1#!/bin/sh 2 3# Fatal trap 12: page fault while in kernel mode 4# cpuid = 1; apic id = 01 5# fault virtual address = 0x20 6# fault code = supervisor read data, page not present 7# instruction pointer = 0x20:0xfa1a2c 8# stack pointer = 0x28:0x27a41a80 9# frame pointer = 0x28:0x27a41a98 10# code segment = base 0x0, limit 0xfffff, type 0x1b 11# = DPL 0, pres 1, def32 1, gran 1 12# processor eflags = interrupt enabled, resume, IOPL = 0 13# current process = 804 (syzkaller63) 14# trap number = 12 15# panic: page fault 16# cpuid = 1 17# time = 1675071979 18# KDB: stack backtrace: 19# db_trace_self_wrapper(d,2048e3a0,27a41a40,20,c,...) at db_trace_self_wrapper+0x28/frame 0x27a418d0 20# vpanic(146c355,27a4190c,27a4190c,27a41938,141f1d6,...) at vpanic+0xf4/frame 0x27a418ec 21# panic(146c355,15010e8,0,fffff,1dfc39b,...) at panic+0x14/frame 0x27a41900 22# trap_fatal(2048e3a0,2048e3a0,27a4196c,1008e0a,18cd6638,...) at trap_fatal+0x346/frame 0x27a41938 23# trap_pfault(20,0,0) at trap_pfault+0x6f/frame 0x27a4196c 24# trap(27a41a40,8,28,28,0,...) at trap+0x31b/frame 0x27a41a34 25# calltrap() at 0xffc0321f/frame 0x27a41a34 26# --- trap 0xc, eip = 0xfa1a2c, esp = 0x27a41a80, ebp = 0x27a41a98 --- 27# kern_cpuset_getid(141f60e,0,9,0,0,0) at kern_cpuset_getid+0x10c/frame 0x27a41a98 28# sys_cpuset_getid(2048e3a0,2048e644,2048e3a0,2048e3a0,27a41b9c,...) at sys_cpuset_getid+0x32/frame 0x27a41ac0 29# syscall(27a41ba8,3b,3b,3b,ffbfe9fc,...) at syscall+0x1ef/frame 0x27a41b9c 30# Xint0x80_syscall() at 0xffc03479/frame 0x27a41b9c 31# --- syscall (486, FreeBSD ELF32, cpuset_getid), eip = 0x2056317d, esp = 0xffbfe990, ebp = 0xffbfe9b0 --- 32# KDB: enter: panic 33# [ thread pid 804 tid 100092 ] 34# Stopped at kdb_enter+0x34: movl $0,kdb_why 35# db> x/s version 36# version: FreeBSD 14.0-CURRENT #0 main-n260354-34b867ca30479: Mon Jan 30 07:26:30 CET 2023 37# pho@mercat1.netperf.freebsd.org:/mnt25/obj/usr/src/i386.i386/sys/PHO 38# db> 39 40. ../default.cfg 41prog=$(basename "$0" .sh) 42[ `uname -p` = "i386" ] || exit 0 43 44cat > /tmp/$prog.c <<EOF 45// https://syzkaller.appspot.com/bug?id=69dd3c8d867306dd9f97e2dae6ab1557fd8d2679 46// autogenerated by syzkaller (https://github.com/google/syzkaller) 47// Reported-by: syzbot+331e8402e0f7347f0f2a@syzkaller.appspotmail.com 48 49#define _GNU_SOURCE 50 51#include <pwd.h> 52#include <stdarg.h> 53#include <stdbool.h> 54#include <stdint.h> 55#include <stdio.h> 56#include <stdlib.h> 57#include <string.h> 58#include <sys/endian.h> 59#include <sys/syscall.h> 60#include <unistd.h> 61 62int main(void) 63{ 64 syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0); 65 syscall(SYS_cpuset_getid, 0, 9, 0ull, 0); 66 return 0; 67} 68EOF 69mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c || exit 1 70 71(cd /tmp; timeout -k 3s 2s ./$prog) 72 73rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core \ 74 /tmp/syzkaller.?????? 75exit 0 76