panic: trap type 4, code=0, pc=ADDR

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5afedbbf Document tpmr ioctls and synopsis
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=179d6efa900000
kernel config: https://syzkaller.appspot.com/x/.config?x=bf87b6915a88cd0d
dashboard link: https://syzkaller.appspot.com/bug?extid=667a100980c19c5145ab

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+667a10...@syzkaller.appspotmail.com

panic: trap type 4, code=0, pc=ffffffff8224a928
Starting stack trace...
panic(ffffffff82402d8a) at panic+0x152 sys/kern/subr_prf.c:218
kerntrap(ffff800024125560) at kerntrap+0x1bd sys/arch/amd64/amd64/trap.c:297
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
pfi_ifhead_RB_REMOVE(ffffffff829335a0,ffff800000af9d00) at pfi_ifhead_RB_REMOVE+0x58 sys/net/pf_if.c:80
pfi_detach_ifgroup(ffff800000aa4800) at pfi_detach_ifgroup+0x11b pfi_kif_unref sys/net/pf_if.c:211 [inline]
pfi_detach_ifgroup(ffff800000aa4800) at pfi_detach_ifgroup+0x11b sys/net/pf_if.c:304
if_delgroup(ffff800000af8000,ffff800000aa4800) at if_delgroup+0x1bc sys/net/if.c:2666
if_detach(ffff800000af8000) at if_detach+0x1b0 sys/net/if.c:1039
tun_clone_destroy(ffff800000af8000) at tun_clone_destroy+0x1e1 sys/net/if_tun.c:326
tun_dev_close(5d01,7) at tun_dev_close+0x160 sys/net/if_tun.c:477
spec_close(ffff800024125890) at spec_close+0x311 sys/kern/spec_vnops.c:560
VOP_CLOSE(fffffd807e9a91a8,7,fffffd807f7bf900,ffff800020ebcc78) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:174
vn_closefile(fffffd806830cc00,ffff800020ebcc78) at vn_closefile+0xd7 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806830cc00,ffff800020ebcc78) at vn_closefile+0xd7 sys/kern/vfs_vnops.c:614
fdrop(fffffd806830cc00,ffff800020ebcc78) at fdrop+0xc2 sys/kern/kern_descrip.c:1279
closef(fffffd806830cc00,ffff800020ebcc78) at closef+0x11c sys/kern/kern_descrip.c:1263
fdfree(ffff800020ebcc78) at fdfree+0x101 sys/kern/kern_descrip.c:1195
exit1(ffff800020ebcc78,0,0,1) at exit1+0x32c sys/kern/kern_exit.c:197
sys_exit(ffff800020ebcc78,ffff800024125b20,ffff800024125b70) at sys_exit+0x16 sys/kern/kern_exit.c:95
syscall(ffff800024125bf0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800024125bf0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffc8a10, count: 238
End of stack trace.


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Anton Lindqvist]

#syz dup: kernel: protection fault trap, code=0 (8)