uvm_fault(0xffffffff8354a888, 0xffff8000124d2004, 0, 1) -> d kernel: page fault trap, code=0 Stopped at ufs_lookup+0x5e1: movzwl 0x4(%r15,%rbx,1),%r14d TID PID UID PRFLAGS PFLAGS CPU COMMAND 489704 95381 0 0x2 0 0 sshd-session *504281 79548 0 0x2 0 1K syz-executor ufs_lookup() at ufs_lookup+0x5e1 sys/ufs/ufs/ufs_lookup.c:279 VOP_LOOKUP(fffffd8067cfeb58,ffff80002a128080,ffff80002a1280b0) at VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85 vfs_lookup(ffff80002a128050) at vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566 namei(ffff80002a128050) at namei+0x7aa sys/kern/vfs_lookup.c:250 domkdirat(ffff8000ffffca30,ffffff9c,7a9f27058300,1ff) at domkdirat+0x8b sys/kern/vfs_syscalls.c:3084 syscall(ffff80002a128230) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff80002a128230) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7a9f27058390, count: 8 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: uvm_fault(0xffffffff8354a888, 0xffff8000124d2004, 0, 1) -> d ddb{1}> trace ufs_lookup() at ufs_lookup+0x5e1 sys/ufs/ufs/ufs_lookup.c:279 VOP_LOOKUP(fffffd8067cfeb58,ffff80002a128080,ffff80002a1280b0) at VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85 vfs_lookup(ffff80002a128050) at vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566 namei(ffff80002a128050) at namei+0x7aa sys/kern/vfs_lookup.c:250 domkdirat(ffff8000ffffca30,ffffff9c,7a9f27058300,1ff) at domkdirat+0x8b sys/kern/vfs_syscalls.c:3084 syscall(ffff80002a128230) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff80002a128230) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7a9f27058390, count: -7 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff80002a127df0 rbx 0 rdx 0 rcx 0xffffffff rax 0xfffffd80586dc378 r8 0xffffffffffffffff r9 0xfffffd807f7d34e0 r10 0x925bf8cae4c7b1bb r11 0xe8b65a7ddb9c1637 r12 0 r13 0xfffffd807d99d888 r14 0 r15 0xffff8000124d2000 rip 0xffffffff829bc8c1 ufs_lookup+0x5e1 cs 0x8 rflags 0x10202 __ALIGN_SIZE+0xf202 rsp 0xffff80002a127ce0 ss 0x10 ufs_lookup+0x5e1: movzwl 0x4(%r15,%rbx,1),%r14d ddb{1}> show proc PROC (syz-executor) tid=504281 pid=79548 tcnt=1 stat=onproc flags process=2 proc=0 runpri=17, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000ffff51e0,0xffff8000ffff4548 process=0xffff8000ffff1b48 user=0xffff80002a123000, vmspace=0xfffffd806c63a388 estcpu=36, cpticks=2, pctcpu=0.6, user=1, sys=9, intr=1 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 37172 90448 30852 0 2 0 syz-executor 95381 489704 69646 0 7 0x2 sshd-session 18137 294230 5621 0 2 0x10 syz-executor 18137 444123 5621 0 3 0x4000090 piperd syz-executor 18137 467992 5621 0 2 0x4000010 syz-executor 18137 407684 5621 0 3 0x4000090 fsleep syz-executor 20793 15121 40311 0 2 0x490 syz-executor 20793 300448 40311 0 3 0x4000090 kqsel syz-executor 20793 103934 40311 0 3 0x4000090 fsleep syz-executor 6986 376279 49270 0 2 0x480 syz-executor 6986 518995 49270 0 3 0x4000080 ttyin syz-executor 6986 46448 49270 0 3 0x4000080 fsleep syz-executor 43699 337207 14647 0 2 0x480 syz-executor 43699 132097 14647 0 3 0x4000080 kqread syz-executor 43699 412994 14647 0 3 0x4000080 kqsel syz-executor 43699 498550 14647 0 3 0x4000080 fsleep syz-executor 49041 520863 0 0 3 0x14200 acct acct 86829 216016 0 0 3 0x14200 bored sosplice 40311 313779 49355 0 3 0x82 nanoslp syz-executor 58993 497664 49355 0 3 0x82 nanoslp syz-executor 49324 300436 49355 0 2 0x482 syz-executor *79548 504281 49355 0 7 0x2 syz-executor 30852 228928 49355 0 2 0x482 syz-executor 49270 207269 49355 0 2 0x482 syz-executor 14647 381025 49355 0 3 0x82 nanoslp syz-executor 5621 428427 49355 0 3 0x82 nanoslp syz-executor 49355 307447 363 0 2 0x2 syz-executor 363 475860 69371 0 3 0x10008a sigsusp ksh 69371 97789 18082 0 3 0x98 kqread sshd-session 18082 337888 69646 0 3 0x92 kqread sshd-session 47710 121112 1 0 3 0x100083 ttyin getty 69646 410508 1 0 3 0x88 kqread sshd 67757 98194 37240 74 3 0x1100092 bpf pflogd 37240 77188 1 0 3 0x80 sbwait pflogd 49690 29152 67644 73 2 0x1100010 syslogd 67644 73298 1 0 3 0x100082 sbwait syslogd 55493 34686 1 0 3 0x100080 kqread resolvd 6801 25991 96072 77 3 0x100092 kqread dhcpleased 53810 141966 96072 77 3 0x100092 kqread dhcpleased 96072 197277 1 0 3 0x80 kqread dhcpleased 64917 202667 0 0 3 0x14200 bored smr 62214 494506 0 0 2 0x14200 zerothread 26759 197523 0 0 3 0x14200 aiodoned aiodoned 10557 414305 0 0 3 0x14200 syncer update 16253 465436 0 0 3 0x14200 cleaner cleaner 64878 136969 0 0 3 0x14200 reaper reaper 75034 249501 0 0 3 0x14200 pgdaemon pagedaemon 28780 83413 0 0 3 0x14200 bored viomb 94547 240898 0 0 3 0x40014200 acpi0 acpi0 41229 344910 0 0 3 0x40014200 idle1 31743 113447 0 0 3 0x14200 bored softnet3 82843 397120 0 0 3 0x14200 bored softnet2 89267 206062 0 0 3 0x14200 bored softnet1 66620 471708 0 0 3 0x14200 bored softnet0 26190 243040 0 0 3 0x14200 bored systqmp 56095 330856 0 0 3 0x14200 bored systq 7648 497822 0 0 3 0x14200 tmoslp softclockmp 10586 416941 0 0 3 0x40014200 tmoslp softclock 92003 320999 0 0 3 0x40014200 idle0 1 28758 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks Process 79548 (syz-executor) thread 0xffff8000ffffca30 (504281) exclusive rrwlock inode r = 0 (0xfffffd807d99d920) #0 witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5b8 sys/kern/subr_witness.c:1151 #1 rw_enter+0x41b sys/kern/kern_rwlock.c:309 #2 rrw_enter+0xbe sys/kern/kern_rwlock.c:464 #3 VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:564 #5 vfs_lookup+0x109 sys/kern/vfs_lookup.c:418 #6 namei+0x7aa sys/kern/vfs_lookup.c:250 #7 domkdirat+0x8b sys/kern/vfs_syscalls.c:3084 #8 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline] #8 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577 #9 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83561d10) #0 witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5b8 sys/kern/subr_witness.c:1151 #1 syscall+0xad6 mi_syscall sys/sys/syscall_mi.h:179 [inline] #1 syscall+0xad6 sys/arch/amd64/amd64/trap.c:577 #2 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10206 10166K 10545K 166960K 11775 0 pcb 18 12K 12K 166960K 70 0 rtable 226 7K 8K 166960K 1187 0 pf 35 17K 22K 166960K 132 0 ifaddr 42 7K 8K 166960K 156 0 ifgroup 55 2K 2K 166960K 171 0 sysctl 3 0K 0K 166960K 3 0 counters 64 36K 36K 166960K 122 0 ioctlops 0 0K 4K 166960K 1546 0 iov 1 1K 24K 166960K 52 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1450 91K 92K 166960K 2020 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 3 5K 9K 166960K 4 0 VM map 2 1K 1K 166960K 2 0 sem 10 0K 0K 166960K 13 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1690 195K 286K 166960K 12418 0 file desc 17 61K 97K 166960K 834 0 sigio 0 0K 0K 166960K 5 0 proc 72 91K 152K 166960K 1282 0 subproc 104 6K 6K 166960K 442 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 161 0 in_multi 96 7K 7K 166960K 392 0 ether_multi 1 0K 0K 166960K 2 0 mrt 0 0K 0K 166960K 6 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 103 466K 466K 166960K 103 0 exec 0 0K 1K 166960K 739 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 257 73K 109K 166960K 7743 0 UVM aobj 6 4K 4K 166960K 6 0 pinsyscall 44 88K 108K 166960K 2604 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 15 0 NDP 12 0K 2K 166960K 109 0 temp 48 6817K 6939K 166960K 21173 0 kqueue 14 20K 26K 166960K 57 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 24 0 0 1 0 1 1 0 8 0 rtpcb 120 114 0 110 1 0 1 1 0 8 0 rtentry 112 408 0 305 6 2 4 4 0 8 0 unpcb 144 249 0 217 3 1 2 2 0 8 0 syncache 336 6 0 6 2 1 1 1 0 8 1 tcpqe 32 1 0 1 1 0 1 1 0 8 1 tcpcb 808 108 0 100 2 0 2 2 0 8 1 arp 120 72 0 53 1 0 1 1 0 8 0 ipq 40 1 0 1 1 0 1 1 0 8 1 ipqe 40 3 0 3 1 0 1 1 0 8 1 inpcb 336 478 0 462 7 5 2 4 0 8 0 nd6 136 105 0 79 1 0 1 1 0 8 0 pkpcb 40 3 0 3 3 2 1 1 0 8 1 kcovpl 48 34 0 26 1 0 1 1 0 8 0 ppxss 1168 2 0 2 2 1 1 1 0 8 1 pfstscr 40 3 0 3 2 1 1 1 0 8 1 pffrag 232 4 0 1 2 1 1 1 0 482 0 pffrnode 88 4 0 1 2 1 1 1 0 8 0 pffrent 40 7 0 4 2 1 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pftag 88 1 0 0 1 0 1 1 0 8 0 pfstitem 24 69 0 42 1 0 1 1 0 8 0 pfstkey 128 72 0 45 1 0 1 1 0 8 0 pfstate 376 70 0 44 4 1 3 3 0 8 0 pfrule 1344 31 0 23 2 1 1 2 0 8 0 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 1624 0 1202 36 7 29 30 0 8 1 art_table 32 1626 0 1202 4 0 4 4 0 8 0 art_node 16 403 0 310 1 0 1 1 0 8 0 sysvmsgpl 40 4 0 0 1 0 1 1 0 8 0 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 112 10 0 2 1 0 1 1 0 8 0 shmpl 112 3 0 0 1 0 1 1 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 2152 0 594 98 0 98 98 0 8 0 ffsino 272 2152 0 594 105 0 105 105 0 8 0 nchpl 144 2792 0 1069 65 0 65 65 0 8 0 uvmvnodes 80 2823 0 0 58 0 58 58 0 8 0 vnodes 216 2823 0 0 157 0 157 157 0 8 0 namei 1024 11473 0 11472 5 4 1 2 0 8 0 percpumem 16 75 0 29 1 0 1 1 0 8 0 kstatmem 264 82 0 58 2 0 2 2 0 8 0 acpiwqpl 32 34 0 34 1 0 1 1 1 8 1 scxspl 216 18903 0 18903 11 9 2 8 1 8 2 plimitpl 152 171 0 152 1 0 1 1 0 8 0 sigapl 424 1088 0 1036 8 2 6 7 0 8 0 futexpl 64 4754 0 4750 5 4 1 1 0 8 0 knotepl 120 370 0 0 10 0 10 10 0 8 0 kqueuepl 216 151 0 138 5 4 1 5 0 8 0 pipepl 320 217 0 186 3 0 3 3 0 8 0 fdescpl 496 1068 0 1036 7 2 5 6 0 8 0 filepl 152 4625 0 4335 18 5 13 13 0 8 1 lockfpl 104 129 0 126 1 0 1 1 0 8 0 lockfspl 48 58 0 55 1 0 1 1 0 8 0 sessionpl 144 51 0 41 1 0 1 1 0 8 0 pgrppl 48 85 0 67 1 0 1 1 0 8 0 ucredpl 104 355 0 340 1 0 1 1 0 8 0 zombiepl 144 1038 0 1036 1 0 1 1 0 8 0 processpl 1160 1088 0 1036 5 1 4 5 0 8 0 procpl 648 1636 0 1574 8 2 6 6 0 8 0 srpgc 96 2 0 2 1 0 1 1 0 8 1 sosppl 168 1 0 1 1 0 1 1 0 8 1 sockpl 664 846 0 795 9 4 5 6 0 8 0 mcl64k 65536 3 0 0 1 0 1 1 0 8 0 mcl16k 16384 1 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 4 0 0 1 0 1 1 0 8 0 mcl4k 4096 3 0 0 1 0 1 1 0 8 0 mcl2k 2048 235 0 0 30 0 30 30 0 8 0 mtagpl 96 9 0 0 1 0 1 1 0 8 0 mbufpl 256 410 0 0 24 0 24 24 0 8 0 bufpl 280 6997 0 700 451 0 451 451 0 8 0 anonpl 24 208318 0 204597 81 8 73 80 0 185 43 amapchunkpl 152 24579 0 24043 45 12 33 40 0 158 10 amappl16 200 3904 0 3884 19 9 10 14 0 8 8 amappl15 192 4 0 4 1 1 0 1 0 8 0 amappl14 184 173 0 160 1 0 1 1 0 8 0 amappl13 176 9 0 8 1 0 1 1 0 8 0 amappl12 168 2137 0 2106 4 2 2 3 0 8 0 amappl11 160 53 0 38 1 0 1 1 0 8 0 amappl10 152 13 0 13 1 1 0 1 0 8 0 amappl9 144 144 0 144 1 1 0 1 0 8 0 amappl8 136 48 0 46 1 0 1 1 0 8 0 amappl7 128 165 0 152 1 0 1 1 0 8 0 amappl6 120 429 0 427 1 0 1 1 0 8 0 amappl5 112 244 0 231 1 0 1 1 0 8 0 amappl4 104 392 0 374 1 0 1 1 0 8 0 amappl3 96 4615 0 4495 7 3 4 4 0 8 0 amappl2 88 1065 0 990 2 0 2 2 0 8 0 amappl1 80 11906 0 11254 16 2 14 14 0 8 0 amappl 88 7141 0 6954 6 1 5 5 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 5 0 0 1 0 1 1 0 8 0 uaddrrnd 24 1068 0 1036 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1068 0 1036 1 0 1 1 0 8 0 vmmpekpl 168 10543 0 10499 3 0 3 3 0 8 0 vmmpepl 168 72894 0 70888 102 8 94 94 0 357 4 vmsppl 440 1067 0 1036 6 2 4 5 0 8 0 rwobjpl 56 26661 0 22787 56 1 55 55 0 8 0 pdppl 4096 2143 0 2072 127 54 73 87 0 8 2 pvpl 32 44622 0 0 361 1 360 361 0 265 0 pmappl 248 1067 0 1036 3 0 3 3 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 450 0 74 11 0 11 11 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff83454ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83561b08) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline] __mp_lock(ffffffff83561b08) at __mp_lock+0x192 sys/kern/kern_lock.c:144 softintr_dispatch(0) at softintr_dispatch+0x5b sys/arch/amd64/amd64/softintr.c:88 Xsoftclock() at Xsoftclock+0x27 end of kernel end trace frame: 0x7b989c71ad80, count: 9 ddb{0}> trace x86_ipi_db(ffffffff83454ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83561b08) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline] __mp_lock(ffffffff83561b08) at __mp_lock+0x192 sys/kern/kern_lock.c:144 softintr_dispatch(0) at softintr_dispatch+0x5b sys/arch/amd64/amd64/softintr.c:88 Xsoftclock() at Xsoftclock+0x27 end of kernel end trace frame: 0x7b989c71ad80, count: -6 ddb{0}> machine ddbcpu 1 Stopped at ufs_lookup+0x5e1: movzwl 0x4(%r15,%rbx,1),%r14d ufs_lookup() at ufs_lookup+0x5e1 sys/ufs/ufs/ufs_lookup.c:279 VOP_LOOKUP(fffffd8067cfeb58,ffff80002a128080,ffff80002a1280b0) at VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85 vfs_lookup(ffff80002a128050) at vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566 namei(ffff80002a128050) at namei+0x7aa sys/kern/vfs_lookup.c:250 domkdirat(ffff8000ffffca30,ffffff9c,7a9f27058300,1ff) at domkdirat+0x8b sys/kern/vfs_syscalls.c:3084 syscall(ffff80002a128230) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff80002a128230) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7a9f27058390, count: 8 ddb{1}> trace ufs_lookup() at ufs_lookup+0x5e1 sys/ufs/ufs/ufs_lookup.c:279 VOP_LOOKUP(fffffd8067cfeb58,ffff80002a128080,ffff80002a1280b0) at VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85 vfs_lookup(ffff80002a128050) at vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566 namei(ffff80002a128050) at namei+0x7aa sys/kern/vfs_lookup.c:250 domkdirat(ffff8000ffffca30,ffffff9c,7a9f27058300,1ff) at domkdirat+0x8b sys/kern/vfs_syscalls.c:3084 syscall(ffff80002a128230) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff80002a128230) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7a9f27058390, count: -7