_LEN_9P 49 Lbuf) 0 9B rcx  0xfffffff000118ea0 This is bad!
his is bad!
05:47:39 executing program 7:
openat$prof_kptrace(0xffffffffffffff9c, &(0x7f0000000140)='/prof/kptrace\x00', 0xe, 0x3, 0x0)
openat$proc_self_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/mem\x00', 0xf, 0x1, 0x0)
openat$proc_self_noteid(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/noteid\x00', 0x12, 0x3, 0x0)
openat$proc_self_segment(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/segment\x00', 0x13, 0x1, 0x0)
openat$net_ether0_1_ifstats(0xffffffffffffff9c, &(0x7f0000000100)='/net/ether0/1/ifstats\x00', 0x16, 0x1, 0x0)
openat$dev_sysstat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sysstat\x00', 0xd, 0x3, 0x0)
05:47:39 executing program 3:
r0 = openat$net_ndb(0xffffffffffffff9c, &(0x7f0000000400)='/net/ndb\x00', 0x9, 0x3, 0x0)
openat$net_udp_clone(0xffffffffffffff9c, &(0x7f0000000100)='/net/udp/clone\x00', 0x27c, 0x3, 0x0)
tcgetattr(r0, &(0x7f00000007c0))
openat$proc_self_user(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/user\x00', 0x10, 0x1, 0x0)
close(r0)
openat$net_ipifc_clone(0xffffffffffffff9c, &(0x7f0000000000)='/net/ipifc/clone\x00', 0x11, 0x3, 0x0)
fff000118ea0
  rdx  0xfffffff000118d6c
  rbp  0xfffffff000118e38
  rsi  0x0000000000000000
  rdi  0xfffffff000118ea0
  r8   0x0000000000000001
  r9   0xffffffffc8790880
  r10  0x0000000000000030
  r11  0xffff8000049462a0
  r12  0xffff8000142baac0
  r13  0x0000000020000080
  r14  0x0000000000000073
  r15  0x0000000000000072
  trap 0x0000000e Page Fault
05:47:39 executing program 4:
r0 = openat$proc_self_ctl(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/ctl\x00', 0xf, 0x3, 0x0)
close(r0)
openat$net_ipselftab(0xffffffffffffff9c, &(0x7f0000000000)='/net/ipselftab\x00', 0xf, 0x1, 0x0)
  gsbs 0xffffffffc8668140
05:47:39 executing program 5:
openat$dev_config(0xffffffffffffff9c, &(0x7f0000000000)='/dev/config\x00', 0xc, 0x1, 0x0)
r0 = openat$proc_self_args(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/args\x00', 0x10, 0x3, 0x0)
r1 = openat$dev_stderr(0xffffffffffffff9c, &(0x7f0000000080)='/dev/stderr\x00', 0xc, 0x3, 0x0)
r2 = openat$net_icmpv6_clone(0xffffffffffffff9c, &(0x7f00000000c0)='/net/icmpv6/clone\x00', 0x12, 0x3, 0x0)
openat$net_udp_0_local(0xffffffffffffff9c, &(0x7f0000000100)='/net/udp/0/local\x00', 0x11, 0x1, 0x0)
close(r1)
openat$net_tcp_0_listen(0xffffffffffffff9c, &(0x7f0000000140)='/net/tcp/0/listen\x00', 0x12, 0x3, 0x0)
openat$net_udp_0_local(0xffffffffffffff9c, &(0x7f0000000180)='/net/udp/0/local\x00', 0x11, 0x1, 0x0)
fcntl$F_SETFL(r2, 0x4, 0x180400)
r3 = openat$net_ether0_0_ctl(0xffffffffffffff9c, &(0x7f00000001c0)='/net/ether0/0/ctl\x00', 0x12, 0x3, 0x0)
r4 = openat$prof_kpdata(0xffffffffffffff9c, &(0x7f0000000200)='/prof/kpdata\x00', 0xd, 0x3, 0x0)
openat$net_tcp_1_listen(0xffffffffffffff9c, &(0x7f0000000240)='/net/tcp/1/listen\x00', 0x12, 0x3, 0x0)
r5 = openat$dev_pgrpid(0xffffffffffffff9c, &(0x7f0000000280)='/dev/pgrpid\x00', 0xc, 0x1, 0x0)
fcntl$F_GETFD(r2, 0x1)
openat$dev_capuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/capuse\x00', 0xc, 0x3, 0x0)
fcntl$F_GETFD(r3, 0x1)
openat$prof_kpctl(0xffffffffffffff9c, &(0x7f0000000300)='/prof/kpctl\x00', 0xc, 0x3, 0x0)
r6 = openat$net_ether0_1_type(0xffffffffffffff9c, &(0x7f0000000340)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
openat$net_ether0_2_ifstats(0xffffffffffffff9c, &(0x7f0000000380)='/net/ether0/2/ifstats\x00', 0x16, 0x1, 0x0)
openat$dev_null(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/null\x00', 0xa, 0x1, 0x0)
openat$dev_kprint(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kprint\x00', 0xc, 0x1, 0x0)
fstat(r6, &(0x7f0000000440))
openat$net_tcp_0_ctl(0xffffffffffffff9c, &(0x7f00000004c0)='/net/tcp/0/ctl\x00', 0xf, 0x3, 0x0)
openat$net_ipifc_1_status(0xffffffffffffff9c, &(0x7f0000000500)='/net/ipifc/1/status\x00', 0x14, 0x1, 0x0)
openat$net_udp_0_local(0xffffffffffffff9c, &(0x7f0000000540)='/net/udp/0/local\x00', 0x11, 0x1, 0x0)
fcntl$F_SETFL(r5, 0x4, 0x80400)
read(r0, &(0x7f0000000580)=""/4096, 0x1000)
read(r4, &(0x7f0000001580)=""/105, 0x69)
openat$net_tcp_2_local(0xffffffffffffff9c, &(0x7f0000001600)='/net/tcp/2/local\x00', 0x11, 0x1, 0x0)
openat$dev_caphash(0xffffffffffffff9c, &(0x7f0000001640)='/dev/caphash\x00', 0xd, 0x3, 0x0)
  fsbs 0x0000000000000000
  err  0x--------00000000
05:47:40 executing program 2:
r0 = openat$net_tcp_1_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/net/tcp/1/ctl\x00', 0x0, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
  rip  0xffffffffc20583b4
  cs   0x------------0008
  flag 0x0000000000010246
  rsp  0xfffffff000118df8
  ss   0x------------0010
Backtrace of kernel context on Core 3:
#01 [<0xffffffffc20583b4>] in sys_readlink at src/syscall.c:2037
#02 [<0xffffffffc20593c9>] in syscall at src/syscall.c:2528
#03 [<0xffffffffc2059584>] in run_local_syscall at src/syscall.c:2563
05:47:40 executing program 0:
openat$net_ipifc_1_local(0xffffffffffffff9c, &(0x7f0000000000)='/net/ipifc/1/local\x00', 0x13, 0x1, 0x0)
r0 = openat$dev_stdout(0xffffffffffffff9c, &(0x7f0000000080)='/dev/stdout\x00', 0xc, 0x3, 0x0)
openat$proc_self_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/mem\x00', 0xf, 0x1, 0x0)
fcntl$F_GETFD(r0, 0x1)
05:47:40 executing program 6:
r0 = openat$net_ether0_0_data(0xffffffffffffff9c, &(0x7f0000000040)='/net/ether0/0/data\x00', 0x13, 0x3, 0x0)
openat(r0, &(0x7f0000000700)='./file0\x00', 0x8, 0x18c2, 0x0)
#04 [<0xffffffffc2059ab9>] in prep_syscalls at src/syscall.c:2583
#05 [<0xffffffffc20ab29a>] in sysenter_callwrapper at arch/x86/trap.c:851
yS(Core 1)> or a list of commands.
R(OS(Core 1)> Ints off):

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/19 05:47 akaros bf9a9ba0d6af 49f35839 .config console log report ci-akaros-main
2018/07/18 16:17 akaros bf9a9ba0d6af 49f35839 .config console log report ci-akaros-main
* Struck through repros no longer work on HEAD.