syzbot


panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) vmmaplk (2)

Status: upstream: reported on 2022/11/13 01:27
Reported-by: syzbot+5782efa4c7ab3c28b543@syzkaller.appspotmail.com
First crash: 86d, last: 86d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) vmmaplk 3 994d 1015d 0/3 closed as dup on 2020/04/28 07:03

Sample crash report:
panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) vmmaplk
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
  28242   8995     73   0x1100010          0    1  syslogd
*245149  18572      0     0x14000      0x200    0K reaper
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff825c349b) at panic+0x177 sys/kern/subr_prf.c:198
witness_checkorder(ffffffff82baa9d8,1,0) at witness_checkorder+0x116d sys/kern/subr_witness.c:833
rw_enter_read(ffffffff82baa9c8) at rw_enter_read+0x83 sys/kern/kern_rwlock.c:112
uvmfault_lookup(ffff800021238d50,0) at uvmfault_lookup+0xd9 sys/uvm/uvm_fault.c:1773
uvm_fault_check(ffff800021238d50,ffff800021238d88,ffff800021238db0) at uvm_fault_check+0x3a sys/uvm/uvm_fault.c:673
uvm_fault(ffffffff82baa9c0,12b5088000,0,1) at uvm_fault+0xf2 sys/uvm/uvm_fault.c:601
kpageflttrap(ffff800021238ef0,12b5088b90) at kpageflttrap+0x22e sys/arch/amd64/amd64/trap.c:277
kerntrap(ffff800021238ef0) at kerntrap+0xef sys/arch/amd64/amd64/trap.c:332
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
softclock_process_kclock_timeout(fffffd80664a0f00,0) at softclock_process_kclock_timeout+0x3a sys/kern/kern_timeout.c:652
softclock(0) at softclock+0x11a sys/kern/kern_timeout.c:717
softintr_dispatch(0) at softintr_dispatch+0xfb sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
end trace frame: 0xffff8000212391d0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: acquiring blockable sleep lock with spinlock or critical section held (rwlock) vmmaplk
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff825c349b) at panic+0x177 sys/kern/subr_prf.c:198
witness_checkorder(ffffffff82baa9d8,1,0) at witness_checkorder+0x116d sys/kern/subr_witness.c:833
rw_enter_read(ffffffff82baa9c8) at rw_enter_read+0x83 sys/kern/kern_rwlock.c:112
uvmfault_lookup(ffff800021238d50,0) at uvmfault_lookup+0xd9 sys/uvm/uvm_fault.c:1773
uvm_fault_check(ffff800021238d50,ffff800021238d88,ffff800021238db0) at uvm_fault_check+0x3a sys/uvm/uvm_fault.c:673
uvm_fault(ffffffff82baa9c0,12b5088000,0,1) at uvm_fault+0xf2 sys/uvm/uvm_fault.c:601
kpageflttrap(ffff800021238ef0,12b5088b90) at kpageflttrap+0x22e sys/arch/amd64/amd64/trap.c:277
kerntrap(ffff800021238ef0) at kerntrap+0xef sys/arch/amd64/amd64/trap.c:332
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
softclock_process_kclock_timeout(fffffd80664a0f00,0) at softclock_process_kclock_timeout+0x3a sys/kern/kern_timeout.c:652
softclock(0) at softclock+0x11a sys/kern/kern_timeout.c:717
softintr_dispatch(0) at softintr_dispatch+0xfb sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
Xspllower() at Xspllower+0x19
printf(ffffffff8258d892) at printf+0x84 sys/kern/subr_prf.c:532
uvm_fault_unwire_locked(fffffd805908bb88,4f887901000,4f887b00000) at uvm_fault_unwire_locked+0x21c sys/uvm/uvm_fault.c:1679
uvm_unmap_kill_entry_withlock(fffffd805908bb88,fffffd8074ca4370,0) at uvm_unmap_kill_entry_withlock+0x67 sys/uvm/uvm_map.c:1925
uvm_map_teardown(fffffd805908bb88) at uvm_map_teardown+0x1a7 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline]
uvm_map_teardown(fffffd805908bb88) at uvm_map_teardown+0x1a7 sys/uvm/uvm_map.c:2578
uvmspace_free(fffffd805908bb88) at uvmspace_free+0xa6 sys/uvm/uvm_map.c:3504
reaper(ffff8000212337a8) at reaper+0x19a sys/kern/kern_exit.c:448
end trace frame: 0x0, count: -21
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff8000212389a0
rbx               0xffffffff8294ab8f    cpu_info_full_primary+0x2b8f
rdx                                0
rcx                                0
rax               0xffff8000212337a8
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xe55dd81bb88625d6
r11               0x87dbdefffc3e656b
r12               0xffffffff8294a990    cpu_info_full_primary+0x2990
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff810aabd8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800021238990
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (reaper) pid=245149 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    pri=86, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff800021233a48,0xffff800021233518
    process=0xffff8000fffff1e0 user=0xffff800021234000, vmspace=0xffffffff82baa9c0
    estcpu=36, cpticks=92, pctcpu=16.6
    user=0, sys=180, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  8944   47067  30843      0  2         0x2                syz-executor.7
 57724  286191  30843      0  2       0x482                syz-executor.3
 17742  107486  30843      0  3        0x82  wait          syz-executor.4
 87308  436832  30843      0  3        0x82  piperd        syz-executor.2
 86193   91536      0      0  3     0x14200  acct          acct
  7762   15867  30843      0  2         0x2                syz-executor.5
 21768  377731  30843      0  3        0x82  piperd        syz-executor.0
 22836  359612  30843      0  3        0x82  piperd        syz-executor.1
 40175  503988  30843      0  3        0x82  piperd        syz-executor.6
 76727  250967      1      0  3    0x100083  ttyin         getty
 33930   85182      1      0  3           0  vmmaplk       syz-executor.4
 33930  522289      1      0  3   0x4000000  vmmapbsy      syz-executor.4
 33930   81508      1      0  3   0x4000000  vmmaplk       syz-executor.4
 33930   93513      1      0  3   0x4000000  vmmaplk       syz-executor.4
 23818  267215      0      0  3     0x14200  bored         sosplice
 30843  311381  81647      0  3        0x82  thrsleep      syz-fuzzer
 30843  167687  81647      0  2   0x4000482                syz-fuzzer
 30843  373598  81647      0  3   0x4000082  wait          syz-fuzzer
 30843   18370  81647      0  3   0x4000082  thrsleep      syz-fuzzer
 30843   38408  81647      0  2   0x4000482                syz-fuzzer
 30843  205292  81647      0  3   0x4000082  thrsleep      syz-fuzzer
 30843  483562  81647      0  3   0x4000082  thrsleep      syz-fuzzer
 30843   96467  81647      0  3   0x4000082  wait          syz-fuzzer
 30843  403376  81647      0  3   0x4000082  thrsleep      syz-fuzzer
 30843   36808  81647      0  3   0x4000082  thrsleep      syz-fuzzer
 30843  470386  81647      0  3   0x4000082  wait          syz-fuzzer
 30843  114467  81647      0  3   0x4000082  wait          syz-fuzzer
 30843  308847  81647      0  3   0x4000082  wait          syz-fuzzer
 30843   81019  81647      0  3   0x4000082  wait          syz-fuzzer
 30843  254742  81647      0  3   0x4000082  wait          syz-fuzzer
 30843  261508  81647      0  3   0x4000082  wait          syz-fuzzer
 81647  218310  48776      0  3    0x10008a  sigsusp       ksh
 48776  229142   9509      0  3        0x9a  kqread        sshd
  9509   99365      1      0  3        0x88  kqread        sshd
 25161   90020  21017     74  2   0x1100492                pflogd
 21017  161036      1      0  3        0x80  netio         pflogd
  8995   28242   7109     73  7   0x1100010                syslogd
  7109  319235      1      0  3    0x100082  netio         syslogd
  1525  467819      1      0  3    0x100080  kqread        resolvd
 19419  305723  39501     77  3    0x100092  kqread        dhcpleased
 43130  234746  39501     77  3    0x100092  kqread        dhcpleased
 39501  297072      1      0  3        0x80  kqread        dhcpleased
 75825  479926      0      0  3     0x14200  bored         smr
  5140  351905      0      0  3     0x14200  pgzero        zerothread
  6183  116943      0      0  3     0x14200  aiodoned      aiodoned
 54800  278306      0      0  2     0x14600                update
 42405   34541      0      0  3     0x14200  cleaner       cleaner
*18572  245149      0      0  7     0x14200                reaper
 64920  515759      0      0  3     0x14200  pgdaemon      pagedaemon
 31561  208043      0      0  3     0x14200  bored         viomb
 66748  100930      0      0  3  0x40014200  acpi0         acpi0
   691  318303      0      0  3  0x40014200                idle1
 30255   59237      0      0  3     0x14200  bored         softnet
 61310   92234      0      0  3     0x14200  bored         softnet
 60433  451767      0      0  3     0x14200  bored         softnet
 48759  206926      0      0  3     0x14200  bored         softnet
 87331   68061      0      0  2     0x14200                systqmp
   311  335753      0      0  3     0x14200  bored         systq
 72618  220072      0      0  2  0x40014200                softclock
 92129  243802      0      0  3  0x40014200                idle0
     1  314780      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_timeout.c:57 r = 0 (0xffffffff8291f510)
#0  witness_lock+0x44d
#1  mtx_enter_try+0x100
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  softclock+0x2d sys/kern/kern_timeout.c:708
#4  softintr_dispatch+0xfb sys/arch/amd64/amd64/softintr.c:90
#5  Xsoftclock+0x1f
#6  Xspllower+0x19
#7  printf+0x84 sys/kern/subr_prf.c:532
#8  uvm_fault_unwire_locked+0x21c sys/uvm/uvm_fault.c:1679
#9  uvm_unmap_kill_entry_withlock+0x67 sys/uvm/uvm_map.c:1925
#10 uvm_map_teardown+0x1a7 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline]
#10 uvm_map_teardown+0x1a7 sys/uvm/uvm_map.c:2578
#11 uvmspace_free+0xa6 sys/uvm/uvm_map.c:3504
#12 reaper+0x19a sys/kern/kern_exit.c:448
#13 proc_trampoline+0x1c
Process 8944 (syz-executor.7) thread 0xffff80002154f268 (47067)
exclusive rrwlock inode r = 0 (0xfffffd80755b42b8)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  ufs_ihashins+0x42 sys/ufs/ufs/ufs_ihash.c:140
#5  ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1353
#6  ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394
#7  ufs_mkdir+0xf4 sys/ufs/ufs/ufs_vnops.c:1150
#8  VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388
#9  domkdirat+0x121 sys/kern/vfs_syscalls.c:3112
#10 syscall+0x438 mi_syscall sys/sys/syscall_mi.h:101 [inline]
#10 syscall+0x438 sys/arch/amd64/amd64/trap.c:599
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8065d650a8)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0xd1 sys/kern/vfs_lookup.c:412
#6  namei+0x36a sys/kern/vfs_lookup.c:244
#7  domkdirat+0x75 sys/kern/vfs_syscalls.c:3097
#8  syscall+0x438 mi_syscall sys/sys/syscall_mi.h:101 [inline]
#8  syscall+0x438 sys/arch/amd64/amd64/trap.c:599
#9  Xsyscall+0x128
Process 7762 (syz-executor.5) thread 0xffff800021300540 (15867)
exclusive rrwlock inode r = 0 (0xfffffd8065d655f8)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  ufs_ihashins+0x42 sys/ufs/ufs/ufs_ihash.c:140
#5  ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1353
#6  ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394
#7  ufs_mkdir+0xf4 sys/ufs/ufs/ufs_vnops.c:1150
#8  VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388
#9  domkdirat+0x121 sys/kern/vfs_syscalls.c:3112
#10 syscall+0x438 mi_syscall sys/sys/syscall_mi.h:101 [inline]
#10 syscall+0x438 sys/arch/amd64/amd64/trap.c:599
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806e251e78)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0xd1 sys/kern/vfs_lookup.c:412
#6  namei+0x36a sys/kern/vfs_lookup.c:244
#7  domkdirat+0x75 sys/kern/vfs_syscalls.c:3097
#8  syscall+0x438 mi_syscall sys/sys/syscall_mi.h:101 [inline]
#8  syscall+0x438 sys/arch/amd64/amd64/trap.c:599
#9  Xsyscall+0x128
Process 33930 (syz-executor.4) thread 0xffff80002131dce0 (93513)
shared rwlock vmmaplk r = 0 (0xfffffd8068793488)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  vm_map_lock_ln+0xda sys/uvm/uvm_map.c:5323
#3  uvm_map_pageable+0x11a sys/uvm/uvm_map.c:2293
#4  sys_mlock+0x184 sys/uvm/uvm_mmap.c:834
#5  syscall+0x438 mi_syscall sys/sys/syscall_mi.h:101 [inline]
#5  syscall+0x438 sys/arch/amd64/amd64/trap.c:599
#6  Xsyscall+0x128
Process 8995 (syslogd) thread 0xffff8000ffff7a50 (28242)
exclusive rrwlock inode r = 0 (0xfffffd806e7393d0)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  sys_fsync+0xf5 sys/kern/vfs_syscalls.c:2935
#6  syscall+0x438 mi_syscall sys/sys/syscall_mi.h:101 [inline]
#6  syscall+0x438 sys/arch/amd64/amd64/trap.c:599
#7  Xsyscall+0x128
Process 18572 (reaper) thread 0xffff8000212337a8 (245149)
exclusive rwlock uobjlk r = 0 (0xfffffd8064b657f8)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  uvm_fault_unwire_locked+0x1e6 sys/uvm/uvm_fault.c:1670
#3  uvm_unmap_kill_entry_withlock+0x67 sys/uvm/uvm_map.c:1925
#4  uvm_map_teardown+0x1a7 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline]
#4  uvm_map_teardown+0x1a7 sys/uvm/uvm_map.c:2578
#5  uvmspace_free+0xa6 sys/uvm/uvm_map.c:3504
#6  reaper+0x19a sys/kern/kern_exit.c:448
#7  proc_trampoline+0x1c
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff829fd4d0)
#0  witness_lock+0x44d
#1  uvm_unmap_kill_entry_withlock+0x4c sys/uvm/uvm_map.c:1923
#2  uvm_map_teardown+0x1a7 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline]
#2  uvm_map_teardown+0x1a7 sys/uvm/uvm_map.c:2578
#3  uvmspace_free+0xa6 sys/uvm/uvm_map.c:3504
#4  reaper+0x19a sys/kern/kern_exit.c:448
#5  proc_trampoline+0x1c
exclusive rwlock vmmaplk r = 0 (0xfffffd805908bba0)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  vm_map_lock_ln+0xda sys/uvm/uvm_map.c:5323
#3  uvm_map_teardown+0x84 sys/uvm/uvm_map.c:2546
#4  uvmspace_free+0xa6 sys/uvm/uvm_map.c:3504
#5  reaper+0x19a sys/kern/kern_exit.c:448
#6  proc_trampoline+0x1c
exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_timeout.c:57 r = 0 (0xffffffff8291f510)
#0  witness_lock+0x44d
#1  mtx_enter_try+0x100
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  softclock+0x2d sys/kern/kern_timeout.c:708
#4  softintr_dispatch+0xfb sys/arch/amd64/amd64/softintr.c:90
#5  Xsoftclock+0x1f
#6  Xspllower+0x19
#7  printf+0x84 sys/kern/subr_prf.c:532
#8  uvm_fault_unwire_locked+0x21c sys/uvm/uvm_fault.c:1679
#9  uvm_unmap_kill_entry_withlock+0x67 sys/uvm/uvm_map.c:1925
#10 uvm_map_teardown+0x1a7 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline]
#10 uvm_map_teardown+0x1a7 sys/uvm/uvm_map.c:2578
#11 uvmspace_free+0xa6 sys/uvm/uvm_map.c:3504
#12 reaper+0x19a sys/kern/kern_exit.c:448
#13 proc_trampoline+0x1c
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10242   6515K    7159K  78643K     38670        0
            pcb    13     20K      24K  78643K      2536        0
         rtable   198      9K      10K  78643K      2872        0
         ifaddr   201     44K      44K  78643K      1177        0
         sysctl     2      0K       2K  78643K         6        0
       counters    68     36K      37K  78643K       600        0
       ioctlops     0      0K       4K  78643K      2584        0
            iov     0      0K      28K  78643K      2785        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1550     97K      97K  78643K     10028        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K       109        0
         VM map     2      1K       1K  78643K         2        0
            sem    23     11K      21K  78643K      1022        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    11     37K      89K  78643K     12205        0
          sigio     0      0K       0K  78643K       492        0
           proc    70     91K     115K  78643K      2426        0
        subproc   117      7K       7K  78643K       715        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       672        0
       in_multi    77      5K       6K  78643K      1010        0
    ether_multi     1      0K       0K  78643K        79        0
            mrt     1      0K       0K  78643K        47        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   169    758K     758K  78643K       169        0
           exec     0      0K       1K  78643K      2913        0
     pfkey data     0      0K       0K  78643K         4        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   541   1103K    1104K  78643K     86715        0
       UVM aobj   131      6K       6K  78643K       139        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K       337        0
            NDP    18      0K       2K  78643K       341        0
           temp   160   4703K    5727K  78643K    275063        0
         kqueue    12     18K      26K  78643K       868        0
      SYN cache     2    136K     144K  78643K         3        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120      765    0      762    10     9     1     3     0     8    0
rtentry    112      865    0      780     4     1     3     4     0     8    0
unpcb      144     8604    0     8589    87    86     1    10     0     8    0
syncache   296       60    0       60    16    16     0     1     0     8    0
tcpqe       32      349    0      349    16    16     0     2     0     8    0
tcpcb      776     3156    0     3150    97    94     3     8     0     8    2
arp        120      126    0      112     1     0     1     1     0     8    0
inpcb      368    17884    0    17809   198   189     9    31     0     8    1
nd6         48      189    0      170     1     0     1     1     0     8    0
pkpcb       40        7    0        7     2     2     0     1     0     8    0
kcovpl      48       55    0       46     1     0     1     1     0     8    0
mppekey    1024       6    0        6     3     3     0     1     0     8    0
ppxss      1256     151    0      151    20    20     0     1     0     8    0
pppxif     1704      61    0       61    12    12     0     1     0     8    0
pfstscr     40      135    0      129     2     1     1     1     0     8    0
pffrag     232       29    0       29     7     6     1     1     0   482    1
pffrnode    88       29    0       29     7     6     1     1     0     8    1
pffrent     40       71    0       71     7     6     1     1     0     8    1
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1280     764    2      252    50     7    43    43     0     8    0
pfqueue    264        5    0        5     2     2     0     1     0     8    0
pfstitem    24       63    0       51     2     1     1     1     0     8    0
pfstkey    120      236    0      233     2     1     1     1     0     8    0
pfstate    384      119    0      113     2     1     1     1     0     8    0
rttmr      136       15    0       15     2     2     0     1     0     8    0
art_heap8  4096      13    0       11     7     5     2     3     0     8    0
art_heap4  256     3753    0     3370    47    23    24    30     0     8    0
art_table   32     3766    0     3381     4     0     4     4     0     8    0
art_node    16      850    0      775     1     0     1     1     0     8    0
sysvmsgpl   40        5    0        5     2     2     0     1     0     8    0
semupl     112        2    0        2     1     1     0     1     0     8    0
semapl     112     1003    0      982     1     0     1     1     0     8    0
shmpl      112      136    0        8     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256    16552    0    15042    95     0    95    95     0     8    0
ffsino     272    16552    0    15042   101     0   101   101     0     8    0
nchpl      144    32863    0    32371    63    39    24    63     0     8    0
rtmask      32        2    0        2     1     1     0     1     0     8    0
uvmvnodes   80     7753    0        0   159     0   159   159     0     8    0
vnodes     216     7753    0        0   431     0   431   431     0     8    0
namei      1024  123544    0   123542     5     4     1     2     0     8    0
percpumem   16      312    0      266     1     0     1     1     0     8    0
vcpupl     2048     133    0        0    17     0    17    17     0     8    0
vmpool     568      149    0       16    10     0    10    10     0     8    0
kstatmem   264      402    0      366     6     3     3     3     0     8    0
scsiplug    72        8    0        8     3     3     0     1     0     8    0
scxspl     216   110564    0   110564    40    39     1     8     0     8    1
plimitpl   152     1728    0     1710     1     0     1     1     0     8    0
sigapl     424    12445    0    12400    10     3     7     9     0     8    0
futexpl     64   108970    0   108970     6     5     1     1     0     8    1
knotepl    120      935    0        0    17     1    16    17     0     8    0
kqueuepl   216     2164    0     2156    36    35     1     8     0     8    0
pipepl     320     3199    0     3170    88    85     3    11     0     8    0
fdescpl    496    12402    0    12378     7     2     5     5     0     8    0
filepl     152    86429    0    86110   140   125    15    26     0     8    0
lockfpl    104     2689    0     2687     4     3     1     2     0     8    0
lockfspl    48      809    0      807     1     0     1     1     0     8    0
sessionpl  144       74    0       56     1     0     1     1     0     8    0
pgrppl      48      252    0      234     1     0     1     1     0     8    0
ucredpl    104    11387    0    11369     1     0     1     1     0     8    0
zombiepl   144    12402    0    12400     2     1     1     1     0     8    0
processpl  1064   12445    0    12400     5     0     5     5     0     8    0
procpl     672    36448    0    36383    19    10     9    10     0     8    0
srpgc       96       50    0       50    15    15     0     1     0     8    0
sosppl     168       89    0       89    20    20     0     1     0     8    0
sockpl     488    27306    0    27213   506   490    16    45     0     8    2
mcl64k     65536     30    0        0     3     0     3     3     0     8    0
mcl16k     16384     25    0        0     4     1     3     3     0     8    0
mcl12k     12288     32    0        0     2     0     2     2     0     8    0
mcl9k      9216      30    0        0     2     1     1     2     0     8    0
mcl8k      8192      41    0        0     5     2     3     3     0     8    0
mcl4k      4096      33    0        0     4     1     3     3     0     8    0
mcl2k2     2112      10    0        0     1     0     1     1     0     8    0
mcl2k      2048     579    0        0    56    32    24    56     0     8    0
mtagpl      96      621    0        0     9     0     9     9     0     8    0
mbufpl     256     4146    0        0   234     0   234   234     0     8    0
bufpl      288    28516    0    20348   584     0   584   584     0     8    0
anonpl      24  2594961    0  2565956   300   122   178   178     0   186    1
amapchunkpl 152  244678    0   243138   109    48    61    61     0   158    0
amappl16   200    25416    0    24851   156   125    31    50     0     8    0
amappl15   192        6    0        6     1     1     0     1     0     8    0
amappl14   184      333    0      317     2     1     1     2     0     8    0
amappl13   176       29    0       28     1     0     1     1     0     8    0
amappl12   168      991    0      985     1     0     1     1     0     8    0
amappl11   160       51    0       36     1     0     1     1     0     8    0
amappl10   152      118    0      101     1     0     1     1     0     8    0
amappl9    144     1061    0     1059     1     0     1     1     0     8    0
amappl8    136      692    0      573     6     1     5     5     0     8    0
amappl7    128      116    0       96     1     0     1     1     0     8    0
amappl6    120      848    0      822     2     1     1     2     0     8    0
amappl5    112      247    0      236     1     0     1     1     0     8    0
amappl4    104     1184    0     1150     2     1     1     2     0     8    0
amappl3     96    37179    0    37124     2     0     2     2     0     8    0
amappl2     88    13434    0    13356     3     1     2     3     0     8    0
amappl1     80   283590    0   282854    27     9    18    22     0     8    0
amappl      88    85560    0    85278    10     2     8     8     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      138    0        8     3     0     3     3     0     8    0
uaddrrnd    24    12551    0    12393     2     1     1     2     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    12551    0    12393     2     1     1     2     0     8    0
vmmpekpl   168   103434    0   103345     5     0     5     5     0     8    0
vmmpepl    168  1147730    0  1144815   318   161   157   162     0   357    0
vmsppl     368    12550    0    12392    18     3    15    16     0     8    0
rwobjpl     56   311693    0   301886   160    20   140   140     0     8    0
pdppl      4096   25109    0    24917   696   492   204   206     0     8   12
pvpl        32  5299206    0  5266313   643   329   314   315     0   265    4
pmappl     248    12550    0    12392    13     2    11    11     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     2103    0      777    39     0    39    39     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff825c349b) at panic+0x177 sys/kern/subr_prf.c:198
witness_checkorder(ffffffff82baa9d8,1,0) at witness_checkorder+0x116d sys/kern/subr_witness.c:833
rw_enter_read(ffffffff82baa9c8) at rw_enter_read+0x83 sys/kern/kern_rwlock.c:112
uvmfault_lookup(ffff800021238d50,0) at uvmfault_lookup+0xd9 sys/uvm/uvm_fault.c:1773
uvm_fault_check(ffff800021238d50,ffff800021238d88,ffff800021238db0) at uvm_fault_check+0x3a sys/uvm/uvm_fault.c:673
uvm_fault(ffffffff82baa9c0,12b5088000,0,1) at uvm_fault+0xf2 sys/uvm/uvm_fault.c:601
kpageflttrap(ffff800021238ef0,12b5088b90) at kpageflttrap+0x22e sys/arch/amd64/amd64/trap.c:277
kerntrap(ffff800021238ef0) at kerntrap+0xef sys/arch/amd64/amd64/trap.c:332
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
softclock_process_kclock_timeout(fffffd80664a0f00,0) at softclock_process_kclock_timeout+0x3a sys/kern/kern_timeout.c:652
softclock(0) at softclock+0x11a sys/kern/kern_timeout.c:717
softintr_dispatch(0) at softintr_dispatch+0xfb sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x1f
Xspllower() at Xspllower+0x19
printf(ffffffff8258d892) at printf+0x84 sys/kern/subr_prf.c:532
uvm_fault_unwire_locked(fffffd805908bb88,4f887901000,4f887b00000) at uvm_fault_unwire_locked+0x21c sys/uvm/uvm_fault.c:1679
uvm_unmap_kill_entry_withlock(fffffd805908bb88,fffffd8074ca4370,0) at uvm_unmap_kill_entry_withlock+0x67 sys/uvm/uvm_map.c:1925
uvm_map_teardown(fffffd805908bb88) at uvm_map_teardown+0x1a7 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline]
uvm_map_teardown(fffffd805908bb88) at uvm_map_teardown+0x1a7 sys/uvm/uvm_map.c:2578
uvmspace_free(fffffd805908bb88) at uvmspace_free+0xa6 sys/uvm/uvm_map.c:3504
reaper(ffff8000212337a8) at reaper+0x19a sys/kern/kern_exit.c:448
end trace frame: 0x0, count: -21
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffff800020dd8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff829fd2c8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff829fd2c8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
__mp_acquire_count(ffffffff829fd2c8,1) at __mp_acquire_count+0x48 sys/kern/kern_lock.c:227
mi_switch() at mi_switch+0x3bb sys/kern/sched_bsd.c:415
sleep_finish(ffff8000212bc350,1) at sleep_finish+0x180 sys/kern/kern_synch.c:417
tsleep(fffffd806f8d3128,11,ffffffff826274ed,0) at tsleep+0x12c sys/kern/kern_synch.c:155
biowait(fffffd806f8d3128) at biowait+0x91 sys/kern/vfs_bio.c:1268
bwrite(fffffd806f8d3128) at bwrite+0x21b sys/kern/vfs_bio.c:769
ffs_update(fffffd806e739338,1) at ffs_update+0x27d sys/ufs/ffs/ffs_inode.c:113
VOP_FSYNC(fffffd806e562cf8,fffffd807f7d7958,1,ffff8000ffff7a50) at VOP_FSYNC+0xce sys/kern/vfs_vops.c:311
sys_fsync(ffff8000ffff7a50,ffff8000212bc5d0,ffff8000212bc620) at sys_fsync+0x109 sys/kern/vfs_syscalls.c:2935
syscall(ffff8000212bc6a0) at syscall+0x438 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff8000212bc6a0) at syscall+0x438 sys/arch/amd64/amd64/trap.c:599
end trace frame: 0xffff8000212bc720, count: 0
ddb{1}> trace
x86_ipi_db(ffff800020dd8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff829fd2c8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff829fd2c8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
__mp_acquire_count(ffffffff829fd2c8,1) at __mp_acquire_count+0x48 sys/kern/kern_lock.c:227
mi_switch() at mi_switch+0x3bb sys/kern/sched_bsd.c:415
sleep_finish(ffff8000212bc350,1) at sleep_finish+0x180 sys/kern/kern_synch.c:417
tsleep(fffffd806f8d3128,11,ffffffff826274ed,0) at tsleep+0x12c sys/kern/kern_synch.c:155
biowait(fffffd806f8d3128) at biowait+0x91 sys/kern/vfs_bio.c:1268
bwrite(fffffd806f8d3128) at bwrite+0x21b sys/kern/vfs_bio.c:769
ffs_update(fffffd806e739338,1) at ffs_update+0x27d sys/ufs/ffs/ffs_inode.c:113
VOP_FSYNC(fffffd806e562cf8,fffffd807f7d7958,1,ffff8000ffff7a50) at VOP_FSYNC+0xce sys/kern/vfs_vops.c:311
sys_fsync(ffff8000ffff7a50,ffff8000212bc5d0,ffff8000212bc620) at sys_fsync+0x109 sys/kern/vfs_syscalls.c:2935
syscall(ffff8000212bc6a0) at syscall+0x438 mi_syscall sys/sys/syscall_mi.h:101 [inline]
syscall(ffff8000212bc6a0) at syscall+0x438 sys/arch/amd64/amd64/trap.c:599
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffb7ba0, count: -15

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-multicore 2022/11/13 01:27 openbsd 6f84e5f76992 f42ee5d8 .config console log report [disk image] [bsd.gdb] [kernel image] panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) vmmaplk
* Struck through repros no longer work on HEAD.