syzbot


panic: releasing active pmap ADDR

Status: fixed on 2021/05/14 02:24
Reported-by: syzbot+ea84cb06937afeae609d@syzkaller.appspotmail.com
Fix commit: 9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
First crash: 1122d, last: 1079d

Sample crash report:
panic: releasing active pmap 0xfffffe0094c09120
cpuid = 1
time = 1619899823
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00885517a0
vpanic() at vpanic+0x1c7/frame 0xfffffe0088551800
panic() at panic+0x43/frame 0xfffffe0088551860
pmap_release() at pmap_release+0x57d/frame 0xfffffe00885518a0
vmspace_free() at vmspace_free+0x7c/frame 0xfffffe00885518c0
vmspace_unshare() at vmspace_unshare+0xc2/frame 0xfffffe0088551900
vm_forkproc() at vm_forkproc+0x85/frame 0xfffffe0088551960
fork1() at fork1+0x537/frame 0xfffffe0088551a30
sys_rfork() at sys_rfork+0x10d/frame 0xfffffe0088551ab0
ia32_syscall() at ia32_syscall+0x237/frame 0xfffffe0088551bf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbffcfa0
KDB: enter: panic
[ thread pid 794 tid 100121 ]
Stopped at      kdb_enter+0x67: movq    $0,0x163acbe(%rip)
db> 
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs                        0x20
ds                        0x3b
es                        0x3b
fs                        0x13
gs                        0x1b
ss                           0
rax                       0x12
rcx                       0x80
rdx         0xffffffff81a21244
rbx                          0
rsp         0xfffffe0088551780
rbp         0xfffffe00885517a0
rsi                        0x1
rdi                          0
r8                           0
r9          0x8080808080808080
r10         0xfffffe0088551670
r11              0x1ff77fff59c
r12         0xffffffff82267ac0  ddb_dbbe
r13                          0
r14         0xffffffff81a7194f
r15         0xffffffff81a7194f
rip         0xffffffff8112e4c7  kdb_enter+0x67
rflags                0x200082  kernload+0x82
kdb_enter+0x67: movq    $0,0x163acbe(%rip)
db> show proc
Process 794 (syz-executor5299858) at 0xfffff8002d681538:
 state: NORMAL
 uid: 0  gids: 0, 0, 5
 parent: pid 787 at 0xfffff8002d5a1a70
 ABI: FreeBSD ELF32
 flag: 0x10080080  flag2: 0
 arguments: ./syz-executor529985851
 reaper: 0xfffff80004512538 reapsubtree: 1
 sigparent: 20
 vmspace: 0xfffffe0094c143e0
   (map 0xfffffe0094c143e0)
   (map.pmap 0xfffffe0094c144a0)
   (pmap 0xfffffe0094c14500)
 threads: 3
100119                   RunQ                                syz-executor5299858
100121                   Run     CPU 1                       syz-executor5299858
100122                   Run     CPU 0                       syz-executor5299858
db> ps
  pid  ppid  pgrp   uid  state   wmesg   wchan               cmd
  795     1   785     0  S       umtxn   0xfffff80004f37f00  syz-executor5299858
  794   787   785     0  T       (threaded)                  syz-executor5299858
100119                   RunQ                                syz-executor5299858
100121                   Run     CPU 1                       syz-executor5299858
100122                   Run     CPU 0                       syz-executor5299858
  793     1   785     0  S       umtxn   0xfffff80004f37e00  syz-executor5299858
  791     1   785     0  S       umtxn   0xfffff80004f37d00  syz-executor5299858
  787   785   785     0  S       nanslp  0xffffffff8273c8e0  syz-executor5299858
  785   783   785     0  Ss      pause   0xfffff80004fa9b20  csh
  783   694   783     0  Ss      select  0xfffff8002d490a40  sshd
  760     1   760     0  Ss+     ttyin   0xfffff800049c2cb0  getty
  759     1   759     0  Ss+     ttyin   0xfffff80004ce18b0  getty
  758     1   758     0  Ss+     ttyin   0xfffff80004ce1cb0  getty
  757     1   757     0  Ss+     ttyin   0xfffff80004ce90b0  getty
  756     1   756     0  Ss+     ttyin   0xfffff80004ce94b0  getty
  755     1   755     0  Ss+     ttyin   0xfffff80004ce98b0  getty
  754     1   754     0  Ss+     ttyin   0xfffff80004ce9cb0  getty
  753     1   753     0  Ss+     ttyin   0xfffff80004c590b0  getty
  752     1   752     0  Ss+     ttyin   0xfffff80004c594b0  getty
  750     1    24     0  S+      piperd  0xfffff80004faf2e8  logger
  749   748    24     0  S+      nanslp  0xffffffff8273c8e0  sleep
  748     1    24     0  S+      wait    0xfffff8002d450a70  sh
  698     1   698     0  Ss      nanslp  0xffffffff8273c8e0  cron
  694     1   694     0  Ss      select  0xfffff8002d490dc0  sshd
  507     1   507     0  Ss      select  0xfffff8002d490e40  syslogd
  436     1   436     0  Ss      select  0xfffff80004f8c0c0  devd
  435     1   435    65  Ss      select  0xfffff80004f8c040  dhclient
  350     1   350     0  Ss      select  0xfffff8002d490ec0  dhclient
  347     1   347     0  Ss      select  0xfffff80004f377c0  dhclient
   23     0     0     0  DL      vlruwt  0xfffff80004cc6000  [vnlru]
   22     0     0     0  DL      syncer  0xffffffff8282bd50  [syncer]
   21     0     0     0  DL      (threaded)                  [bufdaemon]
100080                   D       qsleep  0xffffffff8282ae00  [bufdaemon]
100087                   D       -       0xffffffff8220ae00  [bufspacedaemon-0]
100096                   D       sdflush 0xfffff80027091ce8  [/ worker]
   20     0     0     0  DL      psleep  0xffffffff82852c08  [vmdaemon]
   19     0     0     0  DL      (threaded)                  [pagedaemon]
100078                   D       psleep  0xffffffff82847078  [dom0]
100085                   D       launds  0xffffffff82847084  [laundry: dom0]
100086                   D       umarcl  0xffffffff815c7670  [uma]
   18     0     0     0  DL      -       0xffffffff82570c78  [rand_harvestq]
   17     0     0     0  DL      waiting 0xffffffff82eb5828  [sctp_iterator]
   16     0     0     0  DL      pftm    0xffffffff82fbc3c0  [pf purge]
   15     0     0     0  DL      -       0xffffffff8282845c  [soaiod4]
    9     0     0     0  DL      -       0xffffffff8282845c  [soaiod3]
    8     0     0     0  DL      -       0xffffffff8282845c  [soaiod2]
    7     0     0     0  DL      -       0xffffffff8282845c  [soaiod1]
    6     0     0     0  DL      (threaded)                  [cam]
100043                   D       -       0xffffffff82448140  [doneq0]
100044                   D       -       0xffffffff824480c0  [async]
100077                   D       -       0xffffffff82447f90  [scanner]
   14     0     0     0  DL      seqstat 0xfffff800045a9888  [sequencer 00]
    5     0     0     0  DL      crypto_ 0xfffff80004619d80  [crypto returns 1]
    4     0     0     0  DL      crypto_ 0xfffff80004619d30  [crypto returns 0]
    3     0     0     0  DL      crypto_ 0xffffffff828445a0  [crypto]
   13     0     0     0  DL      (threaded)                  [geom]
100034                   D       -       0xffffffff8271c120  [g_event]
100035                   D       -       0xffffffff8271c128  [g_up]
100036                   D       -       0xffffffff8271c130  [g_down]
    2     0     0     0  DL      (threaded)                  [KTLS]
100027                   D       -       0xfffff8000455d700  [thr_0]
100028                   D       -       0xfffff8000455d780  [thr_1]
   12     0     0     0  WL      (threaded)                  [intr]
100012                   I                                   [swi6: task queue]
100016                   I                                   [swi6: Giant taskq]
100018                   I                                   [swi5: fast taskq]
100029                   I                                   [swi1: netisr 0]
100030                   I                                   [swi3: vm]
100031                   I                                   [swi4: clock (0)]
100032                   I                                   [swi4: clock (1)]
100045                   I                                   [irq24: virtio_pci0]
100046                   I                                   [irq25: virtio_pci0]
100047                   I                                   [irq26: virtio_pci0]
100048                   I                                   [irq27: virtio_pci0]
100049                   I                                   [irq28: virtio_pci1]
100050                   I                                   [irq29: virtio_pci1]
100051                   I                                   [irq30: virtio_pci1]
100052                   I                                   [irq31: virtio_pci1]
100053                   I                                   [irq32: virtio_pci1]
100058                   I                                   [irq10: virtio_pci2]
100060                   I                                   [irq1: atkbd0]
100061                   I                                   [irq12: psm0]
100062                   I                                   [swi0: uart uart++]
100070                   I                                   [swi1: pf send]
100083                   I                                   [swi1: hpts]
100084                   I                                   [swi1: hpts]
   11     0     0     0  RL      (threaded)                  [idle]
100003                   CanRun                              [idle: cpu0]
100004                   CanRun                              [idle: cpu1]
    1     0     1     0  SLs     wait    0xfffff80004512538  [init]
   10     0     0     0  DL      audit_w 0xffffffff82844ab0  [audit]
    0     0     0     0  DLs     (threaded)                  [kernel]
100000                   D       swapin  0xffffffff8271c6b0  [swapper]
100005                   D       -       0xfffff80004144800  [softirq_0]
100006                   D       -       0xfffff80004144700  [softirq_1]
100007                   D       -       0xfffff80004144600  [if_io_tqg_0]
100008                   D       -       0xfffff80004144500  [if_io_tqg_1]
100009                   D       -       0xfffff80004144400  [if_config_tqg_0]
100010                   D       -       0xfffff80004561600  [kqueue_ctx taskq]
100011                   D       -       0xfffff80004561500  [in6m_free taskq]
100013                   D       -       0xfffff80004561200  [linuxkpi_irq_wq]
100014                   D       -       0xfffff80004561100  [inm_free taskq]
100015                   D       -       0xfffff80004561000  [aiod_kick taskq]
100017                   D       -       0xfffff8000455dc00  [thread taskq]
100019                   D       -       0xfffff8000455d900  [linuxkpi_short_wq_0]
100020                   D       -       0xfffff8000455d900  [linuxkpi_short_wq_1]
100021                   D       -       0xfffff8000455d900  [linuxkpi_short_wq_2]
100022                   D       -       0xfffff8000455d900  [linuxkpi_short_wq_3]
100023                   D       -       0xfffff8000455d800  [linuxkpi_long_wq_0]
100024                   D       -       0xfffff8000455d800  [linuxkpi_long_wq_1]
100025                   D       -       0xfffff8000455d800  [linuxkpi_long_wq_2]
100026                   D       -       0xfffff8000455d800  [linuxkpi_long_wq_3]
100033                   D       -       0xfffff8000455d100  [firmware taskq]
100037                   D       -       0xfffff80004618e00  [crypto_0]
100038                   D       -       0xfffff80004618e00  [crypto_1]
100054                   D       -       0xfffff80004618800  [vtnet0 rxq 0]
100055                   D       -       0xfffff80004618700  [vtnet0 txq 0]
100056                   D       -       0xfffff80004618600  [vtnet0 rxq 1]
100057                   D       -       0xfffff80004618500  [vtnet0 txq 1]
100059                   D       vtbslp  0xfffff8000495d480  [virtio_balloon]
100063                   D       -       0xfffff8000495eb00  [mca taskq]
100066                   D       -       0xffffffff81e1e101  [deadlkres]
100072                   D       -       0xfffff80004c21700  [acpi_task_0]
100073                   D       -       0xfffff80004c21700  [acpi_task_1]
100074                   D       -       0xfffff80004c21700  [acpi_task_2]
100076                   D       -       0xfffff80004618d00  [CAM taskq]
db> show all locks
Process 794 (syz-executor5299858) thread 0xfffffe0094c07a00 (100122)
exclusive sleep mutex process lock (process lock) r = 0 (0xfffff8002d681660) locked @ /syzkaller/managers/i386/kernel/sys/kern/subr_trap.c:320
db> show malloc
              Type        InUse        MemUse     Requests
           pf_hash            5        11524K            5
            devbuf         4216         4340K         4241
          tcp_hpts            5         3201K            5
             vtbuf           24         1968K           46
         sysctloid        31145         1826K        31212
              kobj          332         1328K          492
            newblk          472         1142K          619
          vfscache            3         1025K            3
               pcb           23          537K           77
          inodedep           16          518K           72
         ufs_quota            1          512K            1
          vfs_hash            1          512K            1
           callout            2          512K            2
              intr            4          472K            4
           subproc          104          217K          847
            acpica         1674          184K        55406
         vnet_data            1          168K            1
           tidhash            3          141K            3
           pagedep            8          130K           18
        tfo_ccache            1          128K            1
               sem            4          106K            4
            DEVFS1          102          102K          111
            linker          287          101K          310
               bus          995           81K         3509
          mtx_pool            2           72K            2
          syncache            1           68K            1
          acpitask            1           64K            1
       ddb_capture            1           64K            1
            module          507           64K          507
           kdtrace          170           34K          920
              temp           18           33K         1742
         hostcache            1           32K            1
               shm            1           32K            1
              umtx          252           32K          252
            DEVFS3          121           31K          131
               msg            4           30K            4
              vmem            3           26K            4
        gtaskqueue           18           26K           18
            kbdmux            6           22K            6
        DEVFS_RULE           56           20K           56
               BPF           10           18K           10
         ufs_mount            5           17K            6
              proc            3           17K            3
               tty           16           16K           16
           ithread           99           16K           99
            bus-sc           33           14K         1719
            KTRACE          100           13K          100
              kenv           93           12K           93
      eventhandler          133           12K          133
            ifaddr           30           12K           32
          routetbl           50           11K          176
              rman           84           10K          425
              GEOM           60           10K          489
         bmsafemap            2            9K           43
              UART           12            9K           12
           devstat            4            9K            4
              ksem            1            8K            1
               rpc            2            8K            2
             shmfd            1            8K            1
       pfs_vncache            1            8K            1
         pfs_nodes           20            8K           20
     audit_evclass          236            8K          294
            sglist            5            7K            5
           CAM DEV            3            6K          510
         taskqueue           57            6K           57
              cred           21            6K          244
         CAM queue            5            6K         1528
       ufs_dirhash           24            5K           24
               UMA          265            5K          265
            plimit           17            5K          337
                vt           11            5K           11
             ifnet            3            5K            3
           memdesc            1            4K            1
               MCA           32            4K           32
             evdev            4            4K            4
          filedesc            1            4K            1
            kqueue           52            4K          804
           acpisem           28            4K           28
             hhook           13            4K           13
       ether_multi           40            4K           50
           lltable           11            4K           11
           pwddesc           50            4K          797
          pf_ifnet            5            3K            6
       fpukern_ctx            3            3K            3
         in6_multi           25            3K           25
          terminal           11            3K           11
           session           20            3K           32
           uidinfo            3            3K            9
        local_apic            1            2K            1
           io_apic            1            2K            1
         ipsec-saq            2            2K            2
             lockf           17            2K           36
             selfd           27            2K         8141
         proc-args           39            2K          492
            Unitno           27            2K           39
           CAM XPT           22            2K          543
       ipsecpolicy            2            2K            2
           acpidev           20            2K           20
               msi            9            2K            9
             clone            9            2K            9
           softdep            1            1K            1
            dirrem            4            1K           28
            diradd            8            1K           37
          indirdep            4            1K            6
            sahead            1            1K            1
          secasvar            1            1K            1
       vnodemarker            2            1K           10
      NFSD session            1            1K            1
        CAM periph            4            1K          271
            select            7            1K           29
             ipsec            3            1K            3
          freefrag            6            1K           29
             nhops            6            1K            6
         toponodes            6            1K            6
            isadev            6            1K            6
             mount           16            1K           89
          pci_link           10            1K           10
          sctp_ifa            5            1K            6
            crypto            4            1K            4
            ip6ndp            4            1K            5
 encap_export_host           12            1K           12
         newdirblk            4            1K            8
             mkdir            4            1K           16
          in_multi            2            1K            4
              pfil            4            1K            4
           CAM SIM            2            1K            2
              cdev            2            1K            2
    chacha20random            1            1K            1
       inpcbpolicy           10            1K          137
               osd            3            1K           10
          sctp_ifn            2            1K            6
      NFSD lckfile            1            1K            1
     NFSD V4client            1            1K            1
             DEVFS            9            1K           10
          freefile            2            1K           22
               mld            2            1K            2
              igmp            2            1K            2
            vnodes            1            1K            1
              ktls            1            1K            1
            feeder            7            1K            7
           tcpfunc            3            1K            3
        loginclass            3            1K            7
            prison            6            1K            6
             linux            5            1K            6
        aesni_data            2            1K            2
            DEVFSP            2            1K            2
            apmdev            1            1K            1
          atkbddev            2            1K            2
     CAM dev queue            2            1K            2
 CAM I/O Scheduler            1            1K            1
          CAM path            4            1K         1034
          procdesc            1            1K            6
          pmchooks            1            1K            1
          nexusdev            7            1K            7
            soname            4            1K         3209
          filecaps            4            1K           66
               tun            3            1K            3
          sctp_vrf            1            1K            1
              vnet            1            1K            1
           entropy            2            1K           35
          acpiintr            1            1K            1
               pmc            1            1K            1
              cpus            2            1K            2
    vnet_data_free            1            1K            1
           Per-cpu            1            1K            1
          freework            1            1K           47
          p1003.1b            1            1K            1
            mqdata            0            0K            0
          pf_table            0            0K            0
           pf_rule            0            0K            0
           pf_altq            0            0K            0
           pf_osfp            0            0K            0
           pf_temp            0            0K            0
        sctp_mcore            0            0K            0
        sctp_socko            0            0K            0
         sctp_iter            0            0K            3
         sctp_mvrf            0            0K            0
         sctp_timw            0            0K            0
         sctp_cpal            0            0K            0
         sctp_cmsg            0            0K            0
         sctp_stre            0            0K            0
         sctp_athi            0            0K            0
         sctp_athm            0            0K            0
         sctp_atky            0            0K            0
         sctp_atcl            0            0K            0
         sctp_a_it            0            0K            3
         sctp_aadr            0            0K            0
         sctp_stro            0            0K            0
         sctp_stri            0            0K            0
          sctp_map            0            0K            0
       NFSD string            0            0K            0
       NFSD V4lock            0            0K            0
        madt_table            0            0K            2
          smartpqi            0            0K            0
      NFSD V4state            0            0K            0
     NFSD srvcache            0            0K            0
       msdosfs_fat            0            0K            0
     msdosfs_mount            0            0K            0
      msdosfs_node            0            0K            0
              iavf            0            0K            0
               ixl            0            0K            0
            DEVFS4            0            0K            0
            DEVFS2            0            0K            0
            gntdev            0            0K            0
       privcmd_dev            0            0K            0
        ice-resmgr            0            0K            0
         ice-osdep            0            0K            0
               ice            0            0K            0
             axgbe            0            0K            0
        evtchn_dev            0            0K            0
          xenstore            0            0K            0
         ciss_data            0            0K            0
         BACKLIGHT            0            0K            0
               xnb            0            0K            0
              xbbd            0            0K            0
               xbd            0            0K            0
           Balloon            0            0K            0
          sysmouse            0            0K            0
            vtfont            0            0K            0
          xen_intr            0            0K            0
           xen_hvm            0            0K            0
         legacydrv            0            0K            0
            qpidrv            0            0K            0
           ath_hal            0            0K            0
            athdev            0            0K            0
      dmar_idpgtbl            0            0K            0
          dmar_dom            0            0K            0
          dmar_ctx            0            0K            0
           ata_pci            0            0K            0
           ata_dma            0            0K            0
       ata_generic            0            0K            0
              isci            0            0K            0
      iommu_dmamap            0            0K            0
               amr            0            0K            0
     hyperv_socket            0            0K            0
           bxe_ilt            0            0K            0
            xenbus            0            0K            0
            pvscsi            0            0K            0
           scsi_da            0            0K           69
     vm_fictitious            0            0K            0
            ata_da            0            0K            0
           scsi_ch            0            0K            0
           scsi_cd            0            0K            0
       AHCI driver            0            0K            0
            USBdev            0            0K            0
               USB            0            0K            0
               agp            0            0K            0
           nvme_da            0            0K            0
           UMAHash            0            0K            0
           acpipwr            0            0K            0
         acpi_perf            0            0K            0
         vm_pgdata            0            0K            0
           jblocks            0            0K            0
          savedino            0            0K           17
          sentinel            0            0K            0
            jfsync            0            0K            0
            jtrunc            0            0K            0
             sbdep            0            0K            3
           jsegdep            0            0K            0
              jseg            0            0K            0
         jfreefrag            0            0K            0
          jfreeblk            0            0K            0
           jnewblk            0            0K            0
            jmvref            0            0K            0
           jremref            0            0K            0
           jaddref            0            0K            0
           freedep            0            0K            0
          freeblks            0            0K           27
        allocindir            0            0K            0
       allocdirect            0            0K            0
          ufs_trim            0            0K            0
           mactemp            0            0K            0
     audit_trigger            0            0K            0
 audit_pipe_presel            0            0K            0
     audit_pipeent            0            0K            0
        audit_pipe            0            0K            0
      audit_evname            0            0K            0
         audit_bsm            0            0K            0
      audit_gidset            0            0K            0
        audit_text            0            0K            0
        audit_path            0            0K            0
        audit_data            0            0K            0
        audit_cred            0            0K            0
             xform            0            0K            0
            twsbuf            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
         MLX5E_TLS            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
            MLX5EN            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
          MLX5DUMP            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
          seq_file            0            0K            0
             radix            0            0K            0
               idr            0            0K            0
            lkpifw            0            0K            0
               NLM            0            0K            0
    ipsec-spdcache            0            0K            0
         ipsec-reg            0            0K            0
        ipsec-misc            0            0K            0
      ipsecrequest            0            0K            0
            ip6opt            0            0K            3
       ip6_msource            0            0K            0
      ip6_moptions            0            0K            0
       in6_mfilter            0            0K            0
             frag6            0            0K            0
            tcplog            0            0K            0
        tcp_hwpace            0            0K            0
      twe_commands            0            0K            0
               LRO            0            0K            0
      newreno data            0            0K            0
        ip_msource            0            0K            0
       ip_moptions            0            0K            0
        in_mfilter            0            0K            0
              ipid            0            0K            0
         80211scan            0            0K            0
      80211ratectl            0            0K            0
        80211power            0            0K            0
       80211nodeie            0            0K            0
         80211node            0            0K            0
      80211mesh_gt            0            0K            0
      80211mesh_rt            0            0K            0
         80211perr            0            0K            0
         80211prep            0            0K            0
         80211preq            0            0K            0
          80211dfs            0            0K            0
       80211crypto            0            0K            0
          80211vap            0            0K            0
             iflib            0            0K            0
              vlan            0            0K            0
               gif            0            0K            0
           ifdescr            0            0K            0
              zlib            0            0K            0
           fadvise            0            0K            0
           VN POLL            0            0K            0
      twa_commands            0            0K            0
            statfs            0            0K          197
     namei_tracker            0            0K            0
       export_host            0            0K            0
        cl_savebuf            0            0K            6
       tcp_log_dev            0            0K            0
      midi buffers            0            0K            0
             mixer            0            0K            0
              ac97            0            0K            0
             hdacc            0            0K            0
              hdac            0            0K            0
              hdaa            0            0K            0
         acpicmbat            0            0K            0
       SIIS driver            0            0K            0
           CAM CCB            0            0K         1932
               PUC            0            0K            0
          ppbusdev            0            0K            0
agtiapi_MemAlloc malloc            0            0K            0
    osti_cacheable            0            0K            0
          tempbuff            0            0K            0
            biobuf            0            0K            0
              aios            0            0K            0
               lio            0            0K            0
               acl            0            0K            0
          tempbuff            0            0K            0
          mbuf_tag            0            0K           27
ag_tgt_map_t malloc            0            0K            0
ag_slr_map_t malloc            0            0K            0
lDevFlags * malloc            0            0K            0
tiDeviceHandle_t * malloc            0            0K            0
ag_portal_data_t malloc            0            0K            0
ag_device_t malloc            0            0K            0
     STLock malloc            0            0K            0
          CCB List            0            0K            0
            sr_iov            0            0K            0
               OCS            0            0K            0
               OCS            0            0K            0
              nvme            0            0K            0
               nvd            0            0K            0
            netmap            0            0K            0
            mwldev            0            0K            0
        MVS driver            0            0K            0
     CAM ccb queue            0            0K            0
          mrsasbuf            0            0K            0
          mpt_user            0            0K            0
          mps_user            0            0K            0
              accf            0            0K            0
               pts            0            0K            0
               iov            0            0K        13506
          ioctlops            0            0K           86
           eventfd            0            0K            0
           Witness            0            0K            0
             stack            0            0K            0
            MPSSAS            0            0K            0
               mps            0            0K            0
          mpr_user            0            0K            0
            MPRSAS            0            0K            0
               mpr            0            0K            0
            mfibuf            0            0K            0
              sbuf            0            0K          312
        md_sectors            0            0K            0
          firmware            0            0K            0
        compressor            0            0K            0
           md_disk            0            0K            0
              SWAP            0            0K            0
           malodev            0            0K            0
               LED            0            0K            0
         sysctltmp            0            0K          615
            sysctl            0            0K            3
              ekcd            0            0K            0
            dumper            0            0K            0
          sendfile            0            0K            0
              rctl            0            0K            0
          ix_sriov            0            0K            0
        aacraidcam            0            0K            0
       aacraid_buf            0            0K            0
                ix            0            0K            0
            ipsbuf            0            0K            0
             cache            0            0K            0
            iirbuf            0            0K            0
          kcovinfo            0            0K            0
      prison_racct            0            0K            0
       Fail Points            0            0K            0
             sigio            0            0K            1
filedesc_to_leader            0            0K            0
               pwd            0            0K            0
       tty console            0            0K            0
            aaccam            0            0K            0
            aacbuf            0            0K            0
              zstd            0            0K            0
            XZ_DEC            0            0K            0
            nvlist            0            0K            0
          SCSI ENC            0            0K            0
           SCSI sa            0            0K            0
         scsi_pass            0            0K            0
        isofs_node            0            0K            0
       isofs_mount            0            0K            0
     tr_raid5_data            0            0K            0
    tr_raid1e_data            0            0K            0
     tr_raid1_data            0            0K            0
     tr_raid0_data            0            0K            0
    tr_concat_data            0            0K            0
       md_sii_data            0            0K            0
   md_promise_data            0            0K            0
    md_nvidia_data            0            0K            0
   md_jmicron_data            0            0K            0
     md_intel_data            0            0K            0
       md_ddf_data            0            0K            0
         raid_data            0            0K           72
     geom_flashmap            0            0K            0
         tmpfs dir            0            0K            0
        tmpfs name            0            0K            0
       tmpfs mount            0            0K            0
           NFS FHA            0            0K            0
         newnfsmnt            0            0K            0
  newnfsclient_req            0            0K            0
   NFSCL layrecall            0            0K            0
     NFSCL session            0            0K            0
     NFSCL sockreq            0            0K            0
     NFSCL devinfo            0            0K            0
     NFSCL flayout            0            0K            0
      NFSCL layout            0            0K            0
     NFSD rollback            0            0K            0
      NFSCL diroff            0            0K            0
       NEWdirectio            0            0K            0
        NEWNFSnode            0            0K            0
         NFSCL lck            0            0K            0
      NFSCL lckown            0            0K            0
      NFSCL client            0            0K            0
       NFSCL deleg            0            0K            0
        NFSCL open            0            0K            0
       NFSCL owner            0            0K            0
            NFS fh            0            0K            0
           NFS req            0            0K            0
     NFSD usrgroup            0            0K            0
db> show uma
              Zone   Size    Used    Free    Requests  Sleeps  Bucket  Total Mem    XFree
   mbuf_jumbo_page   4096    8320     711       12722       0     254   36990976        0
              pbuf   2624       0     989           0       0       2    2595136        0
              mbuf    256    8578     707       14722       0     254    2376960        0
          BUF TRIE    144     170   13298         501       0      62    1939392        0
        malloc-384    384    4116       4        4116       0      30    1582080        0
       malloc-4096   4096     332       2         492       0       2    1368064        0
        malloc-128    128   10195      35       10214       0     126    1309440        0
       UMA Slabs 0    112    9828      33        9828       0     126    1104432        0
         FFS inode   1160     490      28         513       0       8     600880        0
            lkpimm    160       1    2324           1       0      62     372000        0
          lkpicurr    160       2    2323           2       0      62     372000        0
        RADIX NODE    144    2073     164       22119       0      62     322128        0
      malloc-65536  65536       4       0           4       0       1     262144        0
         VM OBJECT    264     930      30       12800       0      30     253440        0
             VNODE    448     519      30         544       0      30     245952        0
       malloc-4096   4096      59       1         802       0       2     245760        0
         malloc-64     64    3460     320        4456       0     254     241920        0
        256 Bucket   2048     104      12       10048       0       8     237568        0
            THREAD   1792     119       7         122       0       8     225792        0
            DEVCTL   1024       0     216         115       0       0     221184        0
         malloc-16     16   12914     336       12984       0     254     212000        0
      malloc-65536  65536       1       2         183       0       1     196608        0
         UMA Zones    768     237       2         237       0      16     183552        0
         malloc-32     32    4905     387        5711       0     254     169344        0
        malloc-128    128    1267      35       29041       0     126     166656        0
        malloc-256    256     553      62        1043       0      62     157440        0
      malloc-65536  65536       2       0           2       0       1     131072        0
       FFS2 dinode    256     490      20         512       0      62     130560        0
        malloc-128    128     937      24        1924       0     126     123008        0
          ksiginfo    112      37    1007          57       0     126     116928        0
       malloc-1024   1024     103       9         115       0      16     114688        0
         vmem btag     56    1903     101        1903       0     254     112224        0
       S VFS Cache    104     970      83        1009       0     126     109512        0
         MAP ENTRY     96     889     245       38270       0     126     108864        0
       malloc-8192   8192       9       4         138       0       1     106496        0
           VMSPACE   2544      28       8         775       0       4      91584        0
       malloc-2048   2048       2      42        1934       0       8      90112        0
          UMA Kegs    384     222       1         222       0      30      85632        0
      malloc-16384  16384       4       1         180       0       1      81920        0
      malloc-16384  16384       3       2           6       0       1      81920        0
              PROC   1336      49       5         796       0       8      72144        0
      mbuf_cluster   2048      30       2          30       0     254      65536        0
      malloc-65536  65536       1       0           1       0       1      65536        0
      malloc-65536  65536       0       1           8       0       1      65536        0
      malloc-65536  65536       1       0           1       0       1      65536        0
      malloc-32768  32768       0       2         130       0       1      65536        0
      malloc-32768  32768       2       0           2       0       1      65536        0
       malloc-4096   4096      14       1         109       0       2      61440        0
             g_bio    408       0     150        5214       0      30      61200        0
        128 Bucket   1024      39      20         572       0      16      60416        0
         filedesc0   1072      50       6         797       0       8      60032        0
        malloc-256    256     182      28         791       0      62      53760        0
        malloc-128    128     118     254         419       0     126      47616        0
         32 Bucket    256      45     135        5615       0      62      46080        0
       malloc-2048   2048       4      18         511       0       8      45056        0
         malloc-64     64     526     167       14811       0     254      44352        0
        malloc-128    128     298      43         494       0     126      43648        0
            clpbuf   2624       0      16          18       0      16      41984        0
           DIRHASH   1024      34       6          34       0      16      40960        0
       malloc-8192   8192       5       0           5       0       1      40960        0
        malloc-256    256     139      11         156       0      62      38400        0
             NAMEI   1024       0      36       12011       0      16      36864        0
       malloc-4096   4096       7       2         539       0       2      36864        0
        malloc-512    512       4      68         512       0      30      36864        0
            pcpu-8      8    4150     458        4178       0     254      36864        0
         64 Bucket    512      58      14        1383       0      30      36864        0
         malloc-64     64     483      84         695       0     254      36288        0
      malloc-32768  32768       1       0           1       0       1      32768        0
       malloc-8192   8192       3       1           5       0       1      32768        0
           pcpu-64     64     478      34         478       0     254      32768        0
        malloc-384    384      35      45         103       0      30      30720        0
        malloc-256    256      83      37         142       0      62      30720        0
            socket    944      18      14        1246       0     254      30208        0
       malloc-1024   1024      10      18        1125       0      16      28672        0
        malloc-384    384      69       1          69       0      30      26880        0
       malloc-1024   1024      18       6          22       0      16      24576        0
            ttyinq    160     135      15         300       0      62      24000        0
             tcpcb   1048       3      19           7       0     254      23056        0
           ttyoutq    256      72      18         160       0      62      23040        0
        malloc-384    384      52       8          52       0      30      23040        0
       malloc-4096   4096       3       2         201       0       2      20480        0
          8 Bucket     80      39     211         507       0     126      20000        0
         TURNSTILE    136     127      20         127       0      62      19992        0
       Mountpoints   2752       2       5           2       0       4      19264        0
      malloc-16384  16384       1       0           1       0       1      16384        0
       malloc-8192   8192       2       0           2       0       1      16384        0
       malloc-2048   2048       6       2          95       0       8      16384        0
       malloc-1024   1024      12       4          12       0      16      16384        0
       malloc-1024   1024      11       5          11       0      16      16384        0
         malloc-64     64      63     189        8201       0     254      16128        0
         malloc-64     64     127     125         155       0     254      16128        0
         malloc-32     32     335     169         433       0     254      16128        0
         malloc-32     32      70     434        3964       0     254      16128        0
        malloc-256    256      14      46         123       0      62      15360        0
        malloc-256    256      13      47         356       0      62      15360        0
              pipe    744       7      13         286       0      16      14880        0
        SLEEPQUEUE     88     127      33         127       0     126      14080        0
       malloc-2048   2048       3       3         268       0       8      12288        0
       malloc-2048   2048       6       0           6       0       8      12288        0
       malloc-2048   2048       5       1         196       0       8      12288        0
       malloc-1024   1024       5       7          21       0      16      12288        0
       malloc-1024   1024       8       4           9       0      16      12288        0
        malloc-512    512       3      21         189       0      30      12288        0
         malloc-64     64     123      66        1700       0     254      12096        0
         udp_inpcb    488       6      18         126       0     254      11712        0
              kenv    258      15      30        1049       0      30      11610        0
        malloc-256    256      20      25         614       0      62      11520        0
       malloc-8192   8192       1       0           1       0       1       8192        0
       malloc-8192   8192       1       0           1       0       1       8192        0
       malloc-8192   8192       1       0           1       0       1       8192        0
       malloc-2048   2048       3       1           3       0       8       8192        0
       malloc-1024   1024       0       8           4       0      16       8192        0
        malloc-512    512       6      10          14       0      30       8192        0
        malloc-512    512       8       8           8       0      30       8192        0
           rtentry    176      13      33          17       0      62       8096        0
              PGRP     88      20      72          32       0     126       8096        0
          rl_entry     40      31     171          31       0     254       8080        0
        sctp_laddr     48       0     168           4       0     254       8064        0
             udpcb     32       6     246         126       0     254       8064        0
               PWD     32      10     242         102       0     254       8064        0
         malloc-64     64       8     118           9       0     254       8064        0
         malloc-64     64      24     102         293       0     254       8064        0
         malloc-32     32       6     246          11       0     254       8064        0
         malloc-32     32      37     215         741       0     254       8064        0
         malloc-32     32      30     222         192       0     254       8064        0
         16 Bucket    144      35      21         200       0      62       8064        0
          4 Bucket     48       5     163          46       0     254       8064        0
          2 Bucket     32      42     210         501       0     254       8064        0
      vtnet_tx_hdr     24       0     334        1186       0     254       8016        0
             Files     80      71      29        6523       0     126       8000        0
         malloc-16     16       1     499           4       0     254       8000        0
         malloc-16     16      20     480          59       0     254       8000        0
         malloc-16     16     298     202         503       0     254       8000        0
         malloc-16     16      23     477          24       0     254       8000        0
         malloc-16     16     188     312        1429       0     254       8000        0
         malloc-16     16      26     474       25397       0     254       8000        0
         malloc-16     16      14     486          20       0     254       8000        0
        malloc-128    128       5      57          12       0     126       7936        0
        malloc-128    128      39      23          56       0     126       7936        0
        malloc-128    128      10      52          79       0     126       7936        0
             ripcb    488       1      15           4       0     254       7808        0
         tcp_inpcb    488       3      13           7       0     254       7808        0
     routing nhops    256      10      20          17       0      62       7680        0
             unpcb    256       7      23        1092       0     254       7680        0
       mbuf_packet    256       0      30          94       0     254       7680        0
        malloc-384    384       0      20          19       0      30       7680        0
        malloc-384    384       5      15         356       0      30       7680        0
        malloc-384    384      20       0          20       0      30       7680        0
        malloc-256    256      15      15         293       0      62       7680        0
     FPU_save_area    832       1       8           1       0      16       7488        0
            cpuset    104       7      55           7       0     126       6448        0
 epoch_record pcpu    256       4      12           4       0      62       4096        0
       malloc-4096   4096       0       1           3       0       2       4096        0
       malloc-2048   2048       1       1           1       0       8       4096        0
        malloc-512    512       0       8           2       0      30       4096        0
           pcpu-16     16       7     249           7       0     254       4096        0
         hostcache     64       1      62           1       0     254       4032        0
          syncache    168       0      24           5       0     254       4032        0
         malloc-32     32       0     126           2       0     254       4032        0
         malloc-32     32     103      23         227       0     254       4032        0
             KNOTE    160       0      25           8       0      62       4000        0
       UMA Slabs 1    176       8      14           8       0      62       3872        0
        malloc-384    384       1       9           2       0      30       3840        0
            mqnode    416       3       6           3       0      30       3744        0
        KMAP ENTRY     96      12      27          12       0       0       3744        0
              vmem   1856       1       1           1       0       8       3712        0
           SMR CPU     32       3      60           3       0     254       2016        0
        SMR SHARED     24       3      60           3       0     254       1512        0
       FFS1 dinode    128       0       0           0       0     126          0        0
             swblk    136       0       0           0       0      62          0        0
          swpctrie    144       0       0           0       0      62          0        0
   sctp_asconf_ack     48       0       0           0       0     254          0        0
       sctp_asconf     40       0       0           0       0     254          0        0
sctp_stream_msg_out    112       0       0           0       0     254          0        0
        sctp_readq    152       0       0           0       0     254          0        0
        sctp_chunk    152       0       0           0       0     254          0        0
        sctp_raddr    736       0       0           0       0     254          0        0
         sctp_asoc   2288       0       0           0       0     254          0        0
           sctp_ep   1280       0       0           0       0     254          0        0
   pf state scrubs     40       0       0           0       0     254          0        0
   pf frag entries     40       0       0           0       0     254          0        0
          pf frags    248       0       0           0       0      62          0        0
  pf table entries    160       0       0           0       0      62          0        0
pf table entry counters     64       0       0           0       0     254          0        0
   pf source nodes    136       0       0           0       0     254          0        0
     pf state keys     88       0       0           0       0     126          0        0
         pf states    296       0       0           0       0     254          0        0
           pf tags    104       0       0           0       0     126          0        0
          pf mtags     48       0       0           0       0     254          0        0
       tcp_bbr_pcb    832       0       0           0       0      16          0        0
       tcp_bbr_map    128       0       0           0       0     126          0        0
      tcp_rack_pcb    704       0       0           0       0      16          0        0
      tcp_rack_map    120       0       0           0       0     126          0        0
    IPsec SA lft_c     16       0       0           0       0     254          0        0
     udplite_inpcb    488       0       0           0       0     254          0        0
      tcp_log_node    120       0       0           0       0     126          0        0
    tcp_log_bucket    176       0       0           0       0      62          0        0
           tcp_log    416       0       0           0       0     254          0        0
          tcpreass     48       0       0           0       0     254          0        0
tfo_ccache_entries     80       0       0           0       0     126          0        0
               tfo      4       0       0           0       0     254          0        0
          sackhole     32       0       0           0       0     254          0        0
             tcptw     88       0       0           0       0     254          0        0
               ipq     56       0       0           0       0     254          0        0
            itimer    352       0       0           0       0      30          0        0
            AIOLIO    272       0       0           0       0      30          0        0
             AIOCB    552       0       0           0       0      16          0        0
              AIOP     32       0       0           0       0     254          0        0
               AIO    208       0       0           0       0      62          0        0
        mqnotifier    216       0       0           0       0      62          0        0
            mvdata     64       0       0           0       0     254          0        0
            mqueue    248       0       0           0       0      62          0        0
        TMPFS node    224       0       0           0       0      62          0        0
           NCLNODE    584       0       0           0       0      16          0        0
     LTS VFS Cache    360       0       0           0       0      30          0        0
       L VFS Cache    320       0       0           0       0      30          0        0
     STS VFS Cache    144       0       0           0       0      62          0        0
           cryptop    280       0       0           0       0      30          0        0
  linux_dma_object     24       0       0           0       0     254          0        0
  linux_dma_pctrie    144       0       0           0       0      62          0        0
   IOMMU_MAP_ENTRY    120       0       0           0       0     126          0        0
      ktls_session    192       0       0           0       0      62          0        0
    mbuf_jumbo_16k  16384       0       0           0       0     254          0        0
     mbuf_jumbo_9k   9216       0       0           0       0     254          0        0
      audit_record   1280       0       0           0       0       8          0        0
         domainset     40       0       0           0       0     254          0        0
        MAC labels     40       0       0           0       0     254          0        0
            vnpbuf   2624       0       0           0       0      64          0        0
            mdpbuf   2624       0       0           0       0       3          0        0
           nfspbuf   2624       0       0           0       0      16          0        0
            swwbuf   2624       0       0           0       0       8          0        0
            swrbuf   2624       0       0           0       0      16          0        0
          umtx_shm     88       0       0           0       0     126          0        0
           umtx pi     96       0       0           0       0     126          0        0
rangeset pctrie nodes    144       0       0           0       0      62          0        0
      malloc-65536  65536       0       0           0       0       1          0        0
      malloc-65536  65536       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
       malloc-8192   8192       0       0           0       0       1          0        0
       malloc-4096   4096       0       0           0       0       2          0        0
       malloc-4096   4096       0       0           0       0       2          0        0
        malloc-512    512       0       0           0       0      30          0        0
        malloc-512    512       0       0           0       0      30          0        0
        malloc-512    512       0       0           0       0      30          0        0
           pcpu-32     32       0       0           0       0     254          0        0
            pcpu-4      4       0       0           0       0     254          0        0
            fakepg    104       0       0           0       0     126          0        0
          UMA Hash    256       0       0           0       0      62          0        0

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/05/01 20:12 freebsd-src f1957db43d28 77e2b668 console log report syz C ci-freebsd-i386 panic: releasing active pmap ADDR
2021/05/01 15:34 freebsd-src a6ca7519f89c 77e2b668 console log report syz ci-freebsd-main panic: releasing active pmap ADDR
2021/04/17 14:46 freebsd-src 21afed4b1d18 7e2b734b console log report syz ci-freebsd-main panic: releasing active pmap ADDR
2021/04/06 16:06 freebsd-src e5fc416c2855 6a81331a console log report syz ci-freebsd-i386 panic: releasing active pmap ADDR
2021/03/30 05:38 freebsd-src 4d5460a720c5 6a81331a console log report syz ci-freebsd-i386 panic: releasing active pmap ADDR
2021/05/09 03:24 freebsd-src 6cb13813caa0 bc5434be console log report ci-freebsd-main panic: releasing active pmap ADDR
2021/05/01 15:22 freebsd-src a6ca7519f89c 77e2b668 console log report ci-freebsd-main panic: releasing active pmap ADDR
2021/05/12 06:52 freebsd-src b8f113cab91f 86294427 console log report ci-freebsd-i386 panic: releasing active pmap ADDR
2021/05/07 18:29 freebsd-src fb53b42e36a9 f6da8120 console log report ci-freebsd-i386 panic: releasing active pmap ADDR
2021/05/05 15:36 freebsd-src f4ba035bca92 06c27ff5 console log report ci-freebsd-i386 panic: releasing active pmap ADDR
2021/04/17 13:15 freebsd-src 86046cf55f80 7e2b734b console log report ci-freebsd-i386 panic: releasing active pmap ADDR
* Struck through repros no longer work on HEAD.