login: uvm_fault(0xffffffff8225bef8, 0xffff800002960002, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at rtable_satoplen+0x150: movzbl 0xffffffffffffffff(%r13),%r12d
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel page fault
uvm_fault(0xffffffff8225bef8, 0xffff800002960002, 0, 1) -> e
rtable_satoplen(21,ffff80000295ff59) at rtable_satoplen+0x150 sys/net/rtable.c:888
end trace frame: 0xffff800020c3d650, count: 0
ddb{0}> trace
rtable_satoplen(21,ffff80000295ff59) at rtable_satoplen+0x150 sys/net/rtable.c:888
rtable_lookup(0,ffff80000295ff09,ffff80000295ff59,ffff80000295ff11,21) at rtable_lookup+0xfd sys/net/rtable.c:391
rtm_output(ffff80000295ff00,ffff800020c3d740,ffff800020c3d748,21,0) at rtm_output+0x10c sys/net/rtsock.c:1122
route_output(fffffd806f1f5200,fffffd806f6b6780,0,0) at route_output+0x79b sys/net/rtsock.c:806
route_usrreq(fffffd806f6b6780,9,fffffd806f1f5200,0,0,ffff800020b39080) at route_usrreq+0x35d sys/net/rtsock.c:271
sosend(fffffd806f6b6780,0,ffff800020c3da08,0,0,0) at sosend+0x6eb sys/kern/uipc_socket.c:513
sendit(ffff800020b39080,7,ffff800020c3dac8,0,ffff800020c3db90) at sendit+0x590 sys/kern/uipc_syscalls.c:662
sys_sendto(ffff800020b39080,ffff800020c3dba8,ffff800020c3db90) at sys_sendto+0x92
syscall(ffff800020c3dc40) at syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(ffff800020c3dc40) at syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
Xsyscall(6,0,ffffffffffffffd8,0,6,b958cdfd010) at Xsyscall+0x128
end of kernel
end trace frame: 0xb981bf7b460, count: -10
ddb{0}> show registers
rdi 0
rsi 0xaa
rbp 0xffff800020c3d5b0
rbx 0xffffffffffffff5a
rdx 0xffff80000295ff5d
rcx 0xffff800002960003
rax 0xffff800002960003
r8 0x21
r9 0x1
r10 0x4
r11 0xefe848b979d672b1
r12 0
r13 0xffff800002960003
r14 0xffffffff82190d08 mplsdomain
r15 0x4
rip 0xffffffff81d8c9d0 rtable_satoplen+0x150
cs 0x8
rflags 0x10287 __ALIGN_SIZE+0xf287
rsp 0xffff800020c3d560
ss 0x10
rtable_satoplen+0x150: movzbl 0xffffffffffffffff(%r13),%r12d
ddb{0}> show proc
PROC (syz-executor.0) pid=458082 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
pri=75, usrpri=75, nice=20
forw=0xffffffffffffffff, list=0xffff800020b38978,0xffffffff82387188
process=0xffff800020b3b708 user=0xffff800020c38000, vmspace=0xfffffd807effe438
estcpu=36, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
67402 82210 89802 32767 7 0x10 syz-executor.0
*67402 458082 89802 32767 7 0x4000010 syz-executor.0
89802 204806 1862 32767 2 0x490 syz-executor.0
1862 281069 54801 0 3 0x82 wait syz-executor.0
6030 401598 0 0 3 0x14200 bored sosplice
54801 118087 1807 0 2 0x482 syz-fuzzer
54801 358708 1807 0 2 0x4000482 syz-fuzzer
54801 302967 1807 0 3 0x4000082 thrsleep syz-fuzzer
54801 166122 1807 0 2 0x4000002 syz-fuzzer
54801 97710 1807 0 3 0x4000082 thrsleep syz-fuzzer
54801 110650 1807 0 2 0x4000002 syz-fuzzer
54801 323666 1807 0 3 0x4000082 thrsleep syz-fuzzer
54801 499294 1807 0 3 0x4000082 kqread syz-fuzzer
54801 161701 1807 0 3 0x4000082 thrsleep syz-fuzzer
54801 166613 1807 0 3 0x4000082 thrsleep syz-fuzzer
1807 469436 97610 0 3 0x10008a pause ksh
97610 203773 24253 0 3 0x92 select sshd
22612 449689 1 0 3 0x100083 ttyin getty
24253 489180 1 0 3 0x80 select sshd
24956 460631 64086 73 2 0x100090 syslogd
64086 500737 1 0 3 0x100082 netio syslogd
14104 207094 1 77 3 0x100090 poll dhclient
16167 451572 1 0 3 0x80 poll dhclient
67224 338376 0 0 2 0x14200 zerothread
85896 350353 0 0 3 0x14200 aiodoned aiodoned
24870 362716 0 0 3 0x14200 syncer update
71183 90860 0 0 3 0x14200 cleaner cleaner
79415 4913 0 0 3 0x14200 reaper reaper
89052 507024 0 0 3 0x14200 pgdaemon pagedaemon
10219 329886 0 0 3 0x14200 bored crynlk
11439 376202 0 0 3 0x14200 bored crypto
29623 71824 0 0 3 0x40014200 acpi0 acpi0
47763 463705 0 0 3 0x40014200 idle1
63708 49919 0 0 3 0x14200 bored softnet
53136 349577 0 0 3 0x14200 bored systqmp
45061 385351 0 0 3 0x14200 bored systq
99379 191632 0 0 3 0x40014200 bored softclock
77856 153897 0 0 3 0x40014200 idle0
65029 316664 0 0 3 0x14200 bored smr
1 384262 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 67402 (syz-executor.0) thread 0xffff800020b39080 (458082)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff82345c60) locked @ /syzkaller/managers/setuid/kernel/sys/arch/amd64/amd64/softintr.c:87
#0 witness_lock+0x594 sys/kern/subr_witness.c:1201
#1 solock+0x7e sys/kern/uipc_socket2.c:292
#2 sosend+0x586 sys/kern/uipc_socket.c:501
#3 sendit+0x590 sys/kern/uipc_syscalls.c:662
#4 sys_sendto+0x92
#5 syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#5 syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
#6 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9453 6318K 6320K 78643K 10565 0 0
pcb 25 9K 10K 78643K 147 0 0
rtable 80 2K 3K 78643K 307 0 0
ifaddr 28 8K 9K 78643K 59 0 0
counters 39 33K 33K 78643K 39 0 0
ioctlops 0 0K 2K 78643K 19 0 0
iov 0 0K 16K 78643K 26 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1200 75K 75K 78643K 1321 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 5K 78643K 6 0 0
VM map 2 1K 1K 78643K 2 0 0
sem 12 1K 1K 78643K 43 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1808 196K 290K 78643K 12628 0 0
file desc 5 13K 25K 78643K 215 0 0
sigio 0 0K 0K 78643K 6 0 0
proc 41 38K 58K 78643K 343 0 0
subproc 34 34817K 69634K 78643K 204 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 20 0 0
in_multi 22 1K 2K 78643K 82 0 0
ether_multi 1 0K 0K 78643K 2 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 48 212K 212K 78643K 48 0 0
exec 0 0K 1K 78643K 195 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 74 12K 29K 78643K 1448 0 0
UVM aobj 9 2K 2K 78643K 9 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 0K 78643K 22 0 0
NDP 4 0K 0K 78643K 21 0 0
temp 69 2370K 2439K 78643K 3614 0 0
kqueue 0 0K 0K 78643K 5 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 8 0 5 1 0 1 1 0 8 0
inpcbpl 280 168 0 161 1 0 1 1 0 8 0
plimitpl 152 31 0 24 1 0 1 1 0 8 0
plcache 128 20 0 0 1 0 1 1 0 8 0
rtentry 112 77 0 46 2 0 2 2 0 8 0
syncache 264 4 0 4 1 1 0 1 0 8 0
tcpqe 32 25 0 25 1 1 0 1 0 8 0
tcpcb 544 72 0 68 1 0 1 1 0 8 0
nd6 48 12 0 10 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 348 0 204 12 0 12 12 0 8 2
art_table 32 349 0 204 2 0 2 2 0 8 0
art_node 16 76 0 48 1 0 1 1 0 8 0
sysvmsgpl 40 2 0 0 1 0 1 1 0 8 0
semapl 112 41 0 31 1 0 1 1 0 8 0
shmpl 112 7 0 0 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino1pl 128 1662 0 248 46 0 46 46 0 8 0
ffsino 272 1662 0 248 95 0 95 95 0 8 0
nchpl 144 2171 0 563 61 0 61 61 0 8 0
uvmvnodes 72 1773 0 0 33 0 33 33 0 8 0
vnodes 200 1773 0 0 94 0 94 94 0 8 0
namei 1024 5781 0 5781 2 1 1 1 0 8 1
percpumem 16 30 0 0 1 0 1 1 0 8 0
scxspl 192 5392 0 5392 8 7 1 7 0 8 1
sigapl 432 373 0 360 2 0 2 2 0 8 0
futexpl 56 2045 0 2045 1 0 1 1 0 8 1
knotepl 112 212 0 199 1 0 1 1 0 8 0
kqueuepl 104 76 0 74 1 0 1 1 0 8 0
pipepl 112 274 0 259 3 1 2 2 0 8 1
fdescpl 488 374 0 360 3 0 3 3 0 8 1
filepl 152 2275 0 2198 6 1 5 5 0 8 1
lockfpl 104 91 0 90 2 1 1 1 0 8 0
lockfspl 32 214 0 213 2 1 1 1 0 8 0
sessionpl 112 21 0 12 1 0 1 1 0 8 0
pgrppl 48 21 0 12 1 0 1 1 0 8 0
ucredpl 96 493 0 485 1 0 1 1 0 8 0
zombiepl 144 360 0 360 2 1 1 1 0 8 1
processpl 840 390 0 360 4 0 4 4 0 8 0
procpl 600 789 0 749 4 0 4 4 0 8 0
srpgc 64 30 0 30 2 1 1 1 0 8 1
sosppl 128 11 0 11 1 0 1 1 0 8 1
sockpl 384 302 0 283 3 0 3 3 0 8 1
mcl64k 65536 5 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl12k 12288 3 0 0 1 0 1 1 0 8 0
mcl9k 9216 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 3 0 0 1 0 1 1 0 8 0
mcl4k 4096 3 0 0 1 0 1 1 0 8 0
mcl2k2 2112 1 0 0 1 0 1 1 0 8 0
mcl2k 2048 124 0 0 15 0 15 15 0 8 0
mtagpl 80 1 0 0 1 0 1 1 0 8 0
mbufpl 256 140 0 0 9 0 9 9 0 8 0
bufpl 256 5860 0 1122 297 0 297 297 0 8 0
anonpl 16 59511 0 52925 44 5 39 43 0 125 11
amapchunkpl 152 2243 0 2160 10 1 9 9 0 158 5
amappl16 192 1844 0 1504 36 11 25 29 0 8 7
amappl15 184 56 0 52 1 0 1 1 0 8 0
amappl14 176 62 0 58 2 1 1 1 0 8 0
amappl13 168 26 0 23 1 0 1 1 0 8 0
amappl12 160 117 0 112 1 0 1 1 0 8 0
amappl11 152 56 0 44 1 0 1 1 0 8 0
amappl10 144 76 0 76 2 1 1 1 0 8 1
amappl9 136 569 0 567 1 0 1 1 0 8 0
amappl8 128 154 0 134 1 0 1 1 0 8 0
amappl7 120 47 0 42 1 0 1 1 0 8 0
amappl6 112 78 0 70 1 0 1 1 0 8 0
amappl5 104 173 0 162 1 0 1 1 0 8 0
amappl4 96 529 0 506 2 1 1 2 0 8 0
amappl3 88 193 0 181 1 0 1 1 0 8 0
amappl2 80 2123 0 2071 2 0 2 2 0 8 0
amappl1 72 17147 0 16724 23 13 10 19 0 8 0
amappl 72 1036 0 1004 1 0 1 1 0 75 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma64 64 259 0 259 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 17 0 17 1 1 0 1 0 8 0
aobjpl 64 8 0 0 1 0 1 1 0 8 0
uaddrrnd 24 374 0 360 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 374 0 360 1 0 1 1 0 8 0
vmmpekpl 168 7130 0 7109 2 0 2 2 0 8 0
vmmpepl 168 48728 0 47443 89 15 74 75 0 357 17
vmsppl 360 373 0 360 2 0 2 2 0 8 0
pdppl 4096 756 0 720 6 0 6 6 0 8 1
pvpl 32 173152 0 163453 122 9 113 117 0 265 31
pmappl 224 373 0 360 1 0 1 1 0 8 0
extentpl 40 39 0 25 1 0 1 1 0 8 0
phpool 112 447 0 3 13 0 13 13 0 8 0