uvm_fault: dt_ioctl_record_stop (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e6ac069a7f53 Merge remote-tracking branch 'origin/master' ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=17a77815580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=aadb41330e2bc0e0af01

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f35772f58f27/disk-e6ac069a.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/4a02ea109059/bsd-e6ac069a.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/38e0b10c9b4c/kernel-e6ac069a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aadb41...@syzkaller.appspotmail.com

login: uvm_fault(0xffff800001c895d8, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at dt_ioctl_record_stop+0x1b9: movq 0(%r15),%r15
TID PID UID PRFLAGS PFLAGS CPU COMMAND
486849 11244 0 0x2 0x1 0 syz-executor
dt_ioctl_record_stop(ffff8000018a7000) at dt_ioctl_record_stop+0x1b9 sys/dev/dt/dt_dev.c:593
dtclose(11ea8,3,2000,ffff800045ff5248) at dtclose+0x16d sys/dev/dt/dt_dev.c:239
spec_close(ffff80003ab102a0) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff8000018d0118,3,ffff800000119618,ffff800045ff5248) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff8000018ddd30,ffff800045ff5248) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff8000018ddd30,ffff800045ff5248) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff8000018ddd30,ffff800045ff5248) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff8000018ddd30,ffff800045ff5248) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff800045ff5248) at fdfree+0x16d sys/kern/kern_descrip.c:1203
exit1(ffff800045ff5248,0,0,1) at exit1+0x81e sys/kern/kern_exit.c:217
sys_exit(ffff800045ff5248,ffff80003ab10840,ffff80003ab107a0) at sys_exit+0x4a
syscall(ffff80003ab10840) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003ab10840) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70150368c9f0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xffff800001c895d8, 0x0, 0, 1) -> e
ddb{1}> show kasan
kasan: no report recorded this boot
ddb{1}> trace
dt_ioctl_record_stop(ffff8000018a7000) at dt_ioctl_record_stop+0x1b9 sys/dev/dt/dt_dev.c:593
dtclose(11ea8,3,2000,ffff800045ff5248) at dtclose+0x16d sys/dev/dt/dt_dev.c:239
spec_close(ffff80003ab102a0) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff8000018d0118,3,ffff800000119618,ffff800045ff5248) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff8000018ddd30,ffff800045ff5248) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff8000018ddd30,ffff800045ff5248) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff8000018ddd30,ffff800045ff5248) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff8000018ddd30,ffff800045ff5248) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff800045ff5248) at fdfree+0x16d sys/kern/kern_descrip.c:1203
exit1(ffff800045ff5248,0,0,1) at exit1+0x81e sys/kern/kern_exit.c:217
sys_exit(ffff800045ff5248,ffff80003ab10840,ffff80003ab107a0) at sys_exit+0x4a
syscall(ffff80003ab10840) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003ab10840) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70150368c9f0, count: -12
ddb{1}> show registers
rdi 0
rsi 0x3
rbp 0xffff80003ab10170
rbx 0
rdx 0x7
rcx 0xffff808000000000
rax 0x1
r8 0x800000000000
r9 0x1
r10 0x21
r11 0xffffffff81872460 dtclose
r12 0xffff800001ac6800
r13 0xffffffff81872460 dtclose
r14 0
r15 0
rip 0xffffffff81872a69 dt_ioctl_record_stop+0x1b9
cs 0x8
rflags 0x10286 __ALIGN_SIZE+0xf286
rsp 0xffff80003ab10140
ss 0x10
dt_ioctl_record_stop+0x1b9: movq 0(%r15),%r15
ddb{1}>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup