Somewhat simpler str:
still build github.com/mozilla/rr
compile this program with gcc -pthread test.c

#include <pthread.h>
#include <sys/time.h>

static pthread_t reader;

static void* reader_thread(void* dontcare) {
  return NULL;
}

int main(int argc, char* argv[]) {
  struct timeval ts;

  /* (Kick on the syscallbuf if it's enabled.) */
  gettimeofday(&ts, NULL);


  pthread_create(&reader, NULL, reader_thread, NULL);
  pthread_join(reader, NULL);

  return 0;
}

then run
rr record ./a.out
rr replay
when you are dropped into gdb continnue the inferior and see the connection is closed rr is killed and the same kernel bug message appears in dmesg.

I have reduced this to a simple test program that doesn't involve rr. The program is basically

  int fd = open("/proc/self/mem", O_RDWR);
  void* p = mmap(NULL, PAGE_SIZE*2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  mmap(p, PAGE_SIZE, PROT_NONE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  pwrite(fd, zeroes, sizeof(zeroes), (size_t)p); 

It seems to be as simple as a write to /proc/.../mem that crosses VMAs.

On 4.0.4-301.fc22.x86_64, this program fails with a SIGSEGV and we get this in the kernel log:

[14719.326561] ------------[ cut here ]------------
[14719.326570] kernel BUG at mm/memory.c:3042!
[14719.326573] invalid opcode: 0000 [#164] SMP 
[14719.326577] Modules linked in: ccm nfnetlink_queue nfnetlink_log nfnetlink snd_seq_dummy rfcomm xt_CHECKSUM iptable_mangle ipt_MASQUERAD
E nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge ebtable_filter ebtables ip6table_filter ip6_tables ppdev parport_pc parport fuse vmw_vsock_vmci_transport vsock vmw_vmci bnep vfat fat nvidia(POE) arc4 iwldvm uvcvideo btusb videobuf2_vmalloc videobuf2_core videobuf2_memops v4l2_common videodev bluetooth cdc_mbim media cdc_ncm usbnet cdc_acm cdc_wdm mii mac80211 snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi iTCO_wdt iTCO_vendor_support snd_hda_intel mmc_block snd_hda_controller snd_hda_codec intel_rapl iosf_mbi drm iwlwifi snd_hwdep x86_pkg_temp_thermal coretemp snd_seq snd_seq_device
[14719.326643]  cfg80211 snd_pcm sdhci_pci sdhci mmc_core lpc_ich mfd_core snd_timer kvm_intel mei_me mei i2c_i801 shpchp kvm thinkpad_acpi joydev snd serio_raw soundcore tpm_tis rfkill tpm video wmi nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc dm_crypt 8021q garp stp llc mrp crct10dif_pclmul crc32_pclmul e1000e crc32c_intel firewire_ohci ghash_clmulni_intel firewire_core uas usb_storage crc_itu_t ptp pps_core
[14719.326688] CPU: 6 PID: 21417 Comm: test Tainted: P      D W  OE   4.0.4-301.fc22.x86_64 #1
[14719.326691] Hardware name: LENOVO 243827M/243827M, BIOS G5ET61WW (2.03 ) 09/13/2012
[14719.326695] task: ffff8807405831b0 ti: ffff88061c00c000 task.ti: ffff88061c00c000
[14719.326697] RIP: 0010:[<ffffffff811d2dd4>]  [<ffffffff811d2dd4>] handle_mm_fault+0x12a4/0x1840
[14719.326710] RSP: 0018:ffff88061c00fbf8  EFLAGS: 00010246
[14719.326712] RAX: 0000000000000100 RBX: 0000000000000000 RCX: 0000000000000120
[14719.326715] RDX: ffff8806a614c8d0 RSI: 00003ffffffff000 RDI: 00000006a614c067
[14719.326717] RBP: ffff88061c00fcd8 R08: 00000005ef2dc120 R09: ffff8807a0bbba70
[14719.326719] R10: ffff8800000008d0 R11: 0000000000000120 R12: 0000000000000000
[14719.326721] R13: ffff8807a0bbba70 R14: ffff8806a53e9c38 R15: 00007f9ee9d1a000
[14719.326725] FS:  00007f9ee9cec700(0000) GS:ffff88081dd80000(0000) knlGS:0000000000000000
[14719.326727] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[14719.326729] CR2: 0000000000601000 CR3: 00000007f4db5000 CR4: 00000000001407e0
[14719.326732] Stack:
[14719.326734]  ffff88061c00fc80 0000000000000000 ffff88081dd98e38 ffff88061c00fda8
[14719.326738]  ffff88061c00fc88 ffffffff811cbc64 ffff8807a0bbba70 ffff8800ce994400
[14719.326742]  01000005ef2dc120 00000000000008d0 ffffea0000000001 ffff8800ce994400
[14719.326747] Call Trace:
[14719.326755]  [<ffffffff811cbc64>] ? follow_page_pte+0xc4/0x400
[14719.326761]  [<ffffffff811cc14c>] ? follow_page_mask+0x1ac/0x330
[14719.326766]  [<ffffffff811cc4c3>] __get_user_pages+0x1f3/0x710
[14719.326772]  [<ffffffff811cce32>] get_user_pages+0x52/0x60
[14719.326778]  [<ffffffff811cd19c>] __access_remote_vm+0xec/0x300
[14719.326783]  [<ffffffff811d353f>] access_remote_vm+0x1f/0x30
[14719.326790]  [<ffffffff8128b11b>] mem_rw.isra.13+0xbb/0x190
[14719.326795]  [<ffffffff8128b20b>] mem_write+0x1b/0x20
[14719.326801]  [<ffffffff8121d1d4>] vfs_write+0xb4/0x210
[14719.326809]  [<ffffffff810226a5>] ? do_audit_syscall_entry+0x55/0x80
[14719.326814]  [<ffffffff8121e07a>] SyS_pwrite64+0x9a/0xc0
[14719.326823]  [<ffffffff81788c89>] system_call_fastpath+0x12/0x17
[14719.326825] Code: ff ff 48 89 75 b8 48 8d 75 90 48 89 4d c0 48 89 55 98 89 45 90 49 8b 86 90 00 00 00 ff 50 18 4c 8b 95 60 ff ff ff e9 9e fa ff ff <0f> 0b 83 e8 1e 83 f8 01 0f 86 7a 03 00 00 c7 85 60 ff ff ff 10 
[14719.326868] RIP  [<ffffffff811d2dd4>] handle_mm_fault+0x12a4/0x1840
[14719.326873]  RSP <ffff88061c00fbf8>
[14719.326877] ---[ end trace a3f27ce02b728e21 ]---

Created attachment 180381 [details]
test.c

Created attachment 180391 [details]
test.c

Sorry, attached the wrong file previously.

Created attachment 180401 [details]
test.c

Actually I can simplify it further.

This seems to boil down to writing to /proc/.../mem where memory has been mapped PROT_NONE.

This definitely worked in older kernels, though I don't have a precise regression range.

I contributed a patch to address this which has been merged into 4.8rc8, assuming there are no problems discovered with the patch during the testing window, this should be resolved.

ref: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=38e088546522e1e86d2b8f401a1354ad3a9b3303

Thanks!