uvm_fault: vm_terminate

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ba080721f3fe Rewrite bytes/sec calculation using fixed poi..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=167eace9980000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=e9cae6af5be3bb3b2329

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ab4f23d4e4a8/disk-ba080721.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/d7856e4af6a6/bsd-ba080721.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e4b48808aede/kernel-ba080721.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e9cae6...@syzkaller.appspotmail.com

uvm_fault(0xfffffd806bcfd008, 0x2b0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at vm_terminate+0xb0: movq 0x2b0(%r12),%r13
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*366930 66315 0 0x8000000 0x4000000 1 syz-executor
vm_terminate(ffff80002a366000) at vm_terminate+0xb0 sys/dev/vmm/vmm.c:674
vmmioctl(a00,80045604,ffff80002a366000,1,ffff80002a03f458) at vmmioctl+0x3c5 sys/dev/vmm/vmm.c:248
VOP_IOCTL(fffffd806dd96290,80045604,ffff80002a366000,1,fffffd807f7d3000,ffff80002a03f458) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffffd8056e64b48,80045604,ffff80002a366000,ffff80002a03f458) at vn_ioctl+0xf6 sys/kern/vfs_vnops.c:525
sys_ioctl(ffff80002a03f458,ffff80002a3661e0,ffff80002a366130) at sys_ioctl+0x67c
syscall(ffff80002a3661e0) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a3661e0) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x15fa28d0130, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup