uvm_fault(0xWAfRfNIfNfGf: SPLd N8O0T6 eLfO1WdE7R8ED 8O,N 0SxYSC28A8L42L0 ,14 0 ,64 2 )EX I-T> 0 9e
Stopped at savectx+0xae: movl $0,%gs:0x688
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 75207 819 0 0 0x4000000 1 syz-executor
339859 88366 0 0 0x4000000 0 syz-executor
savectx() at savectx+0xae
end of kernel
end trace frame: 0x23a8b6d5920, count: 14
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu0: uvm_fault(0xfffffd806ef1d788, 0x288420, 0, 2) -> e
ddb{1}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0x23a8b6d5920, count: -1
ddb{1}> show registers
rdi 0
rsi 0
rbp 0xffff80003c527770
rbx 0
rdx 0xffff800001480fc0
rcx 0xffff80002f3dca78
rax 0x33
r8 0xffff80003c5276a0
r9 0x65400 acpi_pdirpa+0x51271
r10 0xbabaee9df3929ea1
r11 0x731b348644105a9d
r12 0
r13 0
r14 0xffff80002f3dca78
r15 0
rip 0xffffffff81e113ee savectx+0xae
cs 0x8
rflags 0x46
rsp 0xffff80003c5276f0
ss 0
savectx+0xae: movl $0,%gs:0x688
ddb{1}> show proc
PROC (syz-executor) tid=75207 pid=819 tcnt=2 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=17, usrpri=50, slppri=17, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff8000ffffd488,0xffffffff83975558
process=0xffff80003c4d1860 user=0xffff80003c522000, vmspace=0xfffffd805d4607a8
estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
819 39431 55492 0 2 0 syz-executor
* 819 75207 55492 0 7 0x4000000 syz-executor
28156 68613 26587 0 2 0 syz-executor
28156 454511 26587 0 2 0x4000000 syz-executor
42764 117099 23250 0 2 0xc80 syz-executor
42764 409392 23250 0 3 0x4000000 smrbar syz-executor
42764 119234 23250 0 3 0x4000080 fsleep syz-executor
88366 161958 53237 0 3 0x80 nanoslp syz-executor
88366 339859 53237 0 7 0x4000000 syz-executor
87931 226349 64313 0 2 0 syz-executor
87931 86850 64313 0 3 0x4000080 fsleep syz-executor
47484 178892 51427 0 2 0x4000000 syz-executor
47484 348656 51427 0 3 0x4000080 fifow syz-executor
47484 423885 51427 0 3 0x4000080 fifow syz-executor
62387 165010 99067 0 2 0 syz-executor
62387 239089 99067 0 3 0x4000080 fsleep syz-executor
62387 153248 99067 0 3 0x4000080 fsleep syz-executor
23250 41994 63448 0 2 0xc82 syz-executor
29220 391372 1 0 3 0x100083 ttyin getty
51427 435686 63448 0 3 0x82 nanoslp syz-executor
26587 310179 63448 0 2 0xc82 syz-executor
64313 204325 63448 0 3 0x82 nanoslp syz-executor
55492 138641 63448 0 2 0xc82 syz-executor
99067 343660 63448 0 3 0x82 nanoslp syz-executor
53237 68081 63448 0 2 0xc82 syz-executor
24109 497204 0 0 3 0x14200 bored sosplice
31104 437758 63448 0 3 0x82 wait syz-executor
63448 396293 31073 0 3 0x82 kqread syz-executor
31073 43205 38198 0 3 0x10008a sigsusp ksh
38198 488434 13834 0 3 0x98 kqread sshd-session
13834 478065 75808 0 3 0x92 kqread sshd-session
75808 422432 1 0 3 0x88 kqread sshd
54942 427143 20691 74 3 0x1100092 bpf pflogd
20691 291247 1 0 3 0x80 sbwait pflogd
76584 430344 36318 73 3 0x1100090 kqread syslogd
36318 492309 1 0 3 0x100082 sbwait syslogd
21516 60744 1 0 3 0x100080 kqread resolvd
72163 342850 6010 77 3 0x100092 kqread dhcpleased
6604 210044 6010 77 3 0x100092 kqread dhcpleased
6010 116650 1 0 3 0x80 kqread dhcpleased
163 280207 0 0 2 0x14200 smr
5809 133593 0 0 2 0x14200 zerothread
51581 496774 0 0 3 0x14200 aiodoned aiodoned
80777 497576 0 0 3 0x14200 syncer update
28343 415808 0 0 3 0x14200 cleaner cleaner
74345 11711 0 0 3 0x14200 reaper reaper
78372 376851 0 0 3 0x14200 pgdaemon pagedaemon
66051 496631 0 0 3 0x14200 bored viomb
53056 418687 0 0 3 0x40014200 acpi0 acpi0
17261 340638 0 0 3 0x40014200 idle1
82070 505419 0 0 3 0x14200 bored softnet3
27752 143068 0 0 3 0x14200 bored softnet2
6117 108974 0 0 3 0x14200 bored softnet1
89717 186108 0 0 3 0x14200 bored softnet0
46530 296166 0 0 3 0x14200 bored systqmp
56576 461290 0 0 3 0x14200 bored systq
55160 88946 0 0 2 0x14200 softclockmp
86171 462818 0 0 3 0x40014200 tmoslp softclock
97358 152228 0 0 3 0x40014200 idle0
1 75353 0 0 3 0x80082 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb{1}> show all locks
CPU 1:
exclusive mutex &bq->bufq_mtx r = 0 (0xffff80000019f580)
#0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1 mtx_enter_try+0x1ad sys/kern/kern_lock.c:301
#2 mtx_enter+0x62 sys/kern/kern_lock.c:258
#3 bufq_queue+0x33 sys/kern/kern_bufq.c:135
#4 sdstrategy+0x203 sys/scsi/sd.c:567
#5 spec_strategy+0x45 sys/kern/spec_vnops.c:448
#6 VOP_STRATEGY+0xcc sys/kern/vfs_vops.c:639
#7 ufs_strategy+0x1f6 sys/ufs/ufs/ufs_vnops.c:-1
#8 VOP_STRATEGY+0xcc sys/kern/vfs_vops.c:639
#9 bwrite+0x296 sys/kern/vfs_bio.c:745
#10 VOP_BWRITE+0x60 sys/kern/vfs_vops.c:651
#11 ufs_direnter+0x7d1 sys/ufs/ufs/ufs_lookup.c:833
#12 ufs_makeinode+0x51e sys/ufs/ufs/ufs_vnops.c:1768
#13 ufs_mknod+0x5b sys/ufs/ufs/ufs_vnops.c:167
#14 VOP_MKNOD+0x102 sys/kern/vfs_vops.c:121
#15 domknodat+0x47e sys/kern/vfs_syscalls.c:1636
#16 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#16 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#17 Xsyscall+0x128
Process 819 (syz-executor) thread 0xffff80002f3dca78 (75207)
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10242 11105K 13172K 166960K 18282 0
pcb 18 22K 27K 166960K 1845 0
rtable 254 22K 23K 166960K 1512 0
pf 47 20K 83K 166960K 474 0
ifaddr 48 10K 11K 166960K 335 0
ifgroup 71 3K 3K 166960K 554 0
sysctl 4 1K 9K 166960K 116 0
counters 76 37K 38K 166960K 638 0
ioctlops 0 0K 5K 166960K 2887 0
iov 0 0K 36K 166960K 376 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1583 99K 100K 166960K 6213 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 40K 42K 166960K 97 0
VM map 2 1K 1K 166960K 2 0
sem 21 32K 32K 166960K 195 0
dirhash 15 2K 3K 166960K 123 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 18 65K 240K 166960K 5711 0
sigio 0 0K 0K 166960K 167 0
proc 74 91K 128K 166960K 1540 0
subproc 72 4K 4K 166960K 225 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 998 0
in_multi 81 5K 7K 166960K 540 0
ether_multi 1 0K 0K 166960K 26 0
mrt 2 0K 0K 166960K 34 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 103 466K 466K 166960K 103 0
exec 0 0K 1K 166960K 1467 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 45 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 269 161K 176K 166960K 51201 0
UVM aobj 12 4K 6K 166960K 14 0
pinsyscall 43 86K 108K 166960K 7228 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 1 0K 1K 166960K 312 0
NDP 15 0K 2K 166960K 218 0
temp 86 8696K 8824K 166960K 234656 0
kqueue 16 24K 37K 166960K 1006 0
SYN cache 2 16K 16K 166960K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 26 0 0 1 0 1 1 0 8 0
rtpcb 120 618 0 615 8 5 3 3 0 8 2
rtentry 176 480 0 383 8 2 6 6 0 8 0
unpcb 144 5120 0 5098 20 19 1 6 0 8 0
syncache 336 12 0 12 5 5 0 1 0 8 0
tcpqe 32 5 0 5 4 4 0 1 0 8 0
tcpcb 736 2291 0 2258 48 38 10 13 0 8 6
arp 128 78 0 61 1 0 1 1 0 8 0
inpcb 328 7324 0 7286 49 40 9 13 0 8 4
nd6 144 84 0 66 1 0 1 1 0 8 0
pkpcb 40 206 0 206 4 3 1 1 0 8 1
kcovpl 48 25 0 17 1 0 1 1 0 8 0
mppekey 1024 9 0 9 3 3 0 1 0 8 0
ppxss 1192 212 0 211 3 2 1 1 0 8 0
pppxif 1504 33 0 32 5 4 1 1 0 8 0
pfstscr 40 1 0 1 1 1 0 1 0 8 0
pffrag 232 35 0 28 1 0 1 1 0 482 0
pffrnode 88 28 0 22 1 0 1 1 0 8 0
pffrent 40 129 0 122 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfrktable 1344 4 0 1 1 0 1 1 0 8 0
pftag 88 8 0 0 1 0 1 1 0 8 0
pfstitem 24 295 0 119 2 0 2 2 0 8 0
pfstkey 128 296 0 120 6 0 6 6 0 8 0
pfstate 384 295 0 120 18 0 18 18 0 8 0
pfrule 1344 57 0 39 3 1 2 2 0 8 0
rttmr 136 7 0 7 4 4 0 1 0 8 0
art_heap8 4096 8 0 4 6 2 4 6 0 8 0
art_heap4 256 2896 0 2521 43 17 26 31 0 8 1
art_table 32 2904 0 2525 4 0 4 4 0 8 0
art_node 16 454 0 378 1 0 1 1 0 8 0
sysvmsgpl 40 20 0 13 1 0 1 1 0 8 0
semupl 112 5 0 5 2 2 0 1 0 8 0
semapl 112 188 0 169 1 0 1 1 0 8 0
shmpl 112 11 0 2 1 0 1 1 0 8 0
dirhash 1024 92 0 73 3 0 3 3 0 8 0
dino2pl 256 11262 0 9718 98 1 97 97 0 8 0
ffsino 288 11262 0 9718 111 0 111 111 0 8 0
nchpl 144 18891 0 18307 64 38 26 64 0 8 0
rtmask 32 26 0 26 5 4 1 1 0 8 1
uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0
vnodes 216 5926 0 0 330 0 330 330 0 8 0
namei 1024 74476 0 74476 6 5 1 2 0 8 1
percpumem 16 334 0 281 1 0 1 1 0 8 0
kstatmem 264 334 0 298 3 0 3 3 0 8 0
acpiwqpl 32 1 0 1 1 0 1 1 1 8 1
scsiplug 72 32 0 32 7 6 1 1 0 8 1
scxspl 216 98402 0 98402 14 13 1 8 1 8 1
plimitpl 152 1385 0 1367 1 0 1 1 0 8 0
sigapl 424 5963 0 5912 9 1 8 9 0 8 0
knotepl 120 773 0 0 23 0 23 23 0 8 0
kqueuepl 224 2517 0 2504 18 16 2 5 0 8 1
pipepl 336 851 0 822 10 7 3 8 0 8 0
fdescpl 520 5910 0 5878 3 0 3 3 0 8 0
filepl 160 46709 0 46479 36 21 15 19 0 8 4
lockfpl 104 2540 0 2538 6 5 1 2 0 8 0
lockfspl 48 813 0 811 1 0 1 1 0 8 0
sessionpl 144 51 0 42 1 0 1 1 0 8 0
pgrppl 48 171 0 154 1 0 1 1 0 8 0
ucredpl 104 7874 0 7861 1 0 1 1 0 8 0
zombiepl 144 5913 0 5912 1 0 1 1 0 8 0
processpl 1240 5963 0 5912 6 1 5 6 0 8 0
procpl 656 14286 0 14225 8 2 6 8 0 8 0
srpgc 96 42 0 42 6 5 1 1 0 8 1
sosppl 168 28 0 28 5 5 0 1 0 8 0
sockpl 728 13528 0 13465 69 57 12 21 0 8 3
mcl64k 65536 11 0 0 2 0 2 2 0 8 0
mcl16k 16384 7 0 0 1 0 1 1 0 8 0
mcl12k 12288 3 0 0 1 0 1 1 0 8 0
mcl9k 9216 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 7 0 0 1 0 1 1 0 8 0
mcl4k 4096 139 0 0 15 0 15 15 0 8 0
mcl2k2 2112 1 0 0 1 0 1 1 0 8 0
mcl2k 2048 86 0 0 9 1 8 8 0 8 0
mtagpl 96 178 0 0 5 0 5 5 0 8 0
mbufpl 256 1290 0 0 80 0 80 80 0 8 0
bufpl 280 36060 0 29918 439 0 439 439 0 8 0
anonpl 32 21560 0 0 175 1 174 174 0 246 0
amapchunkpl 152 182881 0 182197 60 27 33 40 0 158 4
amappl16 200 18111 0 17811 113 84 29 45 0 8 8
amappl15 192 9 0 9 2 2 0 1 0 8 0
amappl14 184 163 0 151 1 0 1 1 0 8 0
amappl13 176 25 0 25 1 1 0 1 0 8 0
amappl12 168 6434 0 6410 4 2 2 3 0 8 0
amappl11 160 48 0 34 1 0 1 1 0 8 0
amappl10 152 4 0 4 1 1 0 1 0 8 0
amappl9 144 251 0 250 1 0 1 1 0 8 0
amappl8 136 23 0 20 1 0 1 1 0 8 0
amappl7 128 152 0 139 1 0 1 1 0 8 0
amappl6 120 356 0 352 1 0 1 1 0 8 0
amappl5 112 193 0 183 1 0 1 1 0 8 0
amappl4 104 414 0 392 1 0 1 1 0 8 0
amappl3 96 37132 0 37009 4 0 4 4 0 8 0
amappl2 88 969 0 904 2 0 2 2 0 8 0
amappl1 80 33371 0 32758 16 1 15 15 0 8 0
amappl 88 49258 0 49063 5 0 5 5 0 92 0
dma65536 65536 1 0 1 1 1 0 1 0 8 0
dma32768 32768 1 0 1 1 1 0 1 0 8 0
dma8192 8192 1 0 1 1 1 0 1 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 3 0 2 1 0 1 1 0 8 0
dma256 256 7 0 7 2 2 0 1 0 8 0
dma128 128 263 0 263 6 6 0 1 0 8 0
dma64 64 7 0 7 2 2 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 28 0 27 1 0 1 1 0 8 0
aobjpl 72 13 0 2 1 0 1 1 0 8 0
uaddrrnd 24 5910 0 5878 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 5910 0 5878 1 0 1 1 0 8 0
vmmpekpl 168 39894 0 39824 4 0 4 4 0 8 0
vmmpepl 168 369806 0 367404 172 43 129 129 0 357 21
vmsppl 480 5909 0 5878 6 1 5 5 0 8 0
rwobjpl 72 92473 0 85296 147 6 141 141 0 8 6
pdppl 4096 11827 0 11756 145 74 71 87 0 8 0
pvpl 32 27917 0 0 225 1 224 224 0 265 0
pmappl 256 5909 0 5878 3 0 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 596 0 159 13 0 13 13 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x27: addq $0x8,%rsp
x86_ipi_db(ffffffff83867ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666
acpitimer_delay(1) at acpitimer_delay+0x58 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline]
acpitimer_delay(1) at acpitimer_delay+0x58 sys/dev/acpi/acpitimer.c:120
comcnputc(800,d) at comcnputc+0x29b sys/dev/ic/com.c:1269
db_putchar(a) at db_putchar+0x774 sys/ddb/db_output.c:168
kprintf() at kprintf+0x843 sys/kern/subr_prf.c:-1
db_printf(ffffffff8340cc6c) at db_printf+0x9b sys/kern/subr_prf.c:-1
fault(ffffffff833b3638) at fault+0xa7 sys/arch/amd64/amd64/trap.c:157
kpageflttrap(ffff80002a366090,288420) at kpageflttrap+0x385 sys/arch/amd64/amd64/trap.c:290
kerntrap(ffff80002a366090) at kerntrap+0x14a sys/arch/amd64/amd64/trap.c:332
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x57
end trace frame: 0xffff80002a3664d0, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff83867ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666
acpitimer_delay(1) at acpitimer_delay+0x58 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline]
acpitimer_delay(1) at acpitimer_delay+0x58 sys/dev/acpi/acpitimer.c:120
comcnputc(800,d) at comcnputc+0x29b sys/dev/ic/com.c:1269
db_putchar(a) at db_putchar+0x774 sys/ddb/db_output.c:168
kprintf() at kprintf+0x843 sys/kern/subr_prf.c:-1
db_printf(ffffffff8340cc6c) at db_printf+0x9b sys/kern/subr_prf.c:-1
fault(ffffffff833b3638) at fault+0xa7 sys/arch/amd64/amd64/trap.c:157
kpageflttrap(ffff80002a366090,288420) at kpageflttrap+0x385 sys/arch/amd64/amd64/trap.c:290
kerntrap(ffff80002a366090) at kerntrap+0x14a sys/arch/amd64/amd64/trap.c:332
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x57
syscall(ffff80002a3664e0) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a3664e0) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9a5b191ec70, count: -16
ddb{0}> machine ddbcpu 1
Stopped at savectx+0xae: movl $0,%gs:0x688
savectx() at savectx+0xae
end of kernel
end trace frame: 0x23a8b6d5920, count: 14
ddb{1}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0x23a8b6d5920, count: -1