1#!/bin/sh 2 3# Fatal trap 12: page fault while in kernel mode 4# cpuid = 21; apic id = 29 5# fault virtual address = 0x5eb9977d 6# fault code = supervisor read data, page not present 7# instruction pointer = 0x20:0xffffffff80d8f181 8# stack pointer = 0x28:0xfffffe0126709300 9# frame pointer = 0x28:0xfffffe0126709750 10# code segment = base 0x0, limit 0xfffff, type 0x1b 11# = DPL 0, pres 1, long 1, def32 0, gran 1 12# processor eflags = interrupt enabled, resume, IOPL = 0 13# current process = 12 (swi1: netisr 0) 14# trap number = 12 15# panic: page fault 16# cpuid = 21 17# time = 1589220309 18# KDB: stack backtrace: 19# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0126708fb0 20# vpanic() at vpanic+0x182/frame 0xfffffe0126709000 21# panic() at panic+0x43/frame 0xfffffe0126709060 22# trap_fatal() at trap_fatal+0x387/frame 0xfffffe01267090c0 23# trap_pfault() at trap_pfault+0x99/frame 0xfffffe0126709120 24# trap() at trap+0x2a5/frame 0xfffffe0126709230 25# calltrap() at calltrap+0x8/frame 0xfffffe0126709230 26# --- trap 0xc, rip = 0xffffffff80d8f181, rsp = 0xfffffe0126709300, rbp = 0xfffffe0126709750 --- 27# sctp_process_control() at sctp_process_control+0x1351/frame 0xfffffe0126709750 28# sctp_common_input_processing() at sctp_common_input_processing+0x4f1/frame 0xfffffe01267098c0 29# sctp6_input_with_port() at sctp6_input_with_port+0x22c/frame 0xfffffe01267099b0 30# sctp6_input() at sctp6_input+0xb/frame 0xfffffe01267099c0 31# ip6_input() at ip6_input+0xe89/frame 0xfffffe0126709aa0 32# swi_net() at swi_net+0x1a1/frame 0xfffffe0126709b20 33# ithread_loop() at ithread_loop+0x279/frame 0xfffffe0126709bb0 34# fork_exit() at fork_exit+0x80/frame 0xfffffe0126709bf0 35# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0126709bf0 36# --- trap 0, rip = 0, rsp = 0, rbp = 0 --- 37# KDB: enter: panic 38# [ thread pid 12 tid 100083 ] 39# Stopped at kdb_enter+0x37: movq $0,0x10ca9a6(%rip) 40# db> 41 42# Reproduced on r360902 43# Fixed by r360942 44 45[ `uname -p` = "i386" ] && exit 0 46 47. ../default.cfg 48kldstat -v | grep -q sctp || kldload sctp.ko 49cat > /tmp/syzkaller12.c <<EOF 50// https://syzkaller.appspot.com/bug?id=978bd3a9b4c66b88dd523a3b8b32a1b0aa47ed83 51// autogenerated by syzkaller (https://github.com/google/syzkaller) 52 53#define _GNU_SOURCE 54 55#include <sys/types.h> 56 57#include <pwd.h> 58#include <signal.h> 59#include <stdarg.h> 60#include <stdbool.h> 61#include <stdint.h> 62#include <stdio.h> 63#include <stdlib.h> 64#include <string.h> 65#include <sys/endian.h> 66#include <sys/syscall.h> 67#include <sys/wait.h> 68#include <time.h> 69#include <unistd.h> 70 71static void kill_and_wait(int pid, int* status) 72{ 73 kill(pid, SIGKILL); 74 while (waitpid(-1, status, 0) != pid) { 75 } 76} 77 78static void sleep_ms(uint64_t ms) 79{ 80 usleep(ms * 1000); 81} 82 83static uint64_t current_time_ms(void) 84{ 85 struct timespec ts; 86 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 87 exit(1); 88 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 89} 90 91static void execute_one(void); 92 93#define WAIT_FLAGS 0 94 95static void loop(void) 96{ 97 int iter; 98 for (iter = 0;; iter++) { 99 int pid = fork(); 100 if (pid < 0) 101 exit(1); 102 if (pid == 0) { 103 execute_one(); 104 exit(0); 105 } 106 int status = 0; 107 uint64_t start = current_time_ms(); 108 for (;;) { 109 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 110 break; 111 sleep_ms(1); 112 if (current_time_ms() - start < 5 * 1000) 113 continue; 114 kill_and_wait(pid, &status); 115 break; 116 } 117 } 118} 119 120uint64_t r[1] = {0xffffffffffffffff}; 121 122void execute_one(void) 123{ 124 intptr_t res = 0; 125 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 126 if (res != -1) 127 r[0] = res; 128 *(uint8_t*)0x20000000 = 0x1c; 129 *(uint8_t*)0x20000001 = 0x1c; 130 *(uint16_t*)0x20000002 = htobe16(0x4e22); 131 *(uint32_t*)0x20000004 = 0; 132 *(uint8_t*)0x20000008 = 0; 133 *(uint8_t*)0x20000009 = 0; 134 *(uint8_t*)0x2000000a = 0; 135 *(uint8_t*)0x2000000b = 0; 136 *(uint8_t*)0x2000000c = 0; 137 *(uint8_t*)0x2000000d = 0; 138 *(uint8_t*)0x2000000e = 0; 139 *(uint8_t*)0x2000000f = 0; 140 *(uint8_t*)0x20000010 = 0; 141 *(uint8_t*)0x20000011 = 0; 142 *(uint8_t*)0x20000012 = 0; 143 *(uint8_t*)0x20000013 = 0; 144 *(uint8_t*)0x20000014 = 0; 145 *(uint8_t*)0x20000015 = 0; 146 *(uint8_t*)0x20000016 = 0; 147 *(uint8_t*)0x20000017 = 0; 148 *(uint32_t*)0x20000018 = 0; 149 syscall(SYS_bind, r[0], 0x20000000ul, 0x1cul); 150 *(uint8_t*)0x20000180 = 0x5f; 151 *(uint8_t*)0x20000181 = 0x1c; 152 *(uint16_t*)0x20000182 = htobe16(0x4e22); 153 *(uint32_t*)0x20000184 = 0; 154 *(uint64_t*)0x20000188 = htobe64(0); 155 *(uint64_t*)0x20000190 = htobe64(1); 156 *(uint32_t*)0x20000198 = 0; 157 syscall(SYS_connect, r[0], 0x20000180ul, 0x1cul); 158} 159int main(void) 160{ 161 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 162 loop(); 163 return 0; 164} 165// https://syzkaller.a 166EOF 167mycc -o /tmp/syzkaller12 -Wall -Wextra -O2 /tmp/syzkaller12.c -lpthread || 168 exit 1 169 170(cd /tmp; ./syzkaller12) & 171sleep 60 172pkill -9 syzkaller12 173wait 174 175rm -f /tmp/syzkaller12 /tmp/syzkaller12.c /tmp/syzkaller12.core 176exit 0 177