syzbot


assert "_kernel_lock_held()" failed in uvm_vnode.c

Status: fixed on 2021/09/07 20:47
Reported-by: syzbot+131ed701f32e49de9ad2@syzkaller.appspotmail.com
Fix commit: 8e114673a836 vmm(4): grab kernel lock before vmspace init
First crash: 457d, last: 457d

Sample crash report:
panic: kernel diagnostic assertion "_kernel_lock_held()" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uvm_vnode.c", line 285
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*467243  67467      0           0  0x4000000    0  syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff824502ee) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff824bffea,ffffffff8244811a,11d,ffffffff824ce6c6) at __assert+0x25 sys/kern/subr_prf.c:161
uvn_reference(fffffd8072810ea0) at uvn_reference+0x84 sys/uvm/uvm_vnode.c:285
uvm_mapent_clone(fffffd806efdd8a8,1000,2000,0,7,7) at uvm_mapent_clone+0x1a2 sys/uvm/uvm_map.c:3810
uvm_share(fffffd806efdd8a8,0,7,fffffd807f008450,20000000,200000) at uvm_share+0x45c uvm_mapent_share sys/uvm/uvm_map.c:3840 [inline]
uvm_share(fffffd806efdd8a8,0,7,fffffd807f008450,20000000,200000) at uvm_share+0x45c sys/uvm/uvm_map.c:3739
vm_impl_init_vmx(ffff800021299810,ffff800021288550) at vm_impl_init_vmx+0xb4 sys/arch/amd64/amd64/vmm.c:1591
vm_create(ffff800000b57000,ffff800021288550) at vm_create+0x19b vm_impl_init sys/arch/amd64/amd64/vmm.c:1690 [inline]
vm_create(ffff800000b57000,ffff800021288550) at vm_create+0x19b sys/arch/amd64/amd64/vmm.c:1510
vmmioctl(a00,c5005601,ffff800000b57000,1,ffff800021288550) at vmmioctl+0x1f2
VOP_IOCTL(fffffd806e1f6130,c5005601,ffff800000b57000,1,fffffd807f7d8780,ffff800021288550) at VOP_IOCTL+0x9a sys/kern/vfs_vops.c:295
vn_ioctl(fffffd8067079278,c5005601,ffff800000b57000,ffff800021288550) at vn_ioctl+0xba sys/kern/vfs_vnops.c:531
sys_ioctl(ffff800021288550,ffff800021295dc8,ffff800021295e10) at sys_ioctl+0x4a2
syscall(ffff800021295e90) at syscall+0x5a9 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800021295e90) at syscall+0x5a9 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x4e4f8222470, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: kernel diagnostic assertion "_kernel_lock_held()" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uvm_vnode.c", line 285
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff824502ee) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff824bffea,ffffffff8244811a,11d,ffffffff824ce6c6) at __assert+0x25 sys/kern/subr_prf.c:161
uvn_reference(fffffd8072810ea0) at uvn_reference+0x84 sys/uvm/uvm_vnode.c:285
uvm_mapent_clone(fffffd806efdd8a8,1000,2000,0,7,7) at uvm_mapent_clone+0x1a2 sys/uvm/uvm_map.c:3810
uvm_share(fffffd806efdd8a8,0,7,fffffd807f008450,20000000,200000) at uvm_share+0x45c uvm_mapent_share sys/uvm/uvm_map.c:3840 [inline]
uvm_share(fffffd806efdd8a8,0,7,fffffd807f008450,20000000,200000) at uvm_share+0x45c sys/uvm/uvm_map.c:3739
vm_impl_init_vmx(ffff800021299810,ffff800021288550) at vm_impl_init_vmx+0xb4 sys/arch/amd64/amd64/vmm.c:1591
vm_create(ffff800000b57000,ffff800021288550) at vm_create+0x19b vm_impl_init sys/arch/amd64/amd64/vmm.c:1690 [inline]
vm_create(ffff800000b57000,ffff800021288550) at vm_create+0x19b sys/arch/amd64/amd64/vmm.c:1510
vmmioctl(a00,c5005601,ffff800000b57000,1,ffff800021288550) at vmmioctl+0x1f2
VOP_IOCTL(fffffd806e1f6130,c5005601,ffff800000b57000,1,fffffd807f7d8780,ffff800021288550) at VOP_IOCTL+0x9a sys/kern/vfs_vops.c:295
vn_ioctl(fffffd8067079278,c5005601,ffff800000b57000,ffff800021288550) at vn_ioctl+0xba sys/kern/vfs_vnops.c:531
sys_ioctl(ffff800021288550,ffff800021295dc8,ffff800021295e10) at sys_ioctl+0x4a2
syscall(ffff800021295e90) at syscall+0x5a9 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800021295e90) at syscall+0x5a9 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x4e4f8222470, count: -14
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800021295730
rbx               0xffffffff8280abff    cpu_info_full_primary+0x2bff
rdx                             0x8b
rcx                              0x2
rax                             0x8b
r8                0xffffffff81a0be34    kprintf+0x144
r9                               0x1
r10               0x815c625b4e788e4d
r11               0x996feb5efdbf862a
r12               0xffffffff8280aa00    cpu_info_full_primary+0x2a00
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff81e3e908    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800021295720
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor.0) pid=467243 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=32, usrpri=81, nice=20
    forw=0xffffffffffffffff, list=0xffff8000212887f0,0xffffffff82913618
    process=0xffff800022e9dd68 user=0xffff800021290000, vmspace=0xfffffd807f008450
    estcpu=31, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 67467  520226   5212      0  2           0                syz-executor.0
 67467  497387   5212      0  3   0x4000000  inode         syz-executor.0
 67467  227023   5212      0  2   0x4000000                syz-executor.0
*67467  467243   5212      0  7   0x4000000                syz-executor.0
 52599   59263      0      0  3     0x14280  nfsidl        nfsio
 29394  273855      0      0  3     0x14280  nfsidl        nfsio
  8322  397437      0      0  3     0x14280  nfsidl        nfsio
 26857   68782      0      0  3     0x14280  nfsidl        nfsio
  9078  351425      0      0  3     0x14280  nfsidl        nfsio
  7361  262874      0      0  3     0x14280  nfsidl        nfsio
 88791  131857      0      0  3     0x14280  nfsidl        nfsio
 25981  390079      0      0  3     0x14280  nfsidl        nfsio
 80336  412569      0      0  3     0x14280  nfsidl        nfsio
 84730  156002      0      0  3     0x14280  nfsidl        nfsio
 58469  436774      0      0  3     0x14280  nfsidl        nfsio
 78499  441573      0      0  3     0x14280  nfsidl        nfsio
 81085  419990      0      0  3     0x14280  nfsidl        nfsio
 93806  154266      0      0  3     0x14280  nfsidl        nfsio
 82252  182861      0      0  3     0x14280  nfsidl        nfsio
 66159  473517      0      0  3     0x14280  nfsidl        nfsio
 45510  116112      0      0  3     0x14280  nfsidl        nfsio
 47177  361961      0      0  3     0x14280  nfsidl        nfsio
 67319  190058      0      0  3     0x14280  nfsidl        nfsio
 22152  317130      0      0  3     0x14280  nfsidl        nfsio
 35969  451123   3389      0  2       0x482                syz-executor.1
  7394  444680      0      0  3     0x14200  bored         sosplice
  5212   92132   3389      0  3        0x82  nanoslp       syz-executor.0
  3389  486769  79378      0  3        0x82  thrsleep      syz-fuzzer
  3389  371993  79378      0  3   0x4000082  thrsleep      syz-fuzzer
  3389  242903  79378      0  3   0x4000082  thrsleep      syz-fuzzer
  3389  100352  79378      0  3   0x4000082  thrsleep      syz-fuzzer
  3389  448995  79378      0  3   0x4000082  kqread        syz-fuzzer
  3389  256088  79378      0  3   0x4000082  thrsleep      syz-fuzzer
  3389  165122  79378      0  3   0x4000082  thrsleep      syz-fuzzer
  3389  449362  79378      0  3   0x4000082  thrsleep      syz-fuzzer
 79378  440861  51441      0  3    0x10008a  sigsusp       ksh
 51441  366048  17089      0  3        0x9a  select        sshd
 35990  405797      1      0  3    0x100083  ttyin         getty
 17089  433908      1      0  3        0x88  select        sshd
 53086  366067  68358     74  3    0x100092  bpf           pflogd
 68358  235366      1      0  3        0x80  netio         pflogd
 57167  487605  95263     73  3    0x100090  kqread        syslogd
 95263   82068      1      0  3    0x100082  netio         syslogd
 86369   40221      1      0  3    0x100080  kqread        resolvd
 30414   30757   5259     77  3    0x100092  kqread        dhcpleased
 42357  280193   5259     77  3    0x100092  kqread        dhcpleased
  5259  432086      1      0  3        0x80  kqread        dhcpleased
 84273  518126      0      0  3     0x14200  bored         smr
 83397  468361      0      0  2     0x14200                zerothread
 74002  210044      0      0  3     0x14200  aiodoned      aiodoned
 17502  458486      0      0  3     0x14200  syncer        update
 30281  109712      0      0  3     0x14200  cleaner       cleaner
 12025  481039      0      0  3     0x14200  reaper        reaper
 58732  260147      0      0  3     0x14200  pgdaemon      pagedaemon
 75813  451928      0      0  3     0x14200  bored         crynlk
 57558   56620      0      0  3     0x14200  bored         crypto
  9109  124195      0      0  3     0x14200  bored         viomb
 60444  313702      0      0  3  0x40014200  acpi0         acpi0
 68317  410221      0      0  7  0x40014200                idle1
 16202  187181      0      0  3     0x14200  bored         softnet
 34802   82734      0      0  3     0x14200  bored         systqmp
 11029  260856      0      0  3     0x14200  bored         systq
 68353  387602      0      0  3  0x40014200  bored         softclock
 76861  514586      0      0  3  0x40014200                idle0
     1  373093      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 67467 (syz-executor.0) thread 0xffff8000212887f0 (227023)
exclusive rrwlock inode r = 0 (0xfffffd8064c9c4e0)
#0  witness_lock+0x4b0 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4b0 sys/kern/subr_witness.c:1182
#1  rw_enter+0x3e2 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:461
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:614
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:579
#5  vn_write+0x11d sys/kern/vfs_vnops.c:411
#6  dofilewritev+0x1a3 sys/kern/sys_generic.c:365
#7  sys_pwritev+0xb2 sys/kern/vfs_syscalls.c:3357
#8  syscall+0x5a9 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#8  syscall+0x5a9 sys/arch/amd64/amd64/trap.c:587
#9  Xsyscall+0x128
Process 67467 (syz-executor.0) thread 0xffff800021288550 (467243)
shared rwlock vmmaplk r = 0 (0xfffffd807f008468)
#0  witness_lock+0x4b0 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4b0 sys/kern/subr_witness.c:1182
#1  uvm_share+0xd2 vm_map_lock_read_ln sys/uvm/uvm_map.c:5447 [inline]
#1  uvm_share+0xd2 sys/uvm/uvm_map.c:3691
#2  vm_impl_init_vmx+0xb4 sys/arch/amd64/amd64/vmm.c:1591
#3  vm_create+0x19b vm_impl_init sys/arch/amd64/amd64/vmm.c:1690 [inline]
#3  vm_create+0x19b sys/arch/amd64/amd64/vmm.c:1510
#4  vmmioctl+0x1f2
#5  VOP_IOCTL+0x9a sys/kern/vfs_vops.c:295
#6  vn_ioctl+0xba sys/kern/vfs_vnops.c:531
#7  sys_ioctl+0x4a2
#8  syscall+0x5a9 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#8  syscall+0x5a9 sys/arch/amd64/amd64/trap.c:587
#9  Xsyscall+0x128
exclusive rwlock vmmaplk r = 0 (0xfffffd806efdd8c0)
#0  witness_lock+0x4b0 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4b0 sys/kern/subr_witness.c:1182
#1  rw_enter+0x3e2 sys/kern/kern_rwlock.c:310
#2  vm_map_lock_ln+0xda sys/uvm/uvm_map.c:5425
#3  uvm_share+0xaa vm_map_lock_read_ln sys/uvm/uvm_map.c:5446 [inline]
#3  uvm_share+0xaa sys/uvm/uvm_map.c:3691
#4  vm_impl_init_vmx+0xb4 sys/arch/amd64/amd64/vmm.c:1591
#5  vm_create+0x19b vm_impl_init sys/arch/amd64/amd64/vmm.c:1690 [inline]
#5  vm_create+0x19b sys/arch/amd64/amd64/vmm.c:1510
#6  vmmioctl+0x1f2
#7  VOP_IOCTL+0x9a sys/kern/vfs_vops.c:295
#8  vn_ioctl+0xba sys/kern/vfs_vnops.c:531
#9  sys_ioctl+0x4a2
#10 syscall+0x5a9 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#10 syscall+0x5a9 sys/arch/amd64/amd64/trap.c:587
#11 Xsyscall+0x128
exclusive rwlock vmlistlock r = 0 (0xffff800000655c78)
#0  witness_lock+0x4b0 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4b0 sys/kern/subr_witness.c:1182
#1  vm_create+0x12e vm_impl_init sys/arch/amd64/amd64/vmm.c:1688 [inline]
#1  vm_create+0x12e sys/arch/amd64/amd64/vmm.c:1510
#2  vmmioctl+0x1f2
#3  VOP_IOCTL+0x9a sys/kern/vfs_vops.c:295
#4  vn_ioctl+0xba sys/kern/vfs_vnops.c:531
#5  sys_ioctl+0x4a2
#6  syscall+0x5a9 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#6  syscall+0x5a9 sys/arch/amd64/amd64/trap.c:587
#7  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10165   6437K    6942K  78643K     12678        0
            pcb    13      8K       8K  78643K        97        0
         rtable   106     12K      12K  78643K       309        0
         ifaddr    68     13K      13K  78643K       120        0
       counters    44     34K      34K  78643K        64        0
       ioctlops     1      2K       4K  78643K      1556        0
            iov     1     12K      16K  78643K        72        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         6        0
         vnodes  1220     77K      77K  78643K      1673        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         8        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       0K  78643K       373        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12598        0
      file desc     5     13K      25K  78643K      2341        0
          sigio     0      0K       0K  78643K        20        0
           proc    70     87K     111K  78643K       440        0
        subproc    32      2K       2K  78643K        51        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        78        0
       in_multi    29      1K       2K  78643K        73        0
    ether_multi     1      0K       0K  78643K         9        0
            mrt     0      0K       0K  78643K        18        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    49    228K     228K  78643K        49        0
           exec     0      0K       2K  78643K       493        0
     pfkey data     0      0K       0K  78643K         2        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   267     51K      63K  78643K     29518        0
       UVM aobj    20      2K       2K  78643K        20        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        45        0
            NDP    12      0K       0K  78643K        28        0
           temp   131   4210K    4275K  78643K     14664        0
         kqueue    10     14K      32K  78643K        66        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120       88    0       85     1     0     1     1     0     8    0
rtentry    112       66    0       25     2     0     2     2     0     8    0
unpcb      120      414    0      399     1     0     1     1     0     8    0
syncache   296       19    0       19     5     4     1     1     0     8    1
tcpqe       32     1575    0     1575     4     3     1     3     0     8    1
tcpcb      736      239    0      234     7     5     2     2     0     8    1
arp        120        8    0        2     1     0     1     1     0     8    0
inpcb      304      587    0      579     6     4     2     2     0     8    1
rttmr       72        8    0        8     1     1     0     1     0     8    0
nd6         48       11    0        5     1     0     1     1     0     8    0
pkpcb       40        4    0        4     2     2     0     1     0     8    0
kcovpl      48        3    0        1     1     0     1     1     0     8    0
ppxss      1248       4    0        4     3     2     1     1     0     8    1
pffrag     232        9    0        9     2     1     1     1     0   482    1
pffrnode    88        9    0        9     2     1     1     1     0     8    1
pffrent     40      398    0      398     3     2     1     1     0     8    1
pfosfp      40     1448    0     1013     5     0     5     5     0     8    0
pfosfpen   112     1448    0      714    21     0    21    21     0     8    0
pfrktable  1344       6    0        6     1     1     0     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfqueue    264        2    0        2     1     1     0     1     0     8    0
pfstitem    24       53    0       27     1     0     1     1     0     8    0
pfstkey    112       53    0       27     1     0     1     1     0     8    0
pfstate    320       53    0       27     3     0     3     3     0     8    0
pfrule     1360      34    0       29     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      275    0       60    14     0    14    14     0     8    0
art_table   32      276    0       60     2     0     2     2     0     8    0
art_node    16       65    0       27     1     0     1     1     0     8    0
sysvmsgpl   40       36    0       14     1     0     1     1     0     8    0
semupl     112        3    0        3     1     1     0     1     0     8    0
semapl     112      371    0      361     1     0     1     1     0     8    0
shmpl      112       17    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     4022    0     2616    89     0    89    89     0     8    0
ffsino     272     4022    0     2616    95     0    95    95     0     8    0
nchpl      144     6817    0     5208    61     0    61    61     0     8    0
uvmvnodes   72     4405    0        0    81     0    81    81     0     8    0
vnodes     224     4405    0        0   260     0   260   260     0     8    0
namei      1024   16786    0    16786     2     1     1     1     0     8    1
percpumem   16       44    0       10     1     0     1     1     0     8    0
vcpupl     2048       2    0        0     1     0     1     1     0     8    0
vmpool     560        3    0        0     1     0     1     1     0     8    0
pfiaddrpl  120        2    0        2     1     1     0     1     0     8    0
scsiplug    72        1    0        1     1     0     1     1     0     8    1
scxspl     216    20041    0    20041    10     9     1     8     0     8    1
plimitpl   152       56    0       47     1     0     1     1     0     8    0
sigapl     424     2609    0     2554     8     1     7     7     0     8    0
futexpl     56    20505    0    20505     1     0     1     1     0     8    1
knotepl    112       85    0        0     3     0     3     3     0     8    0
kqueuepl   216     2143    0     2135     2     1     1     2     0     8    0
pipepl     336      209    0      198     6     4     2     2     0     8    0
fdescpl    496     2572    0     2554     3     0     3     3     0     8    0
filepl     152     8519    0     8401     8     2     6     6     0     8    1
lockfpl    104      230    0      227     1     0     1     1     0     8    0
lockfspl    48       59    0       56     1     0     1     1     0     8    0
sessionpl  144       19    0        8     1     0     1     1     0     8    0
pgrppl      48       23    0       12     1     0     1     1     0     8    0
ucredpl     96      643    0      629     1     0     1     1     0     8    0
zombiepl   144     2554    0     2553     2     1     1     1     0     8    0
processpl  1072    2609    0     2553     4     0     4     4     0     8    0
procpl     672     5252    0     5186     9     3     6     6     0     8    0
sosppl     168       13    0       13     5     5     0     1     0     8    0
sockpl     480     1098    0     1072     9     4     5     5     0     8    1
mcl64k     65536      6    0        0     1     0     1     1     0     8    0
mcl16k     16384      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      7    0        0     1     0     1     1     0     8    0
mcl9k      9216       3    0        0     1     0     1     1     0     8    0
mcl8k      8192       5    0        0     1     0     1     1     0     8    0
mcl4k      4096      10    0        0     2     0     2     2     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048     459    0        0    57     0    57    57     0     8    0
mtagpl      96       68    0        0     2     0     2     2     0     8    0
mbufpl     256      589    0        0    37     0    37    37     0     8    0
bufpl      280     6118    0      141   427     0   427   427     0     8    0
anonpl      24   666495    0   644905   188    50   138   158     0   186    3
amapchunkpl 152   70395    0    69667    49    19    30    43     0   158    0
amappl16   200     5508    0     4749    67    27    40    52     0     8    0
amappl15   192        1    0        0     1     0     1     1     0     8    0
amappl14   184     2044    0     2039     1     0     1     1     0     8    0
amappl13   176       45    0       43     1     0     1     1     0     8    0
amappl12   168       16    0       15     1     0     1     1     0     8    0
amappl11   160      311    0      296     1     0     1     1     0     8    0
amappl10   152       51    0       41     1     0     1     1     0     8    0
amappl9    144      247    0      245     1     0     1     1     0     8    0
amappl8    136      426    0      372     2     0     2     2     0     8    0
amappl7    128       78    0       63     1     0     1     1     0     8    0
amappl6    120      129    0      117     1     0     1     1     0     8    0
amappl5    112     1326    0     1308     1     0     1     1     0     8    0
amappl4    104     2047    0     2016     1     0     1     1     0     8    0
amappl3     96      126    0      123     1     0     1     1     0     8    0
amappl2     88      526    0      472     2     0     2     2     0     8    0
amappl1     80    47769    0    47323    15     5    10    13     0     8    0
amappl      88    29003    0    28813     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       19    0        0     1     0     1     1     0     8    0
uaddrrnd    24     2575    0     2554     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2575    0     2554     1     0     1     1     0     8    0
vmmpekpl   168    17613    0    17581     2     0     2     2     0     8    0
vmmpepl    168   290641    0   288490   157    35   122   129     0   357   24
vmsppl     368     2574    0     2554     2     0     2     2     0     8    0
rwobjpl     56    51761    0    50196    31     8    23    26     0     8    0
pdppl      4096    5158    0     5110    66    18    48    50     0     8    0
pvpl        32  1682298    0  1657089   283    59   224   246     0   265   13
pmappl     224     2574    0     2554     4     2     2     2     0     8    0
extentpl    40       58    0       40     1     0     1     1     0     8    0
phpool     112      390    0       31    11     0    11    11     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff824502ee) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff824bffea,ffffffff8244811a,11d,ffffffff824ce6c6) at __assert+0x25 sys/kern/subr_prf.c:161
uvn_reference(fffffd8072810ea0) at uvn_reference+0x84 sys/uvm/uvm_vnode.c:285
uvm_mapent_clone(fffffd806efdd8a8,1000,2000,0,7,7) at uvm_mapent_clone+0x1a2 sys/uvm/uvm_map.c:3810
uvm_share(fffffd806efdd8a8,0,7,fffffd807f008450,20000000,200000) at uvm_share+0x45c uvm_mapent_share sys/uvm/uvm_map.c:3840 [inline]
uvm_share(fffffd806efdd8a8,0,7,fffffd807f008450,20000000,200000) at uvm_share+0x45c sys/uvm/uvm_map.c:3739
vm_impl_init_vmx(ffff800021299810,ffff800021288550) at vm_impl_init_vmx+0xb4 sys/arch/amd64/amd64/vmm.c:1591
vm_create(ffff800000b57000,ffff800021288550) at vm_create+0x19b vm_impl_init sys/arch/amd64/amd64/vmm.c:1690 [inline]
vm_create(ffff800000b57000,ffff800021288550) at vm_create+0x19b sys/arch/amd64/amd64/vmm.c:1510
vmmioctl(a00,c5005601,ffff800000b57000,1,ffff800021288550) at vmmioctl+0x1f2
VOP_IOCTL(fffffd806e1f6130,c5005601,ffff800000b57000,1,fffffd807f7d8780,ffff800021288550) at VOP_IOCTL+0x9a sys/kern/vfs_vops.c:295
vn_ioctl(fffffd8067079278,c5005601,ffff800000b57000,ffff800021288550) at vn_ioctl+0xba sys/kern/vfs_vnops.c:531
sys_ioctl(ffff800021288550,ffff800021295dc8,ffff800021295e10) at sys_ioctl+0x4a2
syscall(ffff800021295e90) at syscall+0x5a9 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800021295e90) at syscall+0x5a9 sys/arch/amd64/amd64/trap.c:587
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x4e4f8222470, count: -14
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffff800020d38ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
acpicpu_idle() at acpicpu_idle+0x2eb sys/dev/acpi/acpicpu.c:1206
sched_idle(ffff800020d38ff0) at sched_idle+0x417 sys/kern/kern_sched.c:178
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff800020d38ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
acpicpu_idle() at acpicpu_idle+0x2eb sys/dev/acpi/acpicpu.c:1206
sched_idle(ffff800020d38ff0) at sched_idle+0x417 sys/kern/kern_sched.c:178
end trace frame: 0x0, count: -5

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2021/09/01 03:56 openbsd 444296aeff58 7eb7e152 .config log report assert "_kernel_lock_held()" failed in uvm_vnode.c
ci-openbsd-multicore 2021/09/01 03:52 openbsd 444296aeff58 7eb7e152 .config log report assert "_kernel_lock_held()" failed in uvm_vnode.c
ci-openbsd-multicore 2021/09/01 03:46 openbsd 444296aeff58 7eb7e152 .config log report assert "_kernel_lock_held()" failed in uvm_vnode.c
ci-openbsd-multicore 2021/09/01 03:38 openbsd 444296aeff58 7eb7e152 .config log report assert "_kernel_lock_held()" failed in uvm_vnode.c
* Struck through repros no longer work on HEAD.