1#!/bin/sh 2 3# Fatal trap 12: page fault while in kernel mode 4# cpuid = 4; apic id = 04 5# fault virtual address = 0x28 6# fault code = supervisor read data, page not present 7# instruction pointer = 0x20:0xffffffff81549dea 8# stack pointer = 0x28:0xfffffe01d8689480 9# frame pointer = 0x28:0xfffffe01d8689490 10# code segment = base 0x0, limit 0xfffff, type 0x1b 11# = DPL 0, pres 1, long 1, def32 0, gran 1 12# processor eflags = interrupt enabled, resume, IOPL = 0 13# current process = 3050 (syzkaller46) 14# trap number = 12 15# panic: page fault 16# cpuid = 4 17# time = 1635158869 18# KDB: stack backtrace: 19# db_trace_self_wrapper() at db_trace_self_wrapper+0xa5/frame 0xfffffe01d8688cb0 20# kdb_backtrace() at kdb_backtrace+0xc9/frame 0xfffffe01d8688e10 21# vpanic() at vpanic+0x248/frame 0xfffffe01d8688ef0 22# panic() at panic+0xb5/frame 0xfffffe01d8688fb0 23# trap_fatal() at trap_fatal+0x52e/frame 0xfffffe01d86890b0 24# trap_pfault() at trap_pfault+0x132/frame 0xfffffe01d86891d0 25# trap() at trap+0x53f/frame 0xfffffe01d86893b0 26# calltrap() at calltrap+0x8/frame 0xfffffe01d86893b0 27# --- trap 0xc, rip = 0xffffffff81549dea, rsp = 0xfffffe01d8689480, rbp = 0xfffffe01d8689490 --- 28# filt_bpfwrite() filt_bpfwrite+0x4a/frame 0xfffffe01d8689490 29# kqueue_register() at kqueue_register+0xea3/frame 0xfffffe01d86895d0 30# kqueue_kevent() at kqueue_kevent+0x26a/frame 0xfffffe01d86899c0 31# kern_kevent_fp() at kern_kevent_fp+0xd2/frame 0xfffffe01d8689a10 32# kern_kevent() at kern_kevent+0x138/frame 0xfffffe01d8689b10 33# kern_kevent_generic() at kern_kevent_gene6/frame 0xfffffesys_kevent() at sys_kevent+0x1e1/frame 0xfffffe01d8689d30 34# amd64_syscall() at amd64_syscall+0x31e/frame 0xfffffe01d8689f30 35# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01d8689f30 36# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x8003adafa, rsp = 0x7fffffffe648, rbp = 0x7fffffffe670 --- 37# KDB: enter: panic 38# [ thread pid 3050 tid 100263 ] 39# Stopped at kdb_enter+0x37: movq $0,0x2638c4e(%rip) 40# db> x/s version 41# version: FreeBSD 14.0-CURRENT #0 main-n250242-eab5358b9080-dirty: Mon Oct 25 11:32:45 CEST 2021 42# pho@mercat1.netperf.freebsd.org 43# db> 44 45 46[ `uname -p` != "amd64" ] && exit 0 47[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 48 49. ../default.cfg 50cat > /tmp/syzkaller46.c <<EOF 51// https://syzkaller.appspot.com/bug?id=a99f705b2b8b854d70ec4d47eed481c90046bd3c 52// autogenerated by syzkaller (https://github.com/google/syzkaller) 53// Reported-by: syzbot+ae45d5166afe15a5a21d@syzkaller.appspotmail.com 54 55#define _GNU_SOURCE 56 57#include <pwd.h> 58#include <stdarg.h> 59#include <stdbool.h> 60#include <stdint.h> 61#include <stdio.h> 62#include <stdlib.h> 63#include <string.h> 64#include <sys/endian.h> 65#include <sys/syscall.h> 66#include <unistd.h> 67 68uint64_t r[1] = {0xffffffffffffffff}; 69 70int main(void) 71{ 72 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 73 intptr_t res = 0; 74 memcpy((void*)0x20000040, "/dev/bpf\000", 9); 75 syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000040ul, 0ul, 0ul); 76 res = syscall(SYS_kqueue); 77 if (res != -1) 78 r[0] = res; 79 *(uint64_t*)0x20000480 = 0x284; 80 *(uint16_t*)0x20000488 = 0xfff8; 81 *(uint16_t*)0x2000048a = 0x10; 82 *(uint32_t*)0x2000048c = 1; 83 *(uint64_t*)0x20000490 = 0x401; 84 *(uint64_t*)0x20000498 = 5; 85 *(uint64_t*)0x200004a0 = 5; 86 *(uint64_t*)0x200004a8 = 0x24000000; 87 *(uint64_t*)0x200004b0 = 0x100000000; 88 *(uint64_t*)0x200004b8 = 0x3f; 89 *(uint64_t*)0x200004c0 = 3; 90 *(uint16_t*)0x200004c8 = 0xfffe; 91 *(uint16_t*)0x200004ca = 1; 92 *(uint32_t*)0x200004cc = 1; 93 *(uint64_t*)0x200004d0 = 1; 94 *(uint64_t*)0x200004d8 = 3; 95 *(uint64_t*)0x200004e0 = 9; 96 *(uint64_t*)0x200004e8 = 0x3ff; 97 *(uint64_t*)0x200004f0 = 0x100000001; 98 *(uint64_t*)0x200004f8 = 3; 99 *(uint64_t*)0x20000500 = 5; 100 *(uint16_t*)0x20000508 = 0xfffe; 101 *(uint16_t*)0x2000050a = 0x42; 102 *(uint32_t*)0x2000050c = 2; 103 *(uint64_t*)0x20000510 = 5; 104 *(uint64_t*)0x20000518 = 0x7f; 105 *(uint64_t*)0x20000520 = 9; 106 *(uint64_t*)0x20000528 = 0x600000000; 107 *(uint64_t*)0x20000530 = 0x1f; 108 *(uint64_t*)0x20000538 = 7; 109 syscall(SYS_kevent, r[0], 0x20000480ul, 3ul, 0x200001c0ul, 0xaul, 0ul); 110 return 0; 111} 112EOF 113mycc -o /tmp/syzkaller46 -Wall -Wextra -O0 /tmp/syzkaller46.c -lpthread || exit 1 114 115(cd /tmp; ./syzkaller46) 116 117rm -rf /tmp/syzkaller46 /tmp/syzkaller46.c /tmp/syzkaller.* 118exit 0 119