Fatal trap 12: page fault in in6_cksum_partial

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 3d80c629 netmap: update unit tests
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1460fe2b200000
dashboard link: https://syzkaller.appspot.com/bug?extid=6295fcc5a8aced81d599

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6295fc...@syzkaller.appspotmail.com

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0x10
fault code = supervisor read data , page not present
instruction pointer = 0x20:0xffffffff813e0389
stack pointer = 0x0:0xfffffe0016ad4710
frame pointer = 0x0:0xfffffe0016ad4770
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (swi1: netisr 0)
trap number = 12
panic: page fault
cpuid = 0
time = 1553116818
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame
0xfffffe0016ad4370
vpanic() at vpanic+0x1e0/frame 0xfffffe0016ad43d0
panic() at panic+0x43/frame 0xfffffe0016ad4430
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe0016ad44b0
trap_pfault() at trap_pfault+0x9f/frame 0xfffffe0016ad4520
trap() at trap+0x44d/frame 0xfffffe0016ad4640
calltrap() at calltrap+0x8/frame 0xfffffe0016ad4640
--- trap 0xc, rip = 0xffffffff813e0389, rsp = 0xfffffe0016ad4710, rbp =
0xfffffe0016ad4770 ---
in6_cksum_partial() at in6_cksum_partial+0x179/frame 0xfffffe0016ad4770
rip6_input() at rip6_input+0x5ff/frame 0xfffffe0016ad4850
ip6_input() at ip6_input+0x1a9b/frame 0xfffffe0016ad4970
swi_net() at swi_net+0x23b/frame 0xfffffe0016ad49f0
ithread_loop() at ithread_loop+0x2f2/frame 0xfffffe0016ad4a60
fork_exit() at fork_exit+0xb0/frame 0xfffffe0016ad4ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0016ad4ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100017 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 3d80c629 netmap: update unit tests
git tree: freebsd

console output: https://syzkaller.appspot.com/x/log.txt?x=172e094d200000
dashboard link: https://syzkaller.appspot.com/bug?extid=6295fcc5a8aced81d599
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16e2c5f7200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6295fc...@syzkaller.appspotmail.com

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0x10
fault code = supervisor read data , page not present
instruction pointer = 0x20:0xffffffff813e0389

stack pointer = 0x28:0xfffffe0016ad4710
frame pointer = 0x28:0xfffffe0016ad4770

code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (swi1: netisr 0)
trap number = 12
panic: page fault
cpuid = 0

time = 1553117822