kernel panic: Proc-ful Page Fault in the Kernel at ADDR!Proc-ful Page Fault in the Kernel at ADDR

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: bf9a9ba0d6af Add panic_hwtf() for kernel faults
git tree: https://github.com/akaros/akaros.git/master
console output: https://syzkaller.appspot.com/x/log.txt?x=1513cf94400000
kernel config: https://syzkaller.appspot.com/x/.config?x=efef8cf2939304d3
dashboard link: https://syzkaller.appspot.com/bug?extid=af7d262ba7923b53b5f3
compiler:

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+af7d26...@syzkaller.appspotmail.com

kernel panic at kern/arch/x86/trap.c:309, from core 3: Proc-ful Page Fault
in the Kernel at 0x000000000000001b!Proc-ful Page Fault in the Kernel at
0x0000000000
00001b!nbuf 90,HSTAT_FIX_LEN_9P 49 ffffff00010fd30 on core 3
rax 0x00000000000 IT16SZ 2, GBIT16(buf) 0
B rbx 0xffff800015a38ca0 This is bad!
his 90,nbuf 90, STAT_FIX_LEN_9P 49 , GBIT16(buf) 0 4B rcx
0xfffffff00010fea0 his is bad!
fff00010fea0
T rdx 0xffff rdx 0xfffffff00010fd6c
16:16:56 executing program 3:
openat$proc_self_core(0xffffffffffffff9c,
&(0x7f0000000000)='/proc/self/core\x00', 0x10, 0x1, 0x0)
openat$dev_sysname(0xffffffffffffff9c,
&(0x7f0000000140)='/dev/sysname\x00', 0xd, 0x3, 0x0)
openat$proc_self_text(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/text\x00', 0x10, 0x1, 0x0)
r0 = openat$net_ndb(0xffffffffffffff9c, &(0x7f00000000c0)='/net/ndb\x00',
0x9, 0x3, 0x0)
openat$net_tcp_1_err(0xffffffffffffff9c,
&(0x7f0000000100)='/net/tcp/1/err\x00', 0xf, 0x3, 0x0)
abort_sysc_fd(r0)
rbp 0xfffffff00010fe38
rsi 0x0000000000000000
rdi 0xfffffff00010fea0
r8 0x0000000000000001
r9 0xffffffffc8790880
r10 0x0000000000000030
r11 0xffff8000142309a0
r12 0xffff8000145c3b80
r13 0x00000000200000c0
r14 0x0000000000000073
r15 0x0000000000001000
trap 0x0000000e Page Fault
gsbs 0xffffffffc8668140
fsbs 0x0000000000000000
err 0x--------00000000
rip 0xffffffffc20583b4
cs 0x------------0008
flag 0x0000000000010246
rsp 0xfffffff00010fdf8
ss 0x------------0010
Backtrace of kernel context on Core 3:
#01 [<0xffffffffc20583b4>] in sys_readlink at src/syscall.c:2037
#02 [<0xffffffffc20593c9>] in syscall at src/syscall.c:2528
#03 [<0xffffffffc2059584>] in run_local_syscall at src/syscall.c:2563
#04 [<0xffffffffc2059ab9>] in prep_syscalls at src/syscall.c:2583
#05 [<0xffffffffc20ab29a>] in sysenter_callwrapper at arch/x86/trap.c:851
16:17:01 executing program 2:
r0 = openat$net_empty(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/.empty\x00', 0xc, 0x3, 0x0)
openat$proc_self_args(0xffffffffffffff9c,
&(0x7f0000000000)='/proc/self/args\x00', 0x10, 0x3, 0x0)
tcgetattr(r0, &(0x7f0000000140))
16:17:01 executing program 7:
r0 = openat$net_ether0_0_stats(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/ether0/0/stats\x00', 0x14, 0x1, 0x0)
abort_sysc_fd(r0)
openat$net_ether0_1_stats(0xffffffffffffff9c,
&(0x7f0000000000)='/net/ether0/1/stats\x00', 0x14, 0x1, 0x0)
16:17:01 executing program 0:
r0 = openat$dev_time(0xffffffffffffff9c, &(0x7f0000000540)='/dev/time\x00',
0xa, 0x3, 0x0)
read(r0, &(0x7f0000000000)=""/255, 0xb7)
16:17:01 executing program 4:
r0 = openat$net_ether0_addr(0xffffffffffffff9c,
&(0x7f0000000080)='/net/ether0/addr\x00', 0x11, 0x3, 0x0)
r1 = proc_create(&(0x7f00000000c0)='./file0\x00', 0x8,
&(0x7f0000000100)='\x00', 0x1, 0x0)
fchdir(r1, r0)
r2 = openat$dev_cputime(0xffffffffffffff9c,
&(0x7f0000000180)='/dev/cputime\x00', 0x7d, 0x1, 0x0)
openat$dev_osversion(0xffffffffffffff9c,
&(0x7f0000000000)='/dev/osversion\x00', 0xfffffffffffffcc0, 0x1, 0x0)
abort_sysc_fd(r2)
openat$net_ether0_2_ctl(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ether0/2/ctl\x00', 0x12, 0x3, 0x0)
16:17:01 executing program 1:
r0 = openat$net_udp_0_ctl(0xffffffffffffff9c,
&(0x7f0000000000)='/net/udp/0/ctl\x00', 0xf, 0x3, 0x0)
r1 = openat$proc_self_segment(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/segment\x00', 0x13, 0x1, 0x0)
tcgetattr(r0, &(0x7f0000000080))
fcntl$F_DUPFD(r1, 0x0, r1, 0x0)
llseek(r1, 0x0, 0x0, &(0x7f0000000280), 0x0)
16:17:01 executing program 6:
r0 = openat$proc_self_segment(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/segment\x00', 0x13, 0x1, 0x0)
openat$net_ether0_2_data(0xffffffffffffff9c,
&(0x7f0000000000)='/net/ether0/2/data\x00', 0xffffffffffffff44, 0x3, 0x0)
openat$proc_self_strace(0xffffffffffffff9c,
&(0x7f0000000080)='/proc/self/strace\x00', 0x12, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f0000000280), 0x0)
16:17:01 executing program 5:
vmm_ctl$VMM_CTL_GET_EXITS(0x1)
change_vcore(0x80000001, 0x0)
openat$net_tcp_2_data(0xffffffffffffff9c,
&(0x7f0000000040)='/net/tcp/2/data\x00', 0x10, 0x3, 0x0)
r0 = openat$prof_kptrace_ctl(0xffffffffffffff9c,
&(0x7f0000000200)='/prof/kptrace_ctl\x00', 0x12, 0x3, 0x0)
read(r0, &(0x7f0000000240)=""/4096, 0x1000)
openat$net_ether0_addr(0xffffffffffffff9c,
&(0x7f0000000000)='/net/ether0/addr\x00', 0x11, 0x3, 0x0)
16:17:02 executing program 3:
openat$net_udp_0_local(0xffffffffffffff9c,
&(0x7f0000000000)='/net/udp/0/local\x00', 0x11, 0x1, 0x0)
openat$net_empty(0xffffffffffffff9c, &(0x7f0000000080)='/net/.empty\x00',
0xc, 0x3, 0x0)
r0 = openat$net_ether0_0_ctl(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ether0/0/ctl\x00', 0x12, 0x3, 0x0)
abort_sysc_fd(r0)
openat$net_ether0_2_type(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/ether0/2/type\x00', 0x13, 0x1, 0x0)


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[Barret Rhoden]

On 2018-07-18 at 11:00 syzbot

#syz invalid