syzbot


assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c (3)

Status: upstream: reported on 2024/04/20 10:28
Reported-by: syzbot+116f728e8f2fd3210d63@syzkaller.appspotmail.com
First crash: 215d, last: 88d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c (2) 1 347d 347d 0/3 auto-obsoleted due to no activity on 2024/03/09 03:03
openbsd assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c 1 904d 904d 0/3 auto-obsoleted due to no activity on 2022/08/30 06:16

Sample crash report:
panic: kernel diagnostic assertion "pmap->pm_type != PMAP_TYPE_EPT" failed: file "/syzkaller/managers/multicore/kernel/sys/arch/amd64/amd64/pmap.c", line 417
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 410581  97766      0     0x14000      0x200    0  zerothread
*183293  94184      0     0x14000      0x200    1  reaper
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff830e0b3c) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8309690a,ffffffff830bb028,1a1,ffffffff830c3d04) at __assert+0x29
pmap_page_remove(fffffd8008bfe760) at pmap_page_remove+0x7cd pmap_map_ptes sys/arch/amd64/amd64/pmap.c:431 [inline]
pmap_page_remove(fffffd8008bfe760) at pmap_page_remove+0x7cd sys/arch/amd64/amd64/pmap.c:1965
uvm_anfree_list(fffffd806e042438,0) at uvm_anfree_list+0xd6
amap_wipeout(fffffd806068c7e8) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:502
uvm_unmap_detach(ffff800029fe5440,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353
uvm_map_teardown(fffffd806bcb5dc8) at uvm_map_teardown+0x35e sys/uvm/uvm_map.c:2518
uvmspace_free(fffffd806bcb5dc8) at uvmspace_free+0xcd sys/uvm/uvm_map.c:3422
reaper(ffff800029fd96d0) at reaper+0x246 sys/kern/kern_exit.c:481
end trace frame: 0x0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "pmap->pm_type != PMAP_TYPE_EPT" failed: file "/syzkaller/managers/multicore/kernel/sys/arch/amd64/amd64/pmap.c", line 417
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff830e0b3c) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8309690a,ffffffff830bb028,1a1,ffffffff830c3d04) at __assert+0x29
pmap_page_remove(fffffd8008bfe760) at pmap_page_remove+0x7cd pmap_map_ptes sys/arch/amd64/amd64/pmap.c:431 [inline]
pmap_page_remove(fffffd8008bfe760) at pmap_page_remove+0x7cd sys/arch/amd64/amd64/pmap.c:1965
uvm_anfree_list(fffffd806e042438,0) at uvm_anfree_list+0xd6
amap_wipeout(fffffd806068c7e8) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:502
uvm_unmap_detach(ffff800029fe5440,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353
uvm_map_teardown(fffffd806bcb5dc8) at uvm_map_teardown+0x35e sys/uvm/uvm_map.c:2518
uvmspace_free(fffffd806bcb5dc8) at uvmspace_free+0xcd sys/uvm/uvm_map.c:3422
reaper(ffff800029fd96d0) at reaper+0x246 sys/kern/kern_exit.c:481
end trace frame: 0x0, count: -10
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800029fe51e0
rbx               0xffff800029b7cd87
rdx                                0
rcx               0xffff800029fd96d0
rax               0xffff800029b7bff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x70a80eaac5389b45
r11               0xe40d94c7107b5163
r12               0xffff800029b7cb88
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff828ecb45    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff800029fe51d0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (reaper) tid=183293 pid=94184 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=4, usrpri=83, slppri=4, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800029fd9958,0xffff800029fd8cc0
    process=0xffff800029feb1e0 user=0xffff800029fe0000, vmspace=0xffffffff834fe560
    estcpu=33, cpticks=2, pctcpu=22.97, user=0, sys=7273, intr=45
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 93658  165516  40398      0  3    0x10008a  sigsusp       sh
 40398  252072  83312      0  3        0x82  wait          syz-executor
 37664   29240  83312      0  2         0x2                syz-executor
 33720  276790  83312      0  3        0x82  piperd        syz-executor
 24200   74278  83312      0  3        0x82  piperd        syz-executor
 15788  407486  83312      0  3        0x82  piperd        syz-executor
 25106  416225  83312      0  3        0x82  piperd        syz-executor
  5765   20094      0      0  3     0x14280  nfsidl        nfsio
 52897  315713      0      0  3     0x14280  nfsidl        nfsio
 36640  166237      0      0  3     0x14280  nfsidl        nfsio
 34396  482675      0      0  3     0x14280  nfsidl        nfsio
 46530  243338      0      0  3     0x14280  nfsidl        nfsio
 29335  136077      0      0  3     0x14280  nfsidl        nfsio
 10911  368377      0      0  3     0x14280  nfsidl        nfsio
 47374   24383      0      0  3     0x14280  nfsidl        nfsio
 76198  239424      0      0  3     0x14280  nfsidl        nfsio
 13081  393790      0      0  3     0x14280  nfsidl        nfsio
 75404  481625      0      0  3     0x14280  nfsidl        nfsio
 46598  215448      0      0  3     0x14280  nfsidl        nfsio
  2966  224320      0      0  3     0x14280  nfsidl        nfsio
 19509  106998      0      0  3     0x14280  nfsidl        nfsio
 88512   72724      0      0  3     0x14280  nfsidl        nfsio
 99042  450818      0      0  3     0x14280  nfsidl        nfsio
 13991   97422      0      0  3     0x14280  nfsidl        nfsio
 68681  403106      0      0  3     0x14280  nfsidl        nfsio
 99899  425443      0      0  3     0x14280  nfsidl        nfsio
 62619   43237      0      0  3     0x14280  nfsidl        nfsio
  2356  158866      0      0  3     0x14200  acct          acct
 74929  338157  83312      0  3        0x82  piperd        syz-executor
 22717  474437      1      0  3    0x100083  ttyin         getty
 22152  335070      0      0  3     0x14200  bored         sosplice
 83312   89731  47636      0  3        0x82  wait          syz-executor
 47636  279298  37824      0  3    0x10008a  sigsusp       ksh
 37824  516791  24656      0  3        0x98  kqread        sshd-session
 24656   52708  75493      0  3        0x92  kqread        sshd-session
 75493  310922      1      0  3        0x88  kqread        sshd
 90944  402918  74490     74  3   0x1100092  bpf           pflogd
 74490  366429      1      0  3        0x80  sbwait        pflogd
 16239  120629  55098     73  2   0x1100010                syslogd
 55098  497966      1      0  3    0x100082  sbwait        syslogd
 61350  266772      1      0  3    0x100080  kqread        resolvd
 17989  335549  88216     77  3    0x100092  kqread        dhcpleased
 46851    8838  88216     77  3    0x100092  kqread        dhcpleased
 88216  214676      1      0  3        0x80  kqread        dhcpleased
 18882  267720      0      0  3     0x14200  bored         smr
 97766  410581      0      0  7     0x14200                zerothread
 40121  430558      0      0  3     0x14200  aiodoned      aiodoned
 57873   68259      0      0  3     0x14200  syncer        update
 41711   37863      0      0  3     0x14200  cleaner       cleaner
*94184  183293      0      0  7     0x14200                reaper
 22199  383154      0      0  3     0x14200  pgdaemon      pagedaemon
  1985   84721      0      0  3     0x14200  bored         viomb
 25864  205739      0      0  3  0x40014200  acpi0         acpi0
 51744  305426      0      0  3  0x40014200                idle1
  3193  405689      0      0  3     0x14200  bored         softnet3
 51117  417985      0      0  3     0x14200  bored         softnet2
 63385  419544      0      0  3     0x14200  bored         softnet1
 45803  283710      0      0  2     0x14200                softnet0
 71668  488923      0      0  3     0x14200  bored         systqmp
 46049   73925      0      0  3     0x14200  bored         systq
 31142  278010      0      0  3     0x14200  tmoslp        softclockmp
 46549  211111      0      0  3  0x40014200  tmoslp        softclock
 11517  497084      0      0  3  0x40014200                idle0
     1  150220      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
CPU 0:
exclusive mutex &uvm.fpageqlock r = 0 (0xffffffff83595860)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  mtx_enter_try+0x178
#2  mtx_enter+0x60 sys/kern/kern_lock.c:239
#3  uvm_pagezero_thread+0x201 sys/uvm/uvm_pmemrange.c:2208
#4  proc_trampoline+0x10
Process 16239 (syslogd) thread 0xffff8000ffffdbe8 (120629)
Process 94184 (reaper) thread 0xffff800029fd96d0 (183293)
Process 45803 (softnet0) thread 0xffff8000ffffe798 (283710)
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10194  10170K   10683K 166960K     12389        0
            pcb    17     14K      16K 166960K       284        0
         rtable   153     14K      16K 166960K      1083        0
             pf    33     17K      26K 166960K       169        0
         ifaddr    30      5K       7K 166960K       158        0
        ifgroup    47      2K       2K 166960K       209        0
         sysctl     2      0K       1K 166960K         5        0
       counters    60     35K      36K 166960K       148        0
       ioctlops     0      0K       4K 166960K      1631        0
            iov     0      0K      20K 166960K       126        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1491     94K      94K 166960K      2403        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        23        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        60        0
        dirhash    12      2K       2K 166960K        24        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    10     33K      93K 166960K      1294        0
          sigio     0      0K       0K 166960K        29        0
           proc    70     91K     140K 166960K      1226        0
        subproc    91      5K       7K 166960K       442        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       143        0
       in_multi    56      4K       7K 166960K       371        0
    ether_multi     1      0K       0K 166960K         6        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   109    493K     493K 166960K       109        0
           exec     0      0K       1K 166960K       886        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   182     95K     116K 166960K     12523        0
       UVM aobj    31      2K       3K 166960K        37        0
     pinsyscall    35     70K     108K 166960K      2921        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        50        0
            NDP    18      1K       1K 166960K       112        0
           temp    69   6822K    6902K 166960K     62279        0
         kqueue    13     20K      33K 166960K       188        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      153    0      150     1     0     1     1     0     8    0
rtentry    112      365    0      303     4     1     3     4     0     8    0
unpcb      144      898    0      881     8     7     1     6     0     8    0
syncache   336        8    0        8     4     4     0     1     0     8    0
tcpqe       32        1   12        1     1     1     0     1     0     8    0
tcpcb      808      332    0      324     6     4     2     5     0     8    0
arp        120       63    0       51     1     0     1     1     0     8    0
ipq         40        1    0        1     1     1     0     1     0     8    0
ipqe        40        3    0        3     1     1     0     1     0     8    0
inpcb      336     1308    0     1297    16    14     2     7     0     8    0
nd6        136       94    0       82     1     0     1     1     0     8    0
pkpcb       40        5    0        5     1     1     0     1     0     8    0
kcovpl      48       34    0       27     1     0     1     1     0     8    0
ppxss      1168      10    0       10     3     3     0     1     0     8    0
pfstscr     40        1    0        1     1     1     0     1     0     8    0
pffrag     232        8    0        3     2     1     1     1     0   482    0
pffrnode    88        8    0        3     2     1     1     1     0     8    0
pffrent     40       13    0        8     2     1     1     1     0     8    0
pfosfp      40     1431    0     1006     5     0     5     5     0     8    0
pfosfpen   112     1431    0      715    21     0    21    21     0     8    0
pfrktable  1344       4    0        1     1     0     1     1     0     8    0
pfanchor   1288       5    0        2     1     0     1     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfqueue    264        1    0        1     1     1     0     1     0     8    0
pfstitem    24       74    0       56     1     0     1     1     0     8    0
pfstkey    128       78    0       61     2     0     2     2     0     8    0
pfstate    376       74    0       58     4     0     4     4     0     8    0
pfrule     1344      38    0       28     2     0     2     2     0     8    0
art_heap8  4096       2    0        1     2     0     2     2     0     8    1
art_heap4  256     1485    0     1212    29     5    24    29     0     8    2
art_table   32     1487    0     1213     4     0     4     4     0     8    0
art_node    16      364    0      309     1     0     1     1     0     8    0
sysvmsgpl   40       23    0       15     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       58    0       48     1     0     1     1     0     8    0
shmpl      112       34    0        6     1     0     1     1     0     8    0
dirhash    1024      25    0        8     3     0     3     3     0     8    0
dino2pl    256     3086    0     1539    97     0    97    97     0     8    0
ffsino     272     3086    0     1539   104     0   104   104     0     8    0
nchpl      144     4571    0     2860    64     0    64    64     0     8    0
uvmvnodes   80     3974    0        0    82     0    82    82     0     8    0
vnodes     216     3974    0        0   221     0   221   221     0     8    0
namei      1024   18053    0    18053     4     3     1     2     0     8    1
percpumem   16       88    0       44     1     0     1     1     0     8    0
vcpupl     3904       6    0        2     1     0     1     1     0     8    0
vmpool     696        7    0        3     1     0     1     1     0     8    0
pfiaddrpl  120        1    0        0     1     0     1     1     0     8    0
kstatmem   264      108    0       88     2     0     2     2     0     8    0
scsiplug    72        4    0        4     3     3     0     1     0     8    0
scxspl     216    28226    0    28226    13    12     1     8     1     8    1
plimitpl   152      309    0      292     1     0     1     1     0     8    0
sigapl     424     1563    0     1497    11     2     9     9     0     8    0
futexpl     64    14316    0    14316     3     3     0     1     0     8    0
knotepl    120      621    0        0    18     0    18    18     0     8    0
kqueuepl   216      308    0      299     1     0     1     1     0     8    0
pipepl     320      339    0      312     4     0     4     4     0     8    1
fdescpl    496     1523    0     1499     7     2     5     5     0     8    0
filepl     152     9651    0     9430    24    11    13    18     0     8    3
lockfpl    104      483    0      481     2     1     1     2     0     8    0
lockfspl    48      142    0      140     1     0     1     1     0     8    0
sessionpl  144       46    0       37     1     0     1     1     0     8    0
pgrppl      48       93    0       76     1     0     1     1     0     8    0
ucredpl    104     1406    0     1393     1     0     1     1     0     8    0
zombiepl   144     1499    0     1497     1     0     1     1     0     8    0
processpl  1160    1563    0     1497     7     1     6     6     0     8    0
procpl     648     3021    0     2955     9     1     8     8     0     8    0
srpgc       96        2    0        2     1     1     0     1     0     8    0
sosppl     168        7    0        7     3     3     0     1     0     8    0
sockpl     664     2411    0     2380    23    16     7    15     0     8    3
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096       3    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     235    0        0    30     0    30    30     0     8    0
mtagpl      96        7    0        0     1     0     1     1     0     8    0
mbufpl     256      508    0        0    29     0    29    29     0     8    0
bufpl      280     8314    0     2142   441     0   441   441     0     8    0
anonpl      24   310858    0   307817    80    29    51    78     0   185   16
amapchunkpl 152   41655    0    41351    47    16    31    42     0   158   13
amappl16   200     6929    0     6922    40    31     9    15     0     8    6
amappl15   192       22    0       21     1     0     1     1     0     8    0
amappl14   184      181    0      169     1     0     1     1     0     8    0
amappl13   176       13    0       13     1     1     0     1     0     8    0
amappl12   168     2523    0     2497     3     1     2     3     0     8    0
amappl11   160       61    0       46     1     0     1     1     0     8    0
amappl10   152       33    0       33     1     1     0     1     0     8    0
amappl9    144      141    0      141     1     1     0     1     0     8    0
amappl8    136       34    0       31     1     0     1     1     0     8    0
amappl7    128      153    0      141     1     0     1     1     0     8    0
amappl6    120      383    0      379     1     0     1     1     0     8    0
amappl5    112      224    0      211     1     0     1     1     0     8    0
amappl4    104      379    0      358     1     0     1     1     0     8    0
amappl3     96     8092    0     8019     4     0     4     4     0     8    0
amappl2     88      916    0      847     2     0     2     2     0     8    0
amappl1     80    12520    0    11945    17     4    13    15     0     8    0
amappl      88    11921    0    11804     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       2    0        1     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       36    0        6     1     0     1     1     0     8    0
uaddrrnd    24     1530    0     1501     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1530    0     1501     1     0     1     1     0     8    0
vmmpekpl   168    14092    0    14033     4     0     4     4     0     8    0
vmmpepl    168   100359    0    98809   111    18    93    97     0   357   11
vmsppl     440     1529    0     1500     7     3     4     5     0     8    0
rwobjpl     56    34986    0    30089    73     3    70    71     0     8    0
pdppl      4096    3067    0     3004   136    65    71    85     0     8    8
pvpl        32    42689    0        0   345     0   345   345     0   265    0
pmappl     248     1529    0     1500     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      470    0      100    11     0    11    11     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83414ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x15 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x15 sys/dev/kcov.c:235
_kernel_lock_held() at _kernel_lock_held+0x41 sys/kern/kern_lock.c:76
msleep(ffffffff835956cc,ffffffff83595850,7f,ffffffff8302434b,0) at msleep+0x1ac sys/kern/kern_synch.c:232
uvm_pagezero_thread(ffff800029fd8518) at uvm_pagezero_thread+0xe9 sys/uvm/uvm_pmemrange.c:2194
end trace frame: 0x0, count: 8
ddb{0}> trace
x86_ipi_db(ffffffff83414ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x15 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x15 sys/dev/kcov.c:235
_kernel_lock_held() at _kernel_lock_held+0x41 sys/kern/kern_lock.c:76
msleep(ffffffff835956cc,ffffffff83595850,7f,ffffffff8302434b,0) at msleep+0x1ac sys/kern/kern_synch.c:232
uvm_pagezero_thread(ffff800029fd8518) at uvm_pagezero_thread+0xe9 sys/uvm/uvm_pmemrange.c:2194
end trace frame: 0x0, count: -7
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff830e0b3c) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8309690a,ffffffff830bb028,1a1,ffffffff830c3d04) at __assert+0x29
pmap_page_remove(fffffd8008bfe760) at pmap_page_remove+0x7cd pmap_map_ptes sys/arch/amd64/amd64/pmap.c:431 [inline]
pmap_page_remove(fffffd8008bfe760) at pmap_page_remove+0x7cd sys/arch/amd64/amd64/pmap.c:1965
uvm_anfree_list(fffffd806e042438,0) at uvm_anfree_list+0xd6
amap_wipeout(fffffd806068c7e8) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:502
uvm_unmap_detach(ffff800029fe5440,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353
uvm_map_teardown(fffffd806bcb5dc8) at uvm_map_teardown+0x35e sys/uvm/uvm_map.c:2518
uvmspace_free(fffffd806bcb5dc8) at uvmspace_free+0xcd sys/uvm/uvm_map.c:3422
reaper(ffff800029fd96d0) at reaper+0x246 sys/kern/kern_exit.c:481
end trace frame: 0x0, count: 5
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff830e0b3c) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8309690a,ffffffff830bb028,1a1,ffffffff830c3d04) at __assert+0x29
pmap_page_remove(fffffd8008bfe760) at pmap_page_remove+0x7cd pmap_map_ptes sys/arch/amd64/amd64/pmap.c:431 [inline]
pmap_page_remove(fffffd8008bfe760) at pmap_page_remove+0x7cd sys/arch/amd64/amd64/pmap.c:1965
uvm_anfree_list(fffffd806e042438,0) at uvm_anfree_list+0xd6
amap_wipeout(fffffd806068c7e8) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:502
uvm_unmap_detach(ffff800029fe5440,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353
uvm_map_teardown(fffffd806bcb5dc8) at uvm_map_teardown+0x35e sys/uvm/uvm_map.c:2518
uvmspace_free(fffffd806bcb5dc8) at uvmspace_free+0xcd sys/uvm/uvm_map.c:3422
reaper(ffff800029fd96d0) at reaper+0x246 sys/kern/kern_exit.c:481
end trace frame: 0x0, count: -10

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/25 11:55 openbsd 9a7d784aa6c4 d7d32352 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c
2024/07/22 06:28 openbsd 134de7a21601 b88348e9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c
2024/05/24 11:37 openbsd 6859a790d2a4 8f98448e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c
2024/05/18 00:53 openbsd fea1e5fd692c c0f1611a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c
2024/05/17 22:20 openbsd fea1e5fd692c c0f1611a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c
2024/05/08 02:53 openbsd 7284c0c62173 4cf3f9b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c
2024/04/29 16:33 openbsd b205d946bc4d 27e33c58 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c
2024/04/20 10:28 openbsd 55906bae5af5 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "pmap->pm_type != PMAP_TYPE_EPT" failed in pmap.c
* Struck through repros no longer work on HEAD.