syzbot


uvm_fault: km_free (2)

Status: upstream: reported on 2023/12/07 19:27
Reported-by: syzbot+bcfb7e93c9db34608a33@syzkaller.appspotmail.com
First crash: 199d, last: 26d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: km_free 6 711d 900d 0/3 auto-obsoleted due to no activity on 2022/10/10 22:33

Sample crash report:
uvm_fault(0xffffffff82d76058, 0x0, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      km_free+0x128:  movq    $0,0(%rax)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 319379  96775      0   0x8000000  0x4000000    1  syz-executor.5
*508793   7147      0     0x14000      0x200    0  systqmp
km_free(0,1000,ffffffff82bd7dc0,ffffffff82bd7dd8) at km_free+0x128 sys/uvm/uvm_km.c:870
pool_p_free(ffffffff82e95b20,fffffd8068db5f90) at pool_p_free+0x14d sys/kern/subr_pool.c:1012
pool_gc_pages(0) at pool_gc_pages+0x255 sys/kern/subr_pool.c:1583
taskq_thread(ffffffff82d48d20) at taskq_thread+0xf5 sys/kern/kern_task.c:448
end trace frame: 0x0, count: 11
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xffffffff82d76058, 0x0, 0, 2) -> e
ddb{0}> trace
km_free(0,1000,ffffffff82bd7dc0,ffffffff82bd7dd8) at km_free+0x128 sys/uvm/uvm_km.c:870
pool_p_free(ffffffff82e95b20,fffffd8068db5f90) at pool_p_free+0x14d sys/kern/subr_pool.c:1012
pool_gc_pages(0) at pool_gc_pages+0x255 sys/kern/subr_pool.c:1583
taskq_thread(ffffffff82d48d20) at taskq_thread+0xf5 sys/kern/kern_task.c:448
end trace frame: 0x0, count: -4
ddb{0}> show registers
rdi                           0x1000    __ALIGN_SIZE
rsi                       0x28000000
rbp               0xffff80002a11d6a0
rbx               0xffffffff82bd7dc0    kv_page
rdx                                0
rcx               0xffff8000ffffe7b0
rax                                0
r8                                 0
r9                               0x1
r10               0x85c2b3734b98bbf7
r11               0x3e046d9a3e6626e3
r12                           0x1000    __ALIGN_SIZE
r13                                0
r14                           0x1000    __ALIGN_SIZE
r15                    0x28000000000
rip               0xffffffff821c2a08    km_free+0x128
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a11d630
ss                              0x10
km_free+0x128:  movq    $0,0(%rax)
ddb{0}> show proc
PROC (systqmp) tid=508793 pid=7147 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=32, usrpri=51, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffffef60,0xffff8000ffffe010
    process=0xffff80002a0fc478 user=0xffff80002a118000, vmspace=0xffffffff82d76058
    estcpu=1, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 38808  405307  64015      0  2   0x8000002                ndp
 64015  345331  23977      0  3   0x810008a  sigsusp       sh
 81112  279196  29678      0  2   0x8000000                syz-executor.3
 81112  172752  29678      0  3   0xc000080  fsleep        syz-executor.3
 34199  332201  12149      0  2   0x8000000                syz-executor.6
 34199  117889  12149      0  3   0xc000080  fsleep        syz-executor.6
 96775   37547   2417      0  2   0x8000000                syz-executor.5
 96775  319379   2417      0  7   0xc000000                syz-executor.5
 96775  511749   2417      0  2   0xc000000                syz-executor.5
 48000  157104  20951  60928  2   0x8000010                syz-executor.2
 48000   58361  20951  60928  3   0xc000090  fsleep        syz-executor.2
 48000   25319  20951  60928  3   0xc000090  fsleep        syz-executor.2
 23977  462946  93627      0  3   0x8000082  wait          syz-executor.7
 20951  449290  93627      0  2   0x8000482                syz-executor.2
 30005   24686  93627      0  3   0x8000082  nanoslp       syz-executor.4
 58316  418939  93627      0  3   0x8000082  nanoslp       syz-executor.0
 12149  511881  93627      0  2   0x8000482                syz-executor.6
  3432   48197      1      0  3  0x18100083  ttyin         getty
 29678  212696  93627      0  3   0x8000082  nanoslp       syz-executor.3
  6015  388347      0      0  3     0x14200  bored         sosplice
 56903  432903  93627      0  3   0x8000002  biowait       syz-executor.1
  2417    3668  93627      0  2   0x8000482                syz-executor.5
 93627  200038   5425      0  3  0x1a000082  thrsleep      syz-fuzzer
 93627   11785   5425      0  3  0x1e000082  nanoslp       syz-fuzzer
 93627  394976   5425      0  3  0x1e000082  wait          syz-fuzzer
 93627   53988   5425      0  3  0x1e000082  wait          syz-fuzzer
 93627  353554   5425      0  2  0x1e000082                syz-fuzzer
 93627  469988   5425      0  3  0x1e000082  wait          syz-fuzzer
 93627  467285   5425      0  3  0x1e000082  wait          syz-fuzzer
 93627   20629   5425      0  3  0x1e000082  thrsleep      syz-fuzzer
 93627  205953   5425      0  3  0x1e000082  kqread        syz-fuzzer
 93627  257756   5425      0  3  0x1e000082  wait          syz-fuzzer
 93627  296613   5425      0  3  0x1e000082  thrsleep      syz-fuzzer
 93627  325045   5425      0  3  0x1e000082  wait          syz-fuzzer
 93627  184961   5425      0  3  0x1e000082  wait          syz-fuzzer
 93627  384364   5425      0  3  0x1e000082  thrsleep      syz-fuzzer
 93627  442925   5425      0  3  0x1e000082  thrsleep      syz-fuzzer
 93627   13603   5425      0  3  0x1e000082  wait          syz-fuzzer
  5425  273329  57629      0  3   0x810008a  sigsusp       ksh
 57629  136970  71786      0  3  0x1800009a  kqread        sshd
 71786  447245      1      0  3  0x18000088  kqread        sshd
 33543   38111  25376     73  3  0x19100010  biowait       syslogd
 25376  190964      1      0  3  0x18100082  sbwait        syslogd
 25658  119728      1      0  3  0x18100080  kqread        resolvd
 96430   52626  24293     77  3  0x18100092  kqread        dhcpleased
 19378  242696  24293     77  3  0x18100092  kqread        dhcpleased
 24293  121154      1      0  3  0x18000080  kqread        dhcpleased
 42264   98049      0      0  3     0x14200  bored         smr
 45269   86842      0      0  2     0x14200                zerothread
 73056   58323      0      0  3     0x14200  aiodoned      aiodoned
 26302  466616      0      0  2     0x14600                update
 55376  261187      0      0  3     0x14200  cleaner       cleaner
 98920  485491      0      0  3     0x14200  reaper        reaper
 14299  164384      0      0  3     0x14200  pgdaemon      pagedaemon
 57142  522257      0      0  3     0x14200  bored         viomb
 43042  452290      0      0  3  0x40014200  acpi0         acpi0
 98504  469042      0      0  3  0x40014200                idle1
 14448  462270      0      0  3     0x14200  bored         softnet3
 44176  439880      0      0  3     0x14200  bored         softnet2
 96182   97055      0      0  3     0x14200  bored         softnet1
 85287  332556      0      0  3     0x14200  bored         softnet0
* 7147  508793      0      0  7     0x14200                systqmp
 75916   23477      0      0  3     0x14200  bored         systq
 97171  261372      0      0  3     0x14200  tmoslp        softclockmp
  8855  163632      0      0  2  0x40014200                softclock
 50206   16407      0      0  3  0x40014200                idle0
     1  268876      0      0  3   0x8000082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 96775 (syz-executor.5) thread 0xffff80002a2239c8 (37547)
shared rwlock vmmaplk r = 0 (0xfffffd80765fe2b0)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1157
#1  uvmfault_lookup+0xd9 sys/uvm/uvm_fault.c:1785
#2  uvm_fault_check+0x3e sys/uvm/uvm_fault.c:672
#3  uvm_fault+0xf2 sys/uvm/uvm_fault.c:600
#4  upageflttrap+0x8e sys/arch/amd64/amd64/trap.c:188
#5  usertrap+0x22a sys/arch/amd64/amd64/trap.c:436
#6  recall_trap+0x8
Process 56903 (syz-executor.1) thread 0xffff80002a2102b0 (432903)
exclusive rrwlock inode r = 0 (0xfffffd8067284918)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1157
#1  rw_enter+0x32d sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x91 sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:524
#4  vn_lock+0x85 sys/kern/vfs_vnops.c:564
#5  vget+0x1fd sys/kern/vfs_subr.c:676
#6  ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119
#7  ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1201
#8  ufs_lookup+0x1373 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x5c sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x6f8 sys/kern/vfs_lookup.c:566
#11 namei+0x56a sys/kern/vfs_lookup.c:250
#12 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1856
#13 syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
#13 syscall+0x854 sys/arch/amd64/amd64/trap.c:577
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806e348920)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1157
#1  rw_enter+0x32d sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x91 sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:524
#4  vn_lock+0x85 sys/kern/vfs_vnops.c:564
#5  vget+0x1fd sys/kern/vfs_subr.c:676
#6  cache_lookup+0x2b3 sys/kern/vfs_cache.c:222
#7  ufs_lookup+0x1b2 sys/ufs/ufs/ufs_lookup.c:160
#8  VOP_LOOKUP+0x5c sys/kern/vfs_vops.c:85
#9  vfs_lookup+0x6f8 sys/kern/vfs_lookup.c:566
#10 namei+0x56a sys/kern/vfs_lookup.c:250
#11 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1856
#12 syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
#12 syscall+0x854 sys/arch/amd64/amd64/trap.c:577
#13 Xsyscall+0x128
Process 33543 (syslogd) thread 0xffff8000ffffd720 (38111)
exclusive rrwlock inode r = 0 (0xfffffd806e71d2c0)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1157
#1  rw_enter+0x32d sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x91 sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:524
#4  vn_lock+0x85 sys/kern/vfs_vnops.c:564
#5  sys_fsync+0xf1 sys/kern/vfs_syscalls.c:2931
#6  syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
#6  syscall+0x854 sys/arch/amd64/amd64/trap.c:577
#7  Xsyscall+0x128
Process 7147 (systqmp) thread 0xffff8000ffffe7b0 (508793)
shared rwlock pools r = 0 (0xffffffff82cc4e10)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1157
#1  pool_gc_pages+0x25 sys/kern/subr_pool.c:1560
#2  taskq_thread+0xf5 sys/kern/kern_task.c:448
#3  proc_trampoline+0x10
shared rwlock systqmp r = 0 (0xffffffff82d48d90)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1157
#1  taskq_thread+0xda sys/kern/kern_task.c:444
#2  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10201   6623K    7004K 166960K     13401        0
            pcb    17     12K      12K 166960K       152        0
         rtable   199      6K       7K 166960K       797        0
             pf    33      9K      10K 166960K       107        0
         ifaddr    43     15K      15K 166960K       121        0
        ifgroup    58      2K       2K 166960K       169        0
         sysctl     4      1K       1K 166960K         4        0
       counters    66     36K      37K 166960K       128        0
       ioctlops     0      0K       4K 166960K      1533        0
            iov     0      0K      16K 166960K        53        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1402     88K      88K 166960K      2324        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        30        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        80        0
        dirhash    12      2K       2K 166960K        36        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    16     57K      97K 166960K      1079        0
          sigio     0      0K       0K 166960K        19        0
           proc    58     79K     115K 166960K       882        0
        subproc   104      6K       8K 166960K       260        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       144        0
       in_multi    91      6K       7K 166960K       265        0
    ether_multi     1      0K       0K 166960K         4        0
            mrt     0      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     0      0K       1K 166960K       620        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   268     76K     111K 166960K     11282        0
       UVM aobj    50      4K       4K 166960K        55        0
     pinsyscall    36     72K     100K 166960K      2549        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        57        0
            NDP    14      0K       2K 166960K        84        0
           temp    75   6808K    7303K 166960K     45037        0
         kqueue    12     18K      28K 166960K       146        0
      SYN cache     2      8K      16K 166960K         3        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      137    0      133     1     0     1     1     0     8    0
rtentry    112      271    0      180     4     0     4     4     0     8    0
unpcb      144      671    0      658     2     0     2     2     0     8    1
syncache   336        6    0        6     3     3     0     1     0     8    0
sackhl      24        1    0        1     1     1     0     1     0     8    0
tcpqe       32       30    0       30     2     2     0     1     0     8    0
tcpcb      808      362    0      356    11     9     2     8     0     8    1
arp        120       47    0       30     1     0     1     1     0     8    0
inpcb      384     1063    0     1052    12     9     3     9     0     8    1
nd6        136       70    0       49     1     0     1     1     0     8    0
pkpcb       40       10    0       10     4     4     0     1     0     8    0
kcovpl      48       20    0       12     1     0     1     1     0     8    0
ppxss      1168       8    0        8     4     4     0     1     0     8    0
pffrag     232        8    0        5     1     0     1     1     0   482    0
pffrnode    88        5    0        2     1     0     1     1     0     8    0
pffrent     40       16    0       13     2     1     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       95    0       57     1     0     1     1     0     8    0
pfstkey    128       95    0       57     2     0     2     2     0     8    0
pfstate    376       95    0       56     5     0     5     5     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1086    0      656    33     6    27    29     0     8    0
art_table   32     1087    0      656     4     0     4     4     0     8    0
art_node    16      269    0      187     1     0     1     1     0     8    0
sysvmsgpl   40       15    0        4     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       78    0       68     1     0     1     1     0     8    0
shmpl      112       52    0        5     2     0     2     2     0     8    0
dirhash    1024      33    0       16     3     0     3     3     0     8    0
dino2pl    256     3060    0     1538    96     0    96    96     0     8    0
ffsino     272     3060    0     1538   103     1   102   103     0     8    0
nchpl      144     4605    0     2860    67     0    67    67     0     8    0
uvmvnodes   80     3857    0        0    79     0    79    79     0     8    0
vnodes     216     3857    0        0   215     0   215   215     0     8    0
namei      1024   16861    0    16861     4     3     1     2     0     8    1
percpumem   16       78    0       31     1     0     1     1     0     8    0
vcpupl     3904       4    0        1     1     0     1     1     0     8    0
vmpool     696        9    0        6     6     5     1     1     0     8    0
kstatmem   264       86    0       62     2     0     2     2     0     8    0
scsiplug    72        2    0        2     2     2     0     1     0     8    0
scxspl     216    28621    0    28619    14    13     1     8     1     8    0
plimitpl   152      185    0      170     1     0     1     1     0     8    0
sigapl     424     1389    0     1341     9     2     7     8     0     8    0
futexpl     64    16851    0    16847     4     3     1     1     0     8    0
knotepl    120      880    0        0    26     0    26    26     0     8    0
kqueuepl   216      370    0      360     5     4     1     5     0     8    0
pipepl     320      269    0      241     3     0     3     3     0     8    0
fdescpl    496     1348    0     1321     7     2     5     5     0     8    0
filepl     152     8306    0     8059    17     5    12    14     0     8    0
lockfpl    104      341    0      339     1     0     1     1     0     8    0
lockfspl    48      152    0      150     1     0     1     1     0     8    0
sessionpl  144       37    0       21     1     0     1     1     0     8    0
pgrppl      48       48    0       32     1     0     1     1     0     8    0
ucredpl    104     1090    0     1077     1     0     1     1     0     8    0
zombiepl   144     1343    0     1341     1     0     1     1     0     8    0
processpl  1144    1389    0     1341     6     1     5     6     0     8    0
procpl     656     2367    0     2298     9     2     7     9     0     8    0
srpgc       96        8    0        8     2     2     0     1     0     8    0
sockpl     664     1888    0     1860    16    12     4     9     0     8    0
mcl64k     65536     12    0        0     2     0     2     2     0     8    0
mcl16k     16384      7    0        0     1     0     1     1     0     8    0
mcl12k     12288      4    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       5    0        0     1     0     1     1     0     8    0
mcl4k      4096       4    0        0     1     0     1     1     0     8    0
mcl2k      2048     388    0        0    49     0    49    49     0     8    0
mtagpl      96       21    0        0     1     0     1     1     0     8    0
mbufpl     256      417    0        0    27     0    27    27     0     8    0
bufpl      280     8663    0     1703   498     0   498   498     0     8    0
anonpl      24   304694    0   298478    78    10    68    68     0   186   19
amapchunkpl 152   37593    0    36960    59    20    39    45     0   158    8
amappl16   200     6782    0     6654    31    22     9    21     0     8    0
amappl15   192       26    0       26     1     1     0     1     0     8    0
amappl14   184      190    0      178     2     1     1     2     0     8    0
amappl13   176       90    0       89     1     0     1     1     0     8    0
amappl12   168     2190    0     2160     3     1     2     3     0     8    0
amappl11   160       73    0       55     1     0     1     1     0     8    0
amappl10   152      131    0      125     1     0     1     1     0     8    0
amappl9    144      176    0      176     2     2     0     1     0     8    0
amappl8    136      182    0      149     2     0     2     2     0     8    0
amappl7    128       76    0       59     1     0     1     1     0     8    0
amappl6    120      463    0      450     2     1     1     2     0     8    0
amappl5    112      221    0      209     1     0     1     1     0     8    0
amappl4    104      628    0      593     2     0     2     2     0     8    0
amappl3     96     7506    0     7434     3     0     3     3     0     8    0
amappl2     88     1830    0     1757     4     2     2     4     0     8    0
amappl1     80    13323    0    12837    23    11    12    22     0     8    0
amappl      88    10568    0    10390     6     0     6     6     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       54    0        5     1     0     1     1     0     8    0
uaddrrnd    24     1358    0     1328     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1358    0     1328     1     0     1     1     0     8    0
vmmpekpl   168    13730    0    13666     4     0     4     4     0     8    0
vmmpepl    168   104313    0   102538   134    37    97   118     0   357    7
vmsppl     440     1357    0     1328     6     1     5     5     0     8    0
rwobjpl     56    34815    0    29836    77     6    71    71     0     8    0
pdppl      4096    2723    0     2659   148    78    70    81     0     8    6
pvpl        32    49998    0        0   405     1   404   404     0   265    0
pmappl     248     1357    0     1328     4     1     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      490    0      106    12     0    12    12     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
km_free(0,1000,ffffffff82bd7dc0,ffffffff82bd7dd8) at km_free+0x128 sys/uvm/uvm_km.c:870
pool_p_free(ffffffff82e95b20,fffffd8068db5f90) at pool_p_free+0x14d sys/kern/subr_pool.c:1012
pool_gc_pages(0) at pool_gc_pages+0x255 sys/kern/subr_pool.c:1583
taskq_thread(ffffffff82d48d20) at taskq_thread+0xf5 sys/kern/kern_task.c:448
end trace frame: 0x0, count: -4
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1e:        addq    $0x8,%rsp
x86_ipi_db(ffff800029cebff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82e5b6b8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82e5b6b8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
syscall(ffff80002ab0d930) at syscall+0x83b mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002ab0d930) at syscall+0x83b sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x88f0cd52b0, count: 9
ddb{1}> trace
x86_ipi_db(ffff800029cebff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82e5b6b8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82e5b6b8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
syscall(ffff80002ab0d930) at syscall+0x83b mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff80002ab0d930) at syscall+0x83b sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x88f0cd52b0, count: -6

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/28 06:27 openbsd 98f39564523a f550015e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/05/21 13:23 openbsd 6fb00c133d1f 4c0d3ee3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/05/06 19:57 openbsd 27da0d9a6e0d d884b519 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/04/12 18:57 openbsd 474ea8ba1797 c8349e48 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: km_free
2024/04/08 15:24 openbsd e16d075e3f83 7591ebb5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/03/31 19:59 openbsd 2ee472d028ec 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
2024/03/17 14:56 openbsd d108608d837e 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: km_free
2024/01/22 04:33 openbsd 83cbdf3a02e6 9bd8dcda .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: km_free
2023/12/07 19:27 openbsd 0d0a919f69d9 28b24332 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: km_free
* Struck through repros no longer work on HEAD.