syzbot
KASAN: invalid memory access in shm_delete_mapping
Status:
fixed on 2026/08/03 11:10
Reported-by: syzbot+f2c08abe216302bc63d6@syzkaller.appspotmail.com
Fix commit:
dfd87cc9ab8c
Eliminate holding raw shmseg over sleep-window in uvm_unmap
First crash: 58d, last: 49d
Sample crash report:
panic: Caught invalid memory access at ffff800001bc2dd0 size 8 op 1
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
402465 67583 0 0 0 1 syz-executor
*251818 67583 0 0 0x4000000 0K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84635b3d) at panic+0x270 sys/kern/subr_prf.c:198
__asan_store8_noabort(ffff800001bc2dd0) at __asan_store8_noabort+0xe4 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_store8_noabort(ffff800001bc2dd0) at __asan_store8_noabort+0xe4 sys/kern/subr_kasan.c:1099
shm_delete_mapping(ffff800001c90208,ffff800001c95008) at shm_delete_mapping+0x1f9 sys/kern/sysv_shm.c:183
syscall(ffff800034f780c0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800034f780c0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9cd83489d60, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff800001bc2dd0 size 8 op 1
ddb{0}> show kasan
KASAN: invalid write of 8 bytes at 0xffff800001bc2dd0 from pc 0xffffffff82a740f9
KASAN: first bad byte at 0xffff800001bc2dd0 (+0); shadow 0xfd: pool use-after-free (or unallocated item)
KASAN: 0xffff800001bc2dd0 is 64 bytes inside the 112-byte item [0xffff800001bc2d90..0xffff800001bc2e00) in pool 'shmpl'
KASAN: allocated at:
#0 pool_get+0x770 sys/kern/subr_pool.c:733
#1 shmget_allocate_segment+0x23b sys/kern/sysv_shm.c:-1
#2 sys_shmget+0x260 sys/kern/sysv_shm.c:503
#3 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#4 Xsyscall+0x128
KASAN: freed at:
#0 pool_put+0x79 sys/kern/subr_pool.c:918
#1 shm_deallocate_segment+0x85 sys/kern/sysv_shm.c:159
#2 sys_shmctl+0x51e sys/kern/sysv_shm.c:366
#3 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#4 Xsyscall+0x128
KASAN: pc: shm_delete_mapping+0x1f9
KASAN: call trace:
#0 __asan_store8_noabort+0xc0 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 __asan_store8_noabort+0xc0 sys/kern/subr_kasan.c:1099
#1 shm_delete_mapping+0x1f9 sys/kern/sysv_shm.c:183
#2 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#2 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#3 Xsyscall+0x128
KASAN: shadow of 0xffff800001bc2c80..0xffff800001bc2f00 (1 cell = 8 bytes):
0xffff800001bc2c80: fd fd fd fd fd fd 08 08 fd fd fd fd fd fd fd fd
0xffff800001bc2d00: fd fd fd fd 08 08 fd fd fd fd fd fd fd fd fd fd
>0xffff800001bc2d80: fd fd 08 08 fd fd fd fd fd fd[fd]fd fd fd fd fd
0xffff800001bc2e00: 08 08 fd fd fd fd fd fd fd fd fd fd fd fd 08 08
0xffff800001bc2e80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84635b3d) at panic+0x270 sys/kern/subr_prf.c:198
__asan_store8_noabort(ffff800001bc2dd0) at __asan_store8_noabort+0xe4 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_store8_noabort(ffff800001bc2dd0) at __asan_store8_noabort+0xe4 sys/kern/subr_kasan.c:1099
shm_delete_mapping(ffff800001c90208,ffff800001c95008) at shm_delete_mapping+0x1f9 sys/kern/sysv_shm.c:183
syscall(ffff800034f780c0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800034f780c0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9cd83489d60, count: -6
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800034f77d70
rbx 0xffff800034f77de0
rdx 0
rcx 0xffffffff84edcff0 cpu_info_full_primary+0x1ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff800034f77b58
r11 0xffffffff8138fdc0 x86_bus_space_io_read_1
r12 0xffffffff84635b3d .str.51+0x99dfd
r13 0xffffffff84eddc08 cpu_info_full_primary+0x2c08
r14 0xffffffff84edde07 cpu_info_full_primary+0x2e07
r15 0x1
rip 0xffffffff838c2057 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff800034f77d70
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=251818 pid=67583 tcnt=4 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=81, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800029942d10,0xffffffff85d464e0
process=0xffff800045ff8e88 user=0xffff800034f6d000, vmspace=0xffff800001c90208
estcpu=31, cpticks=18, pctcpu=0.12, user=0, sys=18, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
67583 402465 14376 0 7 0 0 syz-executor
67583 126875 14376 0 2 0 0x4000000 syz-executor
67583 353008 14376 0 3 0 0x4000080 fsleep syz-executor
*67583 251818 14376 0 7 0 0x4000000 syz-executor
24607 109891 3032 0 2 0 0 syz-executor
24607 443938 3032 0 3 0 0x4000080 piperd syz-executor
19630 188095 99199 0 2 0x11 0 syz-executor
19630 190570 99199 0 3 0x11 0x4000080 fsleep syz-executor
36303 498476 90654 0 2 0 0 syz-executor
36303 52653 90654 0 3 0 0x4000080 fsleep syz-executor
86784 440010 87231 0 2 0x10 0xc80 syz-executor
86784 125873 87231 0 3 0x10 0x4000080 kqread syz-executor
86784 233098 87231 0 3 0x10 0x4000080 fsleep syz-executor
99199 369697 25141 0 2 0x2 0xc80 syz-executor
6107 353093 25141 0 3 0x2 0x80 piperd syz-executor
87231 173073 25141 0 2 0x2 0xc80 syz-executor
14376 66653 25141 0 2 0x2 0xc80 syz-executor
3032 15487 25141 0 2 0x2 0xc80 syz-executor
90654 470063 25141 0 2 0x2 0xc80 syz-executor
92270 462144 25141 0 3 0x2 0x80 wait syz-executor
25141 512332 84900 0 3 0x2 0x80 wait syz-executor
84900 498996 41197 0 3 0x100002 0x88 sigsusp ksh
41197 409867 68167 0 3 0x10 0x88 kqread sshd-session
68167 349555 39464 0 3 0x12 0x80 kqread sshd-session
99355 485636 1 0 3 0x100003 0x80 ttyin getty
39464 128905 1 0 3 0 0x88 kqread sshd
27910 191385 6597 74 3 0x1100012 0x80 bpf pflogd
6597 18715 1 0 3 0 0x80 sbwait pflogd
48574 448875 27443 73 2 0x1100010 0x80 syslogd
27443 403371 1 0 3 0x100002 0x80 sbwait syslogd
27405 134821 1 0 3 0x100000 0x80 kqread resolvd
80469 462612 84889 77 3 0x100012 0x80 kqread dhcpleased
86181 91411 84889 77 3 0x100012 0x80 kqread dhcpleased
84889 418931 1 0 3 0 0x80 kqread dhcpleased
81842 519291 0 0 2 0x14000 0x200 smr
14591 33846 0 0 2 0x14000 0x200 zerothread
31904 330257 0 0 3 0x14000 0x200 aiodoned aiodoned
25293 519158 0 0 3 0x14000 0x200 syncer update
64394 12105 0 0 3 0x14000 0x200 cleaner cleaner
33230 414813 0 0 3 0x14000 0x200 reaper reaper
16007 338001 0 0 3 0x14000 0x200 pgdaemon pagedaemon
13121 350125 0 0 3 0x14000 0x200 bored viomb
94415 424866 0 0 3 0x14000 0x40000200 acpi0 acpi0
81962 113130 0 0 3 0x14000 0x40000200 idle1
71645 439006 0 0 3 0x14000 0x200 bored softnet1
99158 4091 0 0 2 0x14000 0x200 softnet0
38509 241596 0 0 3 0x14000 0x200 bored systqmp
82180 203675 0 0 3 0x14000 0x200 bored systq
67548 332082 0 0 2 0x14000 0x200 softclockmp
54009 383799 0 0 3 0x14000 0x40000200 tmoslp softclock
30207 163940 0 0 3 0x14000 0x40000200 idle0
1 231852 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 67583 (syz-executor) thread 0xffff800029943ca0 (126875)
exclusive rrwlock inode r = 0 (0xffff80000197a7d0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 ufs_ihashins+0xda sys/ufs/ufs/ufs_ihash.c:146
#5 ffs_vget+0x2e9 sys/ufs/ffs/ffs_vfsops.c:1232
#6 ffs_inode_alloc+0x576 sys/ufs/ffs/ffs_alloc.c:393
#7 ufs_makeinode+0x1a1 sys/ufs/ufs/ufs_vnops.c:1759
#8 ufs_mknod+0xd8 sys/ufs/ufs/ufs_vnops.c:167
#9 VOP_MKNOD+0x1a8 sys/kern/vfs_vops.c:121
#10 domknodat+0x57b sys/kern/vfs_syscalls.c:1579
#11 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#12 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffff8000019ceb08)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 vn_lock+0xca sys/kern/vfs_vnops.c:576
#5 vfs_lookup+0x1f7 sys/kern/vfs_lookup.c:431
#6 namei+0xe19 sys/kern/vfs_lookup.c:250
#7 domknodat+0x103 sys/kern/vfs_syscalls.c:1531
#8 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#9 Xsyscall+0x128
Process 67583 (syz-executor) thread 0xffff800029942018 (251818)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85e37880)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1
#2 sleep_finish+0x423 sys/kern/kern_synch.c:369
#3 rw_do_enter_write+0x21f sys/kern/kern_rwlock.c:298
#4 vm_map_lock_ln+0x19f sys/uvm/uvm_map.c:5170
#5 uvm_unmap+0xc9 sys/uvm/uvm_map.c:1798
#6 shm_delete_mapping+0x1bd sys/kern/sysv_shm.c:182
#7 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#7 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#8 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11057 12245K 12395K 166960K 12264 0
pcb 17 24K 24K 166960K 27 0
rtable 242 13K 14K 166960K 416 0
pf 36 23K 29K 166960K 59 0
ifaddr 43 12K 12K 166960K 54 0
ifgroup 55 2K 2K 166960K 65 0
sysctl 3 1K 13K 166960K 7 0
counters 70 42K 43K 166960K 76 0
ioctlops 0 0K 4K 166960K 1603 0
iov 0 0K 16K 166960K 3 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1332 86K 86K 166960K 1482 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 3 6K 6K 166960K 4 0
VM map 2 1K 1K 166960K 2 0
sem 5 0K 0K 166960K 6 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 16 57K 97K 166960K 255 0
sigio 0 0K 0K 166960K 3 0
proc 71 128K 193K 166960K 621 0
subproc 72 9K 9K 166960K 90 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 8 0
in_multi 99 7K 7K 166960K 121 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 5 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 61 425K 425K 166960K 61 0
exec 0 0K 2K 166960K 409 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM amap 226 232K 252K 166960K 4055 0
UVM aobj 5 8K 8K 166960K 6 0
pinsyscall 1065 1757K 1760K 166960K 1463 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 1 0
NDP 14 0K 2K 166960K 35 0
temp 36 9162K 9182K 166960K 5494 0
kqueue 13 40K 53K 166960K 45 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 38 0 35 1 0 1 1 0 8 0
rtentry 176 134 0 23 6 0 6 6 0 8 0
unpcb 144 128 0 99 2 0 2 2 0 8 0
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 20 0 15 1 0 1 1 0 8 0
arp 136 22 0 4 1 0 1 1 0 8 0
inpcb 328 138 0 126 2 0 2 2 0 8 0
nd6 152 31 0 6 1 0 1 1 0 8 0
kcovpl 48 10 0 2 1 0 1 1 0 8 0
ppxss 1192 1 0 1 1 0 1 1 0 8 1
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 36 0 35 1 0 1 1 0 8 0
pfosfp 40 1429 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1429 0 714 21 0 21 21 0 8 0
pfrktable 1344 1 0 0 1 0 1 1 0 8 0
pfanchor 1288 1 0 0 1 0 1 1 0 8 0
pftag 88 2 0 0 1 0 1 1 0 8 0
pfstitem 24 30 0 0 1 0 1 1 0 8 0
pfstkey 128 30 0 0 1 0 1 1 0 8 0
pfstate 448 30 0 0 4 0 4 4 0 8 0
pfrule 1360 24 0 18 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 542 0 88 29 0 29 29 0 8 0
art_table 40 543 0 88 5 0 5 5 0 8 0
art_node 32 134 0 33 1 0 1 1 0 8 0
sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1
semapl 72 4 0 1 1 0 1 1 0 8 0
shmpl 112 3 0 1 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1726 0 250 93 0 93 93 0 8 0
ffsino 296 1726 0 250 114 0 114 114 0 8 0
nchpl 144 2065 0 355 64 0 64 64 0 8 0
vnodes 216 1905 0 0 106 0 106 106 0 8 0
namei 1024 6665 0 6664 1 0 1 1 0 8 0
percpumem 16 54 0 3 1 0 1 1 0 8 0
kstatmem 264 33 0 6 2 0 2 2 0 8 0
scxspl 216 7696 0 7696 10 2 8 8 1 8 8
plimitpl 152 37 0 20 1 0 1 1 0 8 0
sigapl 424 568 0 522 7 0 7 7 0 8 1
knotepl 120 128 0 0 4 0 4 4 0 8 0
kqueuepl 224 118 0 107 5 0 5 5 0 8 4
pipepl 344 386 0 357 9 0 9 9 0 8 6
fdescpl 528 552 0 522 3 0 3 3 0 8 0
filepl 160 2687 0 2449 18 0 18 18 0 8 7
lockfpl 104 53 0 50 1 0 1 1 0 8 0
lockfspl 48 25 0 22 1 0 1 1 0 8 0
sessionpl 144 35 0 25 1 0 1 1 0 8 0
pgrppl 48 46 0 28 1 0 1 1 0 8 0
ucredpl 104 211 0 196 1 0 1 1 0 8 0
zombiepl 144 524 0 522 1 0 1 1 0 8 0
processpl 1232 568 0 522 5 0 5 5 0 8 1
procpl 664 733 0 679 5 0 5 5 0 8 0
sosppl 176 6 0 6 1 0 1 1 0 8 1
sockpl 752 309 0 265 6 0 6 6 0 8 1
mcl64k 65536 3 0 0 1 0 1 1 0 8 0
mcl16k 16384 3 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl9k128 9344 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 118 0 0 15 0 15 15 0 8 0
mcl2k 2048 22 0 0 3 0 3 3 0 8 0
mextrefs 64 20 0 0 1 0 1 1 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 162 0 0 11 0 11 11 0 8 0
bufpl 272 2460 0 106 157 0 157 157 0 8 0
anonpl 32 4507 0 0 37 0 37 37 0 222 0
amapchunkpl 152 11400 0 10950 23 0 23 23 0 158 2
amappl16 200 1856 0 1834 5 3 2 5 0 8 0
amappl15 192 43 0 43 2 1 1 1 0 8 1
amappl14 184 454 0 453 1 0 1 1 0 8 0
amappl13 176 134 0 122 1 0 1 1 0 8 0
amappl12 168 808 0 779 2 0 2 2 0 8 0
amappl11 160 9 0 9 2 1 1 1 0 8 1
amappl10 152 72 0 58 1 0 1 1 0 8 0
amappl9 144 292 0 292 1 1 0 1 0 8 0
amappl8 136 110 0 108 1 0 1 1 0 8 0
amappl7 128 235 0 221 1 0 1 1 0 8 0
amappl6 120 172 0 170 1 0 1 1 0 8 0
amappl5 112 100 0 90 1 0 1 1 0 8 0
amappl4 104 300 0 280 1 0 1 1 0 8 0
amappl3 96 2130 0 2024 4 0 4 4 0 8 0
amappl2 88 554 0 491 2 0 2 2 0 8 0
amappl1 80 11131 0 10530 15 0 15 15 0 8 1
amappl 88 3284 0 3129 4 0 4 4 0 92 0
uvmvnodes 80 100 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 7 0 7 2 2 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 5 0 1 1 0 1 1 0 8 0
uaddrrnd 24 552 0 522 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 552 0 522 1 0 1 1 0 8 0
vmmpekpl 168 7641 0 7605 3 0 3 3 0 8 1
vmmpepl 168 44454 0 42601 88 0 88 88 0 357 3
vmsppl 488 551 0 522 5 0 5 5 0 8 0
rwobjpl 80 16022 0 15007 24 1 23 24 0 8 0
pdppl 4096 1113 0 1044 101 26 75 89 0 8 6
pvpl 32 11731 0 0 97 2 95 95 0 265 0
pmappl 256 551 0 522 3 0 3 3 0 8 0
extentpl 40 47 0 29 1 0 1 1 0 8 0
phpool 120 433 0 32 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84635b3d) at panic+0x270 sys/kern/subr_prf.c:198
__asan_store8_noabort(ffff800001bc2dd0) at __asan_store8_noabort+0xe4 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_store8_noabort(ffff800001bc2dd0) at __asan_store8_noabort+0xe4 sys/kern/subr_kasan.c:1099
shm_delete_mapping(ffff800001c90208,ffff800001c95008) at shm_delete_mapping+0x1f9 sys/kern/sysv_shm.c:183
syscall(ffff800034f780c0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800034f780c0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9cd83489d60, count: -6
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffff800028ff3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85e37080) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85e37080) at __mp_lock+0x272 sys/kern/kern_lock.c:173
syscall(ffff800034f0ced0) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff800034f0ced0) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b5593824210, count: 9
Struck through repros no longer work on HEAD.