[Bug 293900] panic: dst_m ADDR is not wired

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293900

            Bug ID: 293900
           Summary: panic: dst_m ADDR is not wired
           Product: Base System
           Version: 15.0-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: r772577952@gmail.com

Hi FreeBSD maintainers,

We have discovered an issue in the kernel when fuzzing freebsd with syzkaller
and our generated syscall description. This issue is reproducible on the latest
release (release/15.0.0-p4, commit 8ef0ed690df2dca0cc22b827819d112f868470bb),
and from the issue report I think the root cause appears to be located within
the VM subsystem.

The kernel console output, kernel config, and C/syz reproducers can be found at
https://drive.google.com/drive/folders/15kt9ABSTSccI2V7Bhpwxj9_SrkOkt981?usp=sharing.
The issue report is also listed below (symbolized by our modified
syz-symbolize) to assist with the analysis:

```
TITLE: panic: dst_m ADDR is not wired
CORRUPTED: false ()
SUPPRESSED: false
MAINTAINERS (TO): []
MAINTAINERS (CC): []

panic: dst_m 0xfffffe0009028e48 is not wired
cpuid = 2
time = 1773840257
KDB: stack backtrace:
#0 0xffffffff81608a59 at kdb_backtrace+0x119
/usr/obj/usr/src/kern/subr_kdb.c:452
#1 0xffffffff81537d67 at vpanic+0x257 /usr/obj/usr/src/kern/kern_shutdown.c:960
#2 0xffffffff81537b05 at panic+0xb5 /usr/obj/usr/src/kern/kern_shutdown.c:887
#3 0xffffffff81dc61b3 at vm_fault_copy_entry+0xa43
/usr/obj/usr/src/vm/vm_fault.c:2172
#4 0xffffffff81dd8edd at vm_map_protect+0xfed /usr/obj/usr/src/vm/vm_map.c:0
#5 0xffffffff81dea3e1 at sys_mprotect+0x191 /usr/obj/usr/src/vm/vm_mmap.c:690
#6 0xffffffff820f9372 at amd64_syscall+0x4e2
/usr/obj/usr/src/kern/subr_syscall.c:193
#7 0xffffffff8209ffab at fast_syscall_common+0xf8
/usr/obj/usr/src/amd64/amd64/exception.S:571
Uptime: 55s
Automatic reboot in 15 seconds - press a key on the console to abort
```

-- 
You are receiving this mail because:
You are the assignee for the bug.