uvm_fault(0xffffef806ce28d88, 0x204, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at ufsdirhash_add+0x1b3: movl 0(%r15,%rax,4),%r12d
TID PID UID PRFLAGS PFLAGS CPU COMMAND
507421 37979 32767 0x10 0 1 syz-executor
*453331 86612 0 0x2 0 0K syz-executor
ufsdirhash_add(ffffef8076020038,ffff80003c3f7630,9dc) at ufsdirhash_add+0x1b3 sys/ufs/ufs/ufs_dirhash.c:622
ufs_direnter(ffffef80701a02b0,ffffef8077fcbbd8,ffff80003c3f7630,ffff80003c3f7960,ffffef8073529dd8) at ufs_direnter+0x6c8 sys/ufs/ufs/ufs_lookup.c:823
ufs_mkdir(ffff80003c3f77d0) at ufs_mkdir+0x5d5 sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(ffffef80701a02b0,ffff80003c3f7930,ffff80003c3f7960,ffff80003c3f7860) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff80003c4262c8,ffffff9c,7dc6bc4b4e90,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063
syscall(ffff80003c3f7ae0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3f7ae0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7dc6bc4b4e50, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xffffef806ce28d88, 0x204, 0, 1) -> e
ddb{0}> show kasan
No such command
ddb{0}> trace
ufsdirhash_add(ffffef8076020038,ffff80003c3f7630,9dc) at ufsdirhash_add+0x1b3 sys/ufs/ufs/ufs_dirhash.c:622
ufs_direnter(ffffef80701a02b0,ffffef8077fcbbd8,ffff80003c3f7630,ffff80003c3f7960,ffffef8073529dd8) at ufs_direnter+0x6c8 sys/ufs/ufs/ufs_lookup.c:823
ufs_mkdir(ffff80003c3f77d0) at ufs_mkdir+0x5d5 sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(ffffef80701a02b0,ffff80003c3f7930,ffff80003c3f7960,ffff80003c3f7860) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff80003c4262c8,ffffff9c,7dc6bc4b4e90,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063
syscall(ffff80003c3f7ae0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3f7ae0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7dc6bc4b4e50, count: -7
ddb{0}> show registers
rdi 0xffff80003c3f7450
rsi 0x200
rbp 0xffff80003c3f7570
rbx 0x81
rdx 0x81
rcx 0xffff80000168f330
rax 0x81
r8 0x30
r9 0
r10 0xd6111b31e862c4
r11 0x332460261a466316
r12 0x5d
r13 0
r14 0x81
r15 0
rip 0xffffffff816c3923 ufsdirhash_add+0x1b3
cs 0x8
rflags 0x10247 __ALIGN_SIZE+0xf247
rsp 0xffff80003c3f74f0
ss 0x10
ufsdirhash_add+0x1b3: movl 0(%r15,%rax,4),%r12d
ddb{0}> show proc
PROC (syz-executor) tid=453331 pid=86612 tcnt=1 stat=onproc
flags process=2<EXEC> proc=0
runpri=17, usrpri=50, slppri=17, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045fe6020,0xffff80003c426aa0
process=0xffff800045feb9d8 user=0xffff80003c3f2000, vmspace=0xffffef806ce28d88
estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
50261 382743 33055 32767 2 0x10 0 syz-executor
37979 507421 63886 32767 7 0x10 0 syz-executor
37979 379556 63886 32767 2 0x10 0x4000000 syz-executor
46167 370617 10770 32767 2 0x10 0 syz-executor
46167 81074 10770 32767 2 0x10 0x4000000 syz-executor
*86612 453331 66474 0 7 0x2 0 syz-executor
70742 140346 66474 0 3 0x2 0x80 wait syz-executor
10770 280943 91275 32767 3 0x10 0x80 nanoslp syz-executor
91275 329866 66474 0 3 0x2 0x80 wait syz-executor
33055 239419 3953 32767 3 0x10 0x80 nanoslp syz-executor
3953 365830 66474 0 3 0x2 0x80 wait syz-executor
36975 142526 24178 32767 3 0x10 0x80 piperd syz-executor
24178 154103 66474 0 3 0x2 0x80 wait syz-executor
63175 110617 66474 0 3 0x2 0x80 wait syz-executor
63886 190782 91062 32767 3 0x10 0x80 nanoslp syz-executor
91062 437933 66474 0 3 0x2 0x80 wait syz-executor
66474 163289 84476 0 3 0x2 0x80 nanoslp syz-executor
84476 442407 92528 0 3 0x100002 0x88 sigsusp ksh
92528 397891 18495 0 3 0x10 0x88 kqread sshd-session
18495 76993 82355 0 3 0x12 0x80 kqread sshd-session
62020 246196 1 0 3 0x100003 0x80 ttyin getty
82355 240851 1 0 3 0 0x88 kqread sshd
91135 419021 31843 73 3 0x1100010 0x80 kqread syslogd
31843 264399 1 0 3 0x100002 0x80 sbwait syslogd
56501 370537 1 0 3 0x100000 0x80 kqread resolvd
30377 263045 75408 77 3 0x100012 0x80 kqread dhcpleased
53950 429157 75408 77 3 0x100012 0x80 kqread dhcpleased
75408 30731 1 0 3 0 0x80 kqread dhcpleased
44558 118392 0 0 3 0x14000 0x200 bored smr
61378 81085 0 0 2 0x14000 0x200 zerothread
58874 503710 0 0 3 0x14000 0x200 aiodoned aiodoned
26435 386547 0 0 3 0x14000 0x200 syncer update
15630 245967 0 0 3 0x14000 0x200 cleaner cleaner
31663 195204 0 0 3 0x14000 0x200 reaper reaper
53808 475318 0 0 3 0x14000 0x200 pgdaemon pagedaemon
28629 306555 0 0 3 0x14000 0x200 bored viomb
97219 261651 0 0 3 0x14000 0x40000200 acpi0 acpi0
22466 272708 0 0 3 0x14000 0x40000200 idle1
68206 492376 0 0 3 0x14000 0x200 bored softnet1
27166 292514 0 0 3 0x14000 0x200 bored softnet0
789 319209 0 0 3 0x14000 0x200 bored systqmp
9203 217127 0 0 3 0x14000 0x200 bored systq
96131 40941 0 0 3 0x14000 0x200 tmoslp softclockmp
62510 389564 0 0 3 0x14000 0x40000200 tmoslp softclock
2518 58175 0 0 3 0x14000 0x40000200 idle0
1 99595 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 86612 (syz-executor) thread 0xffff80003c4262c8 (453331)
exclusive rwlock dirhash r = 0 (0xffff80000168e818)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2 ufsdirhash_add+0x55 sys/ufs/ufs/ufs_dirhash.c:602
#3 ufs_direnter+0x6c8 sys/ufs/ufs/ufs_lookup.c:823
#4 ufs_mkdir+0x5d5 sys/ufs/ufs/ufs_vnops.c:1179
#5 VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
#6 domkdirat+0x179 sys/kern/vfs_syscalls.c:3063
#7 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#7 syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#8 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a45f80)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
#2 sleep_finish+0x2d8 sys/kern/kern_synch.c:369
#3 biowait+0xc6 sys/kern/vfs_bio.c:1110
#4 bwrite+0x359 sys/kern/vfs_bio.c:625
#5 VOP_BWRITE+0x60 sys/kern/vfs_vops.c:648
#6 ufs_mkdir+0x547 sys/ufs/ufs/ufs_vnops.c:1160
#7 VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
#8 domkdirat+0x179 sys/kern/vfs_syscalls.c:3063
#9 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#9 syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#10 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffffef806d60a5b0)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4 ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4 ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:150
#5 ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232
#6 ffs_inode_alloc+0x279 sys/ufs/ffs/ffs_alloc.c:393
#7 ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112
#8 VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
#9 domkdirat+0x179 sys/kern/vfs_syscalls.c:3063
#10 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffffef80760200d8)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5 vfs_lookup+0x12b sys/kern/vfs_lookup.c:431
#6 namei+0x7c5 sys/kern/vfs_lookup.c:250
#7 domkdirat+0x8b sys/kern/vfs_syscalls.c:3048
#8 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8 syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#9 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11051 12014K 12034K 166960K 12268 0
pcb 17 12K 12K 166960K 17 0
rtable 193 5K 7K 166960K 1607 0
pf 27 16K 16K 166960K 111 0
ifaddr 34 6K 8K 166960K 208 0
ifgroup 42 1K 2K 166960K 210 0
sysctl 1 1K 9K 166960K 6 0
counters 66 36K 37K 166960K 150 0
ioctlops 0 0K 4K 166960K 80 0
iov 0 0K 4K 166960K 15 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1287 81K 81K 166960K 2044 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 9 0
VM map 2 1K 1K 166960K 2 0
sem 27 2K 2K 166960K 89 0
dirhash 15 2K 2K 166960K 15 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 18 62K 129K 166960K 1246 0
sigio 0 0K 0K 166960K 3 0
proc 58 99K 163K 166960K 1659 0
subproc 54 3K 4K 166960K 738 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 81 0
in_multi 77 5K 6K 166960K 550 0
ether_multi 1 0K 0K 166960K 1 0
mrt 1 0K 0K 166960K 17 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 103 466K 466K 166960K 103 0
exec 0 0K 1K 166960K 968 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 180 142K 211K 166960K 10046 0
UVM aobj 78 3K 3K 166960K 79 0
pinsyscall 39 78K 114K 166960K 3468 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 21 0
NDP 12 0K 2K 166960K 147 0
temp 35 9123K 9139K 166960K 10705 0
kqueue 13 20K 29K 166960K 113 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 157 0 154 1 0 1 1 0 8 0
rtentry 176 552 0 464 6 0 6 6 0 8 2
unpcb 144 430 0 415 6 0 6 6 0 8 5
syncache 336 13 0 13 1 0 1 1 0 8 1
tcpqe 32 3 0 3 1 0 1 1 0 8 1
tcpcb 736 364 0 358 7 1 6 7 0 8 5
arp 136 98 0 84 1 0 1 1 0 8 0
ipq 40 3 0 0 1 0 1 1 0 8 0
ipqe 40 5 0 1 1 0 1 1 0 8 0
inpcb 328 1090 0 1081 18 9 9 15 0 8 7
ip6q 80 8 0 4 1 0 1 1 0 8 0
ip6af 40 12 0 9 1 0 1 1 0 8 0
nd6 152 145 0 127 1 0 1 1 0 8 0
kcovpl 48 82 0 76 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 2237 0 1866 36 10 26 32 0 8 0
art_table 40 2238 0 1866 6 0 6 6 0 8 1
art_node 32 552 0 472 1 0 1 1 0 8 0
sysvmsgpl 40 11 0 9 1 0 1 1 0 8 0
semupl 112 3 0 3 1 0 1 1 0 8 1
semapl 72 87 0 62 1 0 1 1 0 8 0
shmpl 112 76 0 1 3 0 3 3 0 8 0
dirhash 1024 19 0 0 3 0 3 3 0 8 0
dino2pl 256 2094 0 501 100 0 100 100 0 8 0
ffsino 296 2094 0 501 123 0 123 123 0 8 0
nchpl 144 2745 0 908 69 0 69 69 0 8 0
vnodes 216 2841 0 0 158 0 158 158 0 8 0
namei 1024 13082 0 13081 2 1 1 2 0 8 0
percpumem 16 91 0 42 1 0 1 1 0 8 0
kstatmem 264 105 0 84 2 0 2 2 0 8 0
scxspl 216 9495 0 9495 10 7 3 8 1 8 3
plimitpl 152 321 0 300 2 0 2 2 0 8 0
sigapl 424 1413 0 1367 7 0 7 7 0 8 0
knotepl 120 312 0 0 10 0 10 10 0 8 0
kqueuepl 224 165 0 156 4 1 3 3 0 8 2
pipepl 344 421 0 394 6 2 4 6 0 8 0
fdescpl 528 1397 0 1367 4 1 3 4 0 8 0
filepl 160 6228 0 6045 17 2 15 16 0 8 4
lockfpl 104 115 0 113 1 0 1 1 0 8 0
lockfspl 48 42 0 40 1 0 1 1 0 8 0
sessionpl 144 133 0 119 1 0 1 1 0 8 0
pgrppl 48 223 0 202 1 0 1 1 0 8 0
ucredpl 104 854 0 837 1 0 1 1 0 8 0
zombiepl 144 1369 0 1367 1 0 1 1 0 8 0
processpl 1232 1413 0 1367 5 0 5 5 0 8 0
procpl 664 2058 0 2010 7 0 7 7 0 8 1
sosppl 176 3 0 3 1 1 0 1 0 8 0
sockpl 752 1682 0 1655 30 13 17 20 0 8 13
mcl64k 65536 4 0 0 1 0 1 1 0 8 0
mcl16k 16384 3 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 131 0 0 17 0 17 17 0 8 0
mcl2k 2048 71 0 0 9 0 9 9 0 8 0
mextrefs 64 22 0 0 1 0 1 1 0 8 0
mtagpl 96 2 0 0 1 0 1 1 0 8 0
mbufpl 256 318 0 0 20 0 20 20 0 8 0
bufpl 272 2923 0 104 188 0 188 188 0 8 0
anonpl 32 7457 0 0 61 0 61 61 0 247 0
amapchunkpl 152 30044 0 29697 37 0 37 37 0 158 20
amappl16 200 2207 0 2193 17 8 9 14 0 8 8
amappl15 192 69 0 69 1 1 0 1 0 8 0
amappl14 184 894 0 893 1 0 1 1 0 8 0
amappl13 176 217 0 207 1 0 1 1 0 8 0
amappl12 168 1796 0 1769 2 0 2 2 0 8 0
amappl11 160 6 0 6 2 2 0 1 0 8 0
amappl10 152 79 0 69 1 0 1 1 0 8 0
amappl9 144 280 0 280 1 1 0 1 0 8 0
amappl8 136 251 0 250 1 0 1 1 0 8 0
amappl7 128 233 0 222 1 0 1 1 0 8 0
amappl6 120 552 0 549 1 0 1 1 0 8 0
amappl5 112 115 0 107 1 0 1 1 0 8 0
amappl4 104 426 0 410 1 0 1 1 0 8 0
amappl3 96 5204 0 5138 5 1 4 4 0 8 1
amappl2 88 1462 0 1393 3 0 3 3 0 8 0
amappl1 80 20623 0 20086 19 0 19 19 0 8 4
amappl 88 8476 0 8357 5 0 5 5 0 92 1
uvmvnodes 80 108 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 78 0 1 2 0 2 2 0 8 0
uaddrrnd 24 1397 0 1367 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1397 0 1367 1 0 1 1 0 8 0
vmmpekpl 168 14316 0 14255 4 0 4 4 0 8 0
vmmpepl 168 100872 0 99204 110 0 110 110 0 357 30
vmsppl 488 1396 0 1367 7 1 6 6 0 8 1
rwobjpl 80 30833 0 29906 30 0 30 30 0 8 5
pdppl 4096 2801 0 2734 135 58 77 99 0 8 10
pvpl 32 15034 0 0 123 1 122 122 0 265 0
pmappl 256 1396 0 1367 4 1 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 529 0 73 14 0 14 14 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
ufsdirhash_add(ffffef8076020038,ffff80003c3f7630,9dc) at ufsdirhash_add+0x1b3 sys/ufs/ufs/ufs_dirhash.c:622
ufs_direnter(ffffef80701a02b0,ffffef8077fcbbd8,ffff80003c3f7630,ffff80003c3f7960,ffffef8073529dd8) at ufs_direnter+0x6c8 sys/ufs/ufs/ufs_lookup.c:823
ufs_mkdir(ffff80003c3f77d0) at ufs_mkdir+0x5d5 sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(ffffef80701a02b0,ffff80003c3f7930,ffff80003c3f7960,ffff80003c3f7860) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff80003c4262c8,ffffff9c,7dc6bc4b4e90,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063
syscall(ffff80003c3f7ae0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3f7ae0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7dc6bc4b4e50, count: -7
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x27: addq $0x8,%rsp
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x779aab4244c0, count: 12
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x779aab4244c0, count: -3