page fault in uvm_pgflcache_alloc

[syzbot <syzbot+0d7184ae7e8a5224d791%syzkaller.appspotmail.com@localhost>]

Hello,

syzbot found the following issue on:

HEAD commit:    b2782b14a8e5 libm: Add missing fma(3) and friends for sh3.
git tree:       netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16144354a80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=0d7184ae7e8a5224d791
compiler:       Debian clang version 15.0.7
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10bfb56ca80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15d67622a80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d4fd14f03742/disk-b2782b14.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/8801e6e6d74f/netbsd-b2782b14.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0d7184ae7e8a5224d791%syzkaller.appspotmail.com@localhost

[  55.4764735] fatal page faultfatal page fault in supervisor mode
[  55.4854072] trap type 6 code 0 rip 0xffffffff85073c54 cs 0x8 rflags 0x10246 cr2 0xffff9a80173814c0 ilevel 0x6 rsp 0xffff9a80c7aa25b0
[  55.4854072]  in supervisor mode
[  55.5002233] curlwp 0xffff9a8013440540 pid 1246.1246 lowest kstack 0xffff9a80c7a9b2c0
[ k er55ne.l5:0 0p2a2g3e3 ] fatrualpt  ttyrpaep ,6 c cooded=e0 [
 Stopped in pid 1246.1246 (syz-executor4027) at  netbsd:uvm_pgflcache_alloc+0x154:       movq    0(%rbx),%r14
?
uvm_pgflcache_alloc() at netbsd:uvm_pgflcache_alloc+0x154 sys/uvm/uvm_pgflcache.c:220
uvm_pagealloc_pgfl() at netbsd:uvm_pagealloc_pgfl+0xe2
uvm_pagealloc_strat() at netbsd:uvm_pagealloc_strat+0x2f34
pmap_enter_ma() at netbsd:pmap_enter_ma+0x1950 pmap_get_ptp sys/arch/x86/x86/pmap.c:2561 [inline]
pmap_enter_ma() at netbsd:pmap_enter_ma+0x1950 sys/arch/x86/x86/pmap.c:5052
pmap_enter_default() at netbsd:pmap_enter_default+0x158 sys/arch/x86/x86/pmap.c:4963
uvm_fault_internal() at netbsd:uvm_fault_internal+0x61e5 uvm_fault_lower_lookup sys/uvm/uvm_fault.c:2029 [inline]
uvm_fault_internal() at netbsd:uvm_fault_internal+0x61e5 uvm_fault_lower sys/uvm/uvm_fault.c:1867 [inline]
uvm_fault_internal() at netbsd:uvm_fault_internal+0x61e5 sys/uvm/uvm_fault.c:936
trap() at netbsd:trap+0x23bd
--- trap (number 6) ---
7f7e2b80a70a:
Panic string: (null)
PID    LID S CPU     FLAGS       STRUCT LWP *               NAME WAIT
1246 >1246 7   0         0   ffff9a8013440540   syz-executor4027
1244  1244 3   0         0   ffff9a8013440100   syz-executor4027 tstile
1240  1240 3   1         0   ffff9a8012c94940   syz-executor4027 tstile
991    991 3   0         0   ffff9a8012c94500   syz-executor4027 tstile
950    950 2   0         0   ffff9a8012c940c0   syz-executor4027
1241 >1241 7   1         0   ffff9a8012bd6900   syz-executor4027
829    829 2   1       140   ffff9a8012bd64c0   syz-executor4027
930    930 3   1       180   ffff9a8012bd6080   syz-executor4027 nanoslp
449    449 3   1       180   ffff9a801251e300   syz-executor4027 nanoslp
942    942 3   0     40180   ffff9a80123922c0   syz-executor4027 nanoslp
1235  1235 3   0       180   ffff9a80123006c0               sshd select
1222  1222 3   0       180   ffff9a8012300b00              getty nanoslp
1084  1084 3   0       180   ffff9a8012300280              getty nanoslp
1224  1224 3   1       180   ffff9a80121ffac0              getty nanoslp
1216  1216 3   0       1c0   ffff9a80121fc200              getty ttyraw
1103  1103 3   0       180   ffff9a8012ba88c0               sshd select
685    685 3   1       180   ffff9a80125e6780             powerd kqueue
693    693 3   0       180   ffff9a8012ba8480            syslogd kqueue
559    559 3   0       180   ffff9a8012ba8040             dhcpcd poll
746    746 3   1       180   ffff9a801251e740             dhcpcd poll
745    745 3   1       180   ffff9a8012392700             dhcpcd poll
599    599 3   1       180   ffff9a80125e6bc0             dhcpcd poll
487    487 3   0       180   ffff9a80125e6340             dhcpcd poll
292    292 3   1       180   ffff9a8012392b40             dhcpcd poll
485    485 2   0       100   ffff9a801251eb80             dhcpcd
1        1 3   0       180   ffff9a8011ede100               init wait
0      859 3   0       200   ffff9a80121fc640            physiod physiod
0      196 3   1       200   ffff9a80121ff680          pooldrain pooldrain
0      195 3   0       200   ffff9a80121ff240            ioflush syncer
0      194 3   0  121fc920   ffff9a80121fca80           pgdaemon pgdaemon
0      167 3   0       200   ffff9a801216ca40               usb7 usbevt
0      172 3   0       200   ffff9a801216c600               usb6 usbevt
0      170 3   0       200   ffff9a801216c1c0               usb5 usbevt
0      168 3   0       200   ffff9a801213ca00               usb4 usbevt


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller%googlegroups.com@localhost.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

-- 
You received this message because you are subscribed to the Google Groups "syzkaller-netbsd-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-netbsd-bugs+unsubscribe%googlegroups.com@localhost.
To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-netbsd-bugs/0000000000002566dd0600105c23%40google.com.