kern.securelevel: 0 -> 1 creating runtime link editor directory cache. preserving editor files. starting network daemons: sshd. starting local daemons:. Thu Nov 14 18:13:27 PST 2019 OpenBSD/amd64 (ci-openbsd-main-4.c.syzkaller.internal) (tty00) Warning: Permanently added '10.128.10.9' (ECDSA) to the list of known hosts. executing program login: kernel: protection fault trap, code=0 Stopped at amap_pp_adjref+0x2ec: movl 0(%r15,%rax,4),%r14d ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic the kernel did not panic ddb> trace amap_pp_adjref(fffffd803cdf18c0,7f0,200,1) at amap_pp_adjref+0x2ec uvm_mapent_clone(ffff8000006a2400,0,200000,7f0000,7,7) at uvm_mapent_clone+0x14c uvm_share(ffff8000006a2400,0,7,fffffd803f011880,20800000,200000) at uvm_share+0x4b4 vm_impl_init_vmx(ffff800014889c70,ffff8000ffff4c68) at vm_impl_init_vmx+0xf1 vm_create(ffff800000a64000,ffff8000ffff4c68) at vm_create+0x193 VOP_IOCTL(fffffd803c9bf8f0,c5005601,ffff800000a64000,1,fffffd803f7c6ba0,ffff8000ffff4c68) at VOP_IOCTL+0x88 vn_ioctl(fffffd8036210350,c5005601,ffff800000a64000,ffff8000ffff4c68) at vn_ioctl+0xb7 sys_ioctl(ffff8000ffff4c68,ffff8000148da218,ffff8000148da260) at sys_ioctl+0x5b9 syscall(ffff8000148da2e0) at syscall+0x507 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7fffff92b0, count: -10 ddb> show registers rdi 0x9f0 rsi 0xdfdfe9b2 rbp 0xffff8000148d9ce0 rbx 0xdfdfdfdf rdx 0 rcx 0x9d3 rax 0xffffffffdfdfe9b2 r8 0x274c __ALIGN_SIZE+0x174c r9 0x7 r10 0x352099da11e3944e r11 0x3e69b94fc2d5e00a r12 0xdfdfe9b2 r13 0x9f0 r14 0x20202021 r15 0xffff800000a65000 rip 0xffffffff8199199c amap_pp_adjref+0x2ec cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff8000148d9c20 ss 0x10 amap_pp_adjref+0x2ec: movl 0(%r15,%rax,4),%r14d ddb> show proc PROC (syz-executor8527) pid=473906 stat=onproc flags process=2 proc=0 pri=51, usrpri=51, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffff4ee0,0xffffffff82586810 process=0xffff8000148a26d8 user=0xffff8000148d5000, vmspace=0xfffffd803f011880 estcpu=1, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND *99407 473906 8583 0 7 0x2 syz-executor8527 8583 514155 30545 0 3 0x10008a pause ksh 30545 518146 10444 0 2 0x12 sshd 25171 300188 1 0 3 0x100083 ttyin getty 10444 457538 1 0 3 0x80 select sshd 44853 379485 53497 73 3 0x100090 kqread syslogd 53497 43109 1 0 3 0x100082 netio syslogd 91702 428243 1 77 3 0x100090 poll dhclient 54116 82662 1 0 3 0x80 poll dhclient 84833 457767 0 0 2 0x14200 zerothread 90732 247754 0 0 3 0x14200 aiodoned aiodoned 22178 440398 0 0 3 0x14200 syncer update 4786 21626 0 0 3 0x14200 cleaner cleaner 46170 334271 0 0 3 0x14200 reaper reaper 8974 181887 0 0 3 0x14200 pgdaemon pagedaemon 93916 64435 0 0 3 0x14200 bored crynlk 51798 420984 0 0 3 0x14200 bored crypto 92541 83075 0 0 3 0x40014200 acpi0 acpi0 6706 92897 0 0 3 0x14200 bored softnet 61929 244770 0 0 3 0x14200 bored systqmp 99993 36592 0 0 3 0x14200 bored systq 86704 44972 0 0 3 0x40014200 bored softclock 21603 411788 0 0 3 0x40014200 idle0 49056 135677 0 0 3 0x14200 bored smr 1 226764 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9438 6318K 6319K 78643K 10535 0 0 pcb 13 8K 8K 78643K 13 0 0 rtable 61 1K 2K 78643K 115 0 0 ifaddr 24 7K 7K 78643K 24 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 1 2K 2K 78643K 14 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1180 74K 74K 78643K 1185 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 1K 78643K 2 0 0 VM map 3 0K 0K 78643K 3 0 0 sem 2 0K 0K 78643K 2 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1794 195K 288K 78643K 12646 0 0 file desc 1 0K 0K 78643K 1 0 0 proc 47 38K 46K 78643K 278 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 in_multi 11 0K 0K 78643K 11 0 0 ether_multi 1 0K 0K 78643K 1 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 18 79K 79K 78643K 18 0 0 exec 0 0K 1K 78643K 151 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 54 15K 15K 78643K 707 0 0 UVM aobj 2 2K 2K 78643K 2 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 NDP 3 0K 0K 78643K 3 0 0 temp 21 3515K 3579K 78643K 1688 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 2 0 0 1 0 1 1 0 8 0 rtpcb 80 15 0 13 1 0 1 1 0 8 0 rtentry 112 23 0 1 1 0 1 1 0 8 0 unpcb 120 27 0 19 1 0 1 1 0 8 0 syncache 264 5 0 5 2 1 1 1 0 8 1 tcpcb 544 8 0 5 1 0 1 1 0 8 0 inpcb 280 22 0 16 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 97 0 0 7 0 7 7 0 8 0 art_table 32 98 0 0 1 0 1 1 0 8 0 art_node 16 22 0 2 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 1389 0 15 45 0 45 45 0 8 0 ffsino 240 1389 0 15 81 0 81 81 0 8 0 nchpl 144 1576 0 44 57 0 57 57 0 8 0 uvmvnodes 72 1398 0 0 26 0 26 26 0 8 0 vnodes 208 1398 0 0 74 0 74 74 0 8 0 namei 1024 3453 0 3453 2 1 1 1 0 8 1 vmpool 520 1 0 0 1 0 1 1 0 8 0 scxspl 192 2554 0 2554 9 8 1 7 0 8 1 plimitpl 152 13 0 8 1 0 1 1 0 8 0 sigapl 432 175 0 165 2 0 2 2 0 8 0 knotepl 112 5 0 0 1 0 1 1 0 8 0 kqueuepl 104 1 0 0 1 0 1 1 0 8 0 pipepl 128 114 0 107 2 1 1 1 0 8 0 fdescpl 424 176 0 165 2 0 2 2 0 8 0 filepl 120 834 0 790 2 0 2 2 0 8 0 lockfpl 104 5 0 4 1 0 1 1 0 8 0 lockfspl 48 3 0 2 1 0 1 1 0 8 0 sessionpl 112 17 0 9 1 0 1 1 0 8 0 pgrppl 48 17 0 9 1 0 1 1 0 8 0 ucredpl 96 47 0 40 1 0 1 1 0 8 0 zombiepl 144 165 0 165 2 1 1 1 0 8 1 processpl 864 190 0 165 4 0 4 4 0 8 0 procpl 632 190 0 165 3 0 3 3 0 8 0 sockpl 384 64 0 48 2 0 2 2 0 8 0 mcl4k 4096 10 0 10 2 1 1 1 0 8 1 mcl2k 2048 5763 0 5735 8 3 5 6 0 8 1 mtagpl 80 2 0 2 1 1 0 1 0 8 0 mbufpl 256 9892 0 9849 4 0 4 4 0 8 0 bufpl 256 2045 0 240 113 0 113 113 0 8 0 anonpl 16 18230 0 17112 7 2 5 7 0 62 0 amapchunkpl 152 547 0 512 2 0 2 2 0 158 0 amappl16 192 71 0 65 1 0 1 1 0 8 0 amappl14 176 35 0 31 1 0 1 1 0 8 0 amappl13 168 1 0 1 1 1 0 1 0 8 0 amappl12 160 7 0 7 1 1 0 1 0 8 0 amappl11 152 42 0 31 1 0 1 1 0 8 0 amappl10 144 2 0 2 1 1 0 1 0 8 0 amappl9 136 379 0 378 1 0 1 1 0 8 0 amappl8 128 81 0 77 1 0 1 1 0 8 0 amappl7 120 17 0 16 1 0 1 1 0 8 0 amappl6 112 42 0 38 1 0 1 1 0 8 0 amappl5 104 135 0 124 1 0 1 1 0 8 0 amappl4 96 395 0 371 1 0 1 1 0 8 0 amappl3 88 101 0 96 1 0 1 1 0 8 0 amappl2 80 662 0 613 3 1 2 2 0 8 0 amappl1 72 11944 0 11563 16 7 9 16 0 8 0 amappl 80 373 0 353 1 0 1 1 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 64 1 0 0 1 0 1 1 0 8 0 uaddrrnd 24 177 0 165 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 177 0 165 1 0 1 1 0 8 0 vmmpekpl 168 5302 0 5286 1 0 1 1 0 8 0 vmmpepl 168 25407 0 24663 52 16 36 48 0 357 2 vmsppl 272 175 0 165 1 0 1 1 0 8 0 pdppl 4096 360 0 330 5 0 5 5 0 8 0 pvpl 32 71484 0 68723 32 6 26 27 0 265 3 pmappl 200 176 0 165 1 0 1 1 0 8 0 extentpl 40 46 0 29 1 0 1 1 0 8 0 phpool 112 230 0 7 7 0 7 7 0 8 0