kernel: protection fault trap, code=0
Stopped at malloc+0x855: movq 0x8(%rbx),%r14
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> show kasan
No such command
ddb{1}> trace
malloc(10,62,2) at malloc+0x855 sys/kern/kern_malloc.c:294
amap_alloc1(20,2,0) at amap_alloc1+0x291 sys/uvm/uvm_amap.c:356
amap_alloc(20000,2,0) at amap_alloc+0xad sys/uvm/uvm_amap.c:-1
amap_copy(fffff0806d17ad78,fffff0806d0ac770,2,0,896a3365000,896a3365001) at amap_copy+0x6a8 sys/uvm/uvm_amap.c:570
uvm_fault_check(ffff80002a32be30,ffff80002a32be68,ffff80002a32bea0,0) at uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
uvm_fault(fffff0806d17ad78,896a3365000,0,2) at uvm_fault+0x106 sys/uvm/uvm_fault.c:627
upageflttrap(ffff80002a32bfd0,896a3365178) at upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:194
usertrap(ffff80002a32bfd0) at usertrap+0x430 sys/arch/amd64/amd64/trap.c:648
recall_trap() at recall_trap+0x8
end trace frame: 0x0, count: -9
ddb{1}> show registers
rdi 0x3405ee251114a8fc
rsi 0
rbp 0xffff80002a32bad0
rbx 0x3405ee251114a8fc
rdx 0
rcx 0xffff800037bb94e0
rax 0xffff80002999dff0
r8 0x896a3365000
r9 0x896a3365001
r10 0
r11 0xfa4aa4399ac2300b
r12 0
r13 0xffffffff83a2b570 kmemstats+0x1880
r14 0xa30c333 __kernel_phys_end+0x670c333
r15 0x3405ee251114a8fc
rip 0xffffffff81a72135 malloc+0x855
cs 0x8
rflags 0x10206 __ALIGN_SIZE+0xf206
rsp 0xffff80002a32ba10
ss 0
malloc+0x855: movq 0x8(%rbx),%r14
ddb{1}> show proc
PROC (syz-executor) tid=243752 pid=70941 tcnt=2 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
runpri=50, usrpri=50, slppri=17, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800037bb9778,0xffffffff83a2e098
process=0xffff800039fcdd00 user=0xffff80002a327000, vmspace=0xfffff0806d17ad78
estcpu=12, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
70941 373966 15115 32767 7 0x10 0 syz-executor
*70941 243752 15115 32767 7 0x10 0x4000000 syz-executor
99487 4919 50141 32767 2 0x10 0 syz-executor
99487 328743 50141 32767 3 0x10 0x4000080 fsleep syz-executor
38935 354709 49636 0 2 0x2 0 syz-executor
6412 285985 94760 32767 2 0x10 0 syz-executor
6412 130117 94760 32767 3 0x10 0x4000080 fsleep syz-executor
6412 66647 94760 32767 3 0x10 0x4000080 fsleep syz-executor
50141 284618 24016 32767 3 0x10 0x80 nanoslp syz-executor
24016 338654 49636 0 3 0x2 0x80 wait syz-executor
31933 33519 99546 32767 3 0x10 0x80 nanoslp syz-executor
31933 121713 99546 32767 3 0x10 0x4000080 kqread syz-executor
31933 393384 99546 32767 3 0x10 0x4000080 fsleep syz-executor
94760 297745 88160 32767 3 0x10 0x80 nanoslp syz-executor
88160 201218 49636 0 3 0x2 0x80 wait syz-executor
49568 286526 49636 0 3 0x2 0x80 wait syz-executor
99546 264424 89490 32767 3 0x10 0x80 nanoslp syz-executor
89490 238973 49636 0 3 0x2 0x80 wait syz-executor
15115 438845 52822 32767 3 0x10 0x80 nanoslp syz-executor
52822 431269 49636 0 3 0x2 0x80 wait syz-executor
95181 392997 10068 32767 3 0x10 0x80 nanoslp syz-executor
10068 364594 49636 0 3 0x2 0x80 wait syz-executor
85570 426075 91154 32767 3 0x10 0x80 wait syz-executor
91154 84212 49636 0 3 0x2 0x80 wait syz-executor
49636 215392 65332 0 3 0x2 0x80 kqread syz-executor
65332 220832 27561 0 3 0x100002 0x88 sigsusp ksh
27561 344033 83688 0 3 0x10 0x88 kqread sshd-session
83688 57784 47560 0 3 0x12 0x80 kqread sshd-session
40385 282209 1 0 3 0x100003 0x80 ttyin getty
47560 178194 1 0 3 0 0x88 kqread sshd
43216 258628 29244 73 3 0x1100010 0x80 kqread syslogd
29244 125928 1 0 3 0x100002 0x80 sbwait syslogd
32736 382626 1 0 3 0x100000 0x80 kqread resolvd
63787 45233 38310 77 3 0x100012 0x80 kqread dhcpleased
60765 328213 38310 77 3 0x100012 0x80 kqread dhcpleased
38310 192155 1 0 3 0 0x80 kqread dhcpleased
91057 430150 0 0 3 0x14000 0x200 bored smr
15557 26266 0 0 2 0x14000 0x200 zerothread
81860 214932 0 0 3 0x14000 0x200 aiodoned aiodoned
43408 176143 0 0 3 0x14000 0x200 syncer update
2603 388019 0 0 3 0x14000 0x200 cleaner cleaner
79085 12007 0 0 3 0x14000 0x200 reaper reaper
97100 224394 0 0 3 0x14000 0x200 pgdaemon pagedaemon
78376 500085 0 0 3 0x14000 0x200 bored viomb
83747 276902 0 0 3 0x14000 0x40000200 acpi0 acpi0
68548 214103 0 0 3 0x14000 0x40000200 idle1
7031 144608 0 0 3 0x14000 0x200 bored softnet1
61543 395224 0 0 3 0x14000 0x200 bored softnet0
78833 51227 0 0 3 0x14000 0x200 smrbar systqmp
84455 412504 0 0 3 0x14000 0x200 bored systq
75744 268074 0 0 3 0x14000 0x200 tmoslp softclockmp
19873 123129 0 0 3 0x14000 0x40000200 tmoslp softclock
79699 422893 0 0 3 0x14000 0x40000200 idle0
1 320169 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{1}> show all locks
CPU 1:
exclusive mutex /syzkaller/managers/setuid/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff8392f6b8)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2 malloc+0x2ef sys/kern/kern_malloc.c:200
#3 amap_alloc1+0x291 sys/uvm/uvm_amap.c:356
#4 amap_alloc+0xad sys/uvm/uvm_amap.c:-1
#5 amap_copy+0x6a8 sys/uvm/uvm_amap.c:570
#6 uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
#7 uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#8 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:194
#9 usertrap+0x430 sys/arch/amd64/amd64/trap.c:648
#10 recall_trap+0x8
Process 70941 (syz-executor) thread 0xffff800037bb94e0 (243752)
exclusive rwlock vmmaplk r = 0 (0xfffff0806d17ae78)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2 uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
#3 uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
#4 uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#5 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:194
#6 usertrap+0x430 sys/arch/amd64/amd64/trap.c:648
#7 recall_trap+0x8
exclusive mutex /syzkaller/managers/setuid/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff8392f6b8)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2 malloc+0x2ef sys/kern/kern_malloc.c:200
#3 amap_alloc1+0x291 sys/uvm/uvm_amap.c:356
#4 amap_alloc+0xad sys/uvm/uvm_amap.c:-1
#5 amap_copy+0x6a8 sys/uvm/uvm_amap.c:570
#6 uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
#7 uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#8 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:194
#9 usertrap+0x430 sys/arch/amd64/amd64/trap.c:648
#10 recall_trap+0x8
Process 78833 (systqmp) thread 0xffff800045ffe530 (51227)
shared rwlock systqmp r = 0 (0xffffffff838ecda8)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x12a sys/kern/kern_task.c:442
#2 proc_trampoline+0x10
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11078 12020K 12034K 166960K 12237 0
pcb 17 14K 16K 166960K 19 0
rtable 215 6K 7K 166960K 991 0
pf 29 16K 16K 166960K 73 0
ifaddr 38 7K 7K 166960K 132 0
ifgroup 46 2K 2K 166960K 134 0
sysctl 1 1K 9K 166960K 5 0
counters 68 36K 37K 166960K 112 0
ioctlops 0 0K 2K 166960K 56 0
iov 0 0K 16K 166960K 8 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1287 81K 81K 166960K 1559 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 3 0
VM map 2 1K 1K 166960K 2 0
sem 13 1K 1K 166960K 14 0
dirhash 12 2K 2K 166960K 18 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 23 85K 121K 166960K 613 0
sigio 0 0K 0K 166960K 6 0
proc 63 115K 180K 166960K 1126 0
subproc 69 4K 4K 166960K 267 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 25 0
in_multi 88 5K 6K 166960K 330 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 6 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 247 1102K 1102K 166960K 247 0
exec 0 0K 1K 166960K 640 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 232 151K 177K 166960K 5924 0
UVM aobj 6 2K 2K 166960K 6 0
pinsyscall 44 88K 110K 166960K 2239 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 44 0
NDP 18 1K 1K 166960K 90 0
temp 38 9119K 9135K 166960K 6170 0
kqueue 14 20K 24K 166960K 49 0
SYN cache 2 16K 16K 166960K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 88 0 85 1 0 1 1 0 8 0
rtentry 176 344 0 245 6 0 6 6 0 8 1
unpcb 144 245 0 230 1 0 1 1 0 8 0
syncache 336 6 0 6 1 0 1 1 0 8 1
tcpcb 736 155 0 149 7 0 7 7 0 8 6
arp 136 60 0 44 1 0 1 1 0 8 0
inpcb 328 505 0 496 12 2 10 12 0 8 8
nd6 152 89 0 68 1 0 1 1 0 8 0
kcovpl 48 29 0 22 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 1413 0 955 34 2 32 33 0 8 1
art_table 40 1414 0 955 6 0 6 6 0 8 0
art_node 32 344 0 244 1 0 1 1 0 8 0
sysvmsgpl 40 2 0 1 1 0 1 1 0 8 0
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 72 12 0 1 1 0 1 1 0 8 0
shmpl 120 3 0 0 1 0 1 1 0 8 0
dirhash 1024 21 0 4 3 0 3 3 0 8 0
dino2pl 256 1772 0 253 96 0 96 96 0 8 0
ffsino 296 1772 0 253 117 0 117 117 0 8 0
nchpl 144 2153 0 388 66 0 66 66 0 8 0
vnodes 216 2048 0 0 114 0 114 114 0 8 0
namei 1024 9932 0 9932 2 0 2 2 0 8 2
percpumem 16 72 0 22 1 0 1 1 0 8 0
kstatmem 264 67 0 44 2 0 2 2 0 8 0
scxspl 216 7132 0 7132 4 3 1 3 1 8 1
plimitpl 152 100 0 75 2 0 2 2 0 8 0
sigapl 424 860 0 809 7 0 7 7 0 8 0
knotepl 120 278 0 0 9 0 9 9 0 8 0
kqueuepl 224 130 0 120 5 0 5 5 0 8 4
pipepl 344 207 0 180 3 0 3 3 0 8 0
fdescpl 528 844 0 809 3 0 3 3 0 8 0
filepl 160 3460 0 3242 15 0 15 15 0 8 4
lockfpl 104 47 0 45 1 0 1 1 0 8 0
lockfspl 48 20 0 18 1 0 1 1 0 8 0
sessionpl 144 56 0 41 1 0 1 1 0 8 0
pgrppl 48 87 0 64 1 0 1 1 0 8 0
ucredpl 104 536 0 518 1 0 1 1 0 8 0
zombiepl 144 812 0 809 1 0 1 1 0 8 0
processpl 1232 860 0 809 5 0 5 5 0 8 0
procpl 664 1132 0 1075 7 0 7 7 0 8 1
sockpl 752 841 0 814 17 5 12 17 0 8 8
mcl64k 65536 4 0 0 1 0 1 1 0 8 0
mcl16k 16384 2 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 124 0 0 16 0 16 16 0 8 0
mcl2k 2048 32 0 0 4 0 4 4 0 8 0
mextrefs 64 29 0 0 1 0 1 1 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 208 0 0 13 0 13 13 0 8 0
bufpl 272 2423 0 102 155 0 155 155 0 8 0
anonpl 32 7314 0 0 59 0 59 59 0 247 0
amapchunkpl 152 17770 0 17247 33 0 33 33 0 158 11
amappl16 200 2226 0 1970 15 1 14 14 0 8 0
amappl15 192 9 0 9 1 1 0 1 0 8 0
amappl14 184 688 0 687 1 0 1 1 0 8 0
amappl13 176 172 0 162 1 0 1 1 0 8 0
amappl12 168 1163 0 1129 2 0 2 2 0 8 0
amappl11 160 4 0 4 1 1 0 1 0 8 0
amappl10 152 58 0 48 1 0 1 1 0 8 0
amappl9 144 268 0 268 1 1 0 1 0 8 0
amappl8 136 173 0 172 1 0 1 1 0 8 0
amappl7 128 181 0 170 1 0 1 1 0 8 0
amappl6 120 355 0 354 1 0 1 1 0 8 0
amappl5 112 92 0 84 1 0 1 1 0 8 0
amappl4 104 338 0 321 1 0 1 1 0 8 0
amappl3 96 3020 0 2922 5 1 4 4 0 8 1
amappl2 88 895 0 820 3 0 3 3 0 8 1
amappl1 80 13947 0 13387 16 0 16 16 0 8 3
amappl 88 4863 0 4694 5 0 5 5 0 92 0
uvmvnodes 80 100 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 5 0 0 1 0 1 1 0 8 0
uaddrrnd 24 844 0 809 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 844 0 809 1 0 1 1 0 8 0
vmmpekpl 168 8647 0 8595 3 0 3 3 0 8 0
vmmpepl 168 63474 0 61279 103 0 103 103 0 357 5
vmsppl 488 843 0 809 7 1 6 6 0 8 0
rwobjpl 80 20947 0 19782 25 0 25 25 0 8 0
pdppl 4096 1695 0 1618 119 28 91 95 0 8 14
pvpl 32 14232 0 0 116 0 116 116 0 265 1
pmappl 256 843 0 809 4 1 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 461 0 33 13 0 13 13 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x27: addq $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff838e0ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x35 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x35 sys/dev/kcov.c:230
syscall(ffff80003bfd5cb0) at syscall+0x984 mi_syscall_return sys/sys/syscall_mi.h:196 [inline]
syscall(ffff80003bfd5cb0) at syscall+0x984 sys/arch/amd64/amd64/trap.c:812
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x72829e99f700, count: -6
ddb{0}> machine ddbcpu 1
Stopped at malloc+0x855: movq 0x8(%rbx),%r14
ddb{1}> trace
malloc(10,62,2) at malloc+0x855 sys/kern/kern_malloc.c:294
amap_alloc1(20,2,0) at amap_alloc1+0x291 sys/uvm/uvm_amap.c:356
amap_alloc(20000,2,0) at amap_alloc+0xad sys/uvm/uvm_amap.c:-1
amap_copy(fffff0806d17ad78,fffff0806d0ac770,2,0,896a3365000,896a3365001) at amap_copy+0x6a8 sys/uvm/uvm_amap.c:570
uvm_fault_check(ffff80002a32be30,ffff80002a32be68,ffff80002a32bea0,0) at uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
uvm_fault(fffff0806d17ad78,896a3365000,0,2) at uvm_fault+0x106 sys/uvm/uvm_fault.c:627
upageflttrap(ffff80002a32bfd0,896a3365178) at upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:194
usertrap(ffff80002a32bfd0) at usertrap+0x430 sys/arch/amd64/amd64/trap.c:648
recall_trap() at recall_trap+0x8
end trace frame: 0x0, count: -9