*cpu1: uvm_fault(0xfffff6006ccbf208, 0x98, 0, 1) -> e ddb{0}> show kasan No such command ddb{0}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x766cb4c15210, count: -1 ddb{0}> show registers rdi 0 rsi 0 rbp 0xffff80003c3ef650 rbx 0 rdx 0 rcx 0xffff8000397b9778 rax 0x2a r8 0xffff80003c3ef580 r9 0 r10 0xca8f26b53144a518 r11 0x217d8afb396a7019 r12 0 r13 0 r14 0 r15 0 rip 0xffffffff823fc4c7 proc_trampoline+0xc7 cs 0x8 rflags 0x246 rsp 0xffff80003c3ef5d0 ss 0 proc_trampoline+0xc7: movl $0,%gs:0x688 ddb{0}> show proc PROC (sh) tid=337667 pid=43328 tcnt=1 stat=onproc flags process=100000 proc=0 runpri=52, usrpri=52, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000397b8d18,0xffffffff83a4f590 process=0xffff8000387a49c0 user=0xffff80003c3ea000, vmspace=0xfffff6006ccbfb90 estcpu=6, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND *43328 337667 15327 0 7 0x100000 0 sh 15327 231650 48553 0 3 0x100002 0x88 sigsusp sh 16812 480431 76319 0 2 0 0 syz-executor 16812 455828 76319 0 7 0 0x4000000 syz-executor 60491 124011 39440 0 2 0 0 syz-executor 60491 193987 39440 0 3 0 0x4000080 kqread syz-executor 93820 10665 54734 0 2 0 0 syz-executor 93820 179117 54734 0 3 0 0x4000080 fsleep syz-executor 64375 365885 38334 0 2 0 0 syz-executor 64375 80171 38334 0 3 0 0x4000080 fsleep syz-executor 46913 174267 73237 0 2 0 0 syz-executor 46913 134406 73237 0 3 0 0x4000080 fsleep syz-executor 34736 415147 62144 0 2 0 0 syz-executor 34736 39262 62144 0 3 0 0x4000080 ttyopn syz-executor 34736 517777 62144 0 3 0 0x4000080 fsleep syz-executor 97698 232676 1447 0 2 0x100002 0 arp 1447 427102 71955 0 3 0x100002 0x88 sigsusp sh 48553 89610 23348 0 3 0x2 0x80 wait syz-executor 71955 27769 23348 0 3 0x2 0x80 wait syz-executor 76319 250526 23348 0 3 0x2 0x80 nanoslp syz-executor 73237 300538 23348 0 3 0x2 0x80 nanoslp syz-executor 62144 372655 23348 0 3 0x2 0x80 nanoslp syz-executor 38334 506607 23348 0 3 0x2 0x80 nanoslp syz-executor 39440 102652 23348 0 3 0x2 0x80 nanoslp syz-executor 54734 183347 23348 0 3 0x2 0x80 nanoslp syz-executor 23348 338056 43522 0 3 0x2 0x80 kqread syz-executor 43522 457463 80088 0 3 0x100002 0x88 sigsusp ksh 80088 125216 73692 0 3 0x10 0x88 kqread sshd-session 73692 415732 48704 0 3 0x12 0x80 kqread sshd-session 15675 199960 1 0 3 0x100003 0x80 ttyin getty 48704 384026 1 0 3 0 0x88 kqread sshd 6723 478559 44834 74 3 0x1100012 0x80 bpf pflogd 44834 295791 1 0 3 0 0x80 sbwait pflogd 93086 275242 69884 73 3 0x1100010 0x80 kqread syslogd 69884 515279 1 0 3 0x100002 0x80 sbwait syslogd 16365 360373 1 0 3 0x100000 0x80 kqread resolvd 49760 470331 73963 77 3 0x100012 0x80 kqread dhcpleased 84462 219400 73963 77 3 0x100012 0x80 kqread dhcpleased 73963 67461 1 0 3 0 0x80 kqread dhcpleased 86742 502970 0 0 3 0x14000 0x200 bored smr 13768 312573 0 0 2 0x14000 0x200 zerothread 74985 64029 0 0 3 0x14000 0x200 aiodoned aiodoned 42862 268367 0 0 3 0x14000 0x200 syncer update 22223 12676 0 0 3 0x14000 0x200 cleaner cleaner 32690 503653 0 0 3 0x14000 0x200 reaper reaper 25734 131070 0 0 3 0x14000 0x200 pgdaemon pagedaemon 12037 334237 0 0 3 0x14000 0x200 bored viomb 25361 95209 0 0 3 0x14000 0x40000200 acpi0 acpi0 23152 210118 0 0 3 0x14000 0x40000200 idle1 75436 182297 0 0 3 0x14000 0x200 bored softnet1 53182 165059 0 0 3 0x14000 0x200 bored softnet0 28263 461603 0 0 3 0x14000 0x200 smrbar systqmp 60701 423202 0 0 3 0x14000 0x200 bored systq 18061 414538 0 0 3 0x14000 0x200 tmoslp softclockmp 41404 491485 0 0 3 0x14000 0x40000200 tmoslp softclock 62333 321403 0 0 3 0x14000 0x40000200 idle0 1 193244 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex &pmap->pm_mtx r = 0 (0xfffff6006ccbe410) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487 #2 pmap_enter+0x24b rcr3 sys/arch/amd64/compile/SYZKALLER/obj/machine/cpufunc.h:139 [inline] #2 pmap_enter+0x24b pmap_map_ptes sys/arch/amd64/amd64/pmap.c:441 [inline] #2 pmap_enter+0x24b sys/arch/amd64/amd64/pmap.c:2777 #3 uvm_fault_upper_lookup+0x30d sys/uvm/uvm_fault.c:-1 #4 uvm_fault+0x159 sys/uvm/uvm_fault.c:632 #5 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192 #6 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640 #7 recall_trap+0x8 Process 43328 (sh) thread 0xffff8000397b9778 (337667) shared rwlock amaplk r = 0 (0xfffff6006ce56520) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413 #2 uvm_fault_check+0x8a9 sys/uvm/uvm_fault.c:834 #3 uvm_fault+0x106 sys/uvm/uvm_fault.c:627 #4 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192 #5 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640 #6 recall_trap+0x8 shared rwlock vmmaplk r = 0 (0xfffff6006ccbfc90) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413 #2 uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880 #3 uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693 #4 uvm_fault+0x106 sys/uvm/uvm_fault.c:627 #5 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192 #6 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640 #7 recall_trap+0x8 exclusive mutex &pmap->pm_mtx r = 0 (0xfffff6006ccbe410) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487 #2 pmap_enter+0x24b rcr3 sys/arch/amd64/compile/SYZKALLER/obj/machine/cpufunc.h:139 [inline] #2 pmap_enter+0x24b pmap_map_ptes sys/arch/amd64/amd64/pmap.c:441 [inline] #2 pmap_enter+0x24b sys/arch/amd64/amd64/pmap.c:2777 #3 uvm_fault_upper_lookup+0x30d sys/uvm/uvm_fault.c:-1 #4 uvm_fault+0x159 sys/uvm/uvm_fault.c:632 #5 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192 #6 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640 #7 recall_trap+0x8 Process 16812 (syz-executor) thread 0xffff8000397b8020 (455828) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83abe180) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline] #1 syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783 #2 Xsyscall+0x128 Process 28263 (systqmp) thread 0xffff800045ffea60 (461603) shared rwlock systqmp r = 0 (0xffffffff8399e8a8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 taskq_thread+0x12a sys/kern/kern_task.c:442 #2 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11061 12214K 12214K 166960K 12152 0 pcb 18 12K 12K 166960K 18 0 rtable 199 5K 5K 166960K 303 0 pf 34 17K 18K 166960K 45 0 ifaddr 38 6K 6K 166960K 40 0 ifgroup 55 2K 2K 166960K 55 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 70 0 ioctlops 0 0K 4K 166960K 1481 0 iov 0 0K 1K 166960K 1 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1292 81K 81K 166960K 1362 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 20 73K 89K 166960K 126 0 proc 69 115K 164K 166960K 523 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 in_multi 78 5K 5K 166960K 78 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 37 175K 175K 166960K 37 0 exec 0 0K 1K 166960K 369 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 242 192K 192K 166960K 3009 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 46 92K 102K 166960K 1253 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 24 1K 1K 166960K 24 0 temp 35 9114K 9121K 166960K 3737 0 kqueue 14 22K 22K 166960K 26 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 30 0 26 1 0 1 1 0 8 0 rtentry 176 95 0 4 5 0 5 5 0 8 0 unpcb 144 39 0 22 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 10 0 4 1 0 1 1 0 8 0 arp 136 16 0 1 1 0 1 1 0 8 0 inpcb 328 67 0 56 2 0 2 2 0 8 1 nd6 152 18 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 15 0 0 1 0 1 1 0 8 0 pfstkey 128 15 0 0 1 0 1 1 0 8 0 pfstate 448 15 0 0 2 0 2 2 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 373 0 0 24 0 24 24 0 8 0 art_table 40 374 0 0 4 0 4 4 0 8 0 art_node 32 95 0 8 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1569 0 101 92 0 92 92 0 8 0 ffsino 296 1569 0 101 113 0 113 113 0 8 0 nchpl 144 1764 0 57 64 0 64 64 0 8 0 vnodes 216 1658 0 0 93 0 93 93 0 8 0 namei 1024 5389 0 5389 2 0 2 2 0 8 2 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 27 0 0 2 0 2 2 0 8 0 scxspl 216 6213 0 6213 4 2 2 3 1 8 2 plimitpl 152 30 0 12 1 0 1 1 0 8 0 sigapl 424 443 0 393 7 0 7 7 0 8 0 knotepl 120 54 0 0 2 0 2 2 0 8 0 kqueuepl 224 22 0 12 1 0 1 1 0 8 0 pipepl 344 126 0 99 3 0 3 3 0 8 0 fdescpl 528 427 0 393 3 0 3 3 0 8 0 filepl 160 1619 0 1331 13 0 13 13 0 8 0 lockfpl 104 8 0 4 1 0 1 1 0 8 0 lockfspl 48 6 0 2 1 0 1 1 0 8 0 sessionpl 144 24 0 15 1 0 1 1 0 8 0 pgrppl 48 32 0 15 1 0 1 1 0 8 0 ucredpl 104 88 0 75 1 0 1 1 0 8 0 zombiepl 144 393 0 393 1 0 1 1 0 8 1 processpl 1232 443 0 393 5 0 5 5 0 8 0 procpl 664 452 0 395 5 0 5 5 0 8 0 sockpl 752 136 0 104 4 0 4 4 0 8 0 mcl64k 65536 1 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 132 0 0 17 0 17 17 0 8 0 mcl2k 2048 21 0 0 3 0 3 3 0 8 0 mextrefs 64 20 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 188 0 0 12 0 12 12 0 8 0 bufpl 272 2285 0 105 146 0 146 146 0 8 0 anonpl 32 3523 0 0 29 0 29 29 0 247 0 amapchunkpl 152 8147 0 7473 28 1 27 27 0 158 1 amappl16 200 1035 0 1022 4 0 4 4 0 8 3 amappl15 192 4 0 4 2 1 1 1 0 8 1 amappl14 184 517 0 513 1 0 1 1 0 8 0 amappl13 176 124 0 111 1 0 1 1 0 8 0 amappl12 168 669 0 637 2 0 2 2 0 8 0 amappl11 160 8 0 8 1 0 1 1 0 8 1 amappl10 152 69 0 54 1 0 1 1 0 8 0 amappl9 144 288 0 288 1 0 1 1 0 8 1 amappl8 136 117 0 116 1 0 1 1 0 8 0 amappl7 128 172 0 158 1 0 1 1 0 8 0 amappl6 120 156 0 152 1 0 1 1 0 8 0 amappl5 112 95 0 85 1 0 1 1 0 8 0 amappl4 104 283 0 266 1 0 1 1 0 8 0 amappl3 96 1394 0 1296 3 0 3 3 0 8 0 amappl2 88 548 0 474 2 0 2 2 0 8 0 amappl1 80 10198 0 9563 15 0 15 15 0 8 0 amappl 88 2298 0 2137 4 0 4 4 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 427 0 393 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 427 0 393 1 0 1 1 0 8 0 vmmpekpl 168 5566 0 5537 2 0 2 2 0 8 0 vmmpepl 168 36228 0 34283 85 0 85 85 0 357 0 vmsppl 488 426 0 393 5 0 5 5 0 8 0 rwobjpl 80 13425 0 12379 24 0 24 24 0 8 1 pdppl 4096 861 0 786 95 12 83 83 0 8 8 pvpl 32 9475 0 0 77 0 77 77 0 265 0 pmappl 256 426 0 393 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 409 0 15 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x766cb4c15210, count: -1 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 sys/arch/amd64/amd64/bus_space.c:670 comcnputc(800,20) at comcnputc+0x250 comcn_read_reg sys/dev/ic/com.c:1671 [inline] comcnputc(800,20) at comcnputc+0x250 sys/dev/ic/com.c:1274 cnputc(20) at cnputc+0x67 sys/dev/cons.c:218 db_putchar(2d) at db_putchar+0x126 db_force_whitespace sys/ddb/db_output.c:102 [inline] db_putchar(2d) at db_putchar+0x126 sys/ddb/db_output.c:153 kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1 db_printf(ffffffff8345f7fc) at db_printf+0x9b sys/kern/subr_prf.c:-1 fault(ffffffff8351e3d0) at fault+0xa7 sys/arch/amd64/amd64/trap.c:161 kpageflttrap(ffff800034791960,98) at kpageflttrap+0x37d sys/arch/amd64/amd64/trap.c:296 kerntrap(ffff800034791960) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff8000397b8020,fffff6006b01abd8,ffff800034791b20) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691 end trace frame: 0xffff800034791b90, count: 0 ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 sys/arch/amd64/amd64/bus_space.c:670 comcnputc(800,20) at comcnputc+0x250 comcn_read_reg sys/dev/ic/com.c:1671 [inline] comcnputc(800,20) at comcnputc+0x250 sys/dev/ic/com.c:1274 cnputc(20) at cnputc+0x67 sys/dev/cons.c:218 db_putchar(2d) at db_putchar+0x126 db_force_whitespace sys/ddb/db_output.c:102 [inline] db_putchar(2d) at db_putchar+0x126 sys/ddb/db_output.c:153 kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1 db_printf(ffffffff8345f7fc) at db_printf+0x9b sys/kern/subr_prf.c:-1 fault(ffffffff8351e3d0) at fault+0xa7 sys/arch/amd64/amd64/trap.c:161 kpageflttrap(ffff800034791960,98) at kpageflttrap+0x37d sys/arch/amd64/amd64/trap.c:296 kerntrap(ffff800034791960) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff8000397b8020,fffff6006b01abd8,ffff800034791b20) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691 sys_futimens(ffff8000397b8020,ffff800034791c70,ffff800034791bc0) at sys_futimens+0xb3 sys/kern/vfs_syscalls.c:2767 syscall(ffff800034791c70) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800034791c70) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xceabcb1cc40, count: -17