syzbot


panic(ADDR) at panic+0x164

Status: closed as invalid on 2020/07/31 06:39
Reported-by: syzbot+0d2dd5f1bc6cfbe523fb@syzkaller.appspotmail.com
First crash: 1577d, last: 1577d

Sample crash report:
panic(ffffffff8240a73d) at panic+0x164 sys/kern/subr_prf.c:218
__assert(ffffffff82474f23,ffffffff82480046,a8e,ffffffff8243b111) at __assert+0x2b sys/kern/subr_prf.c:162
uvm_map_teardown(fffffd807efff8a0) at uvm_map_teardown+0x2ce sys/uvm/uvm_map.c:2704
uvmspace_free(fffffd807efff8a0) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3646
uvm_exit(ffff800020ea3380) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297
reaper(ffff800020d89860) at reaper+0x189 sys/kern/kern_exit.c:456
end trace frame: 0x0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
pool_do_get: mbufpl free list modified: page 0xfffffd8069336000; item addr 0xfffffd8069336100; offset 0x0=0x0 != 0x43efc605495e6d49
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8240a73d) at panic+0x164 sys/kern/subr_prf.c:218
__assert(ffffffff82474f23,ffffffff82480046,a8e,ffffffff8243b111) at __assert+0x2b sys/kern/subr_prf.c:162
uvm_map_teardown(fffffd807efff8a0) at uvm_map_teardown+0x2ce sys/uvm/uvm_map.c:2704
uvmspace_free(fffffd807efff8a0) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3646
uvm_exit(ffff800020ea3380) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297
reaper(ffff800020d89860) at reaper+0x189 sys/kern/kern_exit.c:456
end trace frame: 0x0, count: -7
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020dcef60
rbx               0xffff800020dcf010
rdx                             0x8b
rcx                              0x2
rax                              0x1
r8                0xffffffff81cae1ef    kprintf+0x16f
r9                               0x1
r10                              0x2
r11               0x99813fd67476fde2
r12                     0x3000000008
r13               0xffff800020dcef70
r14                            0x104
r15                              0x1
rip               0xffffffff81a0eff8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020dcef50
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (reaper) pid=307929 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    pri=4, usrpri=55, nice=20
    forw=0xffffffffffffffff, list=0xffff800020d895f0,0xffff800020d89ae0
    process=0xffff800020dbc7c8 user=0xffff800020dca000, vmspace=0xffffffff829223c8
    estcpu=5, cpticks=14, pctcpu=0.19
    user=0, sys=2, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  5042  385962  98832      0  2        0x80                syz-executor.1
  5042   58155  98832      0  7   0x4000000                syz-executor.1
  5042  213393  98832      0  3   0x4000080  fsleep        syz-executor.1
  5042  335152  98832      0  3   0x4000080  fsleep        syz-executor.1
 55160  262482      0      0  3     0x14200  bored         sosplice
 98832  447447  25171      0  3        0x82  nanosleep     syz-executor.1
 95528  118900  25171      0  3        0x82  nanosleep     syz-executor.0
 25171  314659  41354      0  3        0x82  thrsleep      syz-fuzzer
 25171  258193  41354      0  3   0x4000082  nanosleep     syz-fuzzer
 25171  199693  41354      0  3   0x4000082  thrsleep      syz-fuzzer
 25171  224214  41354      0  3   0x4000082  thrsleep      syz-fuzzer
 25171  328432  41354      0  3   0x4000082  thrsleep      syz-fuzzer
 25171  350044  41354      0  3   0x4000082  thrsleep      syz-fuzzer
 25171  482211  41354      0  3   0x4000082  thrsleep      syz-fuzzer
 25171  170622  41354      0  3   0x4000082  kqread        syz-fuzzer
 41354  353711  63071      0  3    0x10008a  pause         ksh
 63071  260218  70633      0  3        0x92  select        sshd
 37999  122131      1      0  3    0x100083  ttyin         getty
 70633  156566      1      0  3        0x80  select        sshd
 96115  175793  84701     74  3    0x100092  bpf           pflogd
 84701  181994      1      0  3        0x80  netio         pflogd
  5860  460588  77166     73  3    0x100090  kqread        syslogd
 77166  284371      1      0  3    0x100082  netio         syslogd
 75423  469823      1     77  3    0x100090  poll          dhclient
  8281  456715      1      0  3        0x80  poll          dhclient
 36746  268798      0      0  3     0x14200  bored         smr
 57831   92084      0      0  2     0x14200                zerothread
   617  278240      0      0  3     0x14200  aiodoned      aiodoned
 54979   36900      0      0  3     0x14200  syncer        update
 82438  202867      0      0  3     0x14200  cleaner       cleaner
*10371  307929      0      0  7     0x14200                reaper
 75250  446374      0      0  3     0x14200  pgdaemon      pagedaemon
 93015  191526      0      0  3     0x14200  bored         crynlk
 22759  326247      0      0  3     0x14200  bored         crypto
 21763   71139      0      0  3  0x40014200  acpi0         acpi0
 88882  326022      0      0  3  0x40014200                idle1
 38315  230759      0      0  2     0x14200                softnet
 88327  287326      0      0  3     0x14200  bored         systqmp
 35061  504273      0      0  3     0x14200  bored         systq
 96883  352297      0      0  3  0x40014200  bored         softclock
 27558   58247      0      0  3  0x40014200                idle0
     1  264232      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
CPU 0:
exclusive mutex mbufpl r = 0 (0xffffffff82930f20)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  mtx_enter_try+0x102
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  pool_get+0xbf sys/kern/subr_pool.c:578
#4  m_copym+0x174 m_get sys/kern/uipc_mbuf.c:250 [inline]
#4  m_copym+0x174 sys/kern/uipc_mbuf.c:667
#5  ether_resolve+0x49f sys/net/if_ethersubr.c:238
#6  ether_output+0x47 ether_encap sys/net/if_ethersubr.c:321 [inline]
#6  ether_output+0x47 sys/net/if_ethersubr.c:350
#7  ip_output+0x12a2 sys/netinet/ip_output.c:509
#8  udp_output+0x5af sys/netinet/udp_usrreq.c:1017
#9  sosend+0x671 sys/kern/uipc_socket.c:555
#10 sendit+0x52b sys/kern/uipc_syscalls.c:657
#11 sys_sendto+0x80 sys/kern/uipc_syscalls.c:522
#12 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#12 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#13 Xsyscall+0x128
CPU 1:
exclusive mutex &uvm.pageqlock r = 0 (0xffffffff8290c390)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  mtx_enter_try+0x102
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  uvm_km_pgremove+0xac sys/uvm/uvm_km.c:262
#4  uvm_unmap_kill_entry+0x1a1 sys/uvm/uvm_map.c:2163
#5  uvm_unmap_remove+0x398 sys/uvm/uvm_map.c:2231
#6  uvm_unmap+0x85 vm_map_unlock_ln sys/uvm/uvm_map.c:5481 [inline]
#6  uvm_unmap+0x85 sys/uvm/uvm_map.c:2041
#7  uvm_uarea_free+0x36 sys/uvm/uvm_glue.c:287
#8  reaper+0x156 sys/kern/kern_exit.c:445
#9  proc_trampoline+0x1c
Process 5042 (syz-executor.1) thread 0xffff800020e03288 (58155)
exclusive rwlock netlock r = 0 (0xffffffff82759528)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  solock+0x5a sys/kern/uipc_socket2.c:282
#2  sosend+0x559 sys/kern/uipc_socket.c:543
#3  sendit+0x52b sys/kern/uipc_syscalls.c:657
#4  sys_sendto+0x80 sys/kern/uipc_syscalls.c:522
#5  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#5  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#6  Xsyscall+0x128
Process 10371 (reaper) thread 0xffff800020d89860 (307929)
exclusive rwlock kmmaplk r = 0 (0xffffffff827cc300)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  rw_enter+0x453 sys/kern/kern_rwlock.c:311
#2  vm_map_lock_ln+0x111 sys/uvm/uvm_map.c:5445
#3  uvm_unmap+0x6b sys/uvm/uvm_map.c:2040
#4  uvm_uarea_free+0x36 sys/uvm/uvm_glue.c:287
#5  reaper+0x156 sys/kern/kern_exit.c:445
#6  proc_trampoline+0x1c
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff828c0930)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  reaper+0x14e sys/kern/kern_exit.c:444
#2  proc_trampoline+0x1c
exclusive mutex &uvm.pageqlock r = 0 (0xffffffff8290c390)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  mtx_enter_try+0x102
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  uvm_km_pgremove+0xac sys/uvm/uvm_km.c:262
#4  uvm_unmap_kill_entry+0x1a1 sys/uvm/uvm_map.c:2163
#5  uvm_unmap_remove+0x398 sys/uvm/uvm_map.c:2231
#6  uvm_unmap+0x85 vm_map_unlock_ln sys/uvm/uvm_map.c:5481 [inline]
#6  uvm_unmap+0x85 sys/uvm/uvm_map.c:2041
#7  uvm_uarea_free+0x36 sys/uvm/uvm_glue.c:287
#8  reaper+0x156 sys/kern/kern_exit.c:445
#9  proc_trampoline+0x1c
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9505   6433K    6819K  78643K     10800        0
            pcb    13      8K       8K  78643K        55        0
         rtable   111     12K      15K  78643K       319        0
         ifaddr    63     13K      13K  78643K        97        0
       counters    43     33K      34K  78643K        49        0
       ioctlops     0      0K       4K  78643K      1517        0
            iov     0      0K      16K  78643K        18        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1219     77K      77K  78643K      1311        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         4        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      1K       1K  78643K        34        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1824    197K     290K  78643K     13058        0
      file desc     5     13K      25K  78643K       269        0
          sigio     0      0K       0K  78643K         4        0
           proc    61     63K      95K  78643K       513        0
        subproc    32      2K       2K  78643K        51        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        40        0
       in_multi    40      2K       2K  78643K        80        0
    ether_multi     1      0K       0K  78643K         8        0
            mrt     0      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    43    201K     201K  78643K        43        0
           exec     0      0K       1K  78643K       251        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   172     27K      40K  78643K      1787        0
       UVM aobj    14      2K       2K  78643K        14        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        33        0
            NDP    10      0K       0K  78643K        21        0
           temp    96   3859K    3926K  78643K      4578        0
         kqueue     3      4K       4K  78643K         3        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        8    0        2     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       25    0       23     1     0     1     1     0     8    0
rtentry    112       59    0       15     2     0     2     2     0     8    0
unpcb      120      129    0      115     1     0     1     1     0     8    0
syncache   264        8    0        8     2     1     1     1     0     8    1
tcpqe       32       64    0       64     1     1     0     1     0     8    0
tcpcb      544      105    0       65     4     1     3     3     0     8    0
inpcb      296      266    0      257     3     1     2     2     0     8    1
nd6         48       12    0        6     1     0     1     1     0     8    0
pkpcb       40        2    0        0     1     0     1     1     0     8    0
ppxss      1136       1    0        1     1     0     1     1     0     8    1
pffrag     232        6    0        2     2     1     1     1     0   482    0
pffrnode    88        6    0        2     2     1     1     1     0     8    0
pffrent     40       74    0       50     2     1     1     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344      18    0       18     1     1     0     1     0     8    0
pfstitem    24       11    0        2     1     0     1     1     0     8    0
pfstkey    112       11    0        2     1     0     1     1     0     8    0
pfstate    328       11    0        2     1     0     1     1     0     8    0
pfrule     1360      27    0       19     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      240    0       51    13     1    12    13     0     8    0
art_table   32      241    0       51     2     0     2     2     0     8    0
art_node    16       58    0       18     1     0     1     1     0     8    0
sysvmsgpl   40       10    0        5     1     0     1     1     0     8    0
semapl     112       32    0       22     1     0     1     1     0     8    0
shmpl      112       11    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1722    0      318    89     1    88    89     0     8    0
ffsino     272     1722    0      318    94     0    94    94     0     8    0
nchpl      144     2415    0      816    60     0    60    60     0     8    0
uvmvnodes   72     1829    0        0    34     0    34    34     0     8    0
vnodes     208     1829    0        0    97     0    97    97     0     8    0
namei      1024    6711    0     6711     1     0     1     1     0     8    1
percpumem   16       35    0        3     1     0     1     1     0     8    0
vmpool     560        2    0        2     1     0     1     1     0     8    1
pfiaddrpl  120        6    0        6     1     1     0     1     0     8    0
scsiplug    64        2    0        2     1     0     1     1     0     8    1
scxspl     192     7199    0     7199     8     3     5     7     0     8    5
plimitpl   152       30    0       22     1     0     1     1     0     8    0
sigapl     424      482    0      450     4     0     4     4     0     8    0
futexpl     56     4739    0     4737     1     0     1     1     0     8    0
knotepl    112       74    0       54     1     0     1     1     0     8    0
kqueuepl   144       25    0       22     1     0     1     1     0     8    0
pipepl     304      111    0      100     2     0     2     2     0     8    0
fdescpl    496      466    0      450     3     0     3     3     0     8    0
filepl     152     2597    0     2488     5     0     5     5     0     8    0
lockfpl    104       41    0       40     1     0     1     1     0     8    0
lockfspl    48       16    0       15     1     0     1     1     0     8    0
sessionpl  112       19    0        8     1     0     1     1     0     8    0
pgrppl      48       23    0       12     1     0     1     1     0     8    0
ucredpl     96      195    0      185     1     0     1     1     0     8    0
zombiepl   144      450    0      449     1     0     1     1     0     8    0
processpl  992      482    0      449     5     0     5     5     0     8    0
procpl     624      929    0      886     4     0     4     4     0     8    0
sosppl     128        1    0        1     1     0     1     1     0     8    1
sockpl     400      422    0      395     4     0     4     4     0     8    1
mcl64k     65536      4    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096       5    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     226    0        0    28     0    28    28     0     8    0
mtagpl      96       12    0        0     1     0     1     1     0     8    0
mbufpl     256      244    0        0    14     0    14    14     0     8    0
mbufpl: pool(0xffffffff82930f10:mbufpl): free list modified: page 0xfffffd8069336000; item ordinal 0; addr 0xfffffd8069336100 (p 0xfffffd8069335000); offset 0x0=0x0
pool(mbufpl): free list modified: page 0xfffffd8069336000; item ordinal 0; addr 0xfffffd8069336100 (p 0xfffffd8069335000); offset 0x0=0x0
mbufpl: pool(0xffffffff82930f10:mbufpl): page inconsistency: page 0xfffffd8069336000; item ordinal 1; addr 0x306be88f61ee3ff
bufpl      280     3972    0      128   275     0   275   275     0     8    0
anonpl      16    66101    0    48433    81     3    78    80     0   124    5
amapchunkpl 152    2425    0     2122    13     1    12    13     0   158    0
amappl16   192     2061    0     1219    54     5    49    54     0     8    6
amappl15   184       18    0       15     1     0     1     1     0     8    0
amappl14   176        3    0        1     1     0     1     1     0     8    0
amappl13   168      147    0      142     1     0     1     1     0     8    0
amappl12   160      136    0      129     1     0     1     1     0     8    0
amappl11   152       62    0       45     1     0     1     1     0     8    0
amappl10   144       17    0       14     1     0     1     1     0     8    0
amappl9    136      472    0      469     1     0     1     1     0     8    0
amappl8    128      484    0      437     2     0     2     2     0     8    0
amappl7    120      123    0      110     1     0     1     1     0     8    0
amappl6    112       32    0       24     1     0     1     1     0     8    0
amappl5    104      364    0      344     1     0     1     1     0     8    0
amappl4     96      501    0      475     1     0     1     1     0     8    0
amappl3     88      120    0      111     1     0     1     1     0     8    0
amappl2     80     2820    0     2744     2     0     2     2     0     8    0
amappl1     72    22434    0    21954    22    12    10    18     0     8    0
amappl      80     1236    0     1150     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       13    0        0     1     0     1     1     0     8    0
uaddrrnd    24      468    0      451     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      468    0      451     1     0     1     1     0     8    0
vmmpekpl   168     7553    0     7515     2     0     2     2     0     8    0
vmmpepl    168    66994    0    64811   126     9   117   124     0   357   22
vmsppl     368      467    0      451     2     0     2     2     0     8    0
pdppl      4096     943    0      902     6     0     6     6     0     8    0
pvpl        32   210096    0   189010   190     2   188   190     0   265   17
pmappl     232      467    0      451     3     1     2     2     0     8    1
extentpl    40       53    0       36     1     0     1     1     0     8    0
phpool     112      271    0        6     8     0     8     8     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffffffff826fbff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
db_enter_ddb() at db_enter_ddb+0x406 sys/arch/amd64/amd64/db_interface.c:306
db_ktrap(1,0,ffff8000222f23d0) at db_ktrap+0x199 sys/arch/amd64/amd64/db_interface.c:137
kerntrap(ffff8000222f23d0) at kerntrap+0x13a sys/arch/amd64/amd64/trap.c:293
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8249d2cc) at panic+0x164 sys/kern/subr_prf.c:218
pool_do_get(ffffffff82930f10,2,ffff8000222f2648) at pool_do_get+0x439 sys/kern/subr_pool.c:738
pool_get(ffffffff82930f10,2) at pool_get+0xeb sys/kern/subr_pool.c:581
m_copym(fffffd8069334300,0,3b9aca00,2) at m_copym+0x174 m_get sys/kern/uipc_mbuf.c:250 [inline]
m_copym(fffffd8069334300,0,3b9aca00,2) at m_copym+0x174 sys/kern/uipc_mbuf.c:667
ether_resolve(ffff80000017c2a8,fffffd8069334300,fffffd806f65f520,fffffd806f380150,ffff8000222f27e8) at ether_resolve+0x49f sys/net/if_ethersubr.c:238
ether_output(ffff80000017c2a8,fffffd8069334300,fffffd806f65f520,fffffd806f380150) at ether_output+0x47 ether_encap sys/net/if_ethersubr.c:321 [inline]
ether_output(ffff80000017c2a8,fffffd8069334300,fffffd806f65f520,fffffd806f380150) at ether_output+0x47 sys/net/if_ethersubr.c:350
end trace frame: 0xffff8000222f2950, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff826fbff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
db_enter_ddb() at db_enter_ddb+0x406 sys/arch/amd64/amd64/db_interface.c:306
db_ktrap(1,0,ffff8000222f23d0) at db_ktrap+0x199 sys/arch/amd64/amd64/db_interface.c:137
kerntrap(ffff8000222f23d0) at kerntrap+0x13a sys/arch/amd64/amd64/trap.c:293
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8249d2cc) at panic+0x164 sys/kern/subr_prf.c:218
pool_do_get(ffffffff82930f10,2,ffff8000222f2648) at pool_do_get+0x439 sys/kern/subr_pool.c:738
pool_get(ffffffff82930f10,2) at pool_get+0xeb sys/kern/subr_pool.c:581
m_copym(fffffd8069334300,0,3b9aca00,2) at m_copym+0x174 m_get sys/kern/uipc_mbuf.c:250 [inline]
m_copym(fffffd8069334300,0,3b9aca00,2) at m_copym+0x174 sys/kern/uipc_mbuf.c:667
ether_resolve(ffff80000017c2a8,fffffd8069334300,fffffd806f65f520,fffffd806f380150,ffff8000222f27e8) at ether_resolve+0x49f sys/net/if_ethersubr.c:238
ether_output(ffff80000017c2a8,fffffd8069334300,fffffd806f65f520,fffffd806f380150) at ether_output+0x47 ether_encap sys/net/if_ethersubr.c:321 [inline]
ether_output(ffff80000017c2a8,fffffd8069334300,fffffd806f65f520,fffffd806f380150) at ether_output+0x47 sys/net/if_ethersubr.c:350
ip_output(fffffd806d73ae00,0,fffffd806f65f510,0,0,fffffd806f65f4a0) at ip_output+0x12a2 sys/netinet/ip_output.c:509
udp_output(fffffd806f65f4a0,fffffd806d73ae00,0,0) at udp_output+0x5af sys/netinet/udp_usrreq.c:1017
sosend(fffffd806c873970,0,ffff8000222f2b10,0,0,0) at sosend+0x671 sys/kern/uipc_socket.c:555
sendit(ffff800020e03288,d,ffff8000222f2bf0,0,ffff8000222f2cd0) at sendit+0x52b sys/kern/uipc_syscalls.c:657
sys_sendto(ffff800020e03288,ffff8000222f2c88,ffff8000222f2cd0) at sys_sendto+0x80 sys/kern/uipc_syscalls.c:522
syscall(ffff8000222f2d50) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff8000222f2d50) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd2ce887f870, count: -21
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8240a73d) at panic+0x164 sys/kern/subr_prf.c:218
__assert(ffffffff82474f23,ffffffff82480046,a8e,ffffffff8243b111) at __assert+0x2b sys/kern/subr_prf.c:162
uvm_map_teardown(fffffd807efff8a0) at uvm_map_teardown+0x2ce sys/uvm/uvm_map.c:2704
uvmspace_free(fffffd807efff8a0) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3646
uvm_exit(ffff800020ea3380) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297
reaper(ffff800020d89860) at reaper+0x189 sys/kern/kern_exit.c:456
end trace frame: 0x0, count: 8
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8240a73d) at panic+0x164 sys/kern/subr_prf.c:218
__assert(ffffffff82474f23,ffffffff82480046,a8e,ffffffff8243b111) at __assert+0x2b sys/kern/subr_prf.c:162
uvm_map_teardown(fffffd807efff8a0) at uvm_map_teardown+0x2ce sys/uvm/uvm_map.c:2704
uvmspace_free(fffffd807efff8a0) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3646
uvm_exit(ffff800020ea3380) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297
reaper(ffff800020d89860) at reaper+0x189 sys/kern/kern_exit.c:456
end trace frame: 0x0, count: -7

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/30 23:16 openbsd 0a287e03b198 8df85ed9 .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.