syzbot


uvm_fault: db_read_bytes

Status: upstream: reported on 2024/02/20 12:48
Reported-by: syzbot+623eeb194558cd7e5e96@syzkaller.appspotmail.com
First crash: 114d, last: 15d

Sample crash report:
kernel: page fault trap, code=10
Stopped at      acpi_pdirpa+0x288ca:    uvm_fault(0xfffffd8008b9a370, 0x3ca59, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      db_read_bytes+0xd0:     movzbl  0xffffffffffffffff(%r15),%eax
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*129035  90194      0   0x8000000  0x4000000    1K syz-executor.5
 149130   2969  60929   0x8000010          0    0  syz-executor.7
db_read_bytes(3ca59,1,ffff80002a272044) at db_read_bytes+0xd0 sys/arch/amd64/amd64/db_memrw.c:85
db_get_value(3ca59,1,0) at db_get_value+0x50 sys/ddb/db_access.c:61
db_disasm(3ca59,0) at db_disasm+0x82
db_trap(6,10) at db_trap+0x115 sys/ddb/db_trap.c:71
db_ktrap(6,10,ffff80002a2722e0) at db_ktrap+0x208 sys/arch/amd64/amd64/db_interface.c:151
kerntrap(ffff80002a2722e0) at kerntrap+0x142 sys/arch/amd64/amd64/trap.c:323
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
acpi_pdirpa() at acpi_pdirpa+0x288ca
rt_clone(ffff80002a2725b8,fffffd805d134890,0) at rt_clone+0x7d sys/net/route.c:383
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 rt_match sys/net/route.c:360 [inline]
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 rtalloc_mpath sys/net/route.c:476 [inline]
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 sys/net/route.c:255
in_pcbselsrc(fffffd8079852074,ffff80002a272708,fffffd805d134800) at in_pcbselsrc+0x1b7 sys/netinet/in_pcb.c:975
rip_output(fffffd80555f5b00,ffff800000eb5cd0,ffff80002a272708,4336) at rip_output+0x21d sys/netinet/raw_ip.c:313
rip_send(ffff800000eb5cd0,fffffd80555f5b00,0,0) at rip_send+0xe3 sys/netinet/raw_ip.c:657
sosend(ffff800000eb5cd0,0,ffff80002a272908,0,0,0) at sosend+0x7aa
end trace frame: 0xffff80002a2728f0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffffd8008b9a370, 0x3ca59, 0, 1) -> e
ddb{1}> trace
db_read_bytes(3ca59,1,ffff80002a272044) at db_read_bytes+0xd0 sys/arch/amd64/amd64/db_memrw.c:85
db_get_value(3ca59,1,0) at db_get_value+0x50 sys/ddb/db_access.c:61
db_disasm(3ca59,0) at db_disasm+0x82
db_trap(6,10) at db_trap+0x115 sys/ddb/db_trap.c:71
db_ktrap(6,10,ffff80002a2722e0) at db_ktrap+0x208 sys/arch/amd64/amd64/db_interface.c:151
kerntrap(ffff80002a2722e0) at kerntrap+0x142 sys/arch/amd64/amd64/trap.c:323
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
acpi_pdirpa() at acpi_pdirpa+0x288ca
rt_clone(ffff80002a2725b8,fffffd805d134890,0) at rt_clone+0x7d sys/net/route.c:383
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 rt_match sys/net/route.c:360 [inline]
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 rtalloc_mpath sys/net/route.c:476 [inline]
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 sys/net/route.c:255
in_pcbselsrc(fffffd8079852074,ffff80002a272708,fffffd805d134800) at in_pcbselsrc+0x1b7 sys/netinet/in_pcb.c:975
rip_output(fffffd80555f5b00,ffff800000eb5cd0,ffff80002a272708,4336) at rip_output+0x21d sys/netinet/raw_ip.c:313
rip_send(ffff800000eb5cd0,fffffd80555f5b00,0,0) at rip_send+0xe3 sys/netinet/raw_ip.c:657
sosend(ffff800000eb5cd0,0,ffff80002a272908,0,0,0) at sosend+0x7aa
dofilewritev(ffff8000ffff59c8,4,ffff80002a272908,0,ffff80002a2729c0) at dofilewritev+0x1a9 sys/kern/sys_generic.c:375
sys_write(ffff8000ffff59c8,ffff80002a272a70,ffff80002a2729c0) at sys_write+0x87 sys/kern/sys_generic.c:295
syscall(ffff80002a272a70) at syscall+0x8cf mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002a272a70) at syscall+0x8cf sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9c919928210, count: -18
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a272030
rbx                              0x1
rdx               0xffff800000dfeb80
rcx               0xffff8000ffff59c8
rax               0xffff800029cebff0
r8                0xffff80002a272160
r9                0x8080808080808080
r10               0xa030455e0ea29b0f
r11               0xb9077c424293687c
r12                              0x1
r13                              0x1
r14               0xffff80002a272045
r15                          0x3ca5a    acpi_pdirpa+0x288cb
rip               0xffffffff826b5070    db_read_bytes+0xd0
cs                               0x8
rflags                       0x10282    __ALIGN_SIZE+0xf282
rsp               0xffff80002a271fd0
ss                              0x10
db_read_bytes+0xd0:     movzbl  0xffffffffffffffff(%r15),%eax
ddb{1}> show proc
PROC (syz-executor.5) tid=129035 pid=90194 tcnt=2 stat=onproc
    flags process=8000000 proc=4000000<THREAD>
    runpri=32, usrpri=84, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffff5218,0xffffffff82e1fc40
    process=0xffff80002c325210 user=0xffff80002a26d000, vmspace=0xfffffd8008b9a370
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 90194   86189  66655      0  2   0x8000000                syz-executor.5
*90194  129035  66655      0  7   0xc000000                syz-executor.5
  2969  149130  95281  60929  7   0x8000010                syz-executor.7
  2969  468849  95281  60929  3   0xc000010  getblk        syz-executor.7
 57510  272411  60451      0  3   0x8000080  nanoslp       syz-executor.0
 57510  375766  60451      0  3   0xc000080  sbwait        syz-executor.0
 57510  463224  60451      0  3   0xc000080  fsleep        syz-executor.0
 57510   77724  60451      0  3   0xc000080  fsleep        syz-executor.0
 17116  509087  90834      0  3   0x8000080  nanoslp       syz-executor.4
 17116  233829  90834      0  3   0xc000080  netcon        syz-executor.4
 17116  155096  90834      0  3   0xc000080  fsleep        syz-executor.4
 94258  309147  13211      0  3   0x8000080  nanoslp       syz-executor.6
 94258  145906  13211      0  3   0xc000080  kqread        syz-executor.6
 94258    8630  13211      0  3   0xc000080  netio         syz-executor.6
 94258  464449  13211      0  3   0xc000080  fsleep        syz-executor.6
 90834   51865  69800      0  3   0x8000082  nanoslp       syz-executor.4
 66655  342889  69800      0  3   0x8000082  nanoslp       syz-executor.5
 13211  365536  69800      0  3   0x8000082  nanoslp       syz-executor.6
 92014  499849  69800      0  3   0x8000002  biowait       syz-executor.1
 96236  206683  69800      0  3   0x8000082  wait          syz-executor.3
 95281   34950  69800      0  3   0x8000082  nanoslp       syz-executor.7
 37254  163580  69800      0  3   0x8000082  wait          syz-executor.2
 60451  435881  69800      0  3   0x8000082  nanoslp       syz-executor.0
 62410   66446      1      0  3  0x18100083  ttyin         getty
 23842  318559      0      0  3     0x14200  bored         sosplice
 69800    5914   5689      0  3  0x1a000082  thrsleep      syz-fuzzer
 69800   33677   5689      0  3  0x1e000082  nanoslp       syz-fuzzer
 69800  484879   5689      0  3  0x1e000082  thrsleep      syz-fuzzer
 69800  442016   5689      0  3  0x1e000082  thrsleep      syz-fuzzer
 69800  242253   5689      0  3  0x1e000082  wait          syz-fuzzer
 69800  190515   5689      0  3  0x1e000082  wait          syz-fuzzer
 69800   48271   5689      0  3  0x1e000082  wait          syz-fuzzer
 69800  172873   5689      0  3  0x1e000082  thrsleep      syz-fuzzer
 69800   43881   5689      0  3  0x1e000082  wait          syz-fuzzer
 69800  313452   5689      0  3  0x1e000082  wait          syz-fuzzer
 69800  382209   5689      0  3  0x1e000082  thrsleep      syz-fuzzer
 69800   31398   5689      0  3  0x1e000082  kqread        syz-fuzzer
 69800  276649   5689      0  3  0x1e000082  wait          syz-fuzzer
 69800  509367   5689      0  3  0x1e000082  wait          syz-fuzzer
 69800  175514   5689      0  3  0x1e000082  wait          syz-fuzzer
  5689   81544  17050      0  3   0x810008a  sigsusp       ksh
 17050  422294  64514      0  3  0x1800009a  kqread        sshd
 64514   91854      1      0  3  0x18000088  kqread        sshd
 79322   38289  21380     73  2  0x19100010                syslogd
 21380  382274      1      0  3  0x18100082  sbwait        syslogd
 83651  112043      1      0  3  0x18100080  kqread        resolvd
  6537  203949  55737     77  3  0x18100092  kqread        dhcpleased
 97879   30776  55737     77  3  0x18100092  kqread        dhcpleased
 55737   10078      1      0  3  0x18000080  kqread        dhcpleased
 35088  481377      0      0  3     0x14200  bored         smr
 38150  174657      0      0  2     0x14200                zerothread
 45976  111737      0      0  3     0x14200  aiodoned      aiodoned
  4695  358729      0      0  3     0x14200  syncer        update
 74153  363988      0      0  3     0x14200  cleaner       cleaner
 26773  342307      0      0  3     0x14200  reaper        reaper
  9904  420818      0      0  3     0x14200  pgdaemon      pagedaemon
 94687  139582      0      0  3     0x14200  bored         viomb
 53797   84535      0      0  3  0x40014200  acpi0         acpi0
 44520  431055      0      0  3  0x40014200                idle1
 19858   14532      0      0  3     0x14200  bored         softnet3
 35753  522012      0      0  3     0x14200  bored         softnet2
 85226  520760      0      0  3     0x14200  bored         softnet1
   977  440803      0      0  3     0x14200  bored         softnet0
 82002   25742      0      0  3     0x14200  bored         systqmp
 34727  112253      0      0  3     0x14200  bored         systq
 77224  167230      0      0  3     0x14200  tmoslp        softclockmp
 18433   31782      0      0  3  0x40014200  tmoslp        softclock
 97806   44335      0      0  3  0x40014200                idle0
     1  496864      0      0  3   0x8000082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 90194 (syz-executor.5) thread 0xffff8000ffff59c8 (129035)
Process 2969 (syz-executor.7) thread 0xffff80002a1fe020 (468849)
Process 92014 (syz-executor.1) thread 0xffff80002c3d62d8 (499849)
Process 79322 (syslogd) thread 0xffff8000ffffdc40 (38289)
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10192   6488K    6951K 166960K     14607        0
            pcb    17     12K      12K 166960K       329        0
         rtable   199      6K       7K 166960K      1400        0
             pf    31      9K      10K 166960K       159        0
         ifaddr    40     15K      15K 166960K       197        0
        ifgroup    54      2K       2K 166960K       261        0
         sysctl     3      0K       1K 166960K         6        0
       counters    64     36K      36K 166960K       170        0
       ioctlops     0      0K       4K 166960K      1595        0
            iov     0      0K      20K 166960K       148        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1377     87K      87K 166960K      3277        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        58        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       135        0
        dirhash    12      2K       3K 166960K        51        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    17     61K      89K 166960K      2241        0
          sigio     0      0K       0K 166960K        47        0
           proc    58     79K     127K 166960K      1437        0
        subproc   104      6K       7K 166960K       494        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       348        0
       in_multi    85      6K       7K 166960K       499        0
    ether_multi     1      0K       0K 166960K        23        0
            mrt     1      0K       0K 166960K         3        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    97    440K     440K 166960K        97        0
           exec     0      0K       1K 166960K       959        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   301     79K      98K 166960K     20875        0
       UVM aobj    87     11K      11K 166960K        91        0
     pinsyscall    37     74K     100K 166960K      4170        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K       123        0
            NDP    11      0K       1K 166960K       138        0
           temp    76   6808K   14743K 166960K     79301        0
         kqueue    12     18K      28K 166960K       307        0
      SYN cache     2      8K      16K 166960K         4        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      268    0      264     1     0     1     1     0     8    0
rtentry    112      484    0      394     4     1     3     4     0     8    0
unpcb      144     1651    0     1637     8     6     2     2     0     8    1
syncache   336        6    0        6     3     3     0     1     0     8    0
sackhl      24        2    0        2     2     2     0     1     0     8    0
tcpqe       32       61    0       61     1     1     0     1     0     8    0
tcpcb      808      590    0      583    12     5     7     7     0     8    6
arp        120       86    0       70     1     0     1     1     0     8    0
ipq         40        1    0        1     1     1     0     1     0     8    0
ipqe        40        2    0        2     1     1     0     1     0     8    0
inpcb      384     2170    0     2157    22    14     8     8     0     8    6
nd6        136      128    0      105     1     0     1     1     0     8    0
pkpcb       40        9    0        9     7     7     0     1     0     8    0
kcovpl      48       38    0       30     1     0     1     1     0     8    0
ppxss      1168       8    0        8     5     4     1     1     0     8    1
pffrag     232       13    0       12     3     2     1     1     0   482    0
pffrnode    88       12    0       11     3     2     1     1     0     8    0
pffrent     40      103    0      102     3     2     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24      191    0      146     1     0     1     1     0     8    0
pfstkey    128      191    0      146     2     0     2     2     0     8    0
pfstate    376      191    0      146     7     2     5     5     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1823    0     1445    38    14    24    29     0     8    0
art_table   32     1824    0     1445     4     0     4     4     0     8    0
art_node    16      478    0      398     1     0     1     1     0     8    0
sysvmsgpl   40        9    0        3     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      133    0      123     1     0     1     1     0     8    0
shmpl      112       88    0        4     3     0     3     3     0     8    0
dirhash    1024      43    0       26     3     0     3     3     0     8    0
dino2pl    256     4803    0     3272    96     0    96    96     0     8    0
ffsino     272     4804    0     3272   103     0   103   103     0     8    0
nchpl      144     8003    0     6256    67     0    67    67     0     8    0
uvmvnodes   80     6308    0        0   129     0   129   129     0     8    0
vnodes     216     6308    0        0   351     0   351   351     0     8    0
namei      1024   30157    0    30154     4     3     1     2     0     8    0
percpumem   16       99    0       53     1     0     1     1     0     8    0
vcpupl     3904       4    0        1     1     0     1     1     0     8    0
vmpool     696        8    0        5     1     0     1     1     0     8    0
kstatmem   264      128    0      106     2     0     2     2     0     8    0
scsiplug    72        5    0        5     4     3     1     1     0     8    1
scxspl     216    41852    0    41851    22    18     4     8     1     8    3
plimitpl   152      385    0      369     1     0     1     1     0     8    0
sigapl     424     2514    0     2467     9     1     8     9     0     8    0
futexpl     64    34038    0    34034     8     7     1     1     0     8    0
knotepl    120      736    0        0    20     1    19    19     0     8    0
kqueuepl   216      662    0      652     4     2     2     2     0     8    1
pipepl     320      500    0      471     3     0     3     3     0     8    0
fdescpl    496     2474    0     2446     7     2     5     5     0     8    0
filepl     152    16115    0    15863    13     0    13    13     0     8    0
lockfpl    104      686    0      684     1     0     1     1     0     8    0
lockfspl    48      318    0      316     1     0     1     1     0     8    0
sessionpl  144       54    0       38     1     0     1     1     0     8    0
pgrppl      48       72    0       56     1     0     1     1     0     8    0
ucredpl    104     2686    0     2671     1     0     1     1     0     8    0
zombiepl   144     2469    0     2467     2     1     1     1     0     8    0
processpl  1144    2514    0     2467     7     2     5     6     0     8    0
procpl     656     4618    0     4547    10     1     9     9     0     8    0
srpgc       96       21    0       21     5     4     1     1     0     8    1
sosppl     168        6    0        6     3     3     0     1     0     8    0
sockpl     664     4119    0     4088    26    18     8     9     0     8    5
mcl64k     65536     17    0        0     3     0     3     3     0     8    0
mcl16k     16384     12    0        0     2     0     2     2     0     8    0
mcl12k     12288      4    0        0     1     0     1     1     0     8    0
mcl9k      9216       3    0        0     1     0     1     1     0     8    0
mcl8k      8192      12    0        0     2     0     2     2     0     8    0
mcl4k      4096       8    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     372    0        0    41     1    40    41     0     8    0
mtagpl      96       25    0        0     1     0     1     1     0     8    0
mbufpl     256      626    0        0    27     0    27    27     0     8    0
bufpl      280    12859    0     3618   661     0   661   661     0     8    0
anonpl      24   532834    0   525801   121    44    77   100     0   186    8
amapchunkpl 152   70507    0    69743    80    40    40    60     0   158    7
amappl16   200    11769    0    11631    71    52    19    21     0     8    7
amappl15   192       16    0       16     1     1     0     1     0     8    0
amappl14   184      268    0      255     2     1     1     2     0     8    0
amappl13   176       19    0       18     2     1     1     1     0     8    0
amappl12   168     3572    0     3540     3     1     2     3     0     8    0
amappl11   160       95    0       77     1     0     1     1     0     8    0
amappl10   152      110    0      106     1     0     1     1     0     8    0
amappl9    144      197    0      197     2     2     0     1     0     8    0
amappl8    136      260    0      227     2     0     2     2     0     8    0
amappl7    128       73    0       59     1     0     1     1     0     8    0
amappl6    120      671    0      658     2     1     1     2     0     8    0
amappl5    112      292    0      280     1     0     1     1     0     8    0
amappl4    104      765    0      734     2     1     1     2     0     8    0
amappl3     96    13066    0    12973     3     0     3     3     0     8    0
amappl2     88     3053    0     2980     4     2     2     4     0     8    0
amappl1     80    18014    0    17523    23    11    12    22     0     8    0
amappl      88    19945    0    19729     6     0     6     6     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       90    0        4     2     0     2     2     0     8    0
uaddrrnd    24     2483    0     2452     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2483    0     2452     1     0     1     1     0     8    0
vmmpekpl   168    21885    0    21822     4     0     4     4     0     8    0
vmmpepl    168   175769    0   173836   153    56    97   115     0   357    0
vmsppl     440     2482    0     2452     4     0     4     4     0     8    0
rwobjpl     56    54384    0    46879   117    11   106   107     0     8    0
pdppl      4096    4973    0     4907   190   122    68    77     0     8    2
pvpl        32    49248    0        0   398     0   398   398     0   265    0
pmappl     248     2482    0     2452     5     2     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      534    0      154    12     0    12    12     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1e:        addq    $0x8,%rsp
x86_ipi_db(ffffffff82c7fff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82e35b70) at __mp_lock+0x129 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82e35b70) at __mp_lock+0x129 sys/kern/kern_lock.c:147
intr_handler(ffff80002a290f00,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:539
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
end of kernel
end trace frame: 0x70faab4f85f0, count: 9
ddb{0}> trace
x86_ipi_db(ffffffff82c7fff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82e35b70) at __mp_lock+0x129 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82e35b70) at __mp_lock+0x129 sys/kern/kern_lock.c:147
intr_handler(ffff80002a290f00,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:539
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
end of kernel
end trace frame: 0x70faab4f85f0, count: -6
ddb{0}> machine ddbcpu 1
Stopped at      db_read_bytes+0xd0:     movzbl  0xffffffffffffffff(%r15),%eax
db_read_bytes(3ca59,1,ffff80002a272044) at db_read_bytes+0xd0 sys/arch/amd64/amd64/db_memrw.c:85
db_get_value(3ca59,1,0) at db_get_value+0x50 sys/ddb/db_access.c:61
db_disasm(3ca59,0) at db_disasm+0x82
db_trap(6,10) at db_trap+0x115 sys/ddb/db_trap.c:71
db_ktrap(6,10,ffff80002a2722e0) at db_ktrap+0x208 sys/arch/amd64/amd64/db_interface.c:151
kerntrap(ffff80002a2722e0) at kerntrap+0x142 sys/arch/amd64/amd64/trap.c:323
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
acpi_pdirpa() at acpi_pdirpa+0x288ca
rt_clone(ffff80002a2725b8,fffffd805d134890,0) at rt_clone+0x7d sys/net/route.c:383
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 rt_match sys/net/route.c:360 [inline]
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 rtalloc_mpath sys/net/route.c:476 [inline]
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 sys/net/route.c:255
in_pcbselsrc(fffffd8079852074,ffff80002a272708,fffffd805d134800) at in_pcbselsrc+0x1b7 sys/netinet/in_pcb.c:975
rip_output(fffffd80555f5b00,ffff800000eb5cd0,ffff80002a272708,4336) at rip_output+0x21d sys/netinet/raw_ip.c:313
rip_send(ffff800000eb5cd0,fffffd80555f5b00,0,0) at rip_send+0xe3 sys/netinet/raw_ip.c:657
sosend(ffff800000eb5cd0,0,ffff80002a272908,0,0,0) at sosend+0x7aa
end trace frame: 0xffff80002a2728f0, count: 0
ddb{1}> trace
db_read_bytes(3ca59,1,ffff80002a272044) at db_read_bytes+0xd0 sys/arch/amd64/amd64/db_memrw.c:85
db_get_value(3ca59,1,0) at db_get_value+0x50 sys/ddb/db_access.c:61
db_disasm(3ca59,0) at db_disasm+0x82
db_trap(6,10) at db_trap+0x115 sys/ddb/db_trap.c:71
db_ktrap(6,10,ffff80002a2722e0) at db_ktrap+0x208 sys/arch/amd64/amd64/db_interface.c:151
kerntrap(ffff80002a2722e0) at kerntrap+0x142 sys/arch/amd64/amd64/trap.c:323
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
acpi_pdirpa() at acpi_pdirpa+0x288ca
rt_clone(ffff80002a2725b8,fffffd805d134890,0) at rt_clone+0x7d sys/net/route.c:383
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 rt_match sys/net/route.c:360 [inline]
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 rtalloc_mpath sys/net/route.c:476 [inline]
route_mpath(fffffd805d134878,ffff80002a27270c,0,0) at route_mpath+0x112 sys/net/route.c:255
in_pcbselsrc(fffffd8079852074,ffff80002a272708,fffffd805d134800) at in_pcbselsrc+0x1b7 sys/netinet/in_pcb.c:975
rip_output(fffffd80555f5b00,ffff800000eb5cd0,ffff80002a272708,4336) at rip_output+0x21d sys/netinet/raw_ip.c:313
rip_send(ffff800000eb5cd0,fffffd80555f5b00,0,0) at rip_send+0xe3 sys/netinet/raw_ip.c:657
sosend(ffff800000eb5cd0,0,ffff80002a272908,0,0,0) at sosend+0x7aa
dofilewritev(ffff8000ffff59c8,4,ffff80002a272908,0,ffff80002a2729c0) at dofilewritev+0x1a9 sys/kern/sys_generic.c:375
sys_write(ffff8000ffff59c8,ffff80002a272a70,ffff80002a2729c0) at sys_write+0x87 sys/kern/sys_generic.c:295
syscall(ffff80002a272a70) at syscall+0x8cf mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002a272a70) at syscall+0x8cf sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9c919928210, count: -18

Crashes (33):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/28 18:09 openbsd 06cae3775af3 34889ee3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: db_read_bytes
2024/05/28 10:33 openbsd 06cae3775af3 f550015e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: db_read_bytes
2024/05/26 15:55 openbsd b0131f08c3a2 a10a183e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/25 00:36 openbsd 4aaef610e0a6 a10a183e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/20 02:45 openbsd 676865473293 c0f1611a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/19 21:13 openbsd 63371a7f711d c0f1611a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/18 17:49 openbsd 1b2581db680c c0f1611a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/13 10:29 openbsd 30293cdc5e30 9026e142 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: db_read_bytes
2024/05/11 11:49 openbsd 1b9599294b30 9026e142 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/10 10:15 openbsd 898e5d067977 375932ce .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: db_read_bytes
2024/05/09 17:48 openbsd a7b9eedcb4c1 de979bc2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/09 15:47 openbsd a7b9eedcb4c1 de979bc2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/09 05:36 openbsd 1b9cf3a3fa61 20bf80e1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/08 13:38 openbsd 8fad29a3d36d 9473be88 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/08 07:38 openbsd 7284c0c62173 4cf3f9b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/08 02:29 openbsd 7284c0c62173 4cf3f9b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/07 15:51 openbsd debf255c65d9 cb2dcc0e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/06 07:36 openbsd 4580bd6ebd98 610f2a54 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/05 17:51 openbsd 5ec8126aae72 610f2a54 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/05/01 00:48 openbsd ab0363c32c56 3ba885bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/27 14:39 openbsd 22bab8566a4f 07b455f9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: db_read_bytes
2024/04/26 05:16 openbsd 8fa0fb927089 8bdc0f22 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/25 21:36 openbsd 8fa0fb927089 8bdc0f22 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/25 01:57 openbsd 799d9b3d961e a604cf37 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/24 01:03 openbsd e6c7c102cf5d 21339d7b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/22 04:03 openbsd e1cb65bb8aa8 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/22 03:34 openbsd e1cb65bb8aa8 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: db_read_bytes
2024/04/21 21:22 openbsd 8a9424f8c5c9 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: db_read_bytes
2024/04/21 11:02 openbsd 8a9424f8c5c9 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/08 05:23 openbsd c112ccd4e935 ca620dd8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/06 03:26 openbsd 3f7c134ffe9c ca620dd8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/04/05 17:32 openbsd 2ee472d028ec ca620dd8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: db_read_bytes
2024/02/20 12:47 openbsd d8131725ee7c 3af7dd65 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: db_read_bytes
* Struck through repros no longer work on HEAD.