Fatal trap 9: general protection fault in sctp_process_control

1 view
Skip to first unread message

syzbot

unread,
May 11, 2020, 1:15:16 AM5/11/20
to syzkaller-f...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 12efb4c0 powerpc64: Implement Radix MMU for POWER9 CPUs
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1122010c100000
dashboard link: https://syzkaller.appspot.com/bug?extid=4481757e967ba83c445a

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+448175...@syzkaller.appspotmail.com

Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff81309450
stack pointer = 0x28:0xfffffe001a0c7260
frame pointer = 0x28:0xfffffe001a0c76d0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (swi1: netisr 0)
trap number = 9
panic: general protection fault
cpuid = 0
time = 1589174060
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe001a0c6f30
vpanic() at vpanic+0x1c7/frame 0xfffffe001a0c6f90
panic() at panic+0x43/frame 0xfffffe001a0c6ff0
trap_fatal() at trap_fatal+0x4ca/frame 0xfffffe001a0c7070
trap() at trap+0xda/frame 0xfffffe001a0c7190
calltrap() at calltrap+0x8/frame 0xfffffe001a0c7190
--- trap 0x9, rip = 0xffffffff81309450, rsp = 0xfffffe001a0c7260, rbp = 0xfffffe001a0c76d0 ---
sctp_process_control() at sctp_process_control+0x3600/frame 0xfffffe001a0c76d0
sctp_common_input_processing() at sctp_common_input_processing+0x74c/frame 0xfffffe001a0c7860
sctp6_input_with_port() at sctp6_input_with_port+0x300/frame 0xfffffe001a0c7960
sctp6_input() at sctp6_input+0x1f/frame 0xfffffe001a0c7980
ip6_input() at ip6_input+0x1802/frame 0xfffffe001a0c7a90
swi_net() at swi_net+0x20d/frame 0xfffffe001a0c7b10
ithread_loop() at ithread_loop+0x328/frame 0xfffffe001a0c7bb0
fork_exit() at fork_exit+0xb3/frame 0xfffffe001a0c7bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe001a0c7bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100022 ]
Stopped at kdb_enter+0x67: movq $0,0x14a9036(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xffffffff810b94f0 vprintf+0x140
rdx 0x1
rbx 0
rsp 0xfffffe001a0c6f10
rbp 0xfffffe001a0c6f30
rsi 0
rdi 0xffffffff810b9526 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0
r12 0xffffffff82068ec0 ddb_dbbe
r13 0
r14 0xffffffff81942f10
r15 0xffffffff81942f10
rip 0xffffffff810ae837 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x14a9036(%rip)
db> show proc
Process 12 (intr) at 0xfffff80003308520:
state: NORMAL
uid: 0 gids: 0
parent: pid 0 at 0xffffffff8250b710
ABI: null
reaper: 0xffffffff8250b710 reapsubtree: 12
sigparent: 20
vmspace: 0xffffffff8250c350
(map 0xffffffff8250c350)
(map.pmap 0xffffffff8250c410)
(pmap 0xffffffff8250c470)
threads: 23
100010 I [swi6: Giant taskq]
100013 I [swi5: fast taskq]
100016 I [swi6: task queue]
100019 I [swi3: vm]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 Run CPU 0 [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
db> ps
pid ppid pgrp uid state wmesg wchan cmd
4896 3436 3436 0 R (threaded) syz-executor.1
100119 RunQ syz-executor.1
100349 RunQ syz-executor.1
4894 4322 4322 0 R (threaded) syz-executor.0
100141 Run CPU 1 syz-executor.0
100360 S connec 0xfffffe00239fa0f0 syz-executor.0
100361 S sbwait 0xfffffe001cfc81d4 syz-executor.0
100362 S sbwait 0xfffffe00239d8c6c syz-executor.0
100365 S uwait 0xfffff80003e5d700 syz-executor.0
4890 4332 4332 0 R (threaded) syz-executor.2
100908 RunQ syz-executor.2
100355 S connec 0xfffffe001cfc5620 syz-executor.2
100356 S uwait 0xfffff80003e5dd80 syz-executor.2
100357 S uwait 0xfffff800171f8200 syz-executor.2
100353 S uwait 0xfffff800171f8580 syz-executor.2
4889 4363 4363 0 R (threaded) syz-executor.3
100831 RunQ syz-executor.3
100302 S select 0xfffff80017b3d240 syz-executor.3
100329 S uwait 0xfffff80003e39a00 syz-executor.3
100352 S uwait 0xfffff80017b3dc00 syz-executor.3
4793 4787 4793 0 Ss select 0xfffff80003e48ac0 dhclient
4790 1 4790 0 Ss select 0xfffff80003e5d8c0 dhclient
4787 4779 424 65 S select 0xfffff800171f8140 dhclient
4779 424 424 0 S wait 0xfffff800174a7000 sh
4778 1 4778 65 Ss select 0xfffff8001721d7c0 dhclient
4363 768 4363 0 Ss nanslp 0xffffffff8252c1e1 syz-executor.3
4352 1 4352 0 Ss select 0xfffff80017232140 dhclient
4332 768 4332 0 Ss nanslp 0xffffffff8252c1e1 syz-executor.2
4322 768 4322 0 Ss nanslp 0xffffffff8252c1e1 syz-executor.0
4320 1 4320 0 Ss select 0xfffff80003e48340 dhclient
3881 1 3881 65 Ss select 0xfffff80017be69c0 dhclient
3461 1 3461 0 Ss select 0xfffff80017be6cc0 dhclient
3458 1 3458 0 Ss select 0xfffff80017be6140 dhclient
3436 768 3436 0 Ss nanslp 0xffffffff8252c1e1 syz-executor.1
768 766 766 0 S (threaded) syz-fuzzer
100104 S uwait 0xfffff80003e39e00 syz-fuzzer
100105 S uwait 0xfffff80017232b00 syz-fuzzer
100106 S uwait 0xfffff8000381dc80 syz-fuzzer
100107 S uwait 0xfffff8000381dd80 syz-fuzzer
100108 S uwait 0xfffff80017232300 syz-fuzzer
100109 S uwait 0xfffff8000381de80 syz-fuzzer
100110 S uwait 0xfffff80017299c80 syz-fuzzer
100111 S uwait 0xfffff80017299d80 syz-fuzzer
100112 S uwait 0xfffff80017232400 syz-fuzzer
100114 S kqread 0xfffff800031f9700 syz-fuzzer
100115 S uwait 0xfffff80003e39400 syz-fuzzer
766 764 766 0 Ss pause 0xfffff800174a60a8 csh
764 682 764 0 Ss select 0xfffff80017299f40 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000383ccb0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b364b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b368b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b36cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003b350b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003b354b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003b358b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003b35cb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003b380b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252c1e1 cron
682 1 682 0 Ss select 0xfffff80017232240 sshd
495 1 495 0 Rs syslogd
424 1 424 0 Ss wait 0xfffff80003cdea40 devd
423 1 423 65 Ss select 0xfffff80003e39ec0 dhclient
338 1 338 0 Ss select 0xfffff80017155040 dhclient
335 1 335 0 Ss select 0xfffff80003e39f40 dhclient
23 0 0 0 DL vlruwt 0xfffff800033dc520 [vnlru]
22 0 0 0 DL syncer 0xffffffff82618118 [syncer]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff82617430 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100085 D sdflush 0xfffff80003c65ce8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263e308 [vmdaemon]
19 0 0 0 DL (threaded) [pagedaemon]
100067 D psleep 0xffffffff826328d8 [dom0]
100074 D launds 0xffffffff826328e4 [laundry: dom0]
100075 D umarcl 0xffffffff815449d0 [uma]
18 0 0 0 DL - 0xffffffff8235fe20 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82c4f3a0 [pf purge]
16 0 0 0 DL waiting 0xffffffff8261a890 [sctp_iterator]
15 0 0 0 DL - 0xffffffff82616a2c [soaiod4]
9 0 0 0 DL - 0xffffffff82616a2c [soaiod3]
8 0 0 0 DL - 0xffffffff82616a2c [soaiod2]
7 0 0 0 DL - 0xffffffff82616a2c [soaiod1]
6 0 0 0 DL (threaded) [cam]
100033 D - 0xffffffff82237b40 [doneq0]
100066 D - 0xffffffff82237a10 [scanner]
5 0 0 0 DL crypto_ 0xfffff80003204e90 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff80003204e30 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff826300c0 [crypto]
14 0 0 0 DL seqstat 0xfffff8000335f488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100024 D - 0xffffffff8250b180 [g_event]
100025 D - 0xffffffff8250b188 [g_up]
100026 D - 0xffffffff8250b190 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100017 D - 0xfffff80003319680 [thr_0]
100018 D - 0xfffff800033196c0 [thr_1]
12 0 0 0 RL (threaded) [intr]
100010 I [swi6: Giant taskq]
100013 I [swi5: fast taskq]
100016 I [swi6: task queue]
100019 I [swi3: vm]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 Run CPU 0 [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff80003307000 [init]
10 0 0 0 DL audit_w 0xffffffff82630598 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8250b710 [swapper]
100005 D - 0xfffff8000320fb00 [if_config_tqg_0]
100006 D - 0xfffff8000320f900 [softirq_0]
100007 D - 0xfffff8000320f700 [softirq_1]
100008 D - 0xfffff8000320f500 [if_io_tqg_0]
100009 D - 0xfffff8000320f300 [if_io_tqg_1]
100011 D - 0xfffff800031fcd00 [in6m_free taskq]
100012 D - 0xfffff800031fcc00 [thread taskq]
100014 D - 0xfffff800031fca00 [kqueue_ctx taskq]
100015 D - 0xfffff800031fc900 [aiod_kick taskq]
100023 D - 0xfffff800031fc700 [firmware taskq]
100028 D - 0xfffff800031fc500 [crypto_0]
100029 D - 0xfffff800031fc500 [crypto_1]
100043 D - 0xfffff800031fc200 [vtnet0 rxq 0]
100044 D - 0xfffff800031fc100 [vtnet0 txq 0]
100045 D - 0xfffff800031fc000 [vtnet0 rxq 1]
100046 D - 0xfffff800031fbe00 [vtnet0 txq 1]
100048 D vtbslp 0xfffff800034f0580 [virtio_balloon]
100052 D - 0xfffff800031fbc00 [mca taskq]
100057 D - 0xffffffff81ce66e0 [deadlkres]
100061 D - 0xfffff80003b81000 [acpi_task_0]
100062 D - 0xfffff80003b81000 [acpi_task_1]
100063 D - 0xfffff80003b81000 [acpi_task_2]
100065 D - 0xfffff800031fc300 [CAM taskq]
db> show all locks
Process 12 (intr) thread 0xfffffe00048b3000 (100022)
exclusive sleep mutex sctp-tcb (tcb) r = 0 (0xfffffe002592da90) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:1342
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 27747 1619K 27811
kobj 332 1328K 491
newblk 13 1027K 12464
vfscache 4 1025K 4
pcb 63 578K 2670
inodedep 126 575K 5102
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 143 285K 4979
acpica 1674 185K 52709
vnet_data 1 168K 1
filedesc 22 153K 7476
pagedep 12 131K 3902
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 237 95K 341
bus 1001 80K 3463
mtx_pool 2 72K 2
BPF 38 71K 126
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 499 63K 499
umtx 360 45K 360
ifaddr 104 40K 150
kdtrace 198 39K 20485
temp 35 33K 4835
hostcache 1 32K 1
shm 1 32K 32
DEVFS3 124 31K 134
msg 4 30K 4
dirrem 112 28K 4370
DEVFS_RULE 56 27K 56
vmem 3 26K 5
gtaskqueue 18 26K 18
kbdmux 6 22K 6
sctp_atcl 37 19K 987
sctp_stro 18 18K 228
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
lltable 41 15K 174
freefile 114 15K 4313
ether_multi 172 14K 552
bus-sc 30 14K 1431
lockf 114 13K 3807
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 132 12K 132
in6_multi 89 11K 358
pfs_nodes 20 10K 20
select 78 10K 78
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 3 9K 4977
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
sctp_timw 32 8K 32
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 233 8K 291
kqueue 63 7K 4903
CAM DEV 3 6K 510
plimit 23 6K 1045
cred 23 6K 349
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
DEVFSP 76 5K 480
taskqueue 45 5K 45
ufs_dirhash 24 5K 24
pf_ifnet 11 5K 23
pf_rule 4 4K 96
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
kcovinfo 64 4K 425
UMA 247 4K 247
session 31 4K 94
pgrp 31 4K 94
routetbl 19 4K 372
hhook 13 4K 13
acpisem 22 3K 22
terminal 11 3K 11
proc-args 50 3K 1140
sctp_atky 55 3K 1224
uidinfo 3 3K 23
sctp_ifa 17 3K 80
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 63
Unitno 33 2K 19229
CAM XPT 22 2K 543
in_multi 6 2K 35
freework 6 2K 6729
mkdir 10 2K 7328
freeblks 5 2K 4091
acpidev 20 2K 20
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 936
NFSD session 1 1K 1
CAM periph 4 1K 271
diradd 7 1K 4493
inpcbpolicy 25 1K 11298
newdirblk 6 1K 3664
mld 6 1K 6
sctp_ifn 6 1K 27
igmp 6 1K 6
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
sctp_athm 37 1K 1009
crypto 3 1K 3
sctp_map 36 1K 456
sctp_stri 1 1K 18
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
osd 3 1K 9
vnodes 1 1K 66
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 6
soname 7 1K 7202
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
tcpfunc 2 1K 2
ip_msource 2 1K 19
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
nexusdev 5 1K 5
entropy 2 1K 73
ip6_msource 1 1K 7
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
filecaps 4 1K 182
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_table 0 0K 82
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 52960
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 2348
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 464
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 155
allocindir 0 0K 0
indirdep 0 0K 2590
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 64
ip6_moptions 0 0K 11
in6_mfilter 0 0K 22
frag6 0 0K 0
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 250
sctp_iter 0 0K 81
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 5
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 76
sctp_aadr 0 0K 0
newreno data 0 0K 0
ip_moptions 0 0K 73
in_mfilter 0 0K 87
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 3798
export_host 0 0K 0
cl_savebuf 0 0K 55
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 797
accf 0 0K 0
pts 0 0K 0
iov 0 0K 26408
ioctlops 0 0K 630
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 932
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 23
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
db> show ktr
No such command; use "help" to list available commands


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
May 11, 2020, 2:21:16 AM5/11/20
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 12efb4c0 powerpc64: Implement Radix MMU for POWER9 CPUs
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=118f3568100000
dashboard link: https://syzkaller.appspot.com/bug?extid=4481757e967ba83c445a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=151b5d32100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12bdfda2100000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+448175...@syzkaller.appspotmail.com

Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff81309450
stack pointer = 0x28:0xfffffe001a0c7260
frame pointer = 0x28:0xfffffe001a0c76d0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (swi1: netisr 0)
trap number = 9
panic: general protection fault
cpuid = 0
time = 1589177924
rcx 0x80 ll+0x5f
rdx 0xffffffff818a2f56
rbx 0
rsp 0xfffffe001a0c6f10
rbp 0xfffffe001a0c6f30
rsi 0x1
rdi 0
950 773 771 0 RE CPU 1 syz-executor0884878
773 771 771 0 R syz-executor0884878
771 769 771 0 Ss pause 0xfffff8001c3ae0a8 csh
769 682 769 0 Ss select 0xfffff8001c1f21c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000383ccb0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b2e4b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b2e8b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b2ecb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003b2d0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003b2d4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003b2d8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003b2dcb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003b300b0 getty
738 1 24 0 S+ piperd 0xfffff80003cf72f8 logger
737 736 24 0 S+ nanslp 0xffffffff8252c1e1 sleep
736 1 24 0 S+ wait 0xfffff80003cdd520 sh
686 1 686 0 Ss nanslp 0xffffffff8252c1e0 cron
682 1 682 0 Ss select 0xfffff80003c2f940 sshd
495 1 495 0 Ss select 0xfffff80003c75c40 syslogd
424 1 424 0 Ss select 0xfffff80003c78040 devd
423 1 423 65 Ss select 0xfffff80003c75cc0 dhclient
338 1 338 0 Ss select 0xfffff80003c780c0 dhclient
335 1 335 0 Ss select 0xfffff8001c1f2ac0 dhclient
23 0 0 0 DL vlruwt 0xfffff800033dc520 [vnlru]
22 0 0 0 DL syncer 0xffffffff82618118 [syncer]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff82617430 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100086 D sdflush 0xfffff80003c69ce8 [/ worker]
100055 D - 0xffffffff81ce66e0 [deadlkres]
100061 D - 0xfffff80003b7e000 [acpi_task_0]
100062 D - 0xfffff80003b7e000 [acpi_task_1]
100063 D - 0xfffff80003b7e000 [acpi_task_2]
100065 D - 0xfffff800031fc300 [CAM taskq]
db> show all locks
Process 950 (syz-executor0884878) thread 0xfffffe002583f500 (100102)
exclusive sleep mutex sctp-inp (inp) r = 0 (0xfffff8001c97f468) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_usrreq.c:695
Process 12 (intr) thread 0xfffffe00048b3000 (100022)
exclusive sleep mutex sctp-tcb (tcb) r = 0 (0xfffffe00258a88b0) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:1342
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4238
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 27747 1619K 27811
kobj 332 1328K 491
newblk 452 1137K 509
vfscache 4 1025K 4
pcb 27 544K 429
inodedep 26 525K 71
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 114 222K 1018
acpica 1674 185K 52709
vnet_data 1 168K 1
pagedep 8 130K 18
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 101 101K 110
linker 237 95K 266
bus 967 78K 3347
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 499 63K 499
temp 18 33K 1536
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
DEVFS3 120 30K 130
umtx 234 30K 234
kdtrace 148 29K 1956
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18
vmem 3 22K 4
kbdmux 6 22K 6
BPF 10 18K 10
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
bus-sc 30 14K 1431
ifaddr 32 13K 32
KTRACE 100 13K 100
kenv 95 12K 99
eventhandler 132 12K 132
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 2 9K 40
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
sctp_timw 31 8K 31
audit_evclass 233 8K 291
CAM DEV 3 6K 510
vt 11 6K 11
cred 21 6K 234
sglist 5 6K 5
CAM queue 5 6K 1528
taskqueue 45 5K 45
ufs_dirhash 24 5K 24
plimit 17 5K 322
ifnet 3 5K 3
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
filedesc 1 4K 1
UMA 247 4K 247
lltable 11 4K 11
routetbl 14 4K 14
hhook 13 4K 13
ether_multi 40 4K 45
pf_ifnet 5 3K 6
in6_multi 25 3K 25
kqueue 47 3K 953
acpisem 22 3K 22
terminal 11 3K 11
sctp_atcl 5 3K 531
session 20 3K 31
pgrp 20 3K 31
select 18 3K 18
uidinfo 3 3K 8
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
proc-args 39 2K 472
freefile 13 2K 22
CAM XPT 22 2K 543
lockf 15 2K 22
Unitno 25 2K 37
acpidev 20 2K 20
msi 9 2K 9
softdep 1 1K 1
dirrem 4 1K 28
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
sctp_stro 1 1K 177
clone 8 1K 8
vnodemarker 2 1K 8
NFSD session 1 1K 1
CAM periph 4 1K 271
diradd 7 1K 36
indirdep 3 1K 3
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
ip6ndp 4 1K 5
sctp_ifa 5 1K 5
crypto 3 1K 3
newdirblk 4 1K 8
mkdir 4 1K 16
sctp_stri 1 1K 354
in_multi 2 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
osd 3 1K 9
mld 2 1K 2
sctp_ifn 2 1K 2
sctp_atky 6 1K 885
igmp 2 1K 2
vnodes 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
inpcbpolicy 6 1K 131
loginclass 3 1K 7
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
tcpfunc 2 1K 2
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
DEVFSP 2 1K 2
soname 4 1K 6142
filecaps 4 1K 66
tun 3 1K 3
nexusdev 5 1K 5
sctp_athm 5 1K 708
entropy 2 1K 35
freework 1 1K 26
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
sctp_map 2 1K 354
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_table 0 0K 0
pf_rule 0 0K 0
CAM CCB 0 0K 1824
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 12
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 3
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freeblks 0 0K 25
freefrag 0 0K 7
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 3
sctp_aadr 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 196
export_host 0 0K 0
cl_savebuf 0 0K 3
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 25
accf 0 0K 0
pts 0 0K 0
iov 0 0K 12967
ioctlops 0 0K 86
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 574
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
kcovinfo 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
Reply all
Reply to author
Forward
0 new messages