uvm_fault: rtable_exists

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 2fc221d2874b Fix csr_swap() to return the old value instea..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11e7dc32580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=4884480f6658a84b2428

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2da922515f83/disk-2fc221d2.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/1064f5cef68a/bsd-2fc221d2.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2a8a7ae844dd/kernel-2fc221d2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+488448...@syzkaller.appspotmail.com

uvm_fault(0xfffff7006f07d7b0, 0x6a5d09db, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at rtable_exists+0x13c: movq 0(%rax,%rcx,8),%r12
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*322941 69162 0 0x2 0 0K ifconfig
rtable_exists(0) at rtable_exists+0x13c sys/net/rtable.c:278
rtrequest(1,ffff80003c3dc888,1,ffff80003c3dc930,0) at rtrequest+0x119 sys/net/route.c:969
rt_ifa_add(ffff80000002c300,240404,ffff80000002c350,0) at rt_ifa_add+0x22e sys/net/route.c:1284
rt_ifa_addlocal(ffff80000002c300) at rt_ifa_addlocal+0x1d8 sys/net/route.c:1394
in6_update_ifa(ffff800001614000,ffff80003c3dcbd0,0) at in6_update_ifa+0x1878 sys/netinet6/in6.c:722
in6_ifattach_linklocal(ffff800001614000,0) at in6_ifattach_linklocal+0x33b sys/netinet6/in6_ifattach.c:266
in6_ifattach(ffff800001614000) at in6_ifattach+0x2d0 sys/netinet6/in6_ifattach.c:384
ifioctl(ffff8000015aabd0,801169ab,ffff80003c3dcdc0,ffff80002a223a00) at ifioctl+0x1b13 sys/net/if.c:2218
sys_ioctl(ffff80002a223a00,ffff80003c3dcfa0,ffff80003c3dcef0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3dcfa0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3dcfa0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c2ad77fadb0, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xfffff7006f07d7b0, 0x6a5d09db, 0, 1) -> e
ddb{0}> show kasan
No such command
ddb{0}> trace
rtable_exists(0) at rtable_exists+0x13c sys/net/rtable.c:278
rtrequest(1,ffff80003c3dc888,1,ffff80003c3dc930,0) at rtrequest+0x119 sys/net/route.c:969
rt_ifa_add(ffff80000002c300,240404,ffff80000002c350,0) at rt_ifa_add+0x22e sys/net/route.c:1284
rt_ifa_addlocal(ffff80000002c300) at rt_ifa_addlocal+0x1d8 sys/net/route.c:1394
in6_update_ifa(ffff800001614000,ffff80003c3dcbd0,0) at in6_update_ifa+0x1878 sys/netinet6/in6.c:722
in6_ifattach_linklocal(ffff800001614000,0) at in6_ifattach_linklocal+0x33b sys/netinet6/in6_ifattach.c:266
in6_ifattach(ffff800001614000) at in6_ifattach+0x2d0 sys/netinet6/in6_ifattach.c:384
ifioctl(ffff8000015aabd0,801169ab,ffff80003c3dcdc0,ffff80002a223a00) at ifioctl+0x1b13 sys/net/if.c:2218
sys_ioctl(ffff80002a223a00,ffff80003c3dcfa0,ffff80003c3dcef0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3dcfa0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3dcfa0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c2ad77fadb0, count: -11
ddb{0}> show registers
rdi 0x17
rsi 0
rbp 0xffff80003c3dc750
rbx 0x1
rdx 0
rcx 0
rax 0x6a5d09db
r8 0
r9 0x8080808080808080
r10 0x6be1f9bdd8114f42
r11 0x5dcfa35c049e5290
r12 0xffff800000c43b20
r13 0x17
r14 0
r15 0xffff80003c3dc700
rip 0xffffffff82a32cec rtable_exists+0x13c
cs 0x8
rflags 0x10206 __ALIGN_SIZE+0xf206
rsp 0xffff80003c3dc700
ss 0x10
rtable_exists+0x13c: movq 0(%rax,%rcx,8),%r12
ddb{0}>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup