login: uvm_fault(0xffffffff82239408, 0xffff800004d8b002, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at rtable_satoplen+0x150: movzbl 0xffffffffffffffff(%r13),%r12d
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
kernel page fault
uvm_fault(0xffffffff82239408, 0xffff800004d8b002, 0, 1) -> e
rtable_satoplen(21,ffff800004d8af59) at rtable_satoplen+0x150 sys/net/rtable.c:888
end trace frame: 0xffff800020c556c0, count: 0
ddb{1}> trace
rtable_satoplen(21,ffff800004d8af59) at rtable_satoplen+0x150 sys/net/rtable.c:888
rtable_lookup(0,ffff800004d8af09,ffff800004d8af59,ffff800004d8af11,21) at rtable_lookup+0xfd sys/net/rtable.c:391
rtm_output(ffff800004d8af00,ffff800020c557b0,ffff800020c557b8,21,0) at rtm_output+0x10c sys/net/rtsock.c:1122
route_output(fffffd806f3aeb00,fffffd806f6cfa80,0,0) at route_output+0x79b sys/net/rtsock.c:806
route_usrreq(fffffd806f6cfa80,9,fffffd806f3aeb00,0,0,ffff800020b39080) at route_usrreq+0x35d sys/net/rtsock.c:271
sosend(fffffd806f6cfa80,0,ffff800020c55a78,0,0,0) at sosend+0x6eb sys/kern/uipc_socket.c:513
sendit(ffff800020b39080,5,ffff800020c55b38,0,ffff800020c55c00) at sendit+0x590 sys/kern/uipc_syscalls.c:662
sys_sendto(ffff800020b39080,ffff800020c55c18,ffff800020c55c00) at sys_sendto+0x92
syscall(ffff800020c55cb0) at syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(ffff800020c55cb0) at syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
Xsyscall(6,0,ffffffffffffffd8,0,6,4726e11e010) at Xsyscall+0x128
end of kernel
end trace frame: 0x4753bddbe80, count: -10
ddb{1}> show registers
rdi 0
rsi 0xaa
rbp 0xffff800020c55620
rbx 0xffffffffffffff5a
rdx 0xffff800004d8af5d
rcx 0xffff800004d8b003
rax 0xffff800004d8b003
r8 0x21
r9 0x1
r10 0x4
r11 0x573d51c0c1019bf1
r12 0
r13 0xffff800004d8b003
r14 0xffffffff821b2890 mplsdomain
r15 0x4
rip 0xffffffff813351d0 rtable_satoplen+0x150
cs 0x8
rflags 0x10287 __ALIGN_SIZE+0xf287
rsp 0xffff800020c555d0
ss 0x10
rtable_satoplen+0x150: movzbl 0xffffffffffffffff(%r13),%r12d
ddb{1}> show proc
PROC (syz-executor.1) pid=413937 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
pri=86, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff800020b38720,0xffffffff82370ee8
process=0xffff800020b3b078 user=0xffff800020c50000, vmspace=0xfffffd807f00b5a0
estcpu=36, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
70663 250313 2610 32767 7 0x10 syz-executor.1
*70663 413937 2610 32767 7 0x4000010 syz-executor.1
4032 465342 79666 32767 3 0x10 biowait syz-executor.0
79666 457110 50125 0 3 0x82 wait syz-executor.0
2610 276948 84976 32767 3 0x90 nanosleep syz-executor.1
84976 493969 50125 0 3 0x82 wait syz-executor.1
93520 294586 0 0 3 0x14200 bored sosplice
50125 131443 50783 0 3 0x82 thrsleep syz-fuzzer
50125 56435 50783 0 3 0x4000082 nanosleep syz-fuzzer
50125 95841 50783 0 3 0x4000082 thrsleep syz-fuzzer
50125 498231 50783 0 3 0x4000082 thrsleep syz-fuzzer
50125 453677 50783 0 3 0x4000082 thrsleep syz-fuzzer
50125 352909 50783 0 3 0x4000082 thrsleep syz-fuzzer
50125 452438 50783 0 3 0x4000082 kqread syz-fuzzer
50125 50394 50783 0 3 0x4000082 thrsleep syz-fuzzer
50125 206828 50783 0 3 0x4000082 thrsleep syz-fuzzer
50125 493622 50783 0 3 0x4000082 thrsleep syz-fuzzer
50125 312423 50783 0 3 0x4000082 thrsleep syz-fuzzer
50783 130426 64836 0 3 0x10008a pause ksh
64836 415941 14457 0 3 0x92 select sshd
21317 427675 1 0 3 0x100083 ttyin getty
14457 256624 1 0 3 0x80 select sshd
7467 130770 38989 73 2 0x100090 syslogd
38989 233425 1 0 3 0x100082 netio syslogd
37691 31860 1 77 3 0x100090 poll dhclient
91512 383501 1 0 3 0x80 poll dhclient
95084 243076 0 0 3 0x14200 pgzero zerothread
17275 81037 0 0 3 0x14200 aiodoned aiodoned
93137 234707 0 0 3 0x14200 syncer update
10948 224437 0 0 3 0x14200 cleaner cleaner
16417 339114 0 0 3 0x14200 reaper reaper
39225 380660 0 0 3 0x14200 pgdaemon pagedaemon
83434 244553 0 0 3 0x14200 bored crynlk
93456 238587 0 0 3 0x14200 bored crypto
52704 231383 0 0 3 0x40014200 acpi0 acpi0
34764 144956 0 0 3 0x40014200 idle1
14462 105894 0 0 3 0x14200 bored softnet
86230 257620 0 0 3 0x14200 bored systqmp
77745 421061 0 0 3 0x14200 bored systq
22899 299646 0 0 3 0x40014200 bored softclock
62922 491425 0 0 3 0x40014200 idle0
64124 219932 0 0 3 0x14200 bored smr
1 386545 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
Process 70663 (syz-executor.1) thread 0xffff800020b39080 (413937)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff82394290) locked @ /syzkaller/managers/setuid/kernel/sys/arch/amd64/amd64/trap.c:161
#0 witness_lock+0x594 sys/kern/subr_witness.c:1201
#1 solock+0x7e sys/kern/uipc_socket2.c:292
#2 sosend+0x586 sys/kern/uipc_socket.c:501
#3 sendit+0x590 sys/kern/uipc_syscalls.c:662
#4 sys_sendto+0x92
#5 syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#5 syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
#6 Xsyscall+0x128
Process 4032 (syz-executor.0) thread 0xffff800020b39530 (465342)
exclusive rrwlock inode r = 0 (0xfffffd806e4bef78) locked @ /syzkaller/managers/setuid/kernel/sys/ufs/ufs/ufs_vnops.c:1547
#0 witness_lock+0x594 sys/kern/subr_witness.c:1201
#1 _rw_enter+0x45d sys/kern/kern_rwlock.c:280
#2 _rrw_enter+0x60 sys/kern/kern_rwlock.c:410
#3 VOP_LOCK+0x57 sys/kern/vfs_vops.c:602
#4 vn_lock+0x6e sys/kern/vfs_vnops.c:549
#5 vget+0x1c3 sys/kern/vfs_subr.c:672
#6 ufs_ihashget+0x151 sys/ufs/ufs/ufs_ihash.c:119
#7 ffs_vget+0x84 sys/ufs/ffs/ffs_vfsops.c:1323
#8 ufs_lookup+0x15d3 sys/ufs/ufs/ufs_lookup.c:487
#9 VOP_LOOKUP+0x67 sys/kern/vfs_vops.c:90
#10 vfs_lookup+0x556 sys/kern/vfs_lookup.c:523
#11 namei+0x4b2 sys/kern/vfs_lookup.c:224
#12 dounlinkat+0xa5 sys/kern/vfs_syscalls.c:1673
#13 syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#13 syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8069d225e8) locked @ /syzkaller/managers/setuid/kernel/sys/ufs/ufs/ufs_vnops.c:1547
#0 witness_lock+0x594 sys/kern/subr_witness.c:1201
#1 _rw_enter+0x45d sys/kern/kern_rwlock.c:280
#2 _rrw_enter+0x60 sys/kern/kern_rwlock.c:410
#3 VOP_LOCK+0x57 sys/kern/vfs_vops.c:602
#4 vn_lock+0x6e sys/kern/vfs_vnops.c:549
#5 vget+0x1c3 sys/kern/vfs_subr.c:672
#6 cache_lookup+0x300 sys/kern/vfs_cache.c:224
#7 ufs_lookup+0x1d7 sys/ufs/ufs/ufs_lookup.c:162
#8 VOP_LOOKUP+0x67 sys/kern/vfs_vops.c:90
#9 vfs_lookup+0x556 sys/kern/vfs_lookup.c:523
#10 namei+0x4b2 sys/kern/vfs_lookup.c:224
#11 dounlinkat+0xa5 sys/kern/vfs_syscalls.c:1673
#12 syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#12 syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
#13 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9460 6321K 6321K 78643K 10592 0 0
pcb 25 9K 11K 78643K 195 0 0
rtable 98 3K 3K 78643K 459 0 0
ifaddr 35 10K 10K 78643K 91 0 0
counters 39 33K 33K 78643K 39 0 0
ioctlops 0 0K 2K 78643K 32 0 0
iov 0 0K 24K 78643K 26 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1200 75K 75K 78643K 1423 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 5K 78643K 8 0 0
VM map 2 1K 1K 78643K 2 0 0
sem 12 1K 1K 78643K 54 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1808 196K 290K 78643K 12628 0 0
file desc 7 21K 33K 78643K 305 0 0
sigio 0 0K 0K 78643K 5 0 0
proc 41 38K 58K 78643K 468 0 0
subproc 68 69634K 69634K 78643K 374 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 24 0 0
in_multi 33 2K 2K 78643K 136 0 0
ether_multi 1 0K 0K 78643K 1 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 60 265K 265K 78643K 60 0 0
exec 0 0K 1K 78643K 233 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 80 20K 21K 78643K 1725 0 0
UVM aobj 23 3K 3K 78643K 25 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 0K 78643K 18 0 0
NDP 7 0K 0K 78643K 36 0 0
temp 97 2368K 2438K 78643K 4137 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 13 0 9 1 0 1 1 0 8 0
inpcbpl 280 160 0 153 1 0 1 1 0 8 0
plimitpl 152 45 0 36 1 0 1 1 0 8 0
plcache 128 20 0 0 1 0 1 1 0 8 0
rtentry 112 122 0 82 2 0 2 2 0 8 0
syncache 264 4 0 4 1 1 0 1 0 8 0
tcpqe 32 50 0 50 1 1 0 1 0 8 0
tcpcb 544 56 0 52 1 0 1 1 0 8 0
nd6 48 22 0 18 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 560 0 375 12 0 12 12 0 8 0
art_table 32 561 0 375 2 0 2 2 0 8 0
art_node 16 121 0 87 1 0 1 1 0 8 0
sysvmsgpl 40 10 0 4 1 0 1 1 0 8 0
semapl 112 52 0 42 1 0 1 1 0 8 0
shmpl 112 23 0 2 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino1pl 128 1768 0 349 46 0 46 46 0 8 0
ffsino 272 1768 0 349 96 0 96 96 0 8 1
nchpl 144 2401 0 788 61 1 60 61 0 8 0
uvmvnodes 72 1964 0 0 36 0 36 36 0 8 0
vnodes 200 1964 0 0 104 0 104 104 0 8 0
namei 1024 7011 0 7011 2 1 1 1 0 8 1
percpumem 16 30 0 0 1 0 1 1 0 8 0
scxspl 192 5819 0 5818 8 7 1 6 0 8 0
sigapl 432 448 0 433 3 1 2 3 0 8 0
futexpl 56 2844 0 2844 1 0 1 1 0 8 1
knotepl 112 347 0 328 1 0 1 1 0 8 0
kqueuepl 104 119 0 117 1 0 1 1 0 8 0
pipepl 112 402 0 383 3 1 2 2 0 8 1
fdescpl 488 449 0 433 3 0 3 3 0 8 1
filepl 152 2940 0 2840 7 1 6 6 0 8 2
lockfpl 104 82 0 82 2 1 1 1 0 8 1
lockfspl 32 212 0 212 2 1 1 1 0 8 1
sessionpl 112 26 0 16 1 0 1 1 0 8 0
pgrppl 48 26 0 16 1 0 1 1 0 8 0
ucredpl 96 694 0 685 1 0 1 1 0 8 0
zombiepl 144 433 0 433 2 1 1 1 0 8 1
processpl 840 465 0 433 4 0 4 4 0 8 0
procpl 600 980 0 937 4 0 4 4 0 8 0
srpgc 64 52 0 52 3 2 1 1 0 8 1
sosppl 128 6 0 6 2 1 1 1 0 8 1
sockpl 384 354 0 335 5 1 4 4 0 8 2
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl12k 12288 3 0 0 1 0 1 1 0 8 0
mcl9k 9216 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 8 0 0 1 0 1 1 0 8 0
mcl2k2 2112 2 0 0 1 0 1 1 0 8 0
mcl2k 2048 127 0 0 15 0 15 15 0 8 0
mtagpl 80 1 0 0 1 0 1 1 0 8 0
mbufpl 256 176 0 0 10 0 10 10 0 8 0
bufpl 256 5863 0 1122 297 0 297 297 0 8 0
anonpl 16 60108 0 54383 51 9 42 44 0 125 13
amapchunkpl 152 2793 0 2707 10 5 5 9 0 158 1
amappl16 192 1945 0 1610 39 13 26 29 0 8 8
amappl15 184 79 0 73 1 0 1 1 0 8 0
amappl14 176 108 0 105 2 1 1 1 0 8 0
amappl13 168 75 0 70 1 0 1 1 0 8 0
amappl12 160 59 0 57 1 0 1 1 0 8 0
amappl11 152 49 0 35 1 0 1 1 0 8 0
amappl10 144 111 0 105 2 1 1 1 0 8 0
amappl9 136 603 0 597 1 0 1 1 0 8 0
amappl8 128 182 0 167 1 0 1 1 0 8 0
amappl7 120 79 0 74 1 0 1 1 0 8 0
amappl6 112 76 0 66 1 0 1 1 0 8 0
amappl5 104 167 0 156 1 0 1 1 0 8 0
amappl4 96 671 0 641 2 1 1 2 0 8 0
amappl3 88 196 0 191 1 0 1 1 0 8 0
amappl2 80 2593 0 2536 2 0 2 2 0 8 0
amappl1 72 19184 0 18739 24 14 10 19 0 8 0
amappl 72 1260 0 1225 1 0 1 1 0 75 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma64 64 259 0 259 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 17 0 17 1 1 0 1 0 8 0
aobjpl 64 24 0 2 1 0 1 1 0 8 0
uaddrrnd 24 449 0 433 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 449 0 433 1 0 1 1 0 8 0
vmmpekpl 168 7799 0 7776 2 0 2 2 0 8 0
vmmpepl 168 57896 0 56511 92 15 77 77 0 357 16
vmsppl 360 448 0 433 2 0 2 2 0 8 0
pdppl 4096 906 0 866 6 0 6 6 0 8 1
pvpl 32 189841 0 180863 132 18 114 118 0 265 28
pmappl 224 448 0 433 4 2 2 2 0 8 1
extentpl 40 39 0 25 1 0 1 1 0 8 0
phpool 112 448 0 3 13 0 13 13 0 8 0