panic: pool_do_get: pdppl free list modified: page 0xfffffd806cc74000; item addr 0xfffffd806cc74000; offset 0x0=0x1f32d6e50339f934 != 0x1f32d6e50339f974
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*443305 49237 0 0x2 0 0 syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833ae828) at panic+0x1cf sys/kern/subr_prf.c:198
pool_do_get(ffffffff83964e18,1,ffff80002a82f758) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff83964e18,1) at pool_get+0x11a sys/kern/subr_pool.c:-1
pmap_create() at pmap_create+0x18c sys/arch/amd64/amd64/pmap.c:1391
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f uvmspace_init sys/uvm/uvm_map.c:-1 [inline]
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f uvmspace_alloc sys/uvm/uvm_map.c:3252 [inline]
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f sys/uvm/uvm_map.c:3737
process_new(ffff80002a86ad28,ffff80003c957aa0,1) at process_new+0x558 sys/kern/kern_fork.c:281
fork1(ffff80003c93b4e0,1,ffffffff82a268e0,0,ffff80002a82f9d0,0) at fork1+0x3f2 sys/kern/kern_fork.c:-1
syscall(ffff80002a82fa80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a82fa80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x705a43ea64d0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: pool_do_get: pdppl free list modified: page 0xfffffd806cc74000; item addr 0xfffffd806cc74000; offset 0x0=0x1f32d6e50339f934 != 0x1f32d6e50339f974
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833ae828) at panic+0x1cf sys/kern/subr_prf.c:198
pool_do_get(ffffffff83964e18,1,ffff80002a82f758) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff83964e18,1) at pool_get+0x11a sys/kern/subr_pool.c:-1
pmap_create() at pmap_create+0x18c sys/arch/amd64/amd64/pmap.c:1391
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f uvmspace_init sys/uvm/uvm_map.c:-1 [inline]
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f uvmspace_alloc sys/uvm/uvm_map.c:3252 [inline]
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f sys/uvm/uvm_map.c:3737
process_new(ffff80002a86ad28,ffff80003c957aa0,1) at process_new+0x558 sys/kern/kern_fork.c:281
fork1(ffff80003c93b4e0,1,ffffffff82a268e0,0,ffff80002a82f9d0,0) at fork1+0x3f2 sys/kern/kern_fork.c:-1
syscall(ffff80002a82fa80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a82fa80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x705a43ea64d0, count: -10
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff80002a82f5c0
rbx 0xfffffd806cc74000
rdx 0
rcx 0
rax 0xffff80003c93b4e0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x6004aafa7e0668b7
r11 0x62589aab5d065828
r12 0
r13 0xf20b75522e0bbe31
r14 0
r15 0x1
rip 0xffffffff81df8255 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80002a82f5b0
ss 0x10
db_enter+0x25: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor) tid=443305 pid=49237 tcnt=1 stat=onproc
flags process=2<EXEC> proc=0
runpri=16, usrpri=50, slppri=16, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a776a68,0xffff80003c93b788
process=0xffff80003c957aa0 user=0xffff80002a82a000, vmspace=0xfffffd80669fa468
estcpu=36, cpticks=117, pctcpu=0.0, user=7, sys=108, intr=2
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
60017 173442 42331 0 2 0x2 ifconfig
57363 64197 27251 0 2 0 syz-executor
57363 405200 27251 0 2 0x4000000 syz-executor
57363 475304 27251 0 2 0x4000000 syz-executor
95238 309784 88565 0 2 0 syz-executor
95238 278060 88565 0 3 0x4000080 fsleep syz-executor
95238 398603 88565 0 3 0x4000080 fsleep syz-executor
66720 389210 34824 0 2 0 syz-executor
66720 41109 34824 0 3 0x4000080 fsleep syz-executor
25559 463674 93415 0 2 0 syz-executor
25559 150540 93415 0 3 0x4000080 fsleep syz-executor
42331 255453 82457 0 3 0x10008a sigsusp sh
82457 148309 85807 0 3 0x82 wait syz-executor
27251 98266 85807 0 3 0x82 nanoslp syz-executor
51790 340492 76471 0 3 0x3000 suspend syz-executor
51790 139521 76471 0 3 0x4081000 biowait syz-executor
51790 127787 76471 0 3 0x4081000 inode syz-executor
51790 39411 76471 0 3 0x4081000 inode syz-executor
98819 390087 1 0 3 0x100083 ttyin getty
34824 287448 85807 0 3 0x82 nanoslp syz-executor
88565 508337 85807 0 3 0x82 nanoslp syz-executor
*49237 443305 85807 0 7 0x2 syz-executor
93415 110744 85807 0 3 0x82 nanoslp syz-executor
31517 158945 85807 0 3 0x82 nanoslp syz-executor
76471 295599 85807 0 3 0x82 wait syz-executor
85807 434011 65784 0 2 0x2 syz-executor
65784 392176 32009 0 3 0x10008a sigsusp ksh
32009 400999 84745 0 3 0x98 kqread sshd-session
84745 299208 44655 0 3 0x92 kqread sshd-session
44655 413201 1 0 3 0x88 kqread sshd
9503 80701 73845 73 3 0x1100090 kqread syslogd
73845 338851 1 0 3 0x100082 sbwait syslogd
6614 199963 1 0 3 0x100080 kqread resolvd
57254 497203 29414 77 3 0x100092 kqread dhcpleased
681 259931 29414 77 3 0x100092 kqread dhcpleased
29414 318732 1 0 3 0x80 kqread dhcpleased
12684 483931 0 0 3 0x14200 bored smr
43394 213592 0 0 2 0x14200 zerothread
64906 70278 0 0 3 0x14200 aiodoned aiodoned
78217 90273 0 0 3 0x14200 syncer update
42675 372244 0 0 3 0x14200 cleaner cleaner
9369 233846 0 0 3 0x14200 reaper reaper
95504 401754 0 0 3 0x14200 pgdaemon pagedaemon
72282 475089 0 0 3 0x14200 bored viomb
74284 164327 0 0 3 0x40014200 acpi0 acpi0
48415 89407 0 0 3 0x14200 bored softnet0
32627 250389 0 0 3 0x14200 bored systqmp
3744 447608 0 0 3 0x14200 bored systq
81863 102031 0 0 3 0x40014200 tmoslp softclock
44481 83406 0 0 3 0x40014200 idle0
1 522654 0 0 3 0x82 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11075 12131K 14273K 166960K 18226 0
pcb 17 16K 24K 166960K 1382 0
rtable 216 16K 16K 166960K 1360 0
pf 33 13K 17K 166960K 512 0
ifaddr 30 6K 8K 166960K 294 0
ifgroup 48 2K 2K 166960K 575 0
sysctl 4 1K 9K 166960K 72 0
counters 33 17K 18K 166960K 429 0
ioctlops 0 0K 4K 166960K 1221 0
iov 0 0K 20K 166960K 296 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1668 105K 105K 166960K 5942 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 9K 166960K 30 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 228 0
dirhash 12 2K 2K 166960K 84 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 19 69K 240K 166960K 4970 0
sigio 0 0K 0K 166960K 293 0
proc 68 67K 108K 166960K 1249 0
subproc 72 4K 4K 166960K 162 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 949 0
in_multi 54 4K 7K 166960K 341 0
ether_multi 1 0K 0K 166960K 51 0
mrt 2 0K 0K 166960K 27 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 235 1049K 1049K 166960K 235 0
exec 0 0K 1K 166960K 1171 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 5 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 230 137K 164K 166960K 45833 0
UVM aobj 149 43K 45K 166960K 174 0
pinsyscall 40 80K 95K 166960K 6367 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 1K 166960K 495 0
NDP 11 0K 1K 166960K 224 0
temp 87 8676K 8932K 166960K 180902 0
kqueue 13 20K 36K 166960K 924 0
SYN cache 2 0K 16K 166960K 4 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 818 0 815 4 1 3 3 0 8 2
rtentry 136 318 0 257 4 0 4 4 0 8 1
unpcb 144 4138 0 4121 10 4 6 6 0 8 5
syncache 336 35 0 35 2 1 1 1 0 8 1
tcpqe 32 17 0 17 2 1 1 1 0 8 1
tcpcb 736 1872 0 1866 13 6 7 7 0 8 5
arp 96 49 0 36 1 0 1 1 0 8 0
ipq 40 14 0 11 1 0 1 1 0 8 0
ipqe 40 52 0 49 1 0 1 1 0 8 0
inpcb 328 6027 0 6017 19 9 10 13 0 8 8
ip6q 72 6 0 4 1 0 1 1 0 8 0
ip6af 40 3 0 3 1 0 1 1 0 8 1
nd6 112 69 0 56 1 0 1 1 0 8 0
pkpcb 40 22 0 22 2 1 1 1 0 8 1
kcovpl 48 18 0 10 1 0 1 1 0 8 0
mppekey 1024 3 0 3 2 1 1 1 0 8 1
ppxss 1072 330 0 330 2 1 1 1 0 8 1
pppxif 1384 30 0 30 2 1 1 1 0 8 1
pfrktable 1344 8 0 3 1 0 1 1 0 8 0
pfanchor 1288 1 0 0 1 0 1 1 0 8 0
pftag 88 2 0 0 1 0 1 1 0 8 0
pfrule 1360 6 0 3 1 0 1 1 0 8 0
rttmr 136 4 0 4 2 1 1 1 0 8 1
art_heap8 4096 6 0 1 6 0 6 6 0 8 1
art_heap4 256 1208 0 890 29 3 26 29 0 8 3
art_table 40 1214 0 891 5 0 5 5 0 8 0
art_node 32 305 0 252 1 0 1 1 0 8 0
sysvmsgpl 40 9 0 6 1 0 1 1 0 8 0
semupl 112 4 0 4 2 1 1 1 0 8 1
semapl 112 220 0 210 1 0 1 1 0 8 0
shmpl 112 143 0 15 4 0 4 4 0 8 0
dirhash 1024 65 0 48 3 0 3 3 0 8 0
dino2pl 256 11225 0 9715 96 0 96 96 0 8 0
ffsino 256 11225 0 9715 96 0 96 96 0 8 0
nchpl 144 18043 0 16322 65 0 65 65 0 8 0
rtmask 32 41 0 41 2 1 1 1 0 8 1
vnodes 216 5926 0 0 330 0 330 330 0 8 0
namei 1024 69189 0 69189 3 2 1 2 0 8 1
vcpupl 3904 19 0 1 3 0 3 3 0 8 0
vmpool 808 28 0 10 2 0 2 2 0 8 0
pfiaddrpl 120 3 0 0 1 0 1 1 0 8 0
kstatmem 264 378 0 356 4 1 3 3 0 8 1
acpiwqpl 32 2 0 2 1 0 1 1 1 8 1
scsiplug 72 23 0 23 2 1 1 1 0 8 1
scxspl 216 60943 0 60942 11 7 4 8 1 8 3
plimitpl 152 1681 0 1664 1 0 1 1 0 8 0
sigapl 424 5274 0 5230 8 0 8 8 0 8 2
knotepl 120 497663 0 497616 73 62 11 18 0 8 8
kqueuepl 184 1955 0 1945 7 3 4 4 0 8 3
pipepl 304 804 0 777 13 5 8 8 0 8 5
fdescpl 448 5206 0 5175 5 1 4 5 0 8 0
filepl 120 43338 0 43095 23 8 15 16 0 8 6
lockfpl 104 2225 0 2223 3 1 2 2 0 8 1
lockfspl 48 650 0 648 1 0 1 1 0 8 0
sessionpl 144 58 0 50 1 0 1 1 0 8 0
pgrppl 48 149 0 133 1 0 1 1 0 8 0
ucredpl 104 8458 0 8447 1 0 1 1 0 8 0
zombiepl 144 5232 0 5230 2 1 1 1 0 8 0
processpl 1152 5274 0 5230 5 0 5 5 0 8 0
procpl 664 12274 0 12221 7 0 7 7 0 8 1
sosppl 176 36 0 36 2 1 1 1 0 8 1
sockpl 552 11267 0 11237 35 24 11 17 0 8 8
mcl64k 65536 642 0 641 1 0 1 1 0 8 0
mcl16k 16384 8 0 8 2 1 1 1 0 8 1
mcl12k 12288 1 0 1 1 0 1 1 0 8 1
mcl9k 9216 7 0 7 2 1 1 1 0 8 1
mcl8k 8192 61 0 61 1 0 1 1 0 8 1
mcl4k 4096 8988 0 8930 16 7 9 15 0 8 1
mcl2k2 2112 4 0 4 2 1 1 1 0 8 1
mcl2k 2048 5655 0 5653 5 3 2 4 0 8 1
mtagpl 96 49 0 49 1 0 1 1 0 8 1
mbufpl 256 173656 0 173552 273 251 22 116 0 8 8
bufpl 280 17403 0 11182 445 0 445 445 0 8 0
anonpl 24 692673 0 680980 103 2 101 101 0 187 19
amapchunkpl 152 160651 0 160107 55 16 39 39 0 158 16
amappl16 200 11391 0 10923 41 6 35 35 0 8 3
amappl15 192 7 0 6 1 0 1 1 0 8 0
amappl14 184 10 0 10 1 1 0 1 0 8 0
amappl13 176 513 0 511 1 0 1 1 0 8 0
amappl12 168 5667 0 5629 2 0 2 2 0 8 0
amappl11 160 7 0 6 1 0 1 1 0 8 0
amappl10 152 43 0 32 1 0 1 1 0 8 0
amappl9 144 259 0 258 1 0 1 1 0 8 0
amappl8 136 38 0 36 1 0 1 1 0 8 0
amappl7 128 201 0 197 1 0 1 1 0 8 0
amappl6 120 423 0 409 1 0 1 1 0 8 0
amappl5 112 91 0 83 1 0 1 1 0 8 0
amappl4 104 578 0 552 1 0 1 1 0 8 0
amappl3 96 27900 0 27813 3 0 3 3 0 8 0
amappl2 88 5489 0 5418 2 0 2 2 0 8 0
amappl1 80 35037 0 34497 16 2 14 15 0 8 1
amappl 88 43975 0 43812 5 0 5 5 0 92 0
uvmvnodes 80 204 0 0 5 0 5 5 0 8 0
dma32768 32768 1 0 1 1 0 1 1 0 8 1
dma16384 16384 3 0 3 1 1 0 1 0 8 0
dma8192 8192 2 0 2 1 0 1 1 0 8 1
dma4096 4096 2 0 2 1 1 0 1 0 8 0
dma1024 1024 2 0 1 1 0 1 1 0 8 0
dma256 256 8 0 8 2 1 1 1 0 8 1
dma128 128 260 0 260 2 1 1 1 0 8 1
dma64 64 9 0 9 2 1 1 1 0 8 1
dma32 32 8 0 8 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 173 0 25 3 0 3 3 0 8 0
uaddrrnd 24 5205 0 5175 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 5205 0 5175 1 0 1 1 0 8 0
vmmpekpl 168 38137 0 38083 4 0 4 4 0 8 0
vmmpepl 168 326244 0 324023 126 9 117 117 0 357 9
vmsppl 368 5205 0 5175 4 1 3 4 0 8 0
rwobjpl 40 76473 0 74824 19 0 19 19 0 8 0
pdppl 4096 10473 0 10388 184 98 86 86 0 8 1
pdppl: pool(0xffffffff83964e18:pdppl): free list modified: page 0xfffffd806cc74000; item ordinal 0; addr 0xfffffd806cc74000 (p 0xfffffd806bb11000); offset 0x0=0x1f32d6e50339f934
pvpl 32 2143145 0 2126294 203 15 188 188 0 265 23
pmappl 216 5233 0 5185 3 0 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 751 0 378 15 2 13 14 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833ae828) at panic+0x1cf sys/kern/subr_prf.c:198
pool_do_get(ffffffff83964e18,1,ffff80002a82f758) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff83964e18,1) at pool_get+0x11a sys/kern/subr_pool.c:-1
pmap_create() at pmap_create+0x18c sys/arch/amd64/amd64/pmap.c:1391
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f uvmspace_init sys/uvm/uvm_map.c:-1 [inline]
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f uvmspace_alloc sys/uvm/uvm_map.c:3252 [inline]
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f sys/uvm/uvm_map.c:3737
process_new(ffff80002a86ad28,ffff80003c957aa0,1) at process_new+0x558 sys/kern/kern_fork.c:281
fork1(ffff80003c93b4e0,1,ffffffff82a268e0,0,ffff80002a82f9d0,0) at fork1+0x3f2 sys/kern/kern_fork.c:-1
syscall(ffff80002a82fa80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a82fa80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x705a43ea64d0, count: -10
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833ae828) at panic+0x1cf sys/kern/subr_prf.c:198
pool_do_get(ffffffff83964e18,1,ffff80002a82f758) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff83964e18,1) at pool_get+0x11a sys/kern/subr_pool.c:-1
pmap_create() at pmap_create+0x18c sys/arch/amd64/amd64/pmap.c:1391
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f uvmspace_init sys/uvm/uvm_map.c:-1 [inline]
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f uvmspace_alloc sys/uvm/uvm_map.c:3252 [inline]
uvmspace_fork(ffff80003c957aa0) at uvmspace_fork+0x7f sys/uvm/uvm_map.c:3737
process_new(ffff80002a86ad28,ffff80003c957aa0,1) at process_new+0x558 sys/kern/kern_fork.c:281
fork1(ffff80003c93b4e0,1,ffffffff82a268e0,0,ffff80002a82f9d0,0) at fork1+0x3f2 sys/kern/kern_fork.c:-1
syscall(ffff80002a82fa80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a82fa80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x705a43ea64d0, count: -10