login: uvm_fault(0xfffff7006cf22018, 0x6ab787f0, 0, 1) -> e kernel: page fault trap, code=0 Stopped at rtable_l2+0x7f: movzbl 0(%rax,%rcx,4),%r14d TID PID UID PRFLAGS PFLAGS CPU COMMAND *453748 66431 0 0 0x4000000 0 syz-executor rtable_l2(0) at rtable_l2+0x7f sys/net/rtable.c:315 in_broadcast(e3000020,0) at in_broadcast+0xd8 sys/netinet/in.c:-1 tcp_connect(ffff80000158d788,fffff7006e070000) at tcp_connect+0x2ec sys/netinet/tcp_usrreq.c:665 sys_connect(ffff80002eb8afb8,ffff80002a36dfd0,ffff80002a36df20) at sys_connect+0x3f2 sys/kern/uipc_syscalls.c:420 syscall(ffff80002a36dfd0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a36dfd0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xbc8236f8230, count: 9 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: uvm_fault(0xfffff7006cf22018, 0x6ab787f0, 0, 1) -> e ddb{0}> show kasan No such command ddb{0}> trace rtable_l2(0) at rtable_l2+0x7f sys/net/rtable.c:315 in_broadcast(e3000020,0) at in_broadcast+0xd8 sys/netinet/in.c:-1 tcp_connect(ffff80000158d788,fffff7006e070000) at tcp_connect+0x2ec sys/netinet/tcp_usrreq.c:665 sys_connect(ffff80002eb8afb8,ffff80002a36dfd0,ffff80002a36df20) at sys_connect+0x3f2 sys/kern/uipc_syscalls.c:420 syscall(ffff80002a36dfd0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a36dfd0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xbc8236f8230, count: -6 ddb{0}> show registers rdi 0xffff800031b8c000 rsi 0xf3 rbp 0xffff80002a36dda0 rbx 0xfffff7006e070001 rdx 0xffff800031b8c000 rcx 0 rax 0x6ab787f0 r8 0x7f7fffffc000 r9 0 r10 0xa501c63b3f6dcef0 r11 0x31f0d2a298c50b72 r12 0x7 r13 0xffffffff r14 0 r15 0xffff800000c40d30 rip 0xffffffff81b4922f rtable_l2+0x7f cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80002a36dd60 ss 0x10 rtable_l2+0x7f: movzbl 0(%rax,%rcx,4),%r14d ddb{0}> show proc PROC (syz-executor) tid=453748 pid=66431 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=71, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002eb8b780,0xffff80002eb8ad30 process=0xffff80002a37cea0 user=0xffff80002a369000, vmspace=0xfffff7006cf22018 estcpu=21, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 55058 36053 57578 0 2 0x10 0 syz-executor 55058 511889 57578 0 2 0x10 0x4000000 syz-executor 55058 217034 57578 0 3 0x10 0x4000080 fsleep syz-executor 44689 301121 89984 0 2 0x100002 0 sh 35785 455859 31856 0 2 0 0 syz-executor 35785 424580 31856 0 3 0 0x4000080 fifor syz-executor 35785 151080 31856 0 3 0 0x4000080 fifor syz-executor 64215 453111 72058 0 2 0 0 syz-executor 64215 110661 72058 0 3 0 0x4000080 fsleep syz-executor 66431 205181 83611 0 2 0 0 syz-executor *66431 453748 83611 0 7 0 0x4000000 syz-executor 36165 280290 96293 0 2 0x2 0 syz-executor 89984 192067 96293 0 3 0x2 0x80 wait syz-executor 31856 318546 96293 0 2 0x2 0xc80 syz-executor 15477 477116 1 0 3 0x100003 0x80 ttyin getty 27728 274040 96293 0 3 0x2 0x80 piperd syz-executor 72058 375799 96293 0 2 0x2 0xc80 syz-executor 57578 262752 96293 0 3 0x2 0x80 nanoslp syz-executor 83611 265262 96293 0 3 0x2 0x80 nanoslp syz-executor 70582 173432 96293 0 2 0x2 0 syz-executor 96293 406230 1 0 2 0x2 0 syz-executor 39174 125539 0 0 3 0x14000 0x200 bored smr 91465 388742 0 0 2 0x14000 0x200 zerothread 59874 279283 0 0 3 0x14000 0x200 aiodoned aiodoned 3772 115320 0 0 3 0x14000 0x200 syncer update 22398 294919 0 0 3 0x14000 0x200 cleaner cleaner 21118 263952 0 0 3 0x14000 0x200 reaper reaper 49686 276922 0 0 3 0x14000 0x200 pgdaemon pagedaemon 92107 463753 0 0 3 0x14000 0x200 bored viomb 72837 506331 0 0 3 0x14000 0x40000200 acpi0 acpi0 61173 471373 0 0 7 0x14000 0x40000200 idle1 21176 477018 0 0 3 0x14000 0x200 bored softnet1 17183 26730 0 0 3 0x14000 0x200 bored softnet0 20059 383280 0 0 3 0x14000 0x200 smrbar systqmp 65791 287073 0 0 3 0x14000 0x200 bored systq 60080 209509 0 0 3 0x14000 0x200 tmoslp softclockmp 62141 490482 0 0 3 0x14000 0x40000200 tmoslp softclock 23667 325613 0 0 3 0x14000 0x40000200 idle0 1 245702 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks Process 66431 (syz-executor) thread 0xffff80002eb8afb8 (453748) exclusive rwlock inet46 r = 0 (0xffff80000158d7a8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 sys_connect+0x32c isdnssocket sys/kern/uipc_syscalls.c:-1 [inline] #2 sys_connect+0x32c sys/kern/uipc_syscalls.c:411 #3 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #3 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #4 Xsyscall+0x128 shared rwlock netlock r = 0 (0xffffffff8397f8f0) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413 #2 solock_shared+0x6e sys/kern/uipc_socket2.c:343 #3 sys_connect+0x32c isdnssocket sys/kern/uipc_syscalls.c:-1 [inline] #3 sys_connect+0x32c sys/kern/uipc_syscalls.c:411 #4 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #5 Xsyscall+0x128 Process 70582 (syz-executor) thread 0xffff80002a222fa0 (173432) exclusive rrwlock inode r = 0 (0xfffff7006c792c80) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576 #5 vget+0x2a2 sys/kern/vfs_subr.c:692 #6 ufs_ihashget+0x185 sys/ufs/ufs/ufs_ihash.c:98 #7 ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1203 #8 ufs_lookup+0x1a36 sys/ufs/ufs/ufs_lookup.c:478 #9 VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85 #10 vfs_lookup+0x9e3 sys/kern/vfs_lookup.c:585 #11 namei+0x7c1 sys/kern/vfs_lookup.c:250 #12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1807 #13 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #13 syscall+0xb17 sys/arch/amd64/amd64/trap.c:791 #14 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffff7007cbded68) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576 #5 vfs_lookup+0x12b sys/kern/vfs_lookup.c:431 #6 namei+0x7c1 sys/kern/vfs_lookup.c:250 #7 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1807 #8 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xb17 sys/arch/amd64/amd64/trap.c:791 #9 Xsyscall+0x128 Process 20059 (systqmp) thread 0xffff800045ffe000 (383280) shared rwlock systqmp r = 0 (0xffffffff839722e8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 taskq_thread+0x12a sys/kern/kern_task.c:442 #2 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11079 12021K 12279K 166960K 12435 0 pcb 18 14K 16K 166960K 163 0 rtable 178 5K 7K 166960K 1342 0 pf 35 17K 22K 166960K 142 0 ifaddr 35 5K 8K 166960K 189 0 ifgroup 55 2K 2K 166960K 228 0 sysctl 3 1K 9K 166960K 9 0 counters 70 37K 37K 166960K 154 0 ioctlops 0 0K 4K 166960K 1541 0 iov 0 0K 16K 166960K 10 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1303 82K 82K 166960K 1944 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 9K 166960K 7 0 VM map 2 1K 1K 166960K 2 0 sem 27 1K 1K 166960K 87 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 14 53K 89K 166960K 863 0 sigio 0 0K 0K 166960K 4 0 proc 21 33K 180K 166960K 1519 0 subproc 64 4K 5K 166960K 379 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 19 0 in_multi 70 4K 6K 166960K 463 0 ether_multi 1 0K 0K 166960K 1 0 mrt 2 0K 0K 166960K 23 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 223 996K 996K 166960K 223 0 exec 0 0K 1K 166960K 889 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 3 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 115 75K 177K 166960K 8043 0 UVM aobj 11 2K 2K 166960K 11 0 pinsyscall 17 34K 104K 166960K 2899 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 13 0 NDP 12 0K 2K 166960K 134 0 temp 33 9118K 9154K 166960K 15757 0 kqueue 2 4K 31K 166960K 81 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 108 0 108 1 0 1 1 0 8 1 rtentry 176 464 0 387 6 0 6 6 0 8 1 unpcb 144 263 0 261 4 3 1 4 0 8 0 syncache 336 7 0 7 2 1 1 1 0 8 1 tcpcb 736 76 0 74 1 0 1 1 0 8 0 arp 136 82 0 70 1 0 1 1 0 8 0 inpcb 328 625 0 622 12 10 2 12 0 8 1 nd6 152 121 0 106 1 0 1 1 0 8 0 pkpcb 40 12 0 12 1 0 1 1 0 8 1 kcovpl 48 42 0 35 1 0 1 1 0 8 0 ppxss 1192 1 0 1 1 0 1 1 0 8 1 pffrag 232 3 0 0 1 0 1 1 0 482 0 pffrnode 88 3 0 0 1 0 1 1 0 8 0 pffrent 40 3 0 0 1 0 1 1 0 8 0 pfosfp 40 1429 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1429 0 714 21 0 21 21 0 8 0 pfrktable 1344 1 0 1 1 1 0 1 0 8 0 pfsrclim 320 1 0 1 1 1 0 1 0 8 0 pftag 88 1 0 1 1 1 0 1 0 8 0 pfstitem 24 53 0 13 1 0 1 1 0 8 0 pfstkey 128 53 0 13 2 0 2 2 0 8 0 pfstate 448 53 0 13 6 0 6 6 0 8 0 pfrule 1360 23 0 17 2 0 2 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 1899 0 1526 32 2 30 32 0 8 1 art_table 40 1900 0 1526 6 1 5 6 0 8 0 art_node 32 464 0 384 1 0 1 1 0 8 0 semupl 112 2 0 2 1 1 0 1 0 8 0 semapl 72 83 0 58 1 0 1 1 0 8 0 shmpl 120 8 0 0 1 0 1 1 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 2172 0 617 98 0 98 98 0 8 0 ffsino 296 2172 0 617 120 0 120 120 0 8 0 nchpl 144 2687 0 853 69 0 69 69 0 8 0 vnodes 216 2633 0 0 147 0 147 147 0 8 0 namei 1024 14251 0 14251 3 1 2 2 0 8 2 percpumem 16 93 0 42 1 0 1 1 0 8 0 kstatmem 264 113 0 84 2 0 2 2 0 8 0 scsiplug 72 4 0 4 1 1 0 1 0 8 0 scxspl 216 10231 0 10231 11 3 8 8 1 8 8 plimitpl 152 107 0 97 1 0 1 1 0 8 0 sigapl 424 1121 0 1088 7 1 6 7 0 8 0 knotepl 120 312 0 0 10 0 10 10 0 8 0 kqueuepl 224 212 0 210 3 2 1 3 0 8 0 pipepl 344 310 0 282 9 0 9 9 0 8 6 fdescpl 528 1105 0 1088 3 0 3 3 0 8 0 filepl 160 5316 0 5165 17 5 12 17 0 8 1 lockfpl 104 91 0 90 1 0 1 1 0 8 0 lockfspl 48 43 0 42 1 0 1 1 0 8 0 sessionpl 144 68 0 65 1 0 1 1 0 8 0 pgrppl 48 111 0 100 1 0 1 1 0 8 0 ucredpl 104 893 0 889 1 0 1 1 0 8 0 zombiepl 144 1088 0 1088 1 0 1 1 0 8 1 processpl 1240 1121 0 1088 5 1 4 5 0 8 0 procpl 664 1571 0 1532 7 1 6 7 0 8 1 sockpl 752 1017 0 1012 17 13 4 17 0 8 2 mcl64k 65536 4 0 0 1 0 1 1 0 8 0 mcl16k 16384 1 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 4 0 0 1 0 1 1 0 8 0 mcl4k 4096 122 0 0 16 0 16 16 0 8 0 mcl2k 2048 30 0 0 4 0 4 4 0 8 0 mextrefs 64 26 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 219 0 0 14 0 14 14 0 8 0 bufpl 272 4347 0 105 283 0 283 283 0 8 0 anonpl 32 5502 0 0 45 0 45 45 0 247 0 amapchunkpl 152 22952 0 22645 34 0 34 34 0 158 20 amappl16 200 1539 0 1526 4 2 2 4 0 8 0 amappl15 192 1 0 1 1 1 0 1 0 8 0 amappl14 184 830 0 829 1 0 1 1 0 8 0 amappl13 176 212 0 211 1 0 1 1 0 8 0 amappl12 168 1496 0 1479 2 0 2 2 0 8 0 amappl11 160 14 0 14 1 1 0 1 0 8 0 amappl10 152 64 0 64 1 0 1 1 0 8 1 amappl9 144 275 0 275 1 0 1 1 0 8 1 amappl8 136 230 0 230 1 0 1 1 0 8 1 amappl7 128 243 0 241 1 0 1 1 0 8 0 amappl6 120 479 0 478 1 0 1 1 0 8 0 amappl5 112 98 0 97 1 0 1 1 0 8 0 amappl4 104 400 0 398 1 0 1 1 0 8 0 amappl3 96 4097 0 4042 3 0 3 3 0 8 0 amappl2 88 1103 0 1080 2 0 2 2 0 8 0 amappl1 80 15763 0 15655 15 3 12 15 0 8 8 amappl 88 6624 0 6524 5 0 5 5 0 92 0 uvmvnodes 80 113 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma2048 2048 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 8 0 8 2 2 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 10 0 0 1 0 1 1 0 8 0 uaddrrnd 24 1105 0 1088 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1105 0 1088 1 0 1 1 0 8 0 vmmpekpl 168 10779 0 10727 4 1 3 4 0 8 0 vmmpepl 168 78800 0 78102 89 3 86 89 0 357 49 vmsppl 488 1104 0 1088 5 0 5 5 0 8 0 rwobjpl 80 23885 0 23465 25 2 23 25 0 8 1 pdppl 4096 2217 0 2176 133 86 47 83 0 8 6 pvpl 32 12526 0 0 102 1 101 101 0 265 0 pmappl 256 1104 0 1088 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 608 0 93 15 0 15 15 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace rtable_l2(0) at rtable_l2+0x7f sys/net/rtable.c:315 in_broadcast(e3000020,0) at in_broadcast+0xd8 sys/netinet/in.c:-1 tcp_connect(ffff80000158d788,fffff7006e070000) at tcp_connect+0x2ec sys/netinet/tcp_usrreq.c:665 sys_connect(ffff80002eb8afb8,ffff80002a36dfd0,ffff80002a36df20) at sys_connect+0x3f2 sys/kern/uipc_syscalls.c:420 syscall(ffff80002a36dfd0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a36dfd0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xbc8236f8230, count: -6 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224 sched_idle(ffff80002999dff0) at sched_idle+0x371 sys/kern/kern_sched.c:192 end trace frame: 0x0, count: 10 ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224 sched_idle(ffff80002999dff0) at sched_idle+0x371 sys/kern/kern_sched.c:192 end trace frame: 0x0, count: -5 ddb{1}>