uvm_fault(0xffffffff825f4ea0, 0xffff800000b6a06e, 0, 1) -> e kernel: page fault trap, code=0 Stopped at rtable_satoplen+0x150: movzbl 0xffffffffffffffff(%r13),%r12d ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic kernel page fault uvm_fault(0xffffffff825f4ea0, 0xffff800000b6a06e, 0, 1) -> e rtable_satoplen(2,ffff800000b69f78) at rtable_satoplen+0x150 sys/net/rtable.c:894 end trace frame: 0xffff800021b9ae90, count: 0 ddb{1}> trace rtable_satoplen(2,ffff800000b69f78) at rtable_satoplen+0x150 sys/net/rtable.c:894 rtable_lookup(0,fffffd8063da9c20,ffff800000b69f78,ffff800000b69f58,4) at rtable_lookup+0xeb sys/net/rtable.c:391 rtrequest_delete(ffff800021b9af30,4,ffff800000b4d800,ffff800021b9b000,0) at rtrequest_delete+0xe3 sys/net/route.c:775 rt_ifa_del(ffff800000b69f00,800100,ffff800000b69f58,0) at rt_ifa_del+0x3c3 sys/net/route.c:1191 in_ioctl_change_ifaddr(8040691a,ffff800021b9b290,ffff800000b4d800,1) at in_ioctl_change_ifaddr+0x355 in_remove_prefix sys/netinet/in.c:738 [inline] in_ioctl_change_ifaddr(8040691a,ffff800021b9b290,ffff800000b4d800,1) at in_ioctl_change_ifaddr+0x355 in_ifscrub sys/netinet/in.c:562 [inline] in_ioctl_change_ifaddr(8040691a,ffff800021b9b290,ffff800000b4d800,1) at in_ioctl_change_ifaddr+0x355 sys/netinet/in.c:432 in_ioctl(8040691a,ffff800021b9b290,ffff800000b4d800,1) at in_ioctl+0x205 sys/netinet/in.c:234 ifioctl(fffffd807d8b7330,8040691a,ffff800021b9b290,ffff800020ab0780) at ifioctl+0xb64 sys/net/if.c:2202 sys_ioctl(ffff800020ab0780,ffff800021b9b3a8,ffff800021b9b3f0) at sys_ioctl+0x5b9 syscall(ffff800021b9b470) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline] syscall(ffff800021b9b470) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555 Xsyscall(6,0,ffffffffffffff36,0,3,470881a8010) at Xsyscall+0x128 end of kernel end trace frame: 0x4732a9d1d80, count: -10 ddb{1}> show registers rdi 0 rsi 0xf7 rbp 0xffff800021b9adf0 rbx 0xffffffffffffff0d rdx 0xffff800000b69f7c rcx 0xffff800000b6a06f rax 0xffff800000b6a06f r8 0x4 r9 0x7 r10 0x453488db0132100b r11 0xdf9e7bc1fafdb19 r12 0 r13 0xffff800000b6a06f r14 0xffffffff824cb908 inetdomain r15 0x4 rip 0xffffffff816afad0 rtable_satoplen+0x150 cs 0x8 rflags 0x10293 __ALIGN_SIZE+0xf293 rsp 0xffff800021b9ada0 ss 0x10 rtable_satoplen+0x150: movzbl 0xffffffffffffffff(%r13),%r12d ddb{1}> show proc PROC (syz-executor.1) pid=75664 stat=onproc flags process=0 proc=4000000 pri=78, usrpri=78, nice=20 forw=0xffffffffffffffff, list=0xffff800020ab1650,0xffff800020ab02a0 process=0xffff800020adc700 user=0xffff800021b96000, vmspace=0xfffffd807f00ba10 estcpu=36, cpticks=1, pctcpu=0.0 user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 91980 321998 75978 0 2 0 syz-executor.1 *91980 75664 75978 0 7 0x4000000 syz-executor.1 91980 423826 75978 0 7 0x4000000 syz-executor.1 91980 238505 75978 0 3 0x4000080 fsleep syz-executor.1 75978 507875 25285 0 3 0x82 nanosleep syz-executor.1 8935 159093 25285 0 3 0x82 nanosleep syz-executor.0 38128 135508 0 0 3 0x14200 acct acct 838 453829 1 0 3 0x100083 ttyopn getty 44951 423155 0 0 3 0x14200 bored sosplice 25285 262772 93252 0 3 0x82 thrsleep syz-fuzzer 25285 139672 93252 0 3 0x4000082 thrsleep syz-fuzzer 25285 440799 93252 0 3 0x4000082 thrsleep syz-fuzzer 25285 266237 93252 0 3 0x4000082 thrsleep syz-fuzzer 25285 280148 93252 0 3 0x4000082 thrsleep syz-fuzzer 25285 386877 93252 0 3 0x4000082 kqread syz-fuzzer 25285 481927 93252 0 3 0x4000082 thrsleep syz-fuzzer 25285 478925 93252 0 3 0x4000082 thrsleep syz-fuzzer 25285 389528 93252 0 3 0x4000082 thrsleep syz-fuzzer 25285 391978 93252 0 3 0x4000082 thrsleep syz-fuzzer 93252 249346 23885 0 3 0x10008a pause ksh 23885 287657 48914 0 3 0x92 select sshd 48914 490872 1 0 3 0x80 select sshd 83319 286890 7792 74 3 0x100092 bpf pflogd 7792 76486 1 0 3 0x80 netio pflogd 13603 70243 91129 73 3 0x100090 kqread syslogd 91129 266269 1 0 3 0x100082 netio syslogd 41052 144706 1 77 3 0x100090 poll dhclient 87213 433352 1 0 3 0x80 poll dhclient 30785 361136 0 0 3 0x14200 pgzero zerothread 73653 211005 0 0 3 0x14200 aiodoned aiodoned 7748 351646 0 0 3 0x14200 syncer update 86147 325077 0 0 3 0x14200 cleaner cleaner 54198 389275 0 0 3 0x14200 reaper reaper 91351 375431 0 0 3 0x14200 pgdaemon pagedaemon 86020 366483 0 0 3 0x14200 bored crynlk 2181 122330 0 0 3 0x14200 bored crypto 23392 273127 0 0 3 0x40014200 acpi0 acpi0 21288 292382 0 0 3 0x40014200 idle1 35043 136835 0 0 3 0x14200 bored softnet 52902 381771 0 0 3 0x14200 bored systqmp 9959 12565 0 0 3 0x14200 bored systq 29830 108764 0 0 3 0x40014200 bored softclock 64290 389630 0 0 3 0x40014200 idle0 16289 371569 0 0 3 0x14200 bored smr 1 423614 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks Process 91980 (syz-executor.1) thread 0xffff800020ab0780 (75664) exclusive rwlock netlock r = 0 (0xffffffff824d2b38) #0 witness_lock+0x52e sys/kern/subr_witness.c:1163 #1 in_ioctl_change_ifaddr+0x3f #2 in_ioctl+0x205 sys/netinet/in.c:234 #3 ifioctl+0xb64 sys/net/if.c:2202 #4 sys_ioctl+0x5b9 #5 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline] #5 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555 #6 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 1 (0xffffffff82672458) #0 witness_lock+0x52e sys/kern/subr_witness.c:1163 #1 syscall+0x400 mi_syscall sys/sys/syscall_mi.h:83 [inline] #1 syscall+0x400 sys/arch/amd64/amd64/trap.c:555 #2 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9632 6473K 8971K 78643K 21845 0 0 pcb 15 10K 12K 78643K 1072 0 0 rtable 106 13K 14K 78643K 3374 0 0 ifaddr 103 25K 30K 78643K 1049 0 0 counters 39 33K 33K 78643K 39 0 0 ioctlops 0 0K 4K 78643K 1728 0 0 iov 0 0K 32K 78643K 1037 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1223 77K 77K 78643K 5816 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 9K 78643K 71 0 0 VM map 43 21K 21K 78643K 54 0 0 sem 12 0K 0K 78643K 984 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1808 196K 290K 78643K 12765 0 0 file desc 5 13K 25K 78643K 5019 0 0 sigio 0 0K 0K 78643K 74 0 0 proc 62 63K 95K 78643K 2125 0 0 subproc 32 2K 2K 78643K 527 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 1K 78643K 448 0 0 in_multi 25 1K 2K 78643K 577 0 0 ether_multi 1 0K 0K 78643K 62 0 0 mrt 0 0K 0K 78643K 31 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 96 424K 424K 78643K 96 0 0 exec 0 0K 1K 78643K 1365 0 0 pfkey data 0 0K 4K 78643K 2 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 173 336K 336K 78643K 19407 0 0 UVM aobj 130 6K 6K 78643K 136 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 2K 78643K 1697 0 0 NDP 26 0K 1K 78643K 326 0 0 temp 271 3566K 4204K 78643K 150125 0 0 kqueue 0 0K 0K 78643K 56 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 115 0 110 1 0 1 1 0 8 0 plcache 128 20 0 0 1 0 1 1 0 8 0 rtpcb 80 1207 0 1205 1 0 1 1 0 8 0 rtentry 112 550 0 516 2 0 2 2 0 8 0 unpcb 120 3093 0 3079 4 3 1 2 0 8 0 syncache 264 33 0 33 13 13 0 1 0 8 0 sackhl 24 1 0 1 1 1 0 1 0 8 0 tcpqe 32 125 0 125 10 10 0 1 0 8 0 tcpcb 544 5070 0 5064 32 31 1 14 0 8 0 inpcb 280 12658 0 12645 26 24 2 9 0 8 1 rttmr 72 10 0 9 3 2 1 1 0 8 0 ip6q 72 4 0 4 2 2 0 1 0 8 0 ip6af 40 12 0 12 2 2 0 1 0 8 0 nd6 48 74 0 72 3 2 1 1 0 8 0 pkpcb 40 26 0 26 12 12 0 1 0 8 0 swfcl 56 2 0 0 1 0 1 1 0 8 0 ppxss 1128 150 0 150 22 21 1 1 0 8 1 pffrag 232 115 0 115 24 23 1 1 0 482 1 pffrnode 88 115 0 115 24 23 1 1 0 8 1 pffrent 40 3961 0 3961 24 23 1 1 0 8 1 pfosfp 40 846 0 423 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 474 0 409 1 0 1 1 0 8 0 pfstkey 112 476 0 411 4 1 3 3 0 8 0 pfstate 328 476 0 410 10 3 7 7 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 15 0 14 10 8 2 3 0 8 1 art_heap4 256 2341 0 2144 44 28 16 17 0 8 0 art_table 32 2356 0 2158 7 4 3 3 0 8 0 art_node 16 549 0 518 1 0 1 1 0 8 0 sysvmsgpl 40 30 0 19 2 1 1 1 0 8 0 semapl 112 980 0 970 1 0 1 1 0 8 0 shmpl 112 134 0 6 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 9785 0 8361 48 1 47 47 0 8 1 ffsino 272 9785 0 8361 96 0 96 96 0 8 0 nchpl 144 17449 0 16996 61 39 22 61 0 8 0 uvmvnodes 72 5926 0 0 108 0 108 108 0 8 0 vnodes 208 5926 0 0 312 0 312 312 0 8 0 namei 1024 63184 0 63184 2 1 1 1 0 8 1 percpumem 16 30 0 0 1 0 1 1 0 8 0 vcpupl 1984 41 0 0 6 0 6 6 0 8 0 vmpool 552 52 0 11 7 4 3 3 0 8 0 scsiplug 64 1 0 1 1 1 0 1 0 8 0 scxspl 192 59522 0 59522 43 40 3 7 0 8 3 plimitpl 152 425 0 417 1 0 1 1 0 8 0 sigapl 432 5133 0 5118 3 1 2 3 0 8 0 futexpl 56 117287 0 117286 2 1 1 1 0 8 0 knotepl 112 1443 0 1424 7 6 1 3 0 8 0 kqueuepl 104 1570 0 1568 7 6 1 4 0 8 0 pipepl 112 3010 0 2991 6 5 1 2 0 8 0 fdescpl 488 5134 0 5118 3 0 3 3 0 8 0 filepl 152 50523 0 50419 42 37 5 14 0 8 1 lockfpl 104 2075 0 2074 1 0 1 1 0 8 0 lockfspl 48 742 0 741 1 0 1 1 0 8 0 sessionpl 112 48 0 37 1 0 1 1 0 8 0 pgrppl 48 72 0 61 1 0 1 1 0 8 0 ucredpl 96 8731 0 8722 1 0 1 1 0 8 0 zombiepl 144 5119 0 5118 2 1 1 1 0 8 0 processpl 896 5152 0 5118 4 0 4 4 0 8 0 procpl 632 17066 0 17020 7 2 5 5 0 8 1 srpgc 64 46 0 46 17 17 0 1 0 8 0 sosppl 128 102 0 101 17 16 1 1 0 8 0 sockpl 384 17124 0 17094 43 38 5 15 0 8 0 mcl64k 65536 516 0 0 65 29 36 65 0 8 0 mcl16k 16384 17 0 0 3 0 3 3 0 8 0 mcl12k 12288 44 0 0 2 0 2 2 0 8 0 mcl9k 9216 23 0 0 2 0 2 2 0 8 0 mcl8k 8192 33 0 0 4 1 3 3 0 8 0 mcl4k 4096 23 0 0 3 0 3 3 0 8 0 mcl2k2 2112 6 0 0 1 0 1 1 0 8 0 mcl2k 2048 235 0 0 23 7 16 23 0 8 0 mtagpl 80 65 0 0 1 0 1 1 0 8 0 mbufpl 256 987 0 0 45 1 44 44 0 8 0 bufpl 256 24695 0 17647 441 0 441 441 0 8 0 anonpl 16 683362 0 664460 227 136 91 95 0 124 7 amapchunkpl 152 38765 0 38595 83 75 8 21 0 158 0 amappl16 192 31611 0 30538 268 206 62 67 0 8 8 amappl15 184 766 0 766 5 4 1 1 0 8 1 amappl14 176 1386 0 1381 1 0 1 1 0 8 0 amappl13 168 842 0 842 5 5 0 1 0 8 0 amappl12 160 247 0 246 2 1 1 1 0 8 0 amappl11 152 512 0 494 1 0 1 1 0 8 0 amappl10 144 413 0 409 1 0 1 1 0 8 0 amappl9 136 1904 0 1896 1 0 1 1 0 8 0 amappl8 128 1425 0 1385 2 0 2 2 0 8 0 amappl7 120 557 0 548 1 0 1 1 0 8 0 amappl6 112 488 0 472 1 0 1 1 0 8 0 amappl5 104 648 0 633 1 0 1 1 0 8 0 amappl4 96 5598 0 5566 1 0 1 1 0 8 0 amappl3 88 1521 0 1513 1 0 1 1 0 8 0 amappl2 80 39172 0 39096 3 1 2 3 0 8 0 amappl1 72 126313 0 125875 25 15 10 20 0 8 0 amappl 80 17904 0 17836 2 0 2 2 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 135 0 6 3 0 3 3 0 8 0 uaddrrnd 24 5186 0 5118 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 5186 0 5118 1 0 1 1 0 8 0 vmmpekpl 168 43634 0 43592 3 0 3 3 0 8 0 vmmpepl 168 668882 0 666565 403 260 143 143 0 357 34 vmsppl 368 5133 0 5118 2 0 2 2 0 8 0 pdppl 4096 10379 0 10299 14 3 11 11 0 8 0 pvpl 32 1731683 0 1709784 437 217 220 224 0 265 35 pmappl 232 5185 0 5129 6 2 4 4 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 791 0 112 20 0 20 20 0 8 0