syzbot


MSan: Uninitialized Memory in umap_lookup

Status: upstream: reported on 2024/05/15 19:28
Reported-by: syzbot+eb3131ee87c501643ca9@syzkaller.appspotmail.com
First crash: 30d, last: 7d07h

Sample crash report:
[ 200.4939714] panic: MSan: Uninitialized Variable 'tdvp' From union_lookup1()

[ 200.4939714] cpu0: Begin traceback...
[ 200.5739375] vpanic() at netbsd:vpanic+0xc9d
[ 200.7239472] panic() at netbsd:panic+0x1b3
[ 200.8739418] __msan_warning() at netbsd:__msan_warning+0x11e kmsan_report_inline sys/kern/subr_msan.c:250 [inline]
[ 200.8739418] __msan_warning() at netbsd:__msan_warning+0x11e sys/kern/subr_msan.c:631
[ 201.0239435] umap_lookup() at netbsd:umap_lookup+0xebb
[ 201.1739427] VOP_LOOKUP() at netbsd:VOP_LOOKUP+0x248
[ 201.3439418] union_lookup1() at netbsd:union_lookup1+0x4cf sys/fs/union/union_vnops.c:279
[ 201.4939703] union_lookup() at netbsd:union_lookup+0x579 sys/fs/union/union_vnops.c:371
[ 201.6439491] VOP_LOOKUP() at netbsd:VOP_LOOKUP+0x248
[ 201.8139489] lookup_once() at netbsd:lookup_once+0x10ec sys/kern/vfs_lookup.c:1150
[ 201.9739556] namei_tryemulroot() at netbsd:namei_tryemulroot+0x3cfc namei_oneroot sys/kern/vfs_lookup.c:1546 [inline]
[ 201.9739556] namei_tryemulroot() at netbsd:namei_tryemulroot+0x3cfc sys/kern/vfs_lookup.c:1906
[ 202.1339482] namei() at netbsd:namei+0x289
[ 202.2939572] do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x48d fd_nameiat sys/kern/vfs_syscalls.c:245 [inline]
[ 202.2939572] do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x48d sys/kern/vfs_syscalls.c:2857
[ 202.4439472] sys___syscall() at netbsd:sys___syscall+0x2ae sy_call sys/sys/syscallvar.h:65 [inline]
[ 202.4439472] sys___syscall() at netbsd:sys___syscall+0x2ae sys/kern/sys_syscall.c:90
[ 202.6039489] syscall() at netbsd:syscall+0x576 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 202.6039489] syscall() at netbsd:syscall+0x576 sys/arch/x86/x86/syscall.c:137
[ 202.6439498] --- syscall (number 10 via SYS_syscall) ---
[ 202.6839500] netbsd:syscall+0x576:
[ 202.6955869] cpu0: End traceback...
[ 202.6955869] fatal breakpoint trap in supervisor mode
[ 202.7044810] trap type 1 code 0 rip 0xffffffff8023687d cs 0x8 rflags 0x282 cr2 0x7bb0f2229000 ilevel 0 rsp 0xffffbb80d0b93f40
[ 202.7160413] curlwp 0xffffbb8013505580 pid 3549.3435 lowest kstack 0xffffbb80d0b8d2c0
Stopped in pid 3549.3435 (syz-executor.1) at    netbsd:breakpoint+0x5:  leave
?
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0xc9d
panic() at netbsd:panic+0x1b3
__msan_warning() at netbsd:__msan_warning+0x11e kmsan_report_inline sys/kern/subr_msan.c:250 [inline]
__msan_warning() at netbsd:__msan_warning+0x11e sys/kern/subr_msan.c:631
umap_lookup() at netbsd:umap_lookup+0xebb
VOP_LOOKUP() at netbsd:VOP_LOOKUP+0x248
union_lookup1() at netbsd:union_lookup1+0x4cf sys/fs/union/union_vnops.c:279
union_lookup() at netbsd:union_lookup+0x579 sys/fs/union/union_vnops.c:371
VOP_LOOKUP() at netbsd:VOP_LOOKUP+0x248
lookup_once() at netbsd:lookup_once+0x10ec sys/kern/vfs_lookup.c:1150
namei_tryemulroot() at netbsd:namei_tryemulroot+0x3cfc namei_oneroot sys/kern/vfs_lookup.c:1546 [inline]
namei_tryemulroot() at netbsd:namei_tryemulroot+0x3cfc sys/kern/vfs_lookup.c:1906
namei() at netbsd:namei+0x289
do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x48d fd_nameiat sys/kern/vfs_syscalls.c:245 [inline]
do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x48d sys/kern/vfs_syscalls.c:2857
sys___syscall() at netbsd:sys___syscall+0x2ae sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x2ae sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x576 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x576 sys/arch/x86/x86/syscall.c:137
--- syscall (number 10 via SYS_syscall) ---
netbsd:syscall+0x576:
Panic string: MSan: Uninitialized Variable 'tdvp' From union_lookup1()

PID     LID S CPU     FLAGS       STRUCT LWP *               NAME WAIT
3295   3295 3   1     40000   ffffbb80135e3a00     syz-executor.2 vm_map
2251   2251 2   0     40000   ffffbb80138cabc0                 sh
3302   3669 3   0       180   ffffbb80137d0240     syz-executor.0 parked
3302   3132 2   0         0   ffffbb80135059c0     syz-executor.0
3302   3302 2   0  10040000   ffffbb80136151c0     syz-executor.0
3549   2922 3   1       180   ffffbb80138b2280     syz-executor.1 parked
3549   2380 3   0       180   ffffbb80137d0ac0     syz-executor.1 parked
3549 > 3435 7   0         0   ffffbb8013505580     syz-executor.1
3549   3549 2   0  10000000   ffffbb80138beb40     syz-executor.1
2112   2112 2   1     40000   ffffbb8013740640     syz-executor.3
3259   3259 3   1         0   ffffbb8013740a80     syz-executor.5 vm_map
2559   2559 3   1       180   ffffbb80138ca780     syz-executor.4 wait
3022   3022 2   1       140   ffffbb80138be2c0     syz-executor.0
2336   2336 2   1       140   ffffbb80135e3180     syz-executor.1
2646   2646 3   0       180   ffffbb80135e35c0     syz-executor.5 parked
2091   2091 3   1       180   ffffbb80138ca340     syz-executor.5 parked
1843   1843 3   1       180   ffffbb80137d0680     syz-executor.4 parked
1735   1735 3   0       180   ffffbb80138be700     syz-executor.1 parked
1226   1328 3   1    100000   ffffbb8013615a40         syz-fuzzer xclow
1226   1209 2   0    100100   ffffbb8013505140         syz-fuzzer
1226   1082 3   1    100000   ffffbb80134e2980         syz-fuzzer xclow
1226   1235 3   1    100000   ffffbb80134e2540         syz-fuzzer xclow
1226   1074 2   0    100100   ffffbb8012ce10c0         syz-fuzzer
1226    931 3   1         0   ffffbb8012c1e4c0         syz-fuzzer xclow
1226    930 3   1    100000   ffffbb8012c1e080         syz-fuzzer xclow
1226   1073 2   0    100140   ffffbb801230fb00         syz-fuzzer
1226   1226 2   0    100100   ffffbb801230f6c0         syz-fuzzer
1224   1224 2   0         0   ffffbb8012527b80               sshd
1233   1233 3   0       180   ffffbb8012527300              getty nanoslp
1229   1229 3   1       180   ffffbb8012275ac0              getty nanoslp
1086   1086 3   0       180   ffffbb801230f280              getty nanoslp
1231   1231 3   0       180   ffffbb80121d7200              getty ttyraw
1112   1112 3   0       180   ffffbb8012bed8c0               sshd select
941     941 3   1       180   ffffbb8012bed480             powerd kqueue
696     696 3   1       180   ffffbb8012bed040            syslogd kqueue
745     745 3   0       180   ffffbb801233f700             dhcpcd poll
558     558 3   1       180   ffffbb801233f2c0             dhcpcd poll
594     594 3   1       180   ffffbb8012558780             dhcpcd poll
604     604 3   1       180   ffffbb8012558bc0             dhcpcd poll
487     487 3   1       180   ffffbb8012558340             dhcpcd poll
488     488 3   1       180   ffffbb801233fb40             dhcpcd poll
292     292 3   1       180   ffffbb8012527740             dhcpcd poll
1         1 3   0       180   ffffbb8011e53100               init wait
0      2868 3   0       200   ffffbb8013740200             ktrace ktrwait
0       990 3   0       200   ffffbb80121d7640            physiod physiod
0       196 3   0       200   ffffbb8012275680          pooldrain pooldrain
0       195 2   0       240   ffffbb8012275240            ioflush
0       194 3   1       200   ffffbb80121d7a80           pgdaemon pgdaemon
0       167 3   0       200   ffffbb80121a7a40               usb7 usbevt
0       172 3   1       200   ffffbb80121a7600               usb6 usbevt
0       170 3   0       200   ffffbb80121a71c0               usb5 usbevt
0       168 3   0       200   ffffbb801211ba00               usb4 usbevt
0       166 3   1       200   ffffbb801211b5c0               usb3 usbevt
0       165 3   1       200   ffffbb801211b180               usb2 usbevt
0        31 3   0       200   ffffbb801206b9c0               usb1 usbevt
0        63 3   0       200   ffffbb801206b580               usb0 usbevt
0       126 3   0       200   ffffbb801206b140         usbtask-dr usbtsk
0       125 3   1       200   ffffbb8011e53980         usbtask-hc usbtsk
0       124 3   0       200   ffffbb80103d3b00          swwreboot swwreboot
0       123 3   1       200   ffffbb8011e53540             npfgc0 npfgcw
0       122 3   0       200   ffffbb8011e47940            rt_free rt_free
0       121 3   0       200   ffffbb8011e47500              unpgc unpgc
0       120 3   0       200   ffffbb8011e470c0    key_timehandler key_timehandler
0       119 3   1       200   ffffbb8011e41900    icmp6_wqinput/1 icmp6_wqinput
0       118 3   0       200   ffffbb8011e414c0    icmp6_wqinput/0 icmp6_wqinput
0    >  117 7   1       200   ffffbb8011e41080          nd6_timer
0       116 3   1       200   ffffbb8011cccbc0    carp6_wqinput/1 carp6_wqinput
0       115 3   0       200   ffffbb8011ccc780    carp6_wqinput/0 carp6_wqinput
0       114 3   1       200   ffffbb8011ccc340     carp_wqinput/1 carp_wqinput
0       113 3   0       200   ffffbb8011ccd8c0     carp_wqinput/0 carp_wqinput
0       112 3   1       200   ffffbb8011ccd480     icmp_wqinput/1 icmp_wqinput
0       111 3   0       200   ffffbb8011cc9b80     icmp_wqinput/0 icmp_wqinput
0       110 3   1       200   ffffbb8011cc9740           rt_timer rt_timer
0       109 3   0       200   ffffbb8011ccd040        vmem_rehash vmem_rehash
0       100 3   0       200   ffffbb8011cc9300          entbutler entropy
0        99 3   0       200   ffffbb80117c0b40              viomb balloon
0        98 3   1       200   ffffbb80117c0700      vioif0_txrx/1 vioif0_txrx
0        97 3   0       200   ffffbb80117c02c0      vioif0_txrx/0 vioif0_txrx
0        30 3   0       200   ffffbb80103d36c0           scsibus0 sccomp
0        29 3   0       200   ffffbb80103d3280               pms0 pmsreset
0        28 3   1       200   ffffbb80103baac0            xcall/1 xcall
0        27 1   1       200   ffffbb80103ba680          softser/1
0        26 3   1       200   ffffbb80103ba240          softclk/1 mutex
0        25 1   1       200   ffffbb80103b7a80          softbio/1
0        24 1   1       200   ffffbb80103b7640          softnet/1
0        23 1   1       201   ffffbb80103b7200             idle/1
0        22 3   0       200   ffffbb800f1d2a40           lnxsyswq lnxsyswq
0        21 3   0       200   ffffbb800f1d2600           lnxubdwq lnxubdwq
0        20 3   0       200   ffffbb800f1d21c0           lnxpwrwq lnxpwrwq
0        19 3   0       200   ffffbb800f1d1a00           lnxlngwq lnxlngwq
0        18 3   0       200   ffffbb800f1d15c0           lnxhipwq lnxhipwq
0        17 3   0       200   ffffbb800f1d1180           lnxrcugc lnxrcugc
0        16 3   0       200   ffffbb800f1ca9c0             sysmon smtaskq
0        15 3   0       200   ffffbb800f1ca580         pmfsuspend pmfsuspend
0        14 3   0       200   ffffbb800f1ca140           pmfevent pmfevent
0        13 3   0       200   ffffbb800f1c8980         sopendfree sopendfr
0        12 3   0       200   ffffbb800f1c8540             ifwdog ifwdog
0        11 3   1       200   ffffbb800f1c8100            iflnkst iflnkst
0        10 3   0       200   ffffbb800f1be940           nfssilly nfssilly
0         9 3   0       200   ffffbb800f1be500           pooldisp pooldisp
0         8 3   1       200   ffffbb800f1be0c0          modunload mod_unld
0         7 2   0       200   ffffbb800ebc9900            xcall/0
0         6 1   0       200   ffffbb800ebc94c0          softser/0
0         5 3   0       200   ffffbb800ebc9080          softclk/0 mutex
0         4 1   0       200   ffffbb800ebc88c0          softbio/0
0         3 1   0       200   ffffbb800ebc8480          softnet/0
0         2 1   0       201   ffffbb800ebc8040             idle/0
0         0 3   0       200   ffffffff86a6f9c0            swapper uvm
[Locks tracked through LWPs]

****** LWP 3295.3295 (syz-executor.2) @ 0xffffbb80135e3a00, l_stat=3

*** Locks held:

* Lock 0 (initialized at netbsd:vcache_alloc+0xc6 sys/kern/vfs_vnode.c:1438)
lock address : ffffbb8013abcf80
type         : sleep/adaptive
initialized  : netbsd:vcache_alloc+0xc6
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffbb80135e3a00 last held: 0xffffbb80135e3a00
last locked* : netbsd:genfs_lock+0x1d6
unlocked     : netbsd:genfs_unlock+0x55
owner/count  : 000000000000000000 flags    : 000000000000000000
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at netbsd:vcache_alloc+0xc6 sys/kern/vfs_vnode.c:1438)
lock address : ffffbb8013b9bb00
type         : sleep/adaptive
initialized  : netbsd:vcache_alloc+0xc6
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffbb80135e3a00 last held: 0xffffbb80135e3a00
last locked* : netbsd:genfs_lock+0x1d6
unlocked     : 0
owner/count  : 000000000000000000 flags    : 000000000000000000
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 2251.2251 (sh) @ 0xffffbb80138cabc0, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:pmap_ctor+0xc0 sys/arch/x86/x86/pmap.c:2872)
lock address : ffffbb8012c1aa80
type         : sleep/adaptive
initialized  : netbsd:pmap_ctor+0xc0
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  1
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffbb80138cabc0 last held: 000000000000000000
last locked  : netbsd:pmap_enter_ma+0x11ce
unlocked*    : netbsd:pmap_enter_ma+0x6f3f
owner field  : 0xffffbb80138cabc0 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 3302.3132 (syz-executor.0) @ 0xffffbb80135059c0, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffbb80135059c0 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 3549.3435 (syz-executor.1) @ 0xffffbb8013505580, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:vcache_alloc+0xc6 sys/kern/vfs_vnode.c:1438)
lock address : ffffbb8013abcd40
type         : sleep/adaptive
initialized  : netbsd:vcache_alloc+0xc6
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffbb8013505580 last held: 0xffffbb8013505580
last locked* : netbsd:genfs_lock+0x1d6
unlocked     : netbsd:genfs_unlock+0x55
owner/count  : 0xffffbb8013505580 flags    : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 2112.2112 (syz-executor.3) @ 0xffffbb8013740640, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:kcov_open+0x10d sys/kern/subr_kcov.c:461)
lock address : ffffbb80139ea940
type         : sleep/adaptive
initialized  : netbsd:kcov_open+0x10d
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffbb8013740640 last held: 0xffffbb8013740640
last locked* : netbsd:kcov_fops_ioctl+0xa0
unlocked     : 0
owner field  : 0xffffbb8013740640 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at netbsd:uvm_obj_init+0x88 sys/uvm/uvm_object.c:70)
lock address : ffffbb8013ab2300
type         : sleep/adaptive
initialized  : netbsd:uvm_obj_init+0x88
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffbb8013740640 last held: 0xffffbb8013740640
last locked* : netbsd:uvm_fault_internal+0x4caf
unlocked     : netbsd:uvm_fault_lower_enter+0x1b49
owner/count  : 0xffffbb8013740640 flags    : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 3259.3259 (syz-executor.5) @ 0xffffbb8013740a80, l_stat=3

*** Locks held:

* Lock 0 (initialized at netbsd:kcov_open+0x10d sys/kern/subr_kcov.c:461)
lock address : ffffbb8013b9fd80
type         : sleep/adaptive
initialized  : netbsd:kcov_open+0x10d
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffbb8013740a80 last held: 0xffffbb8013740a80
last locked* : netbsd:kcov_fops_ioctl+0xa0
unlocked     : 0
owner field  : 0xffffbb8013740a80 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 558.558 (dhcpcd) @ 0xffffbb801233f2c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  0
relevant lwp : 0xffffbb801233f2c0 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 594.594 (dhcpcd) @ 0xffffbb8012558780, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  0
relevant lwp : 0xffffbb8012558780 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 488.488 (dhcpcd) @ 0xffffbb801233fb40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  0
relevant lwp : 0xffffbb801233fb40 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 292.292 (dhcpcd) @ 0xffffbb8012527740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  0
relevant lwp : 0xffffbb8012527740 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.26 (softclk/1) @ 0xffffbb80103ba240, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  0
relevant lwp : 0xffffbb80103ba240 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffbb800f1c8100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  0
relevant lwp : 0xffffbb800f1c8100 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffbb800ebc9080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffbb800ebc9080 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff86a6f9c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type         : sleep/adaptive
initialized  : netbsd:module_hook_init+0x43
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffffff86a6f9c0 last held: 000000000000000000
last locked  : 0
unlocked*    : 0
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at netbsd:main+0x362 sys/kern/init_main.c:304)
lock address : netbsd:kernel_lock
type         : spin
initialized  : netbsd:main+0x362
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffbb8013505580 last held: 0xffffbb8013505580
last locked* : netbsd:VOP_LOOKUP+0x16f
unlocked     : netbsd:VOP_LOCK+0x7de
curcpu holds :                  2 wanted by: 000000000000000000

* Lock 1 (initialized at netbsd:kprintf_init+0xcb sys/kern/subr_prf.c:156)
lock address : netbsd:kprintf_mtx
type         : spin
initialized  : netbsd:kprintf_init+0xcb
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffbb8013505580 last held: 0xffffbb8013505580
last locked* : netbsd:vpanic+0x624
unlocked     : netbsd:log+0x618
owner field  : 0x0000000000000800 wait/spin:                0/1

              PAGE FLAG   PQ            UOBJECT              UANON
0xffffbb8000017180 0001 00000000                0x0                0x0
0xffffbb8000017200 0041 00000000                0x0                0x0
0xffffbb8000017280 0041 00000000                0x0                0x0
0xffffbb8000017300 0041 00000000                0x0                0x0
0xffffbb8000017380 0041 00000000                0x0                0x0
0xffffbb8000017400 0041 00000000                0x0                0x0
0xffffbb8000017480 0041 00000000                0x0                0x0
0xffffbb8000017500 0041 00000000                0x0                0x0
0xffffbb8000017580 0041 00000000                0x0                0x0
0xffffbb8000017600 0041 00000000                0x0                0x0
0xffffbb8000017680 0041 00000000                0x0                0x0
0xffffbb8000017700 0041 00000000                0x0                0x0
0xffffbb8000017780 0041 00000000                0x0                0x0
0xffffbb8000017800 0041 00000000                0x0                0x0
0xffffbb8000017880 0041 00000000                0x0                0x0
0xffffbb8000017900 0041 00000000                0x0                0x0
0xffffbb8000017980 0041 00000000                0x0                0x0
0xffffbb8000017a00 0041 00000000                0x0                0x0
0xffffbb8000017a80 0041 00000000                0x0                0x0
0xffffbb8000017b00 0041 00000000                0x0                0x0
0xffffbb8000017b80 0041 00000000                0x0                0x0
0xffffbb8000017c00 0041 00000000                0x0                0x0
0xffffbb8000017c80 0041 00000000                0x0                0x0
0xffffbb8000017d00 0041 00000000                0x0                0x0
0xffffbb8000017d80 0041 00000000                0x0                0x0
0xffffbb8000017e00 0041 00000000                0x0                0x0
0xffffbb8000017e80 0041 00000000                0x0                0x0
0xffffbb8000017f00 0041 00000000                0x0                0x0
0xffffbb8000017f80 0041 00000000                0x0                0x0
0xffffbb8000018000 0041 00000000                0x0                0x0
0xffffbb8000018080 0041 00000000                0x0                0x0
0xffffbb8000018100 0041 00000000                0x0                0x0
0xffffbb8000018180 0041 00000000                0x0                0x0
0xffffbb8000018200 0041 00000000                0x0                0x0
0xffffbb8000018280 0041 00000000                0x0                0x0
0xffffbb8000018300 0041 00000000                0x0                0x0
0xffffbb8000018380 0041 00000000                0x0                0x0
0xffffbb8000018400 0041 00000000                0x0                0x0
0xffffbb8000018480 0041 00000000                0x0                0x0
0xffffbb8000018500 0041 00000000                0x0                0x0
0xffffbb8000018580 0041 00000000                0x0                0x0
0xffffbb8000018600 0041 00000000                0x0                0x0
0xffffbb8000018680 0041 00000000                0x0                0x0
0xffffbb8000018700 0041 00000000                0x0                0x0
0xffffbb8000018780 0041 00000000                0x0                0x0
0xffffbb8000018800 0041 00000000                0x0                0x0
0xffffbb8000018880 0041 00000000                0x0                0x0
0xffffbb8000018900 0041 00000000                0x0                0x0
0xffffbb8000018980 0041 00000000                0x0                0x0
0xffffbb8000018a00 0041 00000000                0x0                0x0
0xffffbb8000018a80 0041 00000000                0x0                0x0
0xffffbb8000018b00 0041 00000000                0x0                0x0
0xffffbb8000018b80 0041 00000000                0x0                0x0
0xffffbb8000018c00 0041 00000000                0x0                0x0
0xffffbb8000018c80 0041 00000000                0x0                0x0
0xffffbb8000018d00 0041 00000000                0x0                0x0
0xffffbb8000018d80 0041 00000000                0x0                0x0
0xffffbb8000018e00 0041 00000000                0x0                0x0
0xffffbb8000018e80 0041 00000000                0x0                0x0
0xffffbb8000018f00 0041 00000000                0x0                0x0
0xffffbb8000018f80 0041 00000000                0x0                0x0
0xffffbb8000019000 0041 00000000                0x0                0x0
0xffffbb8000019080 0041 00000000                0x0                0x0
0xffffbb8000019100 0041 00000000                0x0                0x0
0xffffbb8000019180 0041 00000000                0x0                0x0
0xffffbb8000019200 0041 00000000                0x0                0x0
0xffffbb8000019280 0041 00000000                0x0                0x0
0xffffbb8000019300 0041 00000000                0x0                0x0
0xffffbb8000019380 0041 00000000                0x0                0x0
0xffffbb8000019400 0041 00000000                0x0                0x0
0xffffbb8000019480 0041 00000000                0x0                0x0
0xffffbb8000019500 0041 00000000                0x0                0x0
0xffffbb8000019580 0041 00000000                0x0                0x0
0xffffbb8000019600 0041 00000000                0x0                0x0
0xffffbb8000019680 0041 00000000                0x0                0x0
0xffffbb8000019700 0041 00000000                0x0                0x0
0xffffbb8000019780 0041 00000000                0x0                0x0
0xffffbb8000019800 0041 00000000                0x0                0x0
0xffffbb8000019880 0041 00000000                0x0                0x0
0xffffbb8000019900 0041 00000000                0x0                0x0
0xffffbb8000019980 0041 00000000                0x0                0x0
0xffffbb8000019a00 0041 00000000                0x0                0x0
0xffffbb8000019a80 0041 00000000                0x0                0x0
0xffffbb8000019b00 0041 00000000                0x0                0x0
0xffffbb8000019b80 0041 00000000                0x0                0x0
0xffffbb8000019c00 0041 00000000                0x0                0x0
0xffffbb8000019c80 0041 00000000                0x0                0x0
0xffffbb8000019d00 0041 00000000                0x0                0x0
0xffffbb8000019d80 0041 00000000                0x0                0x0
0xffffbb8000019e00 0041 00000000                0x0                0x0
0xffffbb8000019e80 0041 00000000                0x0                0x0
0xffffbb8000019f00 0041 00000000                0x0                0x0
0xffffbb8000019f80 0041 00000000                0x0                0x0
0xffffbb800001a000 0041 00000000                0x0                0x0
0xffffbb800001a080 0041 00000000                0x0                0x0
0xffffbb800001a100 0041 00000000                0x0                0x0
0xffffbb800001a180 0041 00000000                0x0                0x0
0xffffbb800001a200 0041 00000000                0x0                0x0
0xffffbb800001a280 0041 00000000                0x0                0x0
0xffffbb800001a300 0041 00000000                0x0                0x0
0xffffbb800001a380 0041 00000000                0x0                0x0
0xffffbb800001a400 0041 00000000                0x0                0x0
0xffffbb800001a480 0041 00000000                0x0                0x0
0xffffbb800001a500 0041 00000000                0x0                0x0
0xffffbb800001a580 0041 00000000                0x0                0x0
0xffffbb800001a600 0041 00000000                0x0                0x0
0xffffbb800001a680 0041 00000000                0x0                0x0
0xffffbb800001a700 0041 00000000                0x0                0x0
0xffffbb800001a780 0041 00000000                0x0                0x0
0xffffbb800001a800 0041 00000000                0x0                0x0
0xffffbb800001a880 0041 00000000                0x0                0x0
0xffffbb800001a900 0041 00000000                0x0                0x0
0xffffbb800001a980 0041 00000000                0x0                0x0
0xffffbb800001aa00 0041 00000000                0x0                0x0
0xffffbb800001aa80 0041 00000000                0x0                0x0
0xffffbb800001ab00 0041 00000000                0x0                0x0
0xffffbb800001ab80 0041 00000000                0x0                0x0
0xffffbb800001ac00 0041 00000000                0x0                0x0
0xffffbb800001ac80 0041 00000000                0x0                0x0
0xffffbb800001ad00 0041 00000000                0x0                0x0
0xffffbb800001ad80 0041 00000000                0x0                0x0
0xffffbb800001ae00 0041 00000000                0x0                0x0
0xffffbb800001ae80 0041 00000000                0x0                0x0
0xffffbb800001af00 0041 00000000                0x0                0x0
0xffffbb800001af80 0041 00000000                0x0                0x0
0xffffbb800001b000 0041 00000000                0x0                0x0
0xffffbb800001b080 0041 00000000                0x0                0x0
0xffffbb800001b100 0041 00000000                0x0                0x0
0xffffbb800001b180 0041 00000000                0x0                0x0
0xffffbb800001b200 0041 00000000                0x0                0x0
0xffffbb800001b280 0041 00000000                0x0                0x0
0xffffbb800001b300 0041 00000000                0x0                0x0
0xffffbb800001b380 0041 00000000                0x0                0x0
0xffffbb800001b400 0041 00000000                0x0                0x0
0xffffbb800001b480 0041 00000000                0x0                0x0
0xffffbb800001b500 0041 00000000                0x0                0x0
0xffffbb800001b580 0041 00000000                0x0                0x0
0xffffbb800001b600 0041 00000000                0x0                0x0
0xffffbb800001b680 0041 00000000                0x0                0x0
0xffffbb800001b700 0041 00000000                0x0                0x0
0xffffbb800001b780 0041 00000000                0x0                0x0
0xffffbb800001b800 0041 00000000                0x0                0x0
0xffffbb800001b880 0041 00000000                0x0                0x0
0xffffbb800001b900 0041 00000000                0x0                0x0
0xffffbb800001b980 0041 00000000                0x0                0x0
0xffffbb800001ba00 0041 00000000                0x0                0x0
0xffffbb800001ba80 0041 00000000                0x0                0x0
0xffffbb800001bb00 0041 00000000                0x0                0x0
0xffffbb800001bb80 0041 00000000                0x0                0x0
0xffffbb800001bc00 0041 00000000                0x0                0x0
0xffffbb800001bc80 0041 00000000                0x0                0x0
0xffffbb800001bd00 0041 00000000                0x0                0x0
0xffffbb800001bd80 0041 00000000                0x0                0x0
0xffffbb800001be00 0041 00000000                0x0                0x0
0xffffbb800001be80 0041 00000000                0x0                0x0
0xffffbb800001bf00 0041 00000000                0x0                0x0
0xffffbb800001bf80 0041 00000000                0x0                0x0
0xffffbb800001c000 0041 00000000                0x0                0x0
0xffffbb800001c080 0041 00000000                0x0                0x0
0xffffbb800001c100 0041 00000000                0x0                0x0
0xffffbb800001c180 0041 00000000                0x0                0x0
0xffffbb800001c200 0041 00000000                0x0                0x0
0xffffbb800001c280 0041 00000000                0x0                0x0
0xffffbb800001c300 0041 00000000                0x0                0x0
0xffffbb800001c380 0041 00000000                0x0                0x0
0xffffbb800001c400 0041 00000000                0x0                0x0
0xffffbb800001c480 0041 00000000                0x0                0x0
0xffffbb800001c500 0041 00000000                0x0                0x0
0xffffbb800001c580 0041 00000000                0x0                0x0
0xffffbb800001c600 0041 00000000                0x0                0x0
0xffffbb800001c680 0041 00000000                0x0                0x0
0xffffbb800001c700 0041 00000000                0x0                0x0
0xffffbb800001c780 0041 00000000                0x0                0x0
0xffffbb800001c800 0041 00000000                0x0                0x0
0xffffbb800001c880 0041 00000000                0x0                0x0
0xffffbb800001c900 0041 00000000                0x0                0x0
0xffffbb800001c980 0041 00000000                0x0                0x0
0xffffbb800001ca00 0041 00000000                0x0                0x0
0xffffbb800001ca80 0041 00000000                0x0                0x0
0xffffbb800001cb00 0041 00000000                0x0                0x0
0xffffbb800001cb80 0041 00000000                0x0                0x0
0xffffbb800001cc00 0041 00000000                0x0                0x0
0xffffbb800001cc80 0041 00000000                0x0                0x0
0xffffbb800001cd00 0041 00000000                0x0                0x0
0xffffbb800001cd80 0041 00000000                0x0                0x0
0xffffbb800001ce00 0041 00000000                0x0                0x0
0xffffbb800001ce80 0041 00000000                0x0                0x0
0xffffbb800001cf00 0041 00000000                0x0                0x0
0xffffbb800001cf80 0001 00000000                0x0                0x0
0xffffbb800001d000 0001 00000000                0x0                0x0
0xffffbb800001d080 0001 00000000                0x0                0x0
0xffffbb800001d100 0001 00000000                0x0                0x0
0xffffbb800001d180 0001 00000000                0x0                0x0
0xffffbb800001d200 0001 00000000                0x0                0x0
0xffffbb800001d280 0001 00000000                0x0                0x0
0xffffbb800001d300 0001 00000000                0x0                0x0
0xffffbb800001d380 0001 00000000                0x0                0x0
0xffffbb800001d400 0001 00000000                0x0                0x0
0xffffbb800001d480 0001 00000000                0x0                0x0
0xffffbb800001d500 0001 00000000                0x0                0x0
0xffffbb800001d580 0001 00000000                0x0                0x0
0xffffbb800001d600 0001 00000000                0x0                0x0
0xffffbb800001d680 0001 00000000                0x0                0x0
0xffffbb800001d700 0001 00000000                0x0                0x0
0xffffbb800001d780 0001 00000000                0x0                0x0

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/07 21:46 netbsd e5717105ade4 82c05ab8 .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kmsan MSan: Uninitialized Memory in umap_lookup
2024/06/04 10:11 netbsd 791da06dc8a6 a1feae05 .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kmsan MSan: Uninitialized Memory in umap_lookup
2024/06/01 10:04 netbsd 942f91362868 3113787f .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kmsan MSan: Uninitialized Memory in umap_lookup
2024/05/29 19:05 netbsd c5ebb1a017a5 34889ee3 .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kmsan MSan: Uninitialized Memory in umap_lookup
2024/05/29 18:35 netbsd c5ebb1a017a5 34889ee3 .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kmsan MSan: Uninitialized Memory in umap_lookup
2024/05/25 03:30 netbsd c4cfd333d39f a10a183e .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kmsan MSan: Uninitialized Memory in umap_lookup
2024/05/17 13:16 netbsd af39a497002a a12e99e7 .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kmsan MSan: Uninitialized Memory in umap_lookup
2024/05/15 19:28 netbsd 906e271cb392 94b087b1 .config console log report [disk image] [netbsd.gdb] ci2-netbsd-kmsan MSan: Uninitialized Memory in umap_lookup
* Struck through repros no longer work on HEAD.