*cpu0: uvm_fault(0xfffffd806be207a0, 0x12d60, 0, 2) -> e ddb{1}> trace savectx() at savectx+0xae end of kernel end trace frame: 0x74d98bb00950, count: -1 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff80002a368150 rbx 0 rdx 0 rcx 0xffff80002a291210 rax 0x33 r8 0xffff80002a368080 r9 0xffff80002a367d48 r10 0xdad294d5ea9f5ba9 r11 0x4ca9c3b594e7d817 r12 0 r13 0 r14 0xffff80002a291210 r15 0 rip 0xffffffff810903ee savectx+0xae cs 0x8 rflags 0x46 rsp 0xffff80002a3680d0 ss 0x10 savectx+0xae: movl $0,%gs:0x680 ddb{1}> show proc PROC (syz-executor) tid=34387 pid=16149 tcnt=1 stat=onproc flags process=2 proc=0 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a2919c0,0xffff80002a290d00 process=0xffff8000ffff77e8 user=0xffff80002a363000, vmspace=0xfffffd8009ed6000 estcpu=36, cpticks=1, pctcpu=0.4, user=0, sys=9, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 99926 418685 78646 0 2 0 syz-executor 99926 113877 78646 0 3 0x4000080 ttyout syz-executor 99926 503574 78646 0 3 0x4000080 fsleep syz-executor 39379 3138 16149 0 2 0 syz-executor 39379 204261 16149 0 2 0x4000000 syz-executor 39379 335718 16149 0 7 0x4000000 syz-executor 69004 253256 67671 0 2 0x480 syz-executor 69004 25725 67671 0 3 0x4000080 fsleep syz-executor 69004 244681 67671 0 2 0x4000000 syz-executor 69004 230349 67671 0 3 0x4000080 fsleep syz-executor 66835 92243 89715 0 2 0x480 syz-executor 66835 304238 89715 0 3 0x4000080 lockf syz-executor 66835 448140 89715 0 3 0x4000080 lockf syz-executor 66835 165288 89715 0 3 0x4000080 fsleep syz-executor 66835 246682 89715 0 3 0x4000080 fsleep syz-executor 18622 354 62291 0 2 0 syz-executor 18622 167839 62291 0 3 0x4000080 fsleep syz-executor 18622 222970 62291 0 3 0x4000080 fsleep syz-executor 18622 345983 62291 0 3 0x4000080 fsleep syz-executor 98641 476527 0 0 3 0x14200 acct acct 2634 51399 0 0 3 0x14200 bored sosplice 89715 68337 99603 0 2 0x482 syz-executor 67671 24198 99603 0 2 0x482 syz-executor 9775 466991 99603 0 3 0x82 wait syz-executor 66705 406445 99603 0 3 0x82 wait syz-executor *16149 34387 99603 0 7 0x2 syz-executor 52048 305099 99603 0 2 0x482 syz-executor 78646 295190 99603 0 2 0x482 syz-executor 62291 30393 99603 0 2 0x482 syz-executor 99603 455874 93316 0 3 0x82 kqread syz-executor 93316 489165 5449 0 3 0x10008a sigsusp ksh 5449 457259 51093 0 3 0x98 kqread sshd-session 51093 343158 3482 0 3 0x92 kqread sshd-session 39227 441790 1 0 3 0x100083 ttyopn getty 3482 135984 1 0 3 0x88 kqread sshd 90717 306136 98473 74 3 0x1100092 bpf pflogd 98473 297321 1 0 3 0x80 sbwait pflogd 83177 334533 54670 73 3 0x1100090 kqread syslogd 54670 292090 1 0 3 0x100082 sbwait syslogd 42017 91527 1 0 3 0x100080 kqread resolvd 63187 161158 64903 77 3 0x100092 kqread dhcpleased 86404 386007 64903 77 3 0x100092 kqread dhcpleased 64903 86318 1 0 3 0x80 kqread dhcpleased 49849 502037 0 0 3 0x14200 bored smr 54974 501035 0 0 2 0x14200 zerothread 22436 124118 0 0 3 0x14200 aiodoned aiodoned 99831 512544 0 0 3 0x14200 syncer update 9245 310485 0 0 3 0x14200 cleaner cleaner 49628 412015 0 0 3 0x14200 reaper reaper 53136 7315 0 0 3 0x14200 pgdaemon pagedaemon 38143 100411 0 0 3 0x14200 bored viomb 11911 192965 0 0 3 0x40014200 acpi0 acpi0 60110 108602 0 0 3 0x40014200 idle1 85279 29801 0 0 3 0x14200 bored softnet3 96919 150117 0 0 3 0x14200 bored softnet2 77407 276975 0 0 3 0x14200 bored softnet1 74815 228403 0 0 3 0x14200 bored softnet0 2947 509873 0 0 3 0x14200 bored systqmp 27703 194949 0 0 3 0x14200 bored systq 32808 330693 0 0 3 0x14200 tmoslp softclockmp 40537 168046 0 0 2 0x40014200 softclock 99300 415848 0 0 3 0x40014200 idle0 1 167147 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks CPU 1: exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff837f38b8) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 mtx_enter_try+0x178 sys/kern/kern_lock.c:-1 #2 mtx_enter+0x60 sys/kern/kern_lock.c:239 #3 malloc+0x2f9 sys/kern/kern_malloc.c:199 #4 ktrsyscall+0x17f sys/kern/kern_ktrace.c:174 #5 syscall+0x2e6 mi_syscall sys/sys/syscall_mi.h:154 [inline] #5 syscall+0x2e6 sys/arch/amd64/amd64/trap.c:577 #6 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10231 11064K 11214K 166960K 11506 0 pcb 18 13K 14K 166960K 93 0 rtable 199 6K 7K 166960K 385 0 pf 36 17K 19K 166960K 59 0 ifaddr 41 7K 7K 166960K 53 0 ifgroup 59 2K 2K 166960K 71 0 sysctl 3 1K 1K 166960K 3 0 counters 66 36K 37K 166960K 74 0 ioctlops 0 0K 4K 166960K 1501 0 iov 0 0K 16K 166960K 9 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1340 84K 84K 166960K 1511 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 7 0 VM map 2 1K 1K 166960K 2 0 sem 11 0K 0K 166960K 19 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 18 65K 89K 166960K 319 0 sigio 0 0K 0K 166960K 6 0 proc 72 91K 128K 166960K 551 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 285 0 in_multi 88 6K 7K 166960K 107 0 ether_multi 1 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 217 970K 970K 166960K 217 0 exec 0 0K 1K 166960K 387 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 261 168K 181K 166960K 4803 0 UVM aobj 7 4K 4K 166960K 8 0 pinsyscall 43 86K 103K 166960K 1437 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 8 0 NDP 13 0K 2K 166960K 32 0 temp 46 8684K 8749K 166960K 14971 0 kqueue 16 24K 26K 166960K 73 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 80 0 76 2 0 2 2 0 8 1 rtentry 176 117 0 27 6 0 6 6 0 8 0 unpcb 144 257 0 239 6 0 6 6 0 8 5 syncache 336 6 0 6 2 1 1 1 0 8 1 tcpcb 808 59 0 55 2 0 2 2 0 8 1 arp 128 19 0 3 1 0 1 1 0 8 0 inpcb 384 358 0 348 8 0 8 8 0 8 7 nd6 144 25 0 3 1 0 1 1 0 8 0 pkpcb 40 1 0 1 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 2 0 2 1 0 1 1 0 8 1 pppxif 1504 1 0 1 1 0 1 1 0 8 1 pffrag 232 1 0 0 1 0 1 1 0 482 0 pffrnode 88 1 0 0 1 0 1 1 0 8 0 pffrent 40 1 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 29 0 0 1 0 1 1 0 8 0 pfstkey 128 29 0 0 1 0 1 1 0 8 0 pfstate 384 29 0 0 3 0 3 3 0 8 0 pfrule 1344 22 0 17 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 498 0 93 29 2 27 29 0 8 1 art_table 32 499 0 93 4 0 4 4 0 8 0 art_node 16 116 0 35 1 0 1 1 0 8 0 sysvmsgpl 40 5 0 5 2 1 1 1 0 8 1 semupl 112 3 0 3 2 1 1 1 0 8 1 semapl 112 16 0 7 1 0 1 1 0 8 0 shmpl 112 5 0 1 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1928 0 417 95 0 95 95 0 8 0 ffsino 288 1928 0 417 109 0 109 109 0 8 0 nchpl 144 2383 0 689 63 0 63 63 0 8 0 uvmvnodes 80 2066 0 0 43 0 43 43 0 8 0 vnodes 216 2066 0 0 115 0 115 115 0 8 0 namei 1024 7680 0 7680 2 1 1 1 0 8 1 percpumem 16 52 0 4 1 0 1 1 0 8 0 kstatmem 264 32 0 6 2 0 2 2 0 8 0 scsiplug 72 1 0 1 1 0 1 1 0 8 1 scxspl 216 7349 0 7349 4 2 2 2 1 8 2 plimitpl 152 87 0 68 1 0 1 1 0 8 0 sigapl 424 630 0 578 8 2 6 7 0 8 0 futexpl 64 3168 0 3160 1 0 1 1 0 8 0 knotepl 120 312 0 0 10 0 10 10 0 8 0 kqueuepl 224 86 0 73 2 0 2 2 0 8 1 pipepl 336 127 0 99 3 0 3 3 0 8 0 fdescpl 520 610 0 578 3 0 3 3 0 8 0 filepl 160 3171 0 2892 17 0 17 17 0 8 5 lockfpl 104 132 0 126 2 0 2 2 0 8 1 lockfspl 48 30 0 27 1 0 1 1 0 8 0 sessionpl 144 24 0 15 1 0 1 1 0 8 0 pgrppl 48 40 0 23 1 0 1 1 0 8 0 ucredpl 104 547 0 533 1 0 1 1 0 8 0 zombiepl 144 581 0 578 2 1 1 1 0 8 0 processpl 1192 630 0 578 5 0 5 5 0 8 0 procpl 656 953 0 887 7 1 6 6 0 8 0 srpgc 96 2 0 2 1 1 0 1 0 8 0 sosppl 168 2 0 2 1 0 1 1 0 8 1 sockpl 728 701 0 669 20 9 11 19 0 8 8 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 127 0 0 16 0 16 16 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 22 0 0 3 0 3 3 0 8 0 mtagpl 96 7 0 0 1 0 1 1 0 8 0 mbufpl 256 636 0 0 40 0 40 40 0 8 0 bufpl 280 2747 0 132 187 0 187 187 0 8 0 anonpl 32 7528 0 0 61 0 61 61 0 246 0 amapchunkpl 152 14224 0 13673 25 0 25 25 0 158 3 amappl16 200 2367 0 2338 18 5 13 15 0 8 11 amappl15 192 5 0 5 1 1 0 1 0 8 0 amappl14 184 117 0 105 1 0 1 1 0 8 0 amappl13 176 3 0 3 1 1 0 1 0 8 0 amappl12 168 1266 0 1234 3 1 2 2 0 8 0 amappl11 160 52 0 37 1 0 1 1 0 8 0 amappl10 152 12 0 11 1 0 1 1 0 8 0 amappl9 144 260 0 260 1 1 0 1 0 8 0 amappl8 136 26 0 23 1 0 1 1 0 8 0 amappl7 128 260 0 248 1 0 1 1 0 8 0 amappl6 120 201 0 198 1 0 1 1 0 8 0 amappl5 112 126 0 117 1 0 1 1 0 8 0 amappl4 104 330 0 309 1 0 1 1 0 8 0 amappl3 96 2560 0 2435 5 1 4 4 0 8 0 amappl2 88 656 0 596 2 0 2 2 0 8 0 amappl1 80 9386 0 8785 15 1 14 15 0 8 0 amappl 88 4063 0 3875 5 0 5 5 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 7 0 1 1 0 1 1 0 8 0 uaddrrnd 24 610 0 578 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 610 0 578 1 0 1 1 0 8 0 vmmpekpl 168 6785 0 6746 3 0 3 3 0 8 0 vmmpepl 168 45674 0 43623 104 5 99 99 0 357 9 vmsppl 480 609 0 578 5 0 5 5 0 8 1 rwobjpl 72 17438 0 14409 58 0 58 58 0 8 2 pdppl 4096 1228 0 1156 104 32 72 84 0 8 0 pvpl 32 15108 0 0 122 0 122 122 0 265 0 pmappl 256 609 0 578 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 417 0 38 11 0 11 11 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff8381eff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666 acpitimer_delay(1) at acpitimer_delay+0xb7 acpitimer_read sys/dev/acpi/acpitimer.c:146 [inline] acpitimer_delay(1) at acpitimer_delay+0xb7 sys/dev/acpi/acpitimer.c:120 comcnputc(800,a) at comcnputc+0x29b sys/dev/ic/com.c:1269 cnputc(a) at cnputc+0x61 sys/dev/cons.c:218 db_putchar(a) at db_putchar+0x774 sys/ddb/db_output.c:168 kprintf() at kprintf+0x843 sys/kern/subr_prf.c:-1 db_printf(ffffffff833fa7ff) at db_printf+0x9b sys/kern/subr_prf.c:-1 fault(ffffffff8339faa0) at fault+0xa7 sys/arch/amd64/amd64/trap.c:157 kpageflttrap(ffff80003c46e7b0,12d60) at kpageflttrap+0x385 sys/arch/amd64/amd64/trap.c:290 kerntrap(ffff80003c46e7b0) at kerntrap+0x14a sys/arch/amd64/amd64/trap.c:332 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b end trace frame: 0xffff80003c46eb20, count: 0 ddb{0}> trace x86_ipi_db(ffffffff8381eff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666 acpitimer_delay(1) at acpitimer_delay+0xb7 acpitimer_read sys/dev/acpi/acpitimer.c:146 [inline] acpitimer_delay(1) at acpitimer_delay+0xb7 sys/dev/acpi/acpitimer.c:120 comcnputc(800,a) at comcnputc+0x29b sys/dev/ic/com.c:1269 cnputc(a) at cnputc+0x61 sys/dev/cons.c:218 db_putchar(a) at db_putchar+0x774 sys/ddb/db_output.c:168 kprintf() at kprintf+0x843 sys/kern/subr_prf.c:-1 db_printf(ffffffff833fa7ff) at db_printf+0x9b sys/kern/subr_prf.c:-1 fault(ffffffff8339faa0) at fault+0xa7 sys/arch/amd64/amd64/trap.c:157 kpageflttrap(ffff80003c46e7b0,12d60) at kpageflttrap+0x385 sys/arch/amd64/amd64/trap.c:290 kerntrap(ffff80003c46e7b0) at kerntrap+0x14a sys/arch/amd64/amd64/trap.c:332 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b copyout() at copyout+0x57 syscall(ffff80003c46ec00) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c46ec00) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xaf7cc9e73e0, count: -17 ddb{0}> machine ddbcpu 1 Stopped at savectx+0xae: movl $0,%gs:0x680 savectx() at savectx+0xae end of kernel end trace frame: 0x74d98bb00950, count: 14 ddb{1}> trace savectx() at savectx+0xae end of kernel end trace frame: 0x74d98bb00950, count: -1