syzbot


uvm_fault: pool_do_get (3)

Status: upstream: reported on 2024/04/15 15:49
Reported-by: syzbot+9cbcf592eb96844a3a19@syzkaller.appspotmail.com
First crash: 61d, last: 61d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: pool_do_get (2) 2 608d 632d 0/3 auto-obsoleted due to no activity on 2023/01/14 12:52
openbsd uvm_fault: pool_do_get 1 831d 831d 0/3 auto-closed as invalid on 2022/06/05 15:40

Sample crash report:
uvm_fault(0xfffffd806efd2a58, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      pool_do_get+0x2dc:      movq    0(%rax),%rax
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 25884  91795      0   0x8000002          0    1  syz-executor.2
 109507  39106      0  0x1a000002  0x4000000    0  syz-fuzzer
pool_do_get(ffffffff82e4fbd8,1,ffff80002f0f1118) at pool_do_get+0x2dc pool_update_curpage sys/kern/subr_pool.c:1059 [inline]
pool_do_get(ffffffff82e4fbd8,1,ffff80002f0f1118) at pool_do_get+0x2dc sys/kern/subr_pool.c:765
pool_get(ffffffff82e4fbd8,1) at pool_get+0xf0 sys/kern/subr_pool.c:582
pmap_create() at pmap_create+0x144 sys/arch/amd64/amd64/pmap.c:1369
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 uvmspace_init sys/uvm/uvm_map.c:3302 [inline]
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 uvmspace_alloc sys/uvm/uvm_map.c:3280 [inline]
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 sys/uvm/uvm_map.c:3852
process_new(ffff8000ffff6540,ffff8000ffffb0e0,1) at process_new+0x3dc sys/kern/kern_fork.c:278
fork1(ffff80002d6af228,1,ffffffff821ef240,0,ffff80002f0f13a0,0) at fork1+0x2ef sys/kern/kern_fork.c:399
syscall(ffff80002f0f1450) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002f0f1450) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7212c53b6840, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffffd806efd2a58, 0x0, 0, 1) -> e
ddb{1}> trace
pool_do_get(ffffffff82e4fbd8,1,ffff80002f0f1118) at pool_do_get+0x2dc pool_update_curpage sys/kern/subr_pool.c:1059 [inline]
pool_do_get(ffffffff82e4fbd8,1,ffff80002f0f1118) at pool_do_get+0x2dc sys/kern/subr_pool.c:765
pool_get(ffffffff82e4fbd8,1) at pool_get+0xf0 sys/kern/subr_pool.c:582
pmap_create() at pmap_create+0x144 sys/arch/amd64/amd64/pmap.c:1369
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 uvmspace_init sys/uvm/uvm_map.c:3302 [inline]
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 uvmspace_alloc sys/uvm/uvm_map.c:3280 [inline]
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 sys/uvm/uvm_map.c:3852
process_new(ffff8000ffff6540,ffff8000ffffb0e0,1) at process_new+0x3dc sys/kern/kern_fork.c:278
fork1(ffff80002d6af228,1,ffffffff821ef240,0,ffff80002f0f13a0,0) at fork1+0x2ef sys/kern/kern_fork.c:399
syscall(ffff80002f0f1450) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002f0f1450) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7212c53b6840, count: -8
ddb{1}> show registers
rdi                              0x1
rsi               0xffffffff82e4fc40    pmap_pdp_pool+0x68
rbp               0xffff80002f0f10a0
rbx               0xfffffd806d188900
rdx                                0
rcx               0xffff80002d6af228
rax                                0
r8                             0x7f8
r9                                 0
r10               0xb1172d297851f0ce
r11               0x8f9271219c908e3d
r12                              0x1
r13                              0x1
r14               0xffffffff82e4fbd8    pmap_pdp_pool
r15                              0x8
rip               0xffffffff810672dc    pool_do_get+0x2dc
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002f0f1020
ss                              0x10
pool_do_get+0x2dc:      movq    0(%rax),%rax
ddb{1}> show proc
PROC (syz-executor.2) tid=25884 pid=91795 tcnt=1 stat=onproc
    flags process=8000002<EXEC> proc=0
    runpri=17, usrpri=76, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0
    forw=0xffffffffffffffff, list=0xffff80002f0c3220,0xffff80002f0c2fa0
    process=0xffff8000ffffb0e0 user=0xffff80002f0ec000, vmspace=0xfffffd806efd2a58
    estcpu=36, cpticks=17, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 46412  185024  32690      0  2   0x8000000                syz-executor.1
 42011  147207  39997      0  2   0x8000000                syz-executor.0
 42011  370747  39997      0  3   0xc000080  fsleep        syz-executor.0
 23565   22275  97482      0  2   0x8000000                syz-executor.5
 23565  144590  97482      0  3   0xc000080  lockf         syz-executor.5
 68931    5367  36256      0  3   0x8000080  nanoslp       syz-executor.3
 68931   59141  36256      0  3   0xc000080  netcon2       syz-executor.3
 68931  476336  36256      0  3   0xc000080  fsleep        syz-executor.3
 10981  412570  66577      0  3   0x8000080  nanoslp       syz-executor.6
 10981  120807  66577      0  3   0xc000080  sbwait        syz-executor.6
 10981  137146  66577      0  3   0xc000080  fsleep        syz-executor.6
*91795   25884  39106      0  7   0x8000002                syz-executor.2
 36256  146941  39106      0  3   0x8000082  nanoslp       syz-executor.3
 46071  411734  39106      0  2   0x8000002                syz-executor.4
 77328  180548      1      0  3  0x18100083  ttyin         getty
 66577  426507  39106      0  2   0x8000482                syz-executor.6
 32690  126665  39106      0  2   0x8000002                syz-executor.1
 39997  290099  39106      0  2   0x8000482                syz-executor.0
 95686  231302  39106      0  2   0x8000482                syz-executor.7
 97482  355679  39106      0  2   0x8000482                syz-executor.5
 48210   95987      0      0  3     0x14200  acct          acct
  7683  493745      0      0  3     0x14280  nfsidl        nfsio
  9560  454652      0      0  3     0x14280  nfsidl        nfsio
 74032  517257      0      0  3     0x14280  nfsidl        nfsio
 59184   58440      0      0  3     0x14280  nfsidl        nfsio
 97446  204541      0      0  3     0x14280  nfsidl        nfsio
 76813  190235      0      0  3     0x14280  nfsidl        nfsio
 96485   61997      0      0  3     0x14280  nfsidl        nfsio
 51546  119832      0      0  3     0x14280  nfsidl        nfsio
 40241  453489      0      0  3     0x14280  nfsidl        nfsio
  8983  162971      0      0  3     0x14280  nfsidl        nfsio
 45486  266845      0      0  3     0x14280  nfsidl        nfsio
 82726  372181      0      0  3     0x14280  nfsidl        nfsio
  7633  315016      0      0  3     0x14280  nfsidl        nfsio
 41608  210577      0      0  3     0x14280  nfsidl        nfsio
 23527  446738      0      0  3     0x14280  nfsidl        nfsio
  1745  330479      0      0  3     0x14280  nfsidl        nfsio
 90909  135693      0      0  3     0x14280  nfsidl        nfsio
 58996  391349      0      0  3     0x14280  nfsidl        nfsio
 52651  358953      0      0  3     0x14280  nfsidl        nfsio
 28490  288160      0      0  3     0x14280  nfsidl        nfsio
 71343  518736      0      0  3     0x14200  bored         sosplice
 39106  458427  33006      0  3  0x1a000082  thrsleep      syz-fuzzer
 39106  344772  33006      0  3  0x1e000082  nanoslp       syz-fuzzer
 39106  239872  33006      0  3  0x1e000082  wait          syz-fuzzer
 39106     399  33006      0  3  0x1e000082  wait          syz-fuzzer
 39106  485072  33006      0  3  0x1e000082  thrsleep      syz-fuzzer
 39106  316246  33006      0  3  0x1e000082  wait          syz-fuzzer
 39106  259060  33006      0  2  0x1e000002                syz-fuzzer
 39106  126030  33006      0  3  0x1e000082  thrsleep      syz-fuzzer
 39106   68526  33006      0  3  0x1e000082  wait          syz-fuzzer
 39106  314526  33006      0  3  0x1e000082  wait          syz-fuzzer
 39106  298026  33006      0  3  0x1e000082  thrsleep      syz-fuzzer
 39106  513442  33006      0  3  0x1e000082  thrsleep      syz-fuzzer
 39106  203384  33006      0  3  0x1e000082  wait          syz-fuzzer
 39106  158185  33006      0  3  0x1e000082  wait          syz-fuzzer
 39106  483671  33006      0  3  0x1e000082  wait          syz-fuzzer
 39106  109507  33006      0  7  0x1e000002                syz-fuzzer
 33006  174674  70527      0  3   0x810008a  sigsusp       ksh
 70527  454210   7022      0  3  0x1800009a  kqread        sshd
  7022  482014      1      0  3  0x18000088  kqread        sshd
 28564  506287  35951     74  3  0x19100092  bpf           pflogd
 35951  274177      1      0  3  0x18000080  sbwait        pflogd
 11289  312523  77953     73  3  0x19100090  kqread        syslogd
 77953   69456      1      0  3  0x18100082  sbwait        syslogd
 40656  176564      1      0  3  0x18100080  kqread        resolvd
 91359  297197  34489     77  3  0x18100092  kqread        dhcpleased
 43169  369946  34489     77  3  0x18100092  kqread        dhcpleased
 34489   84078      1      0  3  0x18000080  kqread        dhcpleased
 45269  427727      0      0  3     0x14200  bored         smr
 76514  138760      0      0  2     0x14200                zerothread
 33440  519396      0      0  3     0x14200  aiodoned      aiodoned
  5874  427197      0      0  3     0x14200  syncer        update
  2619  389769      0      0  3     0x14200  cleaner       cleaner
  9635  154464      0      0  3     0x14200  reaper        reaper
 50000  316833      0      0  3     0x14200  pgdaemon      pagedaemon
 17544  323171      0      0  3     0x14200  bored         viomb
 75804   68208      0      0  3  0x40014200  acpi0         acpi0
 78999   42723      0      0  3  0x40014200                idle1
 37038  447924      0      0  3     0x14200  bored         softnet3
 71136   69021      0      0  3     0x14200  bored         softnet2
 45375  465833      0      0  3     0x14200  bored         softnet1
 97130   67138      0      0  2     0x14200                softnet0
 58592  483088      0      0  3     0x14200  bored         systqmp
 80457   96004      0      0  3     0x14200  bored         systq
 96781  493171      0      0  3     0x14200  tmoslp        softclockmp
 70489  275716      0      0  3  0x40014200  tmoslp        softclock
 93622  188037      0      0  3  0x40014200                idle0
     1  370921      0      0  3   0x8080082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
CPU 1:
exclusive mutex pdppl r = 0 (0xffffffff82e4fbe8)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1187
#1  mtx_enter_try+0x103
#2  mtx_enter+0x4e sys/kern/kern_lock.c:266
#3  pool_get+0xc4 sys/kern/subr_pool.c:579
#4  pmap_create+0x144 sys/arch/amd64/amd64/pmap.c:1369
#5  uvmspace_fork+0x64 uvmspace_init sys/uvm/uvm_map.c:3302 [inline]
#5  uvmspace_fork+0x64 uvmspace_alloc sys/uvm/uvm_map.c:3280 [inline]
#5  uvmspace_fork+0x64 sys/uvm/uvm_map.c:3852
#6  process_new+0x3dc sys/kern/kern_fork.c:278
#7  fork1+0x2ef sys/kern/kern_fork.c:399
#8  syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
#8  syscall+0x854 sys/arch/amd64/amd64/trap.c:577
#9  Xsyscall+0x128
Process 91795 (syz-executor.2) thread 0xffff80002d6af228 (25884)
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10206   6638K    6948K 166960K     12744        0
            pcb    17     12K      12K 166960K       257        0
         rtable   207     15K      16K 166960K      1278        0
             pf    34      9K      10K 166960K       141        0
         ifaddr    40     14K      16K 166960K       171        0
        ifgroup    59      2K       3K 166960K       225        0
         sysctl     3      0K       1K 166960K         8        0
       counters    66     36K      37K 166960K       154        0
       ioctlops     0      0K       4K 166960K      1602        0
            iov     0      0K      33K 166960K       153        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1380     87K      87K 166960K      2622        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        34        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K       172        0
        dirhash    12      2K       2K 166960K        30        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    16     57K      85K 166960K      2327        0
          sigio     0      0K       0K 166960K        52        0
           proc    70     91K     127K 166960K      1430        0
        subproc   104      6K       7K 166960K       418        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       393        0
       in_multi    77      5K       7K 166960K       460        0
    ether_multi     1      0K       0K 166960K        14        0
            mrt     1      0K       0K 166960K         7        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     0      0K       1K 166960K       931        0
     pfkey data     0      0K       0K 166960K         4        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   322    111K     132K 166960K     22203        0
       UVM aobj    84      3K       3K 166960K        97        0
     pinsyscall    40     80K     108K 166960K      4193        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K       169        0
            NDP    13      0K       2K 166960K       121        0
           temp    74   6816K    7312K 166960K     62954        0
         kqueue    12     18K      26K 166960K       277        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      265    0      261     1     0     1     1     0     8    0
rtentry    112      422    0      332     4     0     4     4     0     8    0
unpcb      144     1787    0     1766     8     7     1     5     0     8    0
syncache   336       12    0       12     6     6     0     1     0     8    0
tcpqe       32       15   42       15     1     1     0     1     0     8    0
tcpcb      808      693    0      679     8     6     2     8     0     8    0
arp        120       89    0       72     1     0     1     1     0     8    0
inpcb      392     2335    0     2315    12     9     3     8     0     8    0
nd6        136      103    0       85     1     0     1     1     0     8    0
pkpcb       40       20    0       20     7     6     1     1     0     8    1
kcovpl      48       32    0       24     1     0     1     1     0     8    0
ppxss      1168      11    0       11     9     8     1     1     0     8    1
pool(0xffffffff82da0c78:ppxss): page inconsistency: page 0x0; 0 on list, 0 missing, 14 items per page
pffrag     232       14    0        9     1     0     1     1     0   482    0
pffrnode    88       14    0        9     1     0     1     1     0     8    0
pffrent     40      235    0      230     2     1     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24      212    0      158     1     0     1     1     0     8    0
pfstkey    128      212    0      158     3     0     3     3     0     8    0
pfstate    376      212    0      158     8     0     8     8     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1626    0     1254    41    16    25    33     0     8    1
art_table   32     1627    0     1254     5     1     4     5     0     8    0
art_node    16      417    0      335     1     0     1     1     0     8    0
sysvmsgpl   40       20    0       10     1     0     1     1     0     8    0
semupl     112        5    0        5     1     1     0     1     0     8    0
semapl     112      164    0      154     1     0     1     1     0     8    0
shmpl      112       94    0       13     3     0     3     3     0     8    0
dirhash    1024      29    0       12     3     0     3     3     0     8    0
dino2pl    256     4977    0     3456    96     0    96    96     0     8    0
ffsino     272     4977    0     3456   102     0   102   102     0     8    0
nchpl      144     8409    0     6662    67     1    66    67     0     8    0
uvmvnodes   80     5847    0        0   120     0   120   120     0     8    0
vnodes     216     5847    0        0   325     0   325   325     0     8    0
namei      1024   28751    0    28751     4     3     1     2     0     8    1
percpumem   16       91    0       44     1     0     1     1     0     8    0
vcpupl     3904      10    0        2     1     0     1     1     0     8    0
vmpool     696       12    0        4     1     0     1     1     0     8    0
kstatmem   264      114    0       88     3     0     3     3     0     8    0
scsiplug    72        9    0        9     5     5     0     1     0     8    0
scxspl     216    33722    0    33722    16    15     1     8     1     8    1
plimitpl   152      289    0      273     1     0     1     1     0     8    0
sigapl     424     2630    0     2560    10     1     9     9     0     8    0
futexpl     64    30584    0    30581     3     2     1     1     0     8    0
knotepl    120      420    0        0    11     0    11    11     0     8    0
kqueuepl   216      598    0      590     5     4     1     5     0     8    0
pipepl     320      468    0      440     4     1     3     4     0     8    0
fdescpl    496     2590    0     2561     5     0     5     5     0     8    0
filepl     152    14906    0    14651    21    10    11    20     0     8    0
lockfpl    104      530    0      526     1     0     1     1     0     8    0
lockfspl    48      230    0      227     1     0     1     1     0     8    0
sessionpl  144       50    0       33     1     0     1     1     0     8    0
pgrppl      48       94    0       77     1     0     1     1     0     8    0
ucredpl    104     2433    0     2419     1     0     1     1     0     8    0
zombiepl   144     2561    0     2560     1     0     1     1     0     8    0
processpl  1136    2630    0     2560     6     0     6     6     0     8    0
procpl     656     5031    0     4940    10     1     9     9     0     8    0
srpgc       96       20    0       20     5     4     1     1     0     8    1
sosppl     168       46    0       46     8     7     1     1     0     8    1
sockpl     664     4450    0     4407    23    18     5    17     0     8    1
mcl64k     65536     12    0        0     2     0     2     2     0     8    0
mcl16k     16384      8    0        0     1     0     1     1     0     8    0
mcl12k     12288      8    0        0     1     0     1     1     0     8    0
mcl9k      9216       3    0        0     1     0     1     1     0     8    0
mcl8k      8192      12    0        0     2     0     2     2     0     8    0
mcl4k      4096      23    0        0     3     0     3     3     0     8    0
mcl2k2     2112       9    0        0     1     0     1     1     0     8    0
mcl2k      2048     315    0        0    39     1    38    39     0     8    0
mtagpl      96       21    0        0     1     0     1     1     0     8    0
mbufpl     256     1305    0        0    74     0    74    74     0     8    0
pool(0xffffffff82e2e178:mbufpl): page inconsistency: page 0x0; 0 on list, 0 missing, 16 items per page
pool(0xffffffff82e2e178:mbufpl): page inconsistency: page 0x0; 0 on list, 0 missing, 16 items per page
bufpl      280     9207    0     2952   447     0   447   447     0     8    0
anonpl      24   431724    0   425290   112    44    68    71     0   186    6
amapchunkpl 152   70290    0    69618    62    23    39    42     0   158    9
amappl16   200    10464    0    10349    57    37    20    20     0     8    7
amappl15   192       18    0       18     2     2     0     1     0     8    0
amappl14   184      259    0      239     4     2     2     2     0     8    0
amappl13   176       17    0       17     2     2     0     1     0     8    0
amappl12   168     3652    0     3621     4     2     2     3     0     8    0
amappl11   160       55    0       41     1     0     1     1     0     8    0
amappl10   152       69    0       60     1     0     1     1     0     8    0
amappl9    144      196    0      195     2     1     1     1     0     8    0
amappl8    136      524    0      428     5     0     5     5     0     8    0
amappl7    128      106    0       90     1     0     1     1     0     8    0
amappl6    120      730    0      704     2     0     2     2     0     8    0
amappl5    112      303    0      288     1     0     1     1     0     8    0
amappl4    104      841    0      786     3     1     2     3     0     8    0
amappl3     96    13802    0    13717     3     0     3     3     0     8    0
amappl2     88     3171    0     3092     4     2     2     4     0     8    0
amappl1     80    19293    0    18745    23    10    13    23     0     8    0
amappl      88    21226    0    21029     6     0     6     6     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       96    0       13     2     0     2     2     0     8    0
uaddrrnd    24     2601    0     2565     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2601    0     2565     1     0     1     1     0     8    0
vmmpekpl   168    21907    0    21838     4     0     4     4     0     8    0
vmmpepl    168   180827    0   178794   158    49   109   121     0   357    1
vmsppl     440     2601    0     2565     6     1     5     5     0     8    0
rwobjpl     56    55040    0    47868   103     1   102   102     0     8    0
pdppl      4096    5210    0     5138   240   164    76    79     0     8    3
pool(0xffffffff82e4fbd8:pdppl): page inconsistency: page 0x60c500000000; 0 on list, 0 missing, 1 items per page
pool(0xffffffff82e4fbd8:pdppl): page inconsistency: page 0x2000; 0 on list, 0 missing, 1 items per page
pvpl        32    49242    0        0   398     0   398   398     0   265    0
pmappl     248     2601    0     2565     4     1     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      634    0      206    13     0    13    13     0     8    0
phpool: pool(0xffffffff82d62010:phpool): page inconsistency: page 0x0; at page head addr 0xfffffd806488bf90 (p 0xfffffd806488b000)
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1e:        addq    $0x8,%rsp
x86_ipi_db(ffffffff82d27ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x44 sys/dev/kcov.c:164
intr_handler(ffff8000373b0d40,ffff80000067b300) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:539
Xintr_ioapic_edge26_untramp() at Xintr_ioapic_edge26_untramp+0x18f
__sanitizer_cov_trace_const_cmp8(fffffd806f03f6c0,ffff8000373b1188) at __sanitizer_cov_trace_const_cmp8+0xf sys/dev/kcov.c:240
kqueue_scan(ffff8000373b0f80,8,ffff8000373b1080,ffff8000373b1188,ffff80002d6af9d8,ffff8000373b11c8) at kqueue_scan+0x1bc sys/kern/kern_event.c:1394
sys_kevent(ffff80002d6af9d8,ffff8000373b1310,ffff8000373b1260) at sys_kevent+0x567 sys/kern/kern_event.c:1062
syscall(ffff8000373b1310) at syscall+0x8cf mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff8000373b1310) at syscall+0x8cf sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x2650baa10, count: 4
ddb{0}> trace
x86_ipi_db(ffffffff82d27ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x44 sys/dev/kcov.c:164
intr_handler(ffff8000373b0d40,ffff80000067b300) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:539
Xintr_ioapic_edge26_untramp() at Xintr_ioapic_edge26_untramp+0x18f
__sanitizer_cov_trace_const_cmp8(fffffd806f03f6c0,ffff8000373b1188) at __sanitizer_cov_trace_const_cmp8+0xf sys/dev/kcov.c:240
kqueue_scan(ffff8000373b0f80,8,ffff8000373b1080,ffff8000373b1188,ffff80002d6af9d8,ffff8000373b11c8) at kqueue_scan+0x1bc sys/kern/kern_event.c:1394
sys_kevent(ffff80002d6af9d8,ffff8000373b1310,ffff8000373b1260) at sys_kevent+0x567 sys/kern/kern_event.c:1062
syscall(ffff8000373b1310) at syscall+0x8cf mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff8000373b1310) at syscall+0x8cf sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x2650baa10, count: -11
ddb{0}> machine ddbcpu 1
Stopped at      pool_do_get+0x2dc:      movq    0(%rax),%rax
pool_do_get(ffffffff82e4fbd8,1,ffff80002f0f1118) at pool_do_get+0x2dc pool_update_curpage sys/kern/subr_pool.c:1059 [inline]
pool_do_get(ffffffff82e4fbd8,1,ffff80002f0f1118) at pool_do_get+0x2dc sys/kern/subr_pool.c:765
pool_get(ffffffff82e4fbd8,1) at pool_get+0xf0 sys/kern/subr_pool.c:582
pmap_create() at pmap_create+0x144 sys/arch/amd64/amd64/pmap.c:1369
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 uvmspace_init sys/uvm/uvm_map.c:3302 [inline]
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 uvmspace_alloc sys/uvm/uvm_map.c:3280 [inline]
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 sys/uvm/uvm_map.c:3852
process_new(ffff8000ffff6540,ffff8000ffffb0e0,1) at process_new+0x3dc sys/kern/kern_fork.c:278
fork1(ffff80002d6af228,1,ffffffff821ef240,0,ffff80002f0f13a0,0) at fork1+0x2ef sys/kern/kern_fork.c:399
syscall(ffff80002f0f1450) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002f0f1450) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7212c53b6840, count: 7
ddb{1}> trace
pool_do_get(ffffffff82e4fbd8,1,ffff80002f0f1118) at pool_do_get+0x2dc pool_update_curpage sys/kern/subr_pool.c:1059 [inline]
pool_do_get(ffffffff82e4fbd8,1,ffff80002f0f1118) at pool_do_get+0x2dc sys/kern/subr_pool.c:765
pool_get(ffffffff82e4fbd8,1) at pool_get+0xf0 sys/kern/subr_pool.c:582
pmap_create() at pmap_create+0x144 sys/arch/amd64/amd64/pmap.c:1369
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 uvmspace_init sys/uvm/uvm_map.c:3302 [inline]
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 uvmspace_alloc sys/uvm/uvm_map.c:3280 [inline]
uvmspace_fork(ffff8000ffffb0e0) at uvmspace_fork+0x64 sys/uvm/uvm_map.c:3852
process_new(ffff8000ffff6540,ffff8000ffffb0e0,1) at process_new+0x3dc sys/kern/kern_fork.c:278
fork1(ffff80002d6af228,1,ffffffff821ef240,0,ffff80002f0f13a0,0) at fork1+0x2ef sys/kern/kern_fork.c:399
syscall(ffff80002f0f1450) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002f0f1450) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7212c53b6840, count: -8

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/15 15:48 openbsd 7019ae976ad9 459f4b00 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pool_do_get
* Struck through repros no longer work on HEAD.