[Bug 244346] [3] [Kernel panic: vm_fault_lookup: fault on nofault entry, addr: 0xfffffe0032000000] observed while plugging the UFS USB drive on FreeBSD13-CURRENT

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=244346

            Bug ID: 244346
           Summary: [3] [Kernel panic: vm_fault_lookup: fault on nofault
                    entry, addr: 0xfffffe0032000000] observed while
                    plugging the UFS USB drive on FreeBSD13-CURRENT
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: neerajpal09 at gmail.com

Created attachment 211869
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=211869&action=edit
Contains PoC UFS image and detailed logs includes 13-current

Hi there,

Kernel Panic is observed while attaching the usb drive which contains malicious
UFS filesystem image. No user authentication and interaction is needed.

Just flash the attached UFS image to usb drive and plug the usb drive to
FreeBSD 13-CURRENT.

This doesn't observe on 
+ FreeBSD 12.1-RELEASE r354233
+ FreeBSD 12.1-STABLE r358121.


[Kernel Log - FreeBSD 13-CURRENT]

freebsd dumped core - see /var/crash/vmcore.0

Fri Feb 21 06:41:47 UTC 2020

FreeBSD freebsd 13.0-CURRENT FreeBSD 13.0-CURRENT #3: Thu Feb 20
03:35:37 UTC 2020
root at freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC  amd64

panic: vm_fault_lookup: fault on nofault entry, addr: 0xfffffe0032000000

GNU gdb (GDB) 8.3.1 [GDB v8.3.1 for FreeBSD]
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd13.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...
Reading symbols from /usr/lib/debug//boot/kernel/kernel.debug...

Unread portion of the kernel message buffer:
panic: vm_fault_lookup: fault on nofault entry, addr: 0xfffffe0032000000
cpuid = 0
time = 1582267109
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe002c779490
vpanic() at vpanic+0x185/frame 0xfffffe002c7794f0
panic() at panic+0x43/frame 0xfffffe002c779550
vm_fault() at vm_fault+0x1a98/frame 0xfffffe002c779680
vm_fault_trap() at vm_fault_trap+0x6e/frame 0xfffffe002c7796c0
trap_pfault() at trap_pfault+0x1f3/frame 0xfffffe002c779740
trap() at trap+0x2a7/frame 0xfffffe002c779870
calltrap() at calltrap+0x8/frame 0xfffffe002c779870
--- trap 0xc, rip = 0xffffffff810104fa, rsp = 0xfffffe002c779940, rbp
= 0xfffffe002c779950 ---
sse42_crc32c() at sse42_crc32c+0x8a/frame 0xfffffe002c779950
readsuper() at readsuper+0x101/frame 0xfffffe002c779990
ffs_sbget() at ffs_sbget+0x8f/frame 0xfffffe002c779a00
g_label_ufs_taste_common() at g_label_ufs_taste_common+0x79/frame
0xfffffe002c779a40
g_label_taste() at g_label_taste+0x2ac/frame 0xfffffe002c779b50
g_new_provider_event() at g_new_provider_event+0xaa/frame 0xfffffe002c779b70
g_run_events() at g_run_events+0x176/frame 0xfffffe002c779bb0
fork_exit() at fork_exit+0x80/frame 0xfffffe002c779bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe002c779bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
Uptime: 7m56s
Dumping 258 out of 4062 MB:..7%..13%..25%..31%..44%..56%..62%..75%..81%..93%


[Attachments]
+ UFS filesystem image
+ detailed logs from FreeBSD 13-CURRENT

-- 
You are receiving this mail because:
You are the assignee for the bug.