uvm_fault: sys_futimes

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 52741ec3fdca fq_codel: fix CoDel drop scheduling
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=158ef149580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=51a070d4f16cb82f5d09

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e0b939682628/disk-52741ec3.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/55bfc458cb6f/bsd-52741ec3.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/979fd1ef312f/kernel-52741ec3.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+51a070...@syzkaller.appspotmail.com

uvm_fault(0xfffff5000b1f7b70, 0x98, 0, 1) -> e
kernel: page fault trap, code=0
--db_more-- Stopped at dovutimens+0x368: movl 0x98(%rax),%r12d
--db_more-- TID PID UID PRFLAGS PFLAGS CPU COMMAND
--db_more-- 426343 35371 0 0 0 1 syz-executor
--db_more-- *184761 51061 0 0 0x4000000 0K syz-executor
--db_more-- dovutimens(ffff80002a222d08,fffff5005e133568,ffff80002a2d27d0) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691
sys_futimes(ffff80002a222d08,ffff80002a2d2920,ffff80002a2d2870) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2733
syscall(ffff80002a2d2920) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2d2920) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
--db_more-- Xsyscall() at Xsyscall+0x128
--db_more-- end of kernel
--db_more-- end trace frame: 0x5c1c2c63e00, count: 11
--db_more-- https://www.openbsd.org/ddb.html describes the minimum info required in bug
--db_more-- reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}> s = 0
uvm_fault(0xfffff5000b1f7b70, 0x98, 0, 1) -> e
kernel: page fault trap, code=0
--db_more-- Stopped at dovutimens+0x368: movl 0x98(%rax),%r12d
--db_more-- dovutimens(ffff80002a222d08,fffff5005e133568,ffff80002a2d27d0) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691
--db_more-- sys_futimes(ffff80002a222d08,ffff80002a2d2920,ffff80002a2d2870) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2733
--db_more-- syscall(ffff80002a2d2920) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
--db_more-- syscall(ffff80002a2d2920) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
--db_more-- end trace frame: 0x5c1c2c63e00, count: 11
ddb{0}> maxwidth = 0
No such command
ddb{0}> show panic
*cpu0: uvm_fault(0xfffff5000b1f7b70, 0x98, 0, 1) -> e
ddb{0}> show kasan
No such command
ddb{0}> trace
dovutimens(ffff80002a222d08,fffff5005e133568,ffff80002a2d27d0) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691
sys_futimes(ffff80002a222d08,ffff80002a2d2920,ffff80002a2d2870) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2733
--db_more-- syscall(ffff80002a2d2920) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
--db_more-- syscall(ffff80002a2d2920) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
--db_more-- Xsyscall() at Xsyscall+0x128
--db_more-- end of kernel
--db_more-- end trace frame: 0x5c1c2c63e00, count: -4
ddb{0}> registers
No such command
ddb{0}> show proc
PROC (syz-executor) tid=184761 pid=51061 tcnt=2 stat=onproc
flags process=0 proc=4000000<THREAD>
--db_more-- runpri=32, usrpri=81, slppri=32, nice=20
--db_more-- wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
--db_more-- forw=0xffffffffffffffff, list=0xffff80002a2234d0,0xffff80002a223ca8
--db_more-- process=0xffff800045ff44d8 user=0xffff80002a2cd000, vmspace=0xfffff5000b1f7b70
--db_more-- estcpu=31, cpticks=121, pctcpu=1.20, user=0, sys=121, intr=0
ddb{0}> ow all locks
No such command
ddb{0}>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup