kernel panic: EN_9P 49 cIT1BIT16SZ 2, GBIT16(buf) 0 6This is bad!

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: bf9a9ba0d6af Add panic_hwtf() for kernel faults
git tree: https://github.com/akaros/akaros.git/master
console output: https://syzkaller.appspot.com/x/log.txt?x=13daac44400000
kernel config: https://syzkaller.appspot.com/x/.config?x=efef8cf2939304d3
dashboard link: https://syzkaller.appspot.com/bug?extid=adfa950eef29681cc2aa
compiler:

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+adfa95...@syzkaller.appspotmail.com

(buf) 0 49 kernel panic at kern/arch/x86/trap.n:309, from core 2: EN_9P 49
cIT1BIT16SZ 2, GBIT16(buf) 0 6This is bad!
is bad!
19:37:58 executing program 4:
openat$dev_urandom(0xffffffffffffff9c,
&(0x7f0000000040)='/dev/urandom\x00', 0xd, 0x1, 0x0)
r0 = openat$dev_user(0xffffffffffffff9c, &(0x7f0000000080)='/dev/user\x00',
0xa, 0x3, 0x0)
tcgetattr(r0, &(0x7f0000000100))
openat$proc_self_user(0xffffffffffffff9c,
&(0x7f0000000000)='/proc/self/user\x00', 0x10, 0x1, 0x0)
IT16(buProc-ful Page Fault in the Kernel at 0x000000000000001b!
HW TRAP frame at 0xfffffff0000a6d30 on core 2
rax 0x0000000000000000
rbx 0xffff800014d3d5e0
rcx 0xfffffff0000a6ea0
rdx 0xfffffff0000a6d6c
rbp 0xfffffff0000a6e38
rsi 0x0000000000000000
rdi 0xfffffff0000a6ea0
r8 0x0000000000000001
r9 0xffffffffc8790880
r10 0x0000000000000030
r11 0xffff800015a23820
r12 0xffff800002182ac0
r13 0x0000000020000200
r14 0x0000000000000073
r15 0x00000000000000b9
trap 0x0000000e Page Fault
gsbs 0xffffffffc8667ec0
fsbs 0x0000000000000000
err 0x--------00000000
rip 0xffffffffc20583b4
cs 0x------------0008
flag 0x0000000000010246
rsp 0xfffffff0000a6df8
ss 0x------------0010
Backtrace of kernel context on Core 2:
#01 [<0xffffffffc20583b4>] in sys_readlink at src/syscall.c:2037
#02 [<0xffffffffc20593c9>] in syscall at src/syscall.c:2528
#03 [<0xffffffffc2059584>] in run_local_syscall at src/syscall.c:2563
#04 [<0xffffffffc2059ab9>] in prep_syscalls at src/syscall.c:2583
#05 [<0xffffffffc20ab29a>] in sysenter_callwrapper at arch/x86/trap.c:851
19:38:03 executing program 2:
r0 = openat$dev_cputime(0xffffffffffffff9c,
&(0x7f00000000c0)='/dev/cputime\x00', 0xfffffffffffffe31, 0x1, 0x0)
fd2path(r0, &(0x7f00000002c0)=""/148, 0x94)
19:38:03 executing program 1:
r0 = openat$proc_self_proc(0xffffffffffffff9c,
&(0x7f00000003c0)='/proc/self/proc\x00', 0x10, 0x1, 0x0)
fd2path(r0, &(0x7f00000004c0)=""/219, 0xdb)
openat$dev_kprint(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kprint\x00',
0xfffffffffffffcc2, 0x1, 0x0)
19:38:03 executing program 7:
openat$net_ipifc_0_err(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ipifc/0/err\x00', 0xfffffffffffffe39, 0x3, 0x0)
openat$prof_empty(0xffffffffffffff9c, &(0x7f0000000000)='/prof/.empty\x00',
0xd, 0x3, 0x0)
19:38:03 executing program 0:
openat$dev_capuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/capuse\x00',
0xc, 0x3, 0x0)
openat$dev_random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/random\x00',
0xc, 0x1, 0x0)
19:38:03 executing program 6:
r0 = openat$net_tcp_stats(0xffffffffffffff9c,
&(0x7f0000000300)='/net/tcp/stats\x00', 0xf, 0x1, 0x0)
fcntl$F_GETFL(r0, 0x3)
openat$net_ether0_0_stats(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ether0/0/stats\x00', 0x14, 0x1, 0x0)
openat$dev_drivers(0xffffffffffffff9c,
&(0x7f0000000000)='/dev/drivers\x00', 0xd, 0x1, 0x0)
openat$net_tcp_0_ctl(0xffffffffffffff9c,
&(0x7f0000000080)='/net/tcp/0/ctl\x00', 0xf, 0x3, 0x0)
19:38:03 executing program 3:
openat$dev_sysname(0xffffffffffffff9c,
&(0x7f0000000000)='/dev/sysname\x00', 0xd, 0x3, 0x0)
openat$net_tcp_0_local(0xffffffffffffff9c,
&(0x7f00000001c0)='/net/tcp/0/local\x00', 0xe, 0x1, 0x0)
getpcoreid()
19:38:03 executing program 5:
openat$net_log(0xffffffffffffff9c, &(0x7f0000000100)='/net/log\x00',
0xfffffffffffffd2b, 0x3, 0x0)
openat$net_tcp_0_status(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/tcp/0/status\x00', 0x12, 0x1, 0x0)
openat$net_udp_stats(0xffffffffffffff9c,
&(0x7f0000000080)='/net/udp/stats\x00', 0xf, 0x1, 0x0)
openat$prof_empty(0xffffffffffffff9c, &(0x7f0000000000)='/prof/.empty\x00',
0xd, 0x3, 0x0)
openat$net_icmpv6_clone(0xffffffffffffff9c,
&(0x7f0000000040)='/net/icmpv6/clone\x00', 0x12, 0x3, 0x0)
19:38:04 executing program 4:
openat$proc_self_proc(0xffffffffffffff9c,
&(0x7f0000000000)='/proc/self/proc\x00', 0x10, 0x1, 0x0)
r0 = openat$proc_self_text(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/text\x00', 0x1, 0x1, 0x0)
close(r0)
openat$net_tcp_1_status(0xffffffffffffff9c,
&(0x7f0000000080)='/net/tcp/1/status\x00', 0x12, 0x1, 0x0)


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[Barret Rhoden]

On 2018-07-18 at 17:00 syzbot

#syz invalid