panic: kernel diagnostic assertion "uvm_page_owner_locked_p(pg)" failed: file "/syzkaller/managers/main/kernel/sys/uvm/uvm_page.c", line 1269 Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *523795 52224 0 0x14000 0x200 0 reaper db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff825732bb) at panic+0x161 sys/kern/subr_prf.c:198 __assert(ffffffff825e8d55,ffffffff8259710f,4f5,ffffffff82597142) at __assert+0x25 sys/kern/subr_prf.c:157 uvm_pageunwire(fffffd800607c600) at uvm_pageunwire+0x16b sys/uvm/uvm_page.c:1269 uvm_fault_unwire_locked(fffffd806e202450,fd58ecfe000,fd58eefd000) at uvm_fault_unwire_locked+0x226 sys/uvm/uvm_fault.c:1682 uvm_unmap_kill_entry_withlock(fffffd806e202450,fffffd807666d078,0) at uvm_unmap_kill_entry_withlock+0x62 sys/uvm/uvm_map.c:1887 uvm_map_teardown(fffffd806e202450) at uvm_map_teardown+0x167 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline] uvm_map_teardown(fffffd806e202450) at uvm_map_teardown+0x167 sys/uvm/uvm_map.c:2523 uvmspace_free(fffffd806e202450) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3436 reaper(ffff8000ffff8d28) at reaper+0x15d sys/kern/kern_exit.c:448 end trace frame: 0x0, count: 6 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: kernel diagnostic assertion "uvm_page_owner_locked_p(pg)" failed: file "/syzkaller/managers/main/kernel/sys/uvm/uvm_page.c", line 1269 ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff825732bb) at panic+0x161 sys/kern/subr_prf.c:198 __assert(ffffffff825e8d55,ffffffff8259710f,4f5,ffffffff82597142) at __assert+0x25 sys/kern/subr_prf.c:157 uvm_pageunwire(fffffd800607c600) at uvm_pageunwire+0x16b sys/uvm/uvm_page.c:1269 uvm_fault_unwire_locked(fffffd806e202450,fd58ecfe000,fd58eefd000) at uvm_fault_unwire_locked+0x226 sys/uvm/uvm_fault.c:1682 uvm_unmap_kill_entry_withlock(fffffd806e202450,fffffd807666d078,0) at uvm_unmap_kill_entry_withlock+0x62 sys/uvm/uvm_map.c:1887 uvm_map_teardown(fffffd806e202450) at uvm_map_teardown+0x167 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline] uvm_map_teardown(fffffd806e202450) at uvm_map_teardown+0x167 sys/uvm/uvm_map.c:2523 uvmspace_free(fffffd806e202450) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3436 reaper(ffff8000ffff8d28) at reaper+0x15d sys/kern/kern_exit.c:448 end trace frame: 0x0, count: -9 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff8000216c05b0 rbx 0xfffffd800607c600 rdx 0 rcx 0 rax 0xffff8000ffff8d28 r8 0x101010101010101 r9 0x8080808080808080 r10 0x37f9f3e755b47354 r11 0x96e569b32be3bc65 r12 0 r13 0xffff8000216c06d8 r14 0 r15 0x1 rip 0xffffffff818a9798 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff8000216c05a0 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (reaper) pid=523795 stat=onproc flags process=14000 proc=200 pri=86, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff8000fffffce0,0xffff8000ffff8a98 process=0xffff8000ffffa008 user=0xffff8000216bb000, vmspace=0xffffffff82ac6658 estcpu=36, cpticks=59, pctcpu=20.9 user=0, sys=163, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 59074 509326 0 0 3 0x14200 bored sosplice 80715 25792 13357 0 2 0x2 syz-executor.2 95059 402313 13357 0 2 0x2 syz-executor.7 3813 185384 13357 0 3 0x82 wait syz-executor.0 13357 282323 84871 0 3 0x82 wait syz-fuzzer 13357 358730 84871 0 2 0x4000482 syz-fuzzer 13357 407136 84871 0 3 0x4000082 wait syz-fuzzer 13357 255343 84871 0 3 0x4000082 wait syz-fuzzer 13357 45366 84871 0 3 0x4000082 thrsleep syz-fuzzer 13357 392032 84871 0 3 0x4000082 thrsleep syz-fuzzer 13357 102503 84871 0 2 0x4000002 syz-fuzzer 13357 317874 84871 0 2 0x4000002 syz-fuzzer 13357 195515 84871 0 3 0x4000082 thrsleep syz-fuzzer 13357 37579 84871 0 2 0x4000002 syz-fuzzer 13357 504527 84871 0 3 0x4000082 thrsleep syz-fuzzer 13357 458011 84871 0 2 0x4000002 syz-fuzzer 13357 60344 84871 0 2 0x4000002 syz-fuzzer 13357 318643 84871 0 3 0x4000082 thrsleep syz-fuzzer 84871 111215 87893 0 3 0x10008a sigsusp ksh 87893 24944 12537 0 3 0x9a kqread sshd 53266 37919 1 0 3 0x100083 ttyopn getty 12537 51045 1 0 3 0x88 kqread sshd 13556 320904 24589 73 2 0x1100010 syslogd 24589 337055 1 0 3 0x100082 netio syslogd 39086 357378 1 0 3 0x100080 kqread resolvd 28566 384252 99502 77 3 0x100092 kqread dhcpleased 7770 415505 99502 77 3 0x100092 kqread dhcpleased 99502 280089 1 0 3 0x80 kqread dhcpleased 71359 163114 0 0 3 0x14200 bored smr 62528 523220 0 0 2 0x14200 zerothread 92981 241535 0 0 3 0x14200 aiodoned aiodoned 75396 102418 0 0 2 0x14600 update 503 362230 0 0 3 0x14200 cleaner cleaner *52224 523795 0 0 7 0x14200 reaper 60658 377001 0 0 3 0x14200 pgdaemon pagedaemon 40772 351328 0 0 3 0x14200 bored viomb 95751 5581 0 0 3 0x40014200 acpi0 acpi0 29130 268074 0 0 3 0x14200 bored softnet 77253 312760 0 0 3 0x14200 bored softnet 71793 57893 0 0 3 0x14200 bored softnet 10081 312370 0 0 3 0x14200 bored softnet 23151 444507 0 0 2 0x14200 systqmp 83971 51714 0 0 3 0x14200 bored systq 1134 81623 0 0 2 0x40014200 softclock 82162 39796 0 0 3 0x40014200 idle0 1 337892 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10147 6391K 7758K 78643K 11837 0 pcb 13 8K 8K 78643K 33 0 rtable 45 3K 8K 78643K 421 0 ifaddr 27 8K 16K 78643K 121 0 counters 19 16K 17K 78643K 32 0 ioctlops 0 0K 4K 78643K 86 0 iov 0 0K 12K 78643K 56 0 mount 1 1K 1K 78643K 1 0 log 0 0K 0K 78643K 4 0 vnodes 1273 80K 80K 78643K 1704 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 1K 78643K 2 0 VM map 2 0K 0K 78643K 2 0 sem 17 1K 1K 78643K 34 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1697 195K 286K 78643K 12548 0 file desc 5 13K 73K 78643K 940 0 sigio 0 0K 0K 78643K 14 0 proc 58 59K 67K 78643K 477 0 subproc 39 2K 6K 78643K 104 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 51 0 in_multi 11 0K 6K 78643K 113 0 ether_multi 1 0K 0K 78643K 5 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 73 334K 334K 78643K 73 0 exec 0 0K 2K 78643K 660 0 tdb 3 0K 0K 78643K 3 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 8 62K 64K 78643K 10 0 UVM amap 172 42K 96K 78643K 5955 0 UVM aobj 4 2K 2K 78643K 4 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 16 0 NDP 3 0K 2K 78643K 32 0 temp 74 4712K 4777K 78643K 6127 0 kqueue 12 18K 30K 78643K 131 0 SYN cache 2 16K 16K 78643K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 105 0 102 1 0 1 1 0 8 0 rtentry 112 120 0 106 4 3 1 4 0 8 0 unpcb 144 248 0 235 1 0 1 1 0 8 0 syncache 296 14 0 14 2 2 0 1 0 8 0 tcpqe 32 8 0 8 1 1 0 1 0 8 0 tcpcb 768 253 0 249 13 12 1 12 0 8 0 arp 88 18 0 16 1 0 1 1 0 8 0 inpcb 336 454 0 447 4 3 1 3 0 8 0 nd6 48 29 0 29 1 1 0 1 0 8 0 kcovpl 48 8 0 5 1 0 1 1 0 8 0 pfstscr 40 4 0 4 1 1 0 1 0 8 0 pfosfp 40 5 0 3 1 0 1 1 0 8 0 pfosfpen 112 5 0 0 1 0 1 1 0 8 0 pftag 88 1 0 0 1 0 1 1 0 8 0 pfstkey 120 8 0 8 1 1 0 1 0 8 0 pfstate 336 4 0 4 1 1 0 1 0 8 0 pfrule 1360 15 0 15 2 2 0 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 534 0 448 29 23 6 29 0 8 0 art_table 32 535 0 448 4 3 1 4 0 8 0 art_node 16 119 0 109 1 0 1 1 0 8 0 sysvmsgpl 40 30 0 20 1 0 1 1 0 8 0 semapl 112 15 0 0 1 0 1 1 0 8 0 shmpl 112 1 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 2711 0 1290 90 0 90 90 0 8 0 ffsino 240 2711 0 1290 85 0 85 85 0 8 0 nchpl 144 3997 0 2326 63 0 63 63 0 8 0 uvmvnodes 80 3030 0 0 62 0 62 62 0 8 0 vnodes 216 3030 0 0 169 0 169 169 0 8 0 namei 1024 11160 0 11160 6 5 1 2 0 8 1 kstatmem 264 32 0 26 2 1 1 2 0 8 0 scxspl 216 12015 0 12015 9 8 1 8 0 8 1 plimitpl 152 64 0 54 1 0 1 1 0 8 0 sigapl 424 1231 0 1196 6 1 5 6 0 8 0 futexpl 64 6116 0 6116 6 6 0 1 0 8 0 knotepl 120 12568 0 12498 10 7 3 10 0 8 0 kqueuepl 184 129 0 121 1 0 1 1 0 8 0 pipepl 288 145 0 122 5 3 2 3 0 8 0 fdescpl 432 1214 0 1198 6 3 3 4 0 8 0 filepl 120 4095 0 3934 9 2 7 9 0 8 0 lockfpl 104 72 0 70 1 0 1 1 0 8 0 lockfspl 48 30 0 28 1 0 1 1 0 8 0 sessionpl 144 23 0 11 1 0 1 1 0 8 0 pgrppl 48 28 0 16 1 0 1 1 0 8 0 ucredpl 104 414 0 404 1 0 1 1 0 8 0 zombiepl 144 1198 0 1196 1 0 1 1 0 8 0 processpl 1000 1231 0 1196 7 1 6 6 0 8 0 procpl 672 2198 0 2147 7 0 7 7 0 8 0 sockpl 456 815 0 792 12 9 3 6 0 8 0 mcl16k 16384 10 0 10 1 1 0 1 0 8 0 mcl12k 12288 13 0 13 1 1 0 1 0 8 0 mcl9k 9216 4 0 4 1 1 0 1 0 8 0 mcl8k 8192 18 0 18 1 1 0 1 0 8 0 mcl4k 4096 26 0 26 2 2 0 1 0 8 0 mcl2k2 2112 4 0 4 1 1 0 1 0 8 0 mcl2k 2048 18246 0 18184 22 12 10 13 0 8 0 mtagpl 96 61 0 61 3 3 0 2 0 8 0 mbufpl 256 40664 0 40509 26 14 12 20 0 8 0 bufpl 288 6624 0 223 458 0 458 458 0 8 0 anonpl 24 275649 0 256531 303 37 266 274 0 188 129 amapchunkpl 152 21051 0 19883 114 13 101 108 0 158 47 amappl16 200 2291 0 2127 16 5 11 14 0 8 0 amappl15 192 202 0 197 1 0 1 1 0 8 0 amappl14 184 202 0 197 1 0 1 1 0 8 0 amappl13 176 80 0 78 1 0 1 1 0 8 0 amappl12 168 8 0 4 1 0 1 1 0 8 0 amappl11 160 172 0 156 1 0 1 1 0 8 0 amappl10 152 120 0 119 1 0 1 1 0 8 0 amappl9 144 606 0 603 1 0 1 1 0 8 0 amappl8 136 759 0 715 2 0 2 2 0 8 0 amappl7 128 316 0 296 1 0 1 1 0 8 0 amappl6 120 301 0 288 2 1 1 2 0 8 0 amappl5 112 1011 0 1001 1 0 1 1 0 8 0 amappl4 104 902 0 876 2 0 2 2 0 8 0 amappl3 96 2782 0 2740 2 0 2 2 0 8 0 amappl2 88 454 0 419 2 0 2 2 0 8 0 amappl1 80 30461 0 29954 20 6 14 19 0 8 0 amappl 88 5506 0 5402 4 0 4 4 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 3 0 0 1 0 1 1 0 8 0 uaddrrnd 24 1214 0 1197 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1214 0 1197 1 0 1 1 0 8 0 vmmpekpl 168 11633 0 11596 3 0 3 3 0 8 0 vmmpepl 168 114001 0 112488 107 17 90 102 0 357 2 vmsppl 272 1213 0 1196 4 2 2 3 0 8 0 rwobjpl 24 30512 0 26513 26 0 26 26 0 8 0 pdppl 4096 2434 0 2392 113 65 48 68 0 8 6 pvpl 32 651893 0 627081 675 177 498 511 0 265 255 pmappl 216 1213 0 1196 2 0 2 2 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 856 0 136 22 0 22 22 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff825732bb) at panic+0x161 sys/kern/subr_prf.c:198 __assert(ffffffff825e8d55,ffffffff8259710f,4f5,ffffffff82597142) at __assert+0x25 sys/kern/subr_prf.c:157 uvm_pageunwire(fffffd800607c600) at uvm_pageunwire+0x16b sys/uvm/uvm_page.c:1269 uvm_fault_unwire_locked(fffffd806e202450,fd58ecfe000,fd58eefd000) at uvm_fault_unwire_locked+0x226 sys/uvm/uvm_fault.c:1682 uvm_unmap_kill_entry_withlock(fffffd806e202450,fffffd807666d078,0) at uvm_unmap_kill_entry_withlock+0x62 sys/uvm/uvm_map.c:1887 uvm_map_teardown(fffffd806e202450) at uvm_map_teardown+0x167 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline] uvm_map_teardown(fffffd806e202450) at uvm_map_teardown+0x167 sys/uvm/uvm_map.c:2523 uvmspace_free(fffffd806e202450) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3436 reaper(ffff8000ffff8d28) at reaper+0x15d sys/kern/kern_exit.c:448 end trace frame: 0x0, count: -9 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff825732bb) at panic+0x161 sys/kern/subr_prf.c:198 __assert(ffffffff825e8d55,ffffffff8259710f,4f5,ffffffff82597142) at __assert+0x25 sys/kern/subr_prf.c:157 uvm_pageunwire(fffffd800607c600) at uvm_pageunwire+0x16b sys/uvm/uvm_page.c:1269 uvm_fault_unwire_locked(fffffd806e202450,fd58ecfe000,fd58eefd000) at uvm_fault_unwire_locked+0x226 sys/uvm/uvm_fault.c:1682 uvm_unmap_kill_entry_withlock(fffffd806e202450,fffffd807666d078,0) at uvm_unmap_kill_entry_withlock+0x62 sys/uvm/uvm_map.c:1887 uvm_map_teardown(fffffd806e202450) at uvm_map_teardown+0x167 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:176 [inline] uvm_map_teardown(fffffd806e202450) at uvm_map_teardown+0x167 sys/uvm/uvm_map.c:2523 uvmspace_free(fffffd806e202450) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3436 reaper(ffff8000ffff8d28) at reaper+0x15d sys/kern/kern_exit.c:448 end trace frame: 0x0, count: -9