uvm_fault: upageflttrap

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: b56428e2942e limits.h: bump _POSIX_THREAD_THREADS_MAX to 64
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=132fa149580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=d777299a072dec9bb4cb

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7e31e0698265/disk-b56428e2.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/9ee63f7bf7e9/bsd-b56428e2.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8d30ed1c7cf2/kernel-b56428e2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d77729...@syzkaller.appspotmail.com

uvm_fault(fffff3006f0531f8,4680cde000,0,1) at uvm_fault+0x1ea sys/uvm/uvm_fault.c:650
upageflttrap(ffff80002a2a0bc0,4680cde000) at upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
usertrap(ffff80002a2a0bc0) at usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
recall_trap() at recall_trap+0x8
end of kernel
end trace frame: 0x7c9cb7a628e0, count: -11
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x25: addq $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(fffff3006ffa7b30,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(fffff3006ffa7b18,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
rrw_enter(fffff3006ffa7b18,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
VOP_LOCK(fffff30063034c00,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
vn_lock(fffff30063034c00,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576
vget(fffff30063034c00,2001) at vget+0x2a2 sys/kern/vfs_subr.c:692
ktrwriteraw(ffff800045feea78,fffff30063034c00,fffff300097fd4e0,ffff80003c3faee0,ffff80003c3faec0) at ktrwriteraw+0x175 sys/kern/kern_ktrace.c:689
ktrnamei(ffff800045feea78,ffff80002a213000) at ktrnamei+0x145 ktrwrite sys/kern/kern_ktrace.c:-1 [inline]
ktrnamei(ffff800045feea78,ffff80002a213000) at ktrnamei+0x145 sys/kern/kern_ktrace.c:222
namei(ffff80003c3fb030) at namei+0x29e sys/kern/vfs_lookup.c:170
unp_connect(ffff800001634ee0,fffff3006200c900,ffff800045feea78) at unp_connect+0x29d sys/kern/uipc_usrreq.c:872
uipc_dgram_send(ffff800001634ee0,fffff30061410000,fffff3006200c900,0) at uipc_dgram_send+0x163 sys/kern/uipc_usrreq.c:609
sosend(ffff800001634ee0,fffff3006200c900,ffff80003c3fb2b8,0,0,c) at sosend+0x804 sys/kern/uipc_socket.c:-1
sendit(ffff800045feea78,5,ffff80003c3fb438,c,ffff80003c3fb4f0) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785
sys_sendmsg(ffff800045feea78,ffff80003c3fb5a0,ffff80003c3fb4f0) at sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603
syscall(ffff80003c3fb5a0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3fb5a0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xcffd0e14d70, count: -17


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup