uvm_fault(0xfffff3000b1f7988, 0x0, 0, 1) -> e kernel: page fault trap, code=0 Stopped at sys_shmat+0x453: movq 0(%r15),%rdi TID PID UID PRFLAGS PFLAGS CPU COMMAND 376004 20275 0 0 0 0 syz-executor * 4867 48541 0 0 0x4000000 1K syz-executor sys_shmat(ffff80003a7a4020,ffff80002a28eb40,ffff80002a28ea90) at sys_shmat+0x453 sys/kern/sysv_shm.c:292 syscall(ffff80002a28eb40) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a28eb40) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x699c3288680, count: 12 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: uvm_fault(0xfffff3000b1f7988, 0x0, 0, 1) -> e ddb{1}> show kasan No such command ddb{1}> trace sys_shmat(ffff80003a7a4020,ffff80002a28eb40,ffff80002a28ea90) at sys_shmat+0x453 sys/kern/sysv_shm.c:292 syscall(ffff80002a28eb40) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a28eb40) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x699c3288680, count: -3 ddb{1}> show registers rdi 0xffff80002b780000 rsi 0x8ce rbp 0xffff80002a28ea60 rbx 0xfffff300649e4ee0 rdx 0xffff80002b780000 rcx 0x1 rax 0x1 r8 0x180 r9 0xfffff300097fd270 r10 0 r11 0xb057bdffe094df2e r12 0xffff80003a7a4020 r13 0xffff8000015fd010 r14 0x3 r15 0 rip 0xffffffff82bf3ee3 sys_shmat+0x453 cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80002a28e9d0 ss 0x10 sys_shmat+0x453: movq 0(%r15),%rdi ddb{1}> show proc PROC (syz-executor) tid=4867 pid=48541 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=86, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003a7a54e0,0xffff80003a7a4560 process=0xffff800045ff21c0 user=0xffff80002a289000, vmspace=0xfffff3000b1f7988 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 13210 522705 28613 0 2 0 0 syz-executor 13210 37631 28613 0 3 0 0x4000080 fsleep syz-executor 20275 376004 77909 0 7 0 0 syz-executor 20275 24619 77909 0 2 0 0x4000000 syz-executor 20275 175674 77909 0 3 0 0x4000080 fsleep syz-executor 63003 111572 64415 0 3 0 0x80 nanoslp syz-executor 63003 73998 64415 0 3 0 0x4000080 fsleep syz-executor 63003 480824 64415 0 3 0 0x4000080 fsleep syz-executor 48541 390339 40689 0 2 0 0 syz-executor 48541 68908 40689 0 2 0 0x4000000 syz-executor *48541 4867 40689 0 7 0 0x4000000 syz-executor 12648 184017 94790 0 2 0 0x1 syz-executor 12648 513354 94790 0 3 0 0x4000080 fsleep syz-executor 12648 204877 94790 0 3 0 0x4000080 fsleep syz-executor 11333 214805 54950 -1 2 0x10 0x1 syz-executor 11333 235236 54950 -1 3 0x10 0x4000080 fsleep syz-executor 11333 516750 54950 -1 3 0x10 0x4000080 fsleep syz-executor 78924 500093 7676 0 2 0x2 0 syz-executor 82049 134000 21576 0 3 0 0x80 nanoslp syz-executor 82049 35890 21576 0 3 0 0x4000080 fsleep syz-executor 82049 225757 21576 0 3 0 0x4000080 fsleep syz-executor 85410 291673 1 0 3 0 0x80 nanoslp init 77909 108875 7676 0 3 0x2 0x80 nanoslp syz-executor 54950 197371 7676 0 3 0x2 0x80 nanoslp syz-executor 94790 410545 7676 0 3 0x2 0x80 nanoslp syz-executor 28613 63061 7676 0 3 0x2 0x80 nanoslp syz-executor 40689 472642 7676 0 3 0x2 0x80 nanoslp syz-executor 21576 141493 7676 0 3 0x2 0x80 nanoslp syz-executor 64415 351959 7676 0 3 0x2 0x80 nanoslp syz-executor 7676 492614 1 0 3 0x2 0x80 kqread syz-executor 81521 165531 0 0 3 0x14000 0x200 bored smr 54212 316801 0 0 2 0x14000 0x200 zerothread 25435 210355 0 0 3 0x14000 0x200 aiodoned aiodoned 82545 52881 0 0 3 0x14000 0x200 syncer update 27609 232908 0 0 3 0x14000 0x200 cleaner cleaner 55492 119915 0 0 3 0x14000 0x200 reaper reaper 2390 434653 0 0 3 0x14000 0x200 pgdaemon pagedaemon 35478 203503 0 0 3 0x14000 0x200 bored viomb 67517 477613 0 0 3 0x14000 0x40000200 acpi0 acpi0 74321 187249 0 0 3 0x14000 0x40000200 idle1 34476 282254 0 0 3 0x14000 0x200 bored softnet1 39810 381459 0 0 3 0x14000 0x200 bored softnet0 29705 313498 0 0 3 0x14000 0x200 bored systqmp 16340 296454 0 0 3 0x14000 0x200 bored systq 30559 477354 0 0 3 0x14000 0x200 tmoslp softclockmp 61975 250748 0 0 3 0x14000 0x40000200 tmoslp softclock 94035 311925 0 0 3 0x14000 0x40000200 idle0 1 207342 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks Process 20275 (syz-executor) thread 0xffff80003a7a42b8 (24619) exclusive rwlock fdlock r = 0 (0xffff80003a7aa280) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 doopenat+0x179 sys/kern/vfs_syscalls.c:1130 #3 sys_open+0x59 sys/kern/vfs_syscalls.c:1065 #4 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #5 Xsyscall+0x128 Process 48541 (syz-executor) thread 0xffff800045ffc2a0 (390339) exclusive rwlock vmmaplk r = 0 (0xfffff3000b1f7a88) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5170 #3 uvm_map_protect+0xe0 sys/uvm/uvm_map.c:3075 #4 sys_mprotect+0x351 sys/uvm/uvm_mmap.c:590 #5 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 Process 48541 (syz-executor) thread 0xffff80003a7a4020 (4867) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a157c0) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1 #2 malloc+0xe3 sys/kern/kern_malloc.c:175 #3 sys_shmat+0x9f sys/kern/sysv_shm.c:-1 #4 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #5 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11049 12086K 12211K 166960K 12307 0 pcb 17 12K 12K 166960K 43 0 rtable 198 7K 8K 166960K 395 0 pf 31 17K 24K 166960K 78 0 ifaddr 34 5K 7K 166960K 53 0 ifgroup 47 2K 2K 166960K 70 0 sysctl 3 1K 9K 166960K 8 0 counters 66 36K 37K 166960K 92 0 ioctlops 0 0K 4K 166960K 1517 0 iov 0 0K 2K 166960K 2 0 mount 1 1K 1K 166960K 1 0 log 1 0K 0K 166960K 5 0 vnodes 1326 83K 83K 166960K 1527 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 3 5K 5K 166960K 4 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 23 0 dirhash 12 2K 2K 166960K 18 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 16 61K 89K 166960K 275 0 proc 12 17K 163K 166960K 577 0 subproc 72 4K 5K 166960K 99 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 17 0 in_multi 73 5K 7K 166960K 100 0 ether_multi 1 0K 0K 166960K 1 0 mrt 1 0K 0K 166960K 10 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 61 281K 281K 166960K 61 0 exec 0 0K 1K 166960K 419 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 134 78K 169K 166960K 4632 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 18 36K 102K 166960K 1506 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 2 0 NDP 10 0K 2K 166960K 34 0 temp 37 9115K 9179K 166960K 11326 0 kqueue 1 2K 28K 166960K 46 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 47 0 47 2 1 1 1 0 8 1 rtentry 176 113 0 28 6 0 6 6 0 8 0 unpcb 144 115 0 114 2 1 1 1 0 8 0 syncache 336 8 0 8 1 1 0 1 0 8 0 tcpqe 32 1 0 1 1 1 0 1 0 8 0 tcpcb 736 67 0 62 4 3 1 4 0 8 0 arp 136 18 0 4 1 0 1 1 0 8 0 inpcb 328 225 0 219 7 6 1 7 0 8 0 nd6 152 25 0 8 1 0 1 1 0 8 0 pkpcb 40 3 0 3 1 0 1 1 0 8 1 kcovpl 48 10 0 3 1 0 1 1 0 8 0 ppxss 1192 10 0 10 2 1 1 1 0 8 1 pffrag 232 1 0 0 1 0 1 1 0 482 0 pffrnode 88 1 0 0 1 0 1 1 0 8 0 pffrent 40 1 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfrktable 1344 2 0 2 2 1 1 1 0 8 1 pfanchor 1288 5 0 0 1 0 1 1 0 8 0 pfstitem 24 42 0 0 1 0 1 1 0 8 0 pfstkey 128 42 0 0 2 0 2 2 0 8 0 pfstate 448 41 0 0 5 0 5 5 0 8 0 pfrule 1360 25 0 19 2 0 2 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 486 0 104 31 0 31 31 0 8 1 art_table 40 487 0 104 5 0 5 5 0 8 0 art_node 32 113 0 35 1 0 1 1 0 8 0 sysvmsgpl 40 2 0 1 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 72 21 0 11 1 0 1 1 0 8 0 shmpl 112 1 0 0 1 0 1 1 0 8 0 dirhash 1024 21 0 4 3 0 3 3 0 8 0 dino2pl 256 1833 0 359 93 0 93 93 0 8 0 ffsino 296 1833 0 359 115 1 114 115 0 8 0 nchpl 144 2187 0 477 64 0 64 64 0 8 0 rtmask 32 4 0 4 2 1 1 1 0 8 1 vnodes 216 2037 0 0 114 0 114 114 0 8 0 namei 1024 6983 0 6983 2 1 1 2 0 8 1 percpumem 16 62 0 13 1 0 1 1 0 8 0 acpiwqpl 32 1 0 1 1 0 1 1 1 8 1 kstatmem 264 39 0 16 2 0 2 2 0 8 0 scsiplug 72 1 0 1 1 0 1 1 0 8 1 scxspl 216 10087 0 10087 5 4 1 3 1 8 1 plimitpl 152 49 0 38 1 0 1 1 0 8 0 sigapl 424 606 0 571 7 1 6 7 0 8 0 knotepl 120 262 0 0 8 0 8 8 0 8 0 kqueuepl 224 65 0 60 1 0 1 1 0 8 0 pipepl 344 154 0 127 3 0 3 3 0 8 0 fdescpl 528 590 0 571 3 0 3 3 0 8 0 filepl 160 2548 0 2374 11 2 9 11 0 8 0 lockfpl 104 71 0 67 1 0 1 1 0 8 0 lockfspl 48 34 0 30 1 0 1 1 0 8 0 sessionpl 144 31 0 29 1 0 1 1 0 8 0 pgrppl 48 42 0 32 1 0 1 1 0 8 0 ucredpl 104 220 0 216 1 0 1 1 0 8 0 zombiepl 144 629 0 629 1 0 1 1 0 8 1 processpl 1232 606 0 571 5 1 4 5 0 8 0 procpl 664 854 0 805 6 1 5 6 0 8 0 sockpl 752 393 0 386 9 7 2 8 0 8 0 mcl64k 65536 6 0 0 1 0 1 1 0 8 0 mcl16k 16384 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 2