*cpu0: uvm_fault(0xfffff1806ce5dd70, 0x98, 0, 1) -> e ddb{1}> show kasan No such command ddb{1}> trace savectx() at savectx+0xae end of kernel end trace frame: 0x70c114e4de80, count: -1 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff800037ba9f10 rbx 0 rdx 0 rcx 0xffff8000393b82b8 rax 0x3b r8 0xffff800037ba9e40 r9 0 r10 0xdb62c192d378cd98 r11 0x1edafd05fdc8d20d r12 0 r13 0 r14 0xffff8000393b82b8 r15 0 rip 0xffffffff8179f3ee savectx+0xae cs 0x8 rflags 0x46 rsp 0xffff800037ba9e90 ss 0x10 savectx+0xae: movl $0,%gs:0x688 ddb{1}> show proc PROC (syz-executor) tid=470548 pid=49294 tcnt=4 stat=onproc flags process=0 proc=0 runpri=50, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000393b9778,0xffff8000393b8560 process=0xffff80003c3d61d0 user=0xffff800037ba4000, vmspace=0xfffff1806ce5dd70 estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 34090 79168 63171 0 2 0 0 syz-executor *49294 470548 32737 0 7 0 0 syz-executor 49294 481273 32737 0 3 0 0x4000080 fsleep syz-executor 49294 408790 32737 0 7 0 0x4000000 syz-executor 49294 36765 32737 0 2 0 0x4000000 syz-executor 66845 54871 22334 0 2 0 0 syz-executor 66845 209521 22334 0 2 0 0x4000000 syz-executor 21370 69215 47117 0 2 0 0 syz-executor 21370 239139 47117 0 3 0 0x4000080 kqread syz-executor 19592 99801 30838 0 3 0x1000 0x2000 suspend syz-executor 19592 151013 30838 0 2 0x1000 0x4080000 syz-executor 80282 373048 57941 0 3 0x2 0x80 nanoslp syz-executor 32737 49570 57941 0 3 0x2 0x80 nanoslp syz-executor 222 451758 57941 0 2 0x2 0 syz-executor 47117 385318 57941 0 2 0x2 0xc80 syz-executor 63171 384714 57941 0 2 0x2 0xc80 syz-executor 30838 452147 57941 0 3 0x2 0x80 nanoslp syz-executor 22334 420272 57941 0 2 0x2 0xc80 syz-executor 80379 181647 57941 0 3 0x2 0x80 wait syz-executor 57941 4183 7929 0 3 0x2 0x80 kqread syz-executor 7929 429639 68667 0 3 0x100002 0x88 sigsusp ksh 68667 66391 78431 0 3 0x10 0x88 kqread sshd-session 78431 374787 29718 0 3 0x12 0x80 kqread sshd-session 43272 33827 1 0 3 0x100003 0x80 ttyin getty 29718 58978 1 0 3 0 0x88 kqread sshd 49903 383955 67439 74 3 0x1100012 0x80 bpf pflogd 67439 275298 1 0 3 0 0x80 sbwait pflogd 71921 61656 62168 73 3 0x1100010 0x80 kqread syslogd 62168 482939 1 0 3 0x100002 0x80 sbwait syslogd 34310 91296 1 0 3 0x100000 0x80 kqread resolvd 46564 281512 86145 77 3 0x100012 0x80 kqread dhcpleased 59034 165411 86145 77 3 0x100012 0x80 kqread dhcpleased 86145 331719 1 0 3 0 0x80 kqread dhcpleased 31284 124883 0 0 2 0x14000 0x200 smr 33554 333821 0 0 2 0x14000 0x200 zerothread 56587 180499 0 0 3 0x14000 0x200 aiodoned aiodoned 91914 460482 0 0 3 0x14000 0x200 syncer update 48136 386990 0 0 3 0x14000 0x200 cleaner cleaner 57845 253808 0 0 3 0x14000 0x200 reaper reaper 2268 496038 0 0 3 0x14000 0x200 pgdaemon pagedaemon 24335 63856 0 0 3 0x14000 0x200 bored viomb 23763 471937 0 0 3 0x14000 0x40000200 acpi0 acpi0 61830 47700 0 0 3 0x14000 0x40000200 idle1 81857 308192 0 0 3 0x14000 0x200 bored softnet1 50181 163030 0 0 2 0x14000 0x200 softnet0 85325 247912 0 0 3 0x14000 0x200 bored systqmp 85896 432592 0 0 3 0x14000 0x200 bored systq 25427 98184 0 0 3 0x14000 0x200 tmoslp softclockmp 26018 359645 0 0 3 0x14000 0x40000200 tmoslp softclock 277 304597 0 0 3 0x14000 0x40000200 idle0 1 14127 0 0 3 0x40000002 0x80 wait init 0 0 -1 0 3 0x10010000 0x200 scheduler swapper ddb{1}> show all locks CPU 1: exclusive mutex &pmap->pm_mtx r = 0 (0xfffff1806cb4d210) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487 #2 pmap_write_protect+0x80 rcr3 sys/arch/amd64/compile/SYZKALLER/obj/machine/cpufunc.h:139 [inline] #2 pmap_write_protect+0x80 pmap_map_ptes sys/arch/amd64/amd64/pmap.c:441 [inline] #2 pmap_write_protect+0x80 sys/arch/amd64/amd64/pmap.c:2173 #3 uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:481 [inline] #3 uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202 #4 sys_mprotect+0x351 sys/uvm/uvm_mmap.c:590 #5 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 Process 49294 (syz-executor) thread 0xffff8000393b82b8 (470548) Process 49294 (syz-executor) thread 0xffff8000393b8020 (408790) Process 19592 (syz-executor) thread 0xffff8000393b8a80 (151013) Process 222 (syz-executor) thread 0xffff800045feefa8 (451758) ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11073 12220K 12479K 166960K 12652 0 pcb 17 13K 14K 166960K 122 0 rtable 235 11K 14K 166960K 453 0 pf 37 18K 24K 166960K 263 0 ifaddr 40 6K 8K 166960K 62 0 ifgroup 53 2K 2K 166960K 95 0 sysctl 3 1K 9K 166960K 8 0 counters 70 37K 37K 166960K 102 0 ioctlops 0 0K 4K 166960K 1614 0 iov 0 0K 24K 166960K 20 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1379 87K 87K 166960K 1818 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 3 5K 9K 166960K 14 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 28 0 dirhash 12 2K 2K 166960K 18 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 17 61K 97K 166960K 484 0 sigio 0 0K 0K 166960K 3 0 proc 72 115K 164K 166960K 597 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 54 0 in_multi 88 5K 6K 166960K 118 0 ether_multi 1 0K 0K 166960K 2 0 mrt 1 0K 0K 166960K 18 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 85 387K 387K 166960K 85 0 exec 0 0K 1K 166960K 484 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 1K 166960K 3 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 218 159K 170K 166960K 6115 0 UVM aobj 15 2K 2K 166960K 17 0 pinsyscall 42 84K 104K 166960K 1640 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 11 0 NDP 12 0K 2K 166960K 40 0 temp 42 9119K 9171K 166960K 14012 0 kqueue 13 20K 26K 166960K 85 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 58 0 55 1 0 1 1 0 8 0 rtentry 176 118 0 16 6 0 6 6 0 8 0 unpcb 144 198 0 181 1 0 1 1 0 8 0 syncache 336 8 0 8 2 1 1 1 0 8 1 tcpcb 736 91 0 86 2 0 2 2 0 8 1 arp 136 18 0 2 1 0 1 1 0 8 0 inpcb 328 406 0 397 5 0 5 5 0 8 4 nd6 152 27 0 4 2 0 2 2 0 8 0 pkpcb 40 4 0 4 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 mppekey 1024 1 0 1 1 0 1 1 0 8 1 ppxss 1192 10 0 9 1 0 1 1 0 8 0 pppxif 1576 3 0 3 1 0 1 1 0 8 1 pfstscr 40 17 0 15 1 0 1 1 0 8 0 pffrag 232 3 0 0 1 0 1 1 0 482 0 pffrnode 88 3 0 0 1 0 1 1 0 8 0 pffrent 40 6 0 2 1 0 1 1 0 8 0 pfosfp 40 1429 0 1428 5 0 5 5 0 8 4 pfosfpen 112 1429 0 1428 21 0 21 21 0 8 20 pfrktable 1344 9 0 9 1 0 1 1 0 8 1 pfsrclim 320 1 0 1 1 0 1 1 0 8 1 pfanchor 1288 6 0 2 1 0 1 1 0 8 0 pftag 88 3 0 1 1 0 1 1 0 8 0 pfstitem 24 63 0 4 1 0 1 1 0 8 0 pfstkey 128 77 0 18 2 0 2 2 0 8 0 pfstate 448 67 0 10 7 0 7 7 0 8 0 pfrule 1360 32 0 27 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 525 0 58 30 0 30 30 0 8 0 art_table 40 526 0 58 5 0 5 5 0 8 0 art_node 32 118 0 25 1 0 1 1 0 8 0 sysvmsgpl 40 3 0 1 1 0 1 1 0 8 0 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 72 25 0 15 1 0 1 1 0 8 0 shmpl 112 14 0 2 1 0 1 1 0 8 0 dirhash 1024 21 0 4 3 0 3 3 0 8 0 dino2pl 256 2264 0 805 93 0 93 93 0 8 0 ffsino 296 2264 0 805 114 0 114 114 0 8 0 nchpl 144 2921 0 1213 64 0 64 64 0 8 0 vnodes 216 2630 0 0 147 0 147 147 0 8 0 namei 1024 9627 0 9627 2 1 1 2 0 8 1 percpumem 16 67 0 16 1 0 1 1 0 8 0 pfiaddrpl 120 2 0 2 1 0 1 1 0 8 1 kstatmem 264 51 0 24 3 1 2 3 0 8 0 scsiplug 72 3 0 3 1 0 1 1 0 8 1 scxspl 216 12529 0 12529 11 3 8 8 1 8 8 plimitpl 152 142 0 123 1 0 1 1 0 8 0 sigapl 424 801 0 754 7 1 6 7 0 8 0 knotepl 120 527 0 0 16 0 16 16 0 8 0 kqueuepl 224 117 0 107 1 0 1 1 0 8 0 pipepl 344 220 0 192 3 0 3 3 0 8 0 fdescpl 528 785 0 754 3 0 3 3 0 8 0 filepl 160 4322 0 4097 15 0 15 15 0 8 4 lockfpl 104 141 0 137 1 0 1 1 0 8 0 lockfspl 48 66 0 62 1 0 1 1 0 8 0 sessionpl 144 40 0 31 1 0 1 1 0 8 0 pgrppl 48 49 0 32 1 0 1 1 0 8 0 ucredpl 104 700 0 687 1 0 1 1 0 8 0 zombiepl 144 756 0 754 1 0 1 1 0 8 0 processpl 1232 801 0 754 5 0 5 5 0 8 0 procpl 664 1391 0 1338 6 0 6 6 0 8 0 sockpl 752 678 0 649 8 0 8 8 0 8 4 mcl64k 65536 5 0 0 1 0 1 1 0 8 0 mcl16k 16384 6 0 0 1 0 1 1 0 8 0 mcl12k 12288 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 119 0 0 15 0 15 15 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 21 0 0 3 0 3 3 0 8 0 mextrefs 64 18 0 0 1 0 1 1 0 8 0 mtagpl 96 4 0 0 1 0 1 1 0 8 0 mbufpl 256 164 0 0 10 0 10 10 0 8 0 bufpl 272 4318 0 109 281 0 281 281 0 8 0 anonpl 32 8054 0 0 65 0 65 65 0 247 0 amapchunkpl 152 18844 0 18409 32 1 31 31 0 158 11 amappl16 200 2661 0 2552 22 9 13 15 0 8 7 amappl15 192 7 0 7 1 1 0 1 0 8 0 amappl14 184 430 0 429 1 0 1 1 0 8 0 amappl13 176 124 0 111 1 0 1 1 0 8 0 amappl12 168 1037 0 1008 2 0 2 2 0 8 0 amappl11 160 5 0 5 1 1 0 1 0 8 0 amappl10 152 86 0 72 1 0 1 1 0 8 0 amappl9 144 274 0 274 1 1 0 1 0 8 0 amappl8 136 98 0 96 1 0 1 1 0 8 0 amappl7 128 146 0 133 1 0 1 1 0 8 0 amappl6 120 151 0 149 1 0 1 1 0 8 0 amappl5 112 95 0 84 1 0 1 1 0 8 0 amappl4 104 298 0 277 1 0 1 1 0 8 0 amappl3 96 3436 0 3348 3 0 3 3 0 8 0 amappl2 88 913 0 835 2 0 2 2 0 8 0 amappl1 80 11897 0 11291 15 2 13 15 0 8 0 amappl 88 5356 0 5209 5 0 5 5 0 92 0 uvmvnodes 80 104 0 0 3 0 3 3 0 8 0 dma32768 32768 1 0 1 1 0 1 1 0 8 1 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 16 0 2 1 0 1 1 0 8 0 uaddrrnd 24 785 0 754 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 785 0 754 1 0 1 1 0 8 0 vmmpekpl 168 8328 0 8291 3 0 3 3 0 8 0 vmmpepl 168 57615 0 55636 97 0 97 97 0 357 4 vmsppl 488 784 0 754 5 1 4 5 0 8 0 rwobjpl 80 18877 0 17769 27 0 27 27 0 8 0 pdppl 4096 1577 0 1508 99 28 71 87 0 8 2 pvpl 32 16233 0 0 132 1 131 132 0 265 0 pmappl 256 784 0 754 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 561 0 33 16 0 16 16 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff83982ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:682 acpitimer_delay(1) at acpitimer_delay+0x57 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline] acpitimer_delay(1) at acpitimer_delay+0x57 sys/dev/acpi/acpitimer.c:120 comcnputc(800,20) at comcnputc+0x29b sys/dev/ic/com.c:1274 cnputc(20) at cnputc+0x67 sys/dev/cons.c:218 kputchar(20,5,0) at kputchar+0x2ed sys/kern/subr_prf.c:367 kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1 printf(ffffffff83567a08) at printf+0x8b sys/kern/subr_prf.c:529 trap_print(ffff80003c407a60,6) at trap_print+0x70 sys/arch/amd64/amd64/trap.c:661 kerntrap(ffff80003c407a60) at kerntrap+0x2e6 sys/arch/amd64/amd64/trap.c:524 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff8000393b8020,fffff1805ef53d98,ffff80003c407c40) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691 end trace frame: 0xffff80003c407cb0, count: 0 ddb{0}> trace x86_ipi_db(ffffffff83982ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:682 acpitimer_delay(1) at acpitimer_delay+0x57 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline] acpitimer_delay(1) at acpitimer_delay+0x57 sys/dev/acpi/acpitimer.c:120 comcnputc(800,20) at comcnputc+0x29b sys/dev/ic/com.c:1274 cnputc(20) at cnputc+0x67 sys/dev/cons.c:218 kputchar(20,5,0) at kputchar+0x2ed sys/kern/subr_prf.c:367 kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1 printf(ffffffff83567a08) at printf+0x8b sys/kern/subr_prf.c:529 trap_print(ffff80003c407a60,6) at trap_print+0x70 sys/arch/amd64/amd64/trap.c:661 kerntrap(ffff80003c407a60) at kerntrap+0x2e6 sys/arch/amd64/amd64/trap.c:524 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff8000393b8020,fffff1805ef53d98,ffff80003c407c40) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691 sys_futimes(ffff8000393b8020,ffff80003c407d90,ffff80003c407ce0) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2733 syscall(ffff80003c407d90) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c407d90) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x61166ec36e0, count: -17 ddb{0}> machine ddbcpu 1 Stopped at savectx+0xae: movl $0,%gs:0x688 savectx() at savectx+0xae end of kernel end trace frame: 0x70c114e4de80, count: 14 ddb{1}> trace savectx() at savectx+0xae end of kernel end trace frame: 0x70c114e4de80, count: -1