uvm_fault(0xffffffff83933440, 0xffff800029ef5000, 0, 1) -> e kernel: page fault trap, code=0 Stopped at pvclock_get+0x53: movl 0(%r15),%r12d TID PID UID PRFLAGS PFLAGS CPU COMMAND * 75003 87046 0 0 0x4000000 0 syz-executor pvclock_get(ffffffff8386b9c0) at pvclock_get+0x53 pvclock_read_begin sys/dev/pv/pvclock.c:278 [inline] pvclock_get(ffffffff8386b9c0) at pvclock_get+0x53 sys/dev/pv/pvclock.c:333 nsecuptime() at nsecuptime+0x62 tc_delta sys/kern/kern_tc.c:138 [inline] nsecuptime() at nsecuptime+0x62 binuptime sys/kern/kern_tc.c:191 [inline] nsecuptime() at nsecuptime+0x62 sys/kern/kern_tc.c:257 clockintr_dispatch(ffff80003c8f1890) at clockintr_dispatch+0xe8 sys/kern/kern_clockintr.c:180 lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482 Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a pmap_tlb_shootrange(ffff8000314c8000,ffff800029bb2000,ffff80002a25e000,1) at pmap_tlb_shootrange+0xc3 invpcid sys/arch/amd64/compile/SYZKALLER/obj/machine/cpufunc.h:192 [inline] pmap_tlb_shootrange(ffff8000314c8000,ffff800029bb2000,ffff80002a25e000,1) at pmap_tlb_shootrange+0xc3 sys/arch/amd64/amd64/pmap.c:3363 buf_dealloc_mem(fffffd807c3f77e8) at buf_dealloc_mem+0x125 sys/kern/vfs_biomem.c:186 buf_put(fffffd807c3f77e8) at buf_put+0x1d9 sys/kern/vfs_bio.c:123 brelse(fffffd807c3f77e8) at brelse+0x397 sys/kern/vfs_bio.c:932 writedisklabel(d02,ffffffff81c5bc10,ffff800000039000) at writedisklabel+0x1b8 sys/arch/amd64/amd64/disksubr.c:158 sdioctl(d02,84946467,ffff8000015db000,3,ffff80003c90ad18) at sdioctl+0x959 sys/scsi/sd.c:921 VOP_IOCTL(fffffd806f9a01d8,84946467,ffff8000015db000,3,fffffd8007ffd958,ffff80003c90ad18) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264 vn_ioctl(fffffd807c1dcc38,84946467,ffff8000015db000,ffff80003c90ad18) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537 sys_ioctl(ffff80003c90ad18,ffff80003c8f1f10,ffff80003c8f1e60) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 end trace frame: 0xffff80003c8f1f00, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: uvm_fault(0xffffffff83933440, 0xffff800029ef5000, 0, 1) -> e ddb> trace pvclock_get(ffffffff8386b9c0) at pvclock_get+0x53 pvclock_read_begin sys/dev/pv/pvclock.c:278 [inline] pvclock_get(ffffffff8386b9c0) at pvclock_get+0x53 sys/dev/pv/pvclock.c:333 nsecuptime() at nsecuptime+0x62 tc_delta sys/kern/kern_tc.c:138 [inline] nsecuptime() at nsecuptime+0x62 binuptime sys/kern/kern_tc.c:191 [inline] nsecuptime() at nsecuptime+0x62 sys/kern/kern_tc.c:257 clockintr_dispatch(ffff80003c8f1890) at clockintr_dispatch+0xe8 sys/kern/kern_clockintr.c:180 lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482 Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a pmap_tlb_shootrange(ffff8000314c8000,ffff800029bb2000,ffff80002a25e000,1) at pmap_tlb_shootrange+0xc3 invpcid sys/arch/amd64/compile/SYZKALLER/obj/machine/cpufunc.h:192 [inline] pmap_tlb_shootrange(ffff8000314c8000,ffff800029bb2000,ffff80002a25e000,1) at pmap_tlb_shootrange+0xc3 sys/arch/amd64/amd64/pmap.c:3363 buf_dealloc_mem(fffffd807c3f77e8) at buf_dealloc_mem+0x125 sys/kern/vfs_biomem.c:186 buf_put(fffffd807c3f77e8) at buf_put+0x1d9 sys/kern/vfs_bio.c:123 brelse(fffffd807c3f77e8) at brelse+0x397 sys/kern/vfs_bio.c:932 writedisklabel(d02,ffffffff81c5bc10,ffff800000039000) at writedisklabel+0x1b8 sys/arch/amd64/amd64/disksubr.c:158 sdioctl(d02,84946467,ffff8000015db000,3,ffff80003c90ad18) at sdioctl+0x959 sys/scsi/sd.c:921 VOP_IOCTL(fffffd806f9a01d8,84946467,ffff8000015db000,3,fffffd8007ffd958,ffff80003c90ad18) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264 vn_ioctl(fffffd807c1dcc38,84946467,ffff8000015db000,ffff80003c90ad18) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537 sys_ioctl(ffff80003c90ad18,ffff80003c8f1f10,ffff80003c8f1e60) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80003c8f1f10) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c8f1f10) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7d2c94a1e20, count: -16 ddb>