1*e3b31e23SPeter Holm#!/bin/sh 2*e3b31e23SPeter Holm 3*e3b31e23SPeter Holm# Fatal trap 12: page fault while in kernel mode 4*e3b31e23SPeter Holm# cpuid = 5; apic id = 05 5*e3b31e23SPeter Holm# fault virtual address = 0x3e07d728 6*e3b31e23SPeter Holm# fault code = supervisor write data, page not present 7*e3b31e23SPeter Holm# instruction pointer = 0x20:0xffffffff80c9ba1d 8*e3b31e23SPeter Holm# stack pointer = 0x28:0xfffffe014d9ceba0 9*e3b31e23SPeter Holm# frame pointer = 0x28:0xfffffe014d9cec00 10*e3b31e23SPeter Holm# code segment = base 0x0, limit 0xfffff, type 0x1b 11*e3b31e23SPeter Holm# = DPL 0, pres 1, long 1, def32 0, gran 1 12*e3b31e23SPeter Holm# processor eflags = interrupt enabled, resume, IOPL = 0 13*e3b31e23SPeter Holm# current process = 3135 (syzkaller60) 14*e3b31e23SPeter Holm# trap number = 12 15*e3b31e23SPeter Holm# panic: page fault 16*e3b31e23SPeter Holm# cpuid = 5 17*e3b31e23SPeter Holm# time = 1656134459 18*e3b31e23SPeter Holm# KDB: stack backtrace: 19*e3b31e23SPeter Holm# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe014d9ce960 20*e3b31e23SPeter Holm# vpanic() at vpanic+0x151/frame 0xfffffe014d9ce9b0 21*e3b31e23SPeter Holm# panic() at panic+0x43/frame 0xfffffe014d9cea10 22*e3b31e23SPeter Holm# trap_fatal() at trap_fatal+0x387/frame 0xfffffe014d9cea70 23*e3b31e23SPeter Holm# trap_pfault() at trap_pfault+0xab/frame 0xfffffe014d9cead0 24*e3b31e23SPeter Holm# calltrap() at calltrap+0x8/frame 0xfffffe014d9cead0 25*e3b31e23SPeter Holm# --- trap 0xc, rip = 0xffffffff80c9ba1d, rsp = 0xfffffe014d9ceba0, rbp = 0xfffffe014d9cec00 --- 26*e3b31e23SPeter Holm# soclose() at soclose+0x1ad/frame 0xfffffe014d9cec00 27*e3b31e23SPeter Holm# _fdrop() at _fdrop+0x1b/frame 0xfffffe014d9cec20 28*e3b31e23SPeter Holm# closef() at closef+0x1db/frame 0xfffffe014d9cecb0 29*e3b31e23SPeter Holm# fdescfree() at fdescfree+0x433/frame 0xfffffe014d9ced80 30*e3b31e23SPeter Holm# exit1() at exit1+0x4ef/frame 0xfffffe014d9cedf0 31*e3b31e23SPeter Holm# sys_exit() at sys_exit+0xd/frame 0xfffffe014d9cee00 32*e3b31e23SPeter Holm# amd64_syscall() md64_syscall+0x145/frame 0xfffffe014d9cef30 33*e3b31e23SPeter Holm# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe014d9cef30 34*e3b31e23SPeter Holm# --- syscall (1, FreeBSD ELF64, sys_exit), rip = 0x82209fdca, rsp = 0x820fab718, rbp = 0x820fab730 --- 35*e3b31e23SPeter Holm# KDB: enter: panic 36*e3b31e23SPeter Holm# [ thread pid 3135 tid 100332 ] 37*e3b31e23SPeter Holm# Stopped at kdb_enter+0x32: movq $0,0x129f1a3(%rip) 38*e3b31e23SPeter Holm# db> x/s version 39*e3b31e23SPeter Holm# version: FreeBSD 14.0-CURRENT #0 main-n256319-c11e64ce51308: Sat Jun 25 07:12:49 CEST 2022\012 40*e3b31e23SPeter Holm# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO 41*e3b31e23SPeter Holm# db> 42*e3b31e23SPeter Holm 43*e3b31e23SPeter Holm[ `uname -p` != "amd64" ] && exit 0 44*e3b31e23SPeter Holm 45*e3b31e23SPeter Holm. ../default.cfg 46*e3b31e23SPeter Holmcat > /tmp/syzkaller60.c <<EOF 47*e3b31e23SPeter Holm// https://syzkaller.appspot.com/bug?id=c08c1aff3eaffde1197888c66684fabf474f3305 48*e3b31e23SPeter Holm// autogenerated by syzkaller (https://github.com/google/syzkaller) 49*e3b31e23SPeter Holm// Reported-by: syzbot+4b862074650b91e087b4@syzkaller.appspotmail.com 50*e3b31e23SPeter Holm 51*e3b31e23SPeter Holm#define _GNU_SOURCE 52*e3b31e23SPeter Holm 53*e3b31e23SPeter Holm#include <pwd.h> 54*e3b31e23SPeter Holm#include <stdarg.h> 55*e3b31e23SPeter Holm#include <stdbool.h> 56*e3b31e23SPeter Holm#include <stdint.h> 57*e3b31e23SPeter Holm#include <stdio.h> 58*e3b31e23SPeter Holm#include <stdlib.h> 59*e3b31e23SPeter Holm#include <string.h> 60*e3b31e23SPeter Holm#include <sys/endian.h> 61*e3b31e23SPeter Holm#include <sys/syscall.h> 62*e3b31e23SPeter Holm#include <unistd.h> 63*e3b31e23SPeter Holm 64*e3b31e23SPeter Holmuint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; 65*e3b31e23SPeter Holm 66*e3b31e23SPeter Holmint main(void) 67*e3b31e23SPeter Holm{ 68*e3b31e23SPeter Holm syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 69*e3b31e23SPeter Holm intptr_t res = 0; 70*e3b31e23SPeter Holm res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 71*e3b31e23SPeter Holm if (res != -1) 72*e3b31e23SPeter Holm r[0] = res; 73*e3b31e23SPeter Holm *(uint8_t*)0x20000000 = 0x1c; 74*e3b31e23SPeter Holm *(uint8_t*)0x20000001 = 0x1c; 75*e3b31e23SPeter Holm *(uint16_t*)0x20000002 = htobe16(0x4e22); 76*e3b31e23SPeter Holm *(uint32_t*)0x20000004 = 0; 77*e3b31e23SPeter Holm memset((void*)0x20000008, 0, 16); 78*e3b31e23SPeter Holm *(uint32_t*)0x20000018 = 0; 79*e3b31e23SPeter Holm syscall(SYS_bind, r[0], 0x20000000ul, 0x1cul); 80*e3b31e23SPeter Holm syscall(SYS_listen, r[0], 0x40000); 81*e3b31e23SPeter Holm res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 82*e3b31e23SPeter Holm if (res != -1) 83*e3b31e23SPeter Holm r[1] = res; 84*e3b31e23SPeter Holm *(uint8_t*)0x20000180 = 0x1c; 85*e3b31e23SPeter Holm *(uint8_t*)0x20000181 = 0x1c; 86*e3b31e23SPeter Holm *(uint16_t*)0x20000182 = htobe16(0x4e22); 87*e3b31e23SPeter Holm *(uint32_t*)0x20000184 = 0; 88*e3b31e23SPeter Holm *(uint64_t*)0x20000188 = htobe64(0); 89*e3b31e23SPeter Holm *(uint64_t*)0x20000190 = htobe64(1); 90*e3b31e23SPeter Holm *(uint32_t*)0x20000198 = 0; 91*e3b31e23SPeter Holm syscall(SYS_connect, r[1], 0x20000180ul, 0x1cul); 92*e3b31e23SPeter Holm return 0; 93*e3b31e23SPeter Holm} 94*e3b31e23SPeter HolmEOF 95*e3b31e23SPeter Holmmycc -o /tmp/syzkaller60 -Wall -Wextra -O0 /tmp/syzkaller60.c || exit 1 96*e3b31e23SPeter Holm 97*e3b31e23SPeter Holmkldstat | grep -q sctp || { kldload sctp.ko && loaded=1; } 98*e3b31e23SPeter Holm(cd /tmp; timeout 3m ./syzkaller60) 99*e3b31e23SPeter Holm 100*e3b31e23SPeter Holmrm -rf /tmp/syzkaller60 /tmp/syzkaller60.c /tmp/syzkaller60.core \ 101*e3b31e23SPeter Holm /tmp/syzkaller.?????? 102*e3b31e23SPeter Holm[ $loaded ] && kldunload sctp.ko 103*e3b31e23SPeter Holmexit 0 104