kernel: protection fault trap, code=0
Stopped at malloc+0x855: movq 0x8(%rbx),%r14
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> show kasan
No such command
ddb{0}> trace
malloc(10,62,2) at malloc+0x855 sys/kern/kern_malloc.c:294
amap_alloc1(20,2,0) at amap_alloc1+0x291 sys/uvm/uvm_amap.c:353
amap_alloc(20000,2,0) at amap_alloc+0xad sys/uvm/uvm_amap.c:-1
amap_copy(fffff3006cf169b8,fffff3006cfd6ed8,2,0,d6bd1928000,d6bd1928001) at amap_copy+0x6ac sys/uvm/uvm_amap.c:567
uvm_fault_check(ffff80003c3f30b0,ffff80003c3f30e8,ffff80003c3f3120,0) at uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
uvm_fault(fffff3006cf169b8,d6bd1928000,0,2) at uvm_fault+0x106 sys/uvm/uvm_fault.c:627
upageflttrap(ffff80003c3f3250,d6bd19284b8) at upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
usertrap(ffff80003c3f3250) at usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
recall_trap() at recall_trap+0x8
end trace frame: 0x0, count: -9
ddb{0}> show registers
rdi 0x3d7c37050be3f18b
rsi 0x7fff00007fff
rbp 0xffff80003c3f2d50
rbx 0x3d7c48fa0be38e74
rdx 0
rcx 0xffff80003c3e02c0
rax 0xffffffff839d5ff0 cpu_info_full_primary+0x1ff0
r8 0xd6bd1928000
r9 0xd6bd1928001
r10 0
r11 0x3153474d19ac2f04
r12 0x7fff00007fff
r13 0xffffffff839e2290 kmemstats+0x1880
r14 0xa30c333 __kernel_phys_end+0x670c333
r15 0x3d7c37050be3f18b
rip 0xffffffff810d8395 malloc+0x855
cs 0x8
rflags 0x10206 __ALIGN_SIZE+0xf206
rsp 0xffff80003c3f2c90
ss 0
malloc+0x855: movq 0x8(%rbx),%r14
ddb{0}> show proc
PROC (syz-executor) tid=414000 pid=82557 tcnt=3 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
runpri=86, usrpri=86, slppri=17, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045fe9248,0xffffffff83b21ef0
process=0xffff800045fe4e90 user=0xffff80003c3ee000, vmspace=0xfffff3006cf169b8
estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
51667 95026 16612 32767 7 0x10 0 syz-executor
51667 127712 16612 32767 2 0x10 0x4000000 syz-executor
51667 374467 16612 32767 2 0x10 0x4000000 syz-executor
50787 173835 71245 32767 2 0x10 0 syz-executor
3733 315461 4836 32767 2 0x10 0 syz-executor
3733 71861 4836 32767 3 0x10 0x4000080 fsleep syz-executor
3733 267241 4836 32767 2 0x10 0x4000000 syz-executor
64426 522004 42343 32767 2 0x10 0 syz-executor
64426 391630 42343 32767 3 0x10 0x4000080 fsleep syz-executor
64426 130335 42343 32767 3 0x10 0x4000080 fsleep syz-executor
49646 15791 37161 32767 2 0x10 0 syz-executor
49646 382095 37161 32767 3 0x10 0x4000080 fsleep syz-executor
82557 216287 63 32767 2 0x10 0 syz-executor
82557 491979 63 32767 3 0x10 0x4000080 sbwait syz-executor
*82557 414000 63 32767 7 0x10 0x4000000 syz-executor
62300 278818 93280 32767 2 0x10 0 syz-executor
62300 168994 93280 32767 3 0x10 0x4000080 fsleep syz-executor
37161 111136 28331 32767 3 0x10 0x80 nanoslp syz-executor
71245 359534 73286 32767 3 0x10 0x80 nanoslp syz-executor
93280 242007 74514 32767 3 0x10 0x80 nanoslp syz-executor
42343 148481 46707 32767 3 0x10 0x80 nanoslp syz-executor
5304 220915 70205 32767 3 0x10 0x80 nanoslp syz-executor
4836 504589 38296 32767 3 0x10 0x80 nanoslp syz-executor
16612 82059 59515 32767 3 0x10 0x80 nanoslp syz-executor
63 191954 56311 32767 3 0x10 0x80 nanoslp syz-executor
28331 193008 77172 0 3 0x2 0x80 wait syz-executor
73286 70932 77172 0 3 0x2 0x80 wait syz-executor
70205 352618 77172 0 3 0x2 0x80 wait syz-executor
46707 15802 77172 0 3 0x2 0x80 wait syz-executor
74514 414872 77172 0 3 0x2 0x80 wait syz-executor
38296 485144 77172 0 3 0x2 0x80 wait syz-executor
59515 127465 77172 0 3 0x2 0x80 wait syz-executor
56311 217111 77172 0 3 0x2 0x80 wait syz-executor
77172 154392 1353 0 3 0x2 0x80 kqread syz-executor
1353 29022 25492 0 3 0x100002 0x88 sigsusp ksh
25492 41632 86825 0 3 0x10 0x88 kqread sshd-session
86825 489569 20071 0 3 0x12 0x80 kqread sshd-session
78469 111049 1 0 3 0x100003 0x80 ttyin getty
20071 448342 1 0 3 0 0x88 kqread sshd
12651 72509 34984 73 3 0x1100010 0x80 kqread syslogd
34984 19679 1 0 3 0x100002 0x80 sbwait syslogd
390 419057 1 0 3 0x100000 0x80 kqread resolvd
58403 8571 86098 77 3 0x100012 0x80 kqread dhcpleased
88889 520388 86098 77 3 0x100012 0x80 kqread dhcpleased
86098 110701 1 0 3 0 0x80 kqread dhcpleased
28882 28712 0 0 3 0x14000 0x200 bored smr
26774 373140 0 0 2 0x14000 0x200 zerothread
20978 398647 0 0 3 0x14000 0x200 aiodoned aiodoned
32258 108413 0 0 3 0x14000 0x200 syncer update
29759 466342 0 0 3 0x14000 0x200 cleaner cleaner
18136 175025 0 0 3 0x14000 0x200 reaper reaper
37281 80524 0 0 3 0x14000 0x200 pgdaemon pagedaemon
52158 116475 0 0 3 0x14000 0x200 bored viomb
53156 456328 0 0 3 0x14000 0x40000200 acpi0 acpi0
15495 162553 0 0 3 0x14000 0x40000200 idle1
10769 387690 0 0 3 0x14000 0x200 bored softnet1
89669 257652 0 0 3 0x14000 0x200 bored softnet0
79810 493236 0 0 3 0x14000 0x200 bored systqmp
85627 278620 0 0 3 0x14000 0x200 bored systq
15504 60827 0 0 3 0x14000 0x200 tmoslp softclockmp
70587 53448 0 0 3 0x14000 0x40000200 tmoslp softclock
46740 356949 0 0 3 0x14000 0x40000200 idle0
1 291579 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex /syzkaller/managers/setuid/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff838d7f18)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2 malloc+0x2ef sys/kern/kern_malloc.c:200
#3 amap_alloc1+0x291 sys/uvm/uvm_amap.c:353
#4 amap_alloc+0xad sys/uvm/uvm_amap.c:-1
#5 amap_copy+0x6ac sys/uvm/uvm_amap.c:567
#6 uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
#7 uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#8 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#9 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#10 recall_trap+0x8
Process 82557 (syz-executor) thread 0xffff80003c3e0028 (491979)
exclusive rwlock sbufrcv r = 0 (0xffff8000015a5590)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2 sblock+0xb6 sys/kern/uipc_socket2.c:536
#3 soreceive+0x27d sys/kern/uipc_socket.c:890
#4 recvit+0x40b sys/kern/uipc_syscalls.c:1078
#5 sys_recvfrom+0x109 sys/kern/uipc_syscalls.c:844
#6 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
Process 82557 (syz-executor) thread 0xffff80003c3e02c0 (414000)
exclusive rwlock vmmaplk r = 0 (0xfffff3006cf16ab8)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2 uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
#3 uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
#4 uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#5 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#6 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#7 recall_trap+0x8
exclusive mutex /syzkaller/managers/setuid/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff838d7f18)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2 malloc+0x2ef sys/kern/kern_malloc.c:200
#3 amap_alloc1+0x291 sys/uvm/uvm_amap.c:353
#4 amap_alloc+0xad sys/uvm/uvm_amap.c:-1
#5 amap_copy+0x6ac sys/uvm/uvm_amap.c:567
#6 uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
#7 uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#8 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#9 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#10 recall_trap+0x8
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11049 12018K 12034K 166960K 12140 0
pcb 17 12K 12K 166960K 17 0
rtable 241 6K 7K 166960K 360 0
pf 31 16K 16K 166960K 31 0
ifaddr 42 7K 7K 166960K 44 0
ifgroup 50 2K 2K 166960K 50 0
sysctl 1 1K 9K 166960K 6 0
counters 70 37K 37K 166960K 70 0
ioctlops 0 0K 2K 166960K 31 0
iov 0 0K 8K 166960K 2 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1287 81K 81K 166960K 1360 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 3 5K 5K 166960K 3 0
VM map 2 1K 1K 166960K 2 0
sem 6 0K 0K 166960K 6 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 26 97K 129K 166960K 228 0
sigio 0 0K 0K 166960K 3 0
proc 58 99K 147K 166960K 511 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 85 0
in_multi 99 7K 7K 166960K 103 0
ether_multi 1 0K 0K 166960K 2 0
mrt 0 0K 0K 166960K 4 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 55 254K 254K 166960K 55 0
exec 0 0K 1K 166960K 380 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 249 160K 176K 166960K 3737 0
UVM aobj 6 2K 2K 166960K 6 0
pinsyscall 47 94K 116K 166960K 1338 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 5 0
NDP 11 0K 2K 166960K 27 0
temp 37 9114K 9130K 166960K 3920 0
kqueue 13 20K 23K 166960K 42 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 40 0 37 1 0 1 1 0 8 0
rtentry 176 113 0 1 6 0 6 6 0 8 0
unpcb 144 152 0 135 3 0 3 3 0 8 2
syncache 336 5 0 5 1 0 1 1 0 8 1
tcpcb 736 76 0 70 4 0 4 4 0 8 3
arp 136 18 0 0 1 0 1 1 0 8 0
ipq 40 1 0 0 1 0 1 1 0 8 0
ipqe 40 1 0 0 1 0 1 1 0 8 0
inpcb 328 165 0 156 4 0 4 4 0 8 3
nd6 152 26 0 0 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 470 0 0 30 0 30 30 0 8 0
art_table 40 471 0 0 5 0 5 5 0 8 0
art_node 32 113 0 11 1 0 1 1 0 8 0
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 72 4 0 0 1 0 1 1 0 8 0
shmpl 112 3 0 0 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1685 0 224 92 0 92 92 0 8 0
ffsino 296 1685 0 224 113 0 113 113 0 8 0
nchpl 144 2002 0 310 64 0 64 64 0 8 0
vnodes 216 1766 0 0 99 0 99 99 0 8 0
namei 1024 6255 0 6255 2 0 2 2 0 8 2
percpumem 16 51 0 0 1 0 1 1 0 8 0
kstatmem 264 25 0 0 2 0 2 2 0 8 0
scxspl 216 6769 0 6769 4 3 1 3 1 8 1
plimitpl 152 44 0 19 2 0 2 2 0 8 1
sigapl 424 529 0 475 7 0 7 7 0 8 0
knotepl 120 107 0 0 4 0 4 4 0 8 0
kqueuepl 224 79 0 69 3 0 3 3 0 8 2
pipepl 344 164 0 137 6 0 6 6 0 8 3
fdescpl 528 513 0 475 4 0 4 4 0 8 0
filepl 160 2182 0 1970 13 0 13 13 0 8 3
lockfpl 104 29 0 27 1 0 1 1 0 8 0
lockfspl 48 12 0 10 1 0 1 1 0 8 0
sessionpl 144 26 0 10 1 0 1 1 0 8 0
pgrppl 48 34 0 10 1 0 1 1 0 8 0
ucredpl 104 185 0 166 1 0 1 1 0 8 0
zombiepl 144 476 0 475 1 0 1 1 0 8 0
processpl 1232 529 0 475 5 0 5 5 0 8 0
procpl 664 687 0 623 6 0 6 6 0 8 0
sosppl 176 2 0 2 1 0 1 1 0 8 1
sockpl 752 357 0 328 10 0 10 10 0 8 7
mcl64k 65536 3 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 3 0 0 1 0 1 1 0 8 0
mcl4k 4096 119 0 0 15 0 15 15 0 8 0
mcl2k 2048 19 0 0 3 0 3 3 0 8 0
mextrefs 64 19 0 0 1 0 1 1 0 8 0
mtagpl 96 2 0 0 1 0 1 1 0 8 0
mbufpl 256 222 0 0 14 0 14 14 0 8 0
bufpl 272 2406 0 102 154 0 154 154 0 8 0
anonpl 32 5754 0 0 47 0 47 47 0 247 0
amapchunkpl 152 11411 0 10848 38 0 38 38 0 158 13
amappl16 200 1891 0 1868 5 1 4 5 0 8 1
amappl15 192 4 0 4 1 1 0 1 0 8 0
amappl14 184 415 0 414 1 0 1 1 0 8 0
amappl13 176 115 0 105 1 0 1 1 0 8 0
amappl12 168 750 0 713 2 0 2 2 0 8 0
amappl11 160 77 0 77 1 1 0 1 0 8 0
amappl10 152 57 0 47 1 0 1 1 0 8 0
amappl9 144 275 0 275 1 1 0 1 0 8 0
amappl8 136 97 0 96 1 0 1 1 0 8 0
amappl7 128 138 0 126 1 0 1 1 0 8 0
amappl6 120 237 0 236 1 0 1 1 0 8 0
amappl5 112 102 0 93 1 0 1 1 0 8 0
amappl4 104 264 0 245 1 0 1 1 0 8 0
amappl3 96 1970 0 1833 5 1 4 4 0 8 0
amappl2 88 536 0 481 2 0 2 2 0 8 0
amappl1 80 10641 0 10058 14 0 14 14 0 8 0
amappl 88 3029 0 2843 5 0 5 5 0 92 0
uvmvnodes 80 100 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 5 0 0 1 0 1 1 0 8 0
uaddrrnd 24 513 0 475 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 513 0 475 1 0 1 1 0 8 0
vmmpekpl 168 6199 0 6169 2 0 2 2 0 8 0
vmmpepl 168 41737 0 39623 95 0 95 95 0 357 2
vmsppl 488 512 0 475 7 1 6 6 0 8 0
rwobjpl 80 15242 0 14286 22 0 22 22 0 8 0
pdppl 4096 1033 0 950 113 30 83 99 0 8 0
pvpl 32 14842 0 0 120 0 120 120 0 265 0
pmappl 256 512 0 475 4 1 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 442 0 33 12 0 12 12 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
malloc(10,62,2) at malloc+0x855 sys/kern/kern_malloc.c:294
amap_alloc1(20,2,0) at amap_alloc1+0x291 sys/uvm/uvm_amap.c:353
amap_alloc(20000,2,0) at amap_alloc+0xad sys/uvm/uvm_amap.c:-1
amap_copy(fffff3006cf169b8,fffff3006cfd6ed8,2,0,d6bd1928000,d6bd1928001) at amap_copy+0x6ac sys/uvm/uvm_amap.c:567
uvm_fault_check(ffff80003c3f30b0,ffff80003c3f30e8,ffff80003c3f3120,0) at uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
uvm_fault(fffff3006cf169b8,d6bd1928000,0,2) at uvm_fault+0x106 sys/uvm/uvm_fault.c:627
upageflttrap(ffff80003c3f3250,d6bd19284b8) at upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
usertrap(ffff80003c3f3250) at usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
recall_trap() at recall_trap+0x8
end trace frame: 0x0, count: -9
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x27: addq $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x75f1cb72c9e0, count: -3