uvm_fault(0xffffffff82542bb0, 0xffff800000ac0000, 0, 1) -> e kernel: page fault trap, code=0 Stopped at uvm_unmap_remove+0x3eb: movq 0x100(%r15),%r15 ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic kernel page fault uvm_fault(0xffffffff82542bb0, 0xffff800000ac0000, 0, 1) -> e uvm_unmap_remove(ffff800000abff00,0,80000000,ffff800016b26958,1,0) at uvm_unmap_remove+0x3eb uvmspace_dused sys/uvm/uvm_map.c:497 [inline] uvm_unmap_remove(ffff800000abff00,0,80000000,ffff800016b26958,1,0) at uvm_unmap_remove+0x3eb sys/uvm/uvm_map.c:2217 end trace frame: 0xffff800016b26990, count: 0 ddb> trace uvm_unmap_remove(ffff800000abff00,0,80000000,ffff800016b26958,1,0) at uvm_unmap_remove+0x3eb uvmspace_dused sys/uvm/uvm_map.c:497 [inline] uvm_unmap_remove(ffff800000abff00,0,80000000,ffff800016b26958,1,0) at uvm_unmap_remove+0x3eb sys/uvm/uvm_map.c:2217 uvm_map_deallocate(ffff800000abff00) at uvm_map_deallocate+0x6e sys/uvm/uvm_map.c:4233 vm_impl_init_vmx(ffff80001488d258,ffff8000ffff2290) at vm_impl_init_vmx+0x1e0 vm_create(ffff800000ac9800,ffff8000ffff2290) at vm_create+0x182 vm_impl_init sys/arch/amd64/amd64/vmm.c:1376 [inline] vm_create(ffff800000ac9800,ffff8000ffff2290) at vm_create+0x182 sys/arch/amd64/amd64/vmm.c:1164 VOP_IOCTL(fffffd803c7e7750,c5005601,ffff800000ac9800,1,fffffd803f7c69c0,ffff8000ffff2290) at VOP_IOCTL+0x88 sys/kern/vfs_vops.c:291 vn_ioctl(fffffd8038c329e0,c5005601,ffff800000ac9800,ffff8000ffff2290) at vn_ioctl+0xb7 sys/kern/vfs_vnops.c:524 sys_ioctl(ffff8000ffff2290,ffff800016b26d38,ffff800016b26d80) at sys_ioctl+0x5b9 syscall(ffff800016b26e00) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555 Xsyscall(6,0,ffffffffffffff59,0,3,8e484022010) at Xsyscall+0x128 end of kernel end trace frame: 0x8e687608160, count: -9 ddb> show registers rdi 0 rsi 0 rbp 0xffff800016b26940 rbx 0 rdx 0x16de __ALIGN_SIZE+0x6de rcx 0xffff800016b45000 rax 0xffff800000abff00 r8 0x1 r9 0 r10 0x33676c257738386a r11 0xaef24f1565f8aaaf r12 0 r13 0xfffffd802f730ad8 r14 0 r15 0xffff800000abff00 rip 0xffffffff813897cb uvm_unmap_remove+0x3eb cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff800016b26890 ss 0x10 uvm_unmap_remove+0x3eb: movq 0x100(%r15),%r15 ddb> show proc PROC (syz-executor.0) pid=385585 stat=onproc flags process=0 proc=4000000 pri=86, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffff29f8,0xffffffff825545b0 process=0xffff8000ffff66d0 user=0xffff800016b21000, vmspace=0xfffffd803f013660 estcpu=36, cpticks=2, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 64250 358636 12979 0 2 0 syz-executor.0 *64250 385585 12979 0 7 0x4000000 syz-executor.0 88709 207416 25265 0 2 0x480 syz-executor.1 88709 440543 25265 0 3 0x4000080 ttyin syz-executor.1 88709 32560 25265 0 3 0x4000080 fsleep syz-executor.1 12979 289848 74553 0 3 0x82 nanosleep syz-executor.0 3061 144893 0 0 3 0x14200 bored sosplice 25265 430902 74553 0 2 0x482 syz-executor.1 74553 95159 13930 0 3 0x82 thrsleep syz-fuzzer 74553 61012 13930 0 3 0x4000082 thrsleep syz-fuzzer 74553 53845 13930 0 3 0x4000082 thrsleep syz-fuzzer 74553 13758 13930 0 3 0x4000082 thrsleep syz-fuzzer 74553 429574 13930 0 3 0x4000082 thrsleep syz-fuzzer 74553 111824 13930 0 3 0x4000082 kqread syz-fuzzer 74553 39966 13930 0 3 0x4000082 thrsleep syz-fuzzer 13930 133209 25921 0 3 0x10008a pause ksh 25921 33158 55621 0 3 0x92 select sshd 57845 33996 1 0 3 0x100083 ttyopn getty 55621 228529 1 0 3 0x80 select sshd 18287 141994 2787 73 2 0x100090 syslogd 2787 441992 1 0 3 0x100082 netio syslogd 34365 257287 1 77 3 0x100090 poll dhclient 38307 88245 1 0 3 0x80 poll dhclient 70273 274151 0 0 2 0x14200 zerothread 15918 491754 0 0 3 0x14200 aiodoned aiodoned 2576 274459 0 0 3 0x14200 syncer update 94143 231152 0 0 3 0x14200 cleaner cleaner 35246 509944 0 0 3 0x14200 reaper reaper 20935 449149 0 0 3 0x14200 pgdaemon pagedaemon 76578 289638 0 0 3 0x14200 bored crynlk 74400 61325 0 0 3 0x14200 bored crypto 66313 228682 0 0 3 0x40014200 acpi0 acpi0 30944 439742 0 0 3 0x14200 bored softnet 24085 339564 0 0 3 0x14200 bored systqmp 18130 74320 0 0 3 0x14200 bored systq 13122 90701 0 0 3 0x40014200 bored softclock 11536 258084 0 0 3 0x40014200 idle0 83549 295163 0 0 3 0x14200 bored smr 1 462297 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9458 6323K 6717K 78643K 11370 0 0 pcb 13 8K 8K 78643K 60 0 0 rtable 111 4K 4K 78643K 287 0 0 ifaddr 39 10K 11K 78643K 62 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 1 2K 2K 78643K 157 0 0 iov 0 0K 12K 78643K 21 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1215 76K 77K 78643K 1462 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 7 0 0 VM map 3 0K 0K 78643K 130 0 0 sem 12 0K 0K 78643K 155 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1793 195K 288K 78643K 12645 0 0 file desc 6 17K 25K 78643K 307 0 0 sigio 0 0K 0K 78643K 6 0 0 proc 48 38K 54K 78643K 397 0 0 subproc 32 2K 2K 78643K 51 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 4 0K 0K 78643K 1489 0 0 in_multi 33 2K 2K 78643K 56 0 0 ether_multi 1 0K 0K 78643K 4 0 0 mrt 0 0K 0K 78643K 1 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 84 371K 371K 78643K 84 0 0 exec 0 0K 1K 78643K 210 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 93 21K 21K 78643K 1617 0 0 UVM aobj 12 2K 2K 78643K 14 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 0K 78643K 30 0 0 NDP 6 0K 0K 78643K 18 0 0 temp 103 3524K 3592K 78643K 4838 0 0 kqueue 0 0K 0K 78643K 4 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 8 0 2 1 0 1 1 0 8 0 rtpcb 80 37 0 35 1 0 1 1 0 8 0 rtentry 112 55 0 11 2 0 2 2 0 8 0 unpcb 120 179 0 171 1 0 1 1 0 8 0 syncache 264 4 0 4 1 1 0 1 0 8 0 tcpqe 32 4804 0 4804 1 1 0 1 0 8 0 tcpcb 544 466 0 458 10 8 2 3 0 8 1 ipq 40 2 0 2 1 1 0 1 0 8 0 ipqe 40 8 0 8 1 1 0 1 0 8 0 inpcb 280 1003 0 988 10 7 3 5 0 8 1 nd6 48 6 0 2 1 0 1 1 0 8 0 pkpcb 40 4 0 4 1 1 0 1 0 8 0 ppxss 1128 3 0 3 1 0 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 254 0 43 14 0 14 14 0 8 0 art_table 32 255 0 43 2 0 2 2 0 8 0 art_node 16 54 0 14 1 0 1 1 0 8 0 sysvmsgpl 40 12 0 6 1 0 1 1 0 8 0 semapl 112 153 0 143 1 0 1 1 0 8 0 shmpl 112 12 0 2 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 1807 0 415 46 0 46 46 0 8 0 ffsino 240 1807 0 415 83 0 83 83 0 8 0 nchpl 144 2506 0 907 60 0 60 60 0 8 0 uvmvnodes 72 2038 0 0 38 0 38 38 0 8 0 vnodes 208 2038 0 0 108 0 108 108 0 8 0 namei 1024 7445 0 7445 2 1 1 1 0 8 1 vmpool 520 128 0 127 3 2 1 1 0 8 0 scxspl 192 7471 0 7471 8 7 1 7 0 8 1 plimitpl 152 34 0 27 1 0 1 1 0 8 0 sigapl 432 475 0 461 2 0 2 2 0 8 0 futexpl 56 9960 0 9959 1 0 1 1 0 8 0 knotepl 112 122 0 103 1 0 1 1 0 8 0 kqueuepl 104 81 0 79 1 0 1 1 0 8 0 pipepl 112 316 0 297 3 2 1 2 0 8 0 fdescpl 424 476 0 461 2 0 2 2 0 8 0 filepl 120 4501 0 4389 11 7 4 6 0 8 0 lockfpl 104 69 0 68 1 0 1 1 0 8 0 lockfspl 48 28 0 27 1 0 1 1 0 8 0 sessionpl 112 18 0 8 1 0 1 1 0 8 0 pgrppl 48 290 0 280 1 0 1 1 0 8 0 ucredpl 96 673 0 666 1 0 1 1 0 8 0 zombiepl 144 461 0 461 2 1 1 1 0 8 1 processpl 864 491 0 461 4 0 4 4 0 8 0 procpl 632 906 0 867 4 0 4 4 0 8 0 sosppl 128 12 0 12 2 2 0 1 0 8 0 sockpl 384 1228 0 1203 12 7 5 7 0 8 2 mcl64k 65536 11 0 11 7 6 1 1 0 8 1 mcl16k 16384 4 0 4 3 3 0 1 0 8 0 mcl12k 12288 11 0 11 4 4 0 1 0 8 0 mcl9k 9216 3 0 3 3 3 0 1 0 8 0 mcl8k 8192 48 0 48 4 3 1 1 0 8 1 mcl4k 4096 22 0 22 8 7 1 1 0 8 1 mcl2k 2048 55420 0 55378 16 10 6 14 0 8 0 mtagpl 80 14 0 2 2 1 1 1 0 8 0 mbufpl 256 93192 0 93090 14 4 10 11 0 8 0 bufpl 256 6718 0 1873 303 0 303 303 0 8 0 anonpl 16 52889 0 39167 59 3 56 56 0 62 0 amapchunkpl 152 2197 0 2085 9 4 5 7 0 158 0 amappl16 192 1969 0 1205 40 1 39 39 0 8 0 amappl14 176 295 0 289 1 0 1 1 0 8 0 amappl12 160 5 0 3 1 0 1 1 0 8 0 amappl11 152 47 0 36 1 0 1 1 0 8 0 amappl10 144 9 0 7 1 0 1 1 0 8 0 amappl9 136 590 0 584 1 0 1 1 0 8 0 amappl8 128 168 0 146 1 0 1 1 0 8 0 amappl7 120 41 0 36 1 0 1 1 0 8 0 amappl6 112 68 0 58 1 0 1 1 0 8 0 amappl5 104 152 0 140 1 0 1 1 0 8 0 amappl4 96 690 0 663 1 0 1 1 0 8 0 amappl3 88 249 0 243 1 0 1 1 0 8 0 amappl2 80 2996 0 2924 3 1 2 3 0 8 0 amappl1 72 18398 0 17970 28 19 9 20 0 8 0 amappl 80 1136 0 1097 1 0 1 1 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma64 64 259 0 259 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 13 0 2 1 0 1 1 0 8 0 uaddrrnd 24 604 0 461 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 604 0 461 1 0 1 1 0 8 0 vmmpekpl 168 7455 0 7429 2 0 2 2 0 8 0 vmmpepl 168 63654 0 61737 144 60 84 104 0 357 0 vmsppl 272 475 0 461 2 1 1 2 0 8 0 pdppl 4096 1214 0 1176 6 1 5 6 0 8 0 pvpl 32 206861 0 190015 175 31 144 146 0 265 6 pmappl 200 603 0 588 1 0 1 1 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 478 0 46 13 0 13 13 0 8 0