*cpu0: uvm_fault(0xfffffb006ce8a5d8, 0x98, 0, 1) -> e ddb{1}> show kasan No such command ddb{1}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x7b8a80953ae0, count: -1 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff80003c3dd300 rbx 0 rdx 0 rcx 0xffff80003c3c67f0 rax 0x2a r8 0xffff80003c3dd230 r9 0x1 r10 0x85e81f8468e441bb r11 0xf2e550b642a23252 r12 0 r13 0 r14 0 r15 0 rip 0xffffffff816804c7 proc_trampoline+0xc7 cs 0x8 rflags 0x246 rsp 0xffff80003c3dd280 ss 0 proc_trampoline+0xc7: movl $0,%gs:0x688 ddb{1}> show proc PROC (syz-executor) tid=455747 pid=3947 tcnt=2 stat=onproc flags process=0 proc=0 runpri=50, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003c3c7a18,0xffff80003c3c6038 process=0xffff80003c3c9d00 user=0xffff80003c3d8000, vmspace=0xfffffb006ce8a9a8 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 40820 207289 66223 0 2 0 0 syz-executor 40820 7290 66223 0 7 0 0x4000000 syz-executor * 3947 455747 6892 0 7 0 0 syz-executor 3947 299917 6892 0 3 0 0x4000080 fsleep syz-executor 80413 21230 12504 0 2 0 0 syz-executor 80413 62261 12504 0 2 0 0x4000000 syz-executor 69161 158237 9318 0 2 0 0 syz-executor 69161 352931 9318 0 3 0 0x4000080 sbwait syz-executor 19573 515928 31033 0 2 0 0 syz-executor 19573 332568 31033 0 3 0 0x4000080 fsleep syz-executor 60647 188640 50931 0 2 0 0 syz-executor 60647 224624 50931 0 3 0 0x4000080 kqread syz-executor 60647 285257 50931 0 3 0 0x4000080 fsleep syz-executor 60647 148298 50931 0 2 0 0x4000000 syz-executor 17663 351357 12197 0 2 0x2 0 ndp 12197 354612 78109 0 3 0x100002 0x88 sigsusp sh 64511 493929 72802 0 3 0 0x80 nanoslp syz-executor 64511 429804 72802 0 3 0 0x4000080 fsleep syz-executor 64511 510833 72802 0 3 0 0x4000080 sbwait syz-executor 64511 148077 72802 0 3 0 0x4000080 fsleep syz-executor 6892 201127 3323 0 3 0x2 0x80 nanoslp syz-executor 78109 203570 3323 0 3 0x2 0x80 wait syz-executor 50931 9488 3323 0 3 0x2 0x80 nanoslp syz-executor 9318 206590 3323 0 2 0x2 0 syz-executor 12504 494411 3323 0 3 0x2 0x80 nanoslp syz-executor 72802 373729 3323 0 3 0x2 0x80 nanoslp syz-executor 31033 118208 3323 0 3 0x2 0x80 nanoslp syz-executor 66223 479813 3323 0 3 0x2 0x80 nanoslp syz-executor 3323 214492 75140 0 3 0x2 0x80 kqread syz-executor 75140 51471 81254 0 3 0x100002 0x88 sigsusp ksh 81254 314797 43575 0 3 0x10 0x88 kqread sshd-session 43575 240974 45725 0 3 0x12 0x80 kqread sshd-session 65319 342581 1 0 3 0x100003 0x80 ttyin getty 45725 98844 1 0 3 0 0x88 kqread sshd 44722 287565 4606 74 3 0x1100012 0x80 bpf pflogd 4606 506889 1 0 3 0 0x80 sbwait pflogd 41259 3319 32856 73 3 0x1100010 0x80 kqread syslogd 32856 521992 1 0 3 0x100002 0x80 sbwait syslogd 61407 88428 1 0 3 0x100000 0x80 kqread resolvd 20487 241038 37777 77 3 0x100012 0x80 kqread dhcpleased 59492 458641 37777 77 3 0x100012 0x80 kqread dhcpleased 37777 367346 1 0 3 0 0x80 kqread dhcpleased 99212 492399 0 0 3 0x14000 0x200 bored smr 79280 12536 0 0 2 0x14000 0x200 zerothread 57447 181263 0 0 3 0x14000 0x200 aiodoned aiodoned 69963 276945 0 0 3 0x14000 0x200 syncer update 24981 493914 0 0 3 0x14000 0x200 cleaner cleaner 47144 300760 0 0 3 0x14000 0x200 reaper reaper 47225 339916 0 0 3 0x14000 0x200 pgdaemon pagedaemon 50942 402830 0 0 3 0x14000 0x200 bored viomb 29468 186683 0 0 3 0x14000 0x40000200 acpi0 acpi0 79511 218104 0 0 3 0x14000 0x40000200 idle1 50948 245994 0 0 3 0x14000 0x200 bored softnet1 34659 445993 0 0 3 0x14000 0x200 bored softnet0 91842 322224 0 0 3 0x14000 0x200 bored systqmp 53071 228921 0 0 3 0x14000 0x200 bored systq 35322 403847 0 0 3 0x14000 0x200 tmoslp softclockmp 96359 441488 0 0 3 0x14000 0x40000200 tmoslp softclock 90512 462082 0 0 3 0x14000 0x40000200 idle0 1 188883 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks Process 40820 (syz-executor) thread 0xffff80003c3c6a88 (7290) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a8ed40) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline] #1 syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783 #2 Xsyscall+0x128 Process 3947 (syz-executor) thread 0xffff80003c3c67f0 (455747) shared rwlock uobjlk r = 0 (0xfffffb006de505a8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413 #2 uvm_fault_lower_lookup+0x53 sys/uvm/uvm_fault.c:1204 #3 uvm_fault_lower+0x89 sys/uvm/uvm_fault.c:1334 #4 uvm_fault+0x274 sys/uvm/uvm_fault.c:-1 #5 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192 #6 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640 #7 recall_trap+0x8 shared rwlock vmmaplk r = 0 (0xfffffb006ce8aaa8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413 #2 uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880 #3 uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693 #4 uvm_fault+0x106 sys/uvm/uvm_fault.c:627 #5 upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192 #6 usertrap+0x430 sys/arch/amd64/amd64/trap.c:640 #7 recall_trap+0x8 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11059 12151K 12151K 166960K 12155 0 pcb 17 12K 12K 166960K 18 0 rtable 243 8K 8K 166960K 370 0 pf 34 17K 18K 166960K 45 0 ifaddr 43 7K 7K 166960K 45 0 ifgroup 55 2K 2K 166960K 55 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 70 0 ioctlops 0 0K 4K 166960K 1484 0 iov 0 0K 4K 166960K 1 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1294 81K 81K 166960K 1367 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 3 0K 0K 166960K 3 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 19 69K 93K 166960K 152 0 proc 71 115K 180K 166960K 556 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 in_multi 99 6K 6K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 3 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 43 201K 201K 166960K 43 0 exec 0 0K 1K 166960K 392 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 242 160K 167K 166960K 3241 0 UVM aobj 5 4K 4K 166960K 6 0 pinsyscall 45 90K 104K 166960K 1338 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 2 0 NDP 28 2K 2K 166960K 28 0 temp 35 9114K 9120K 166960K 3938 0 kqueue 16 26K 26K 166960K 29 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 36 0 32 1 0 1 1 0 8 0 rtentry 176 111 0 1 5 0 5 5 0 8 0 unpcb 144 52 0 33 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 11 0 5 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 73 0 63 2 0 2 2 0 8 1 nd6 152 23 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 18 0 0 1 0 1 1 0 8 0 pfstkey 128 18 0 0 1 0 1 1 0 8 0 pfstate 448 18 0 0 2 0 2 2 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 458 0 0 29 0 29 29 0 8 0 art_table 40 460 0 0 5 0 5 5 0 8 0 art_node 32 111 0 11 1 0 1 1 0 8 0 semapl 72 1 0 0 1 0 1 1 0 8 0 shmpl 112 3 0 1 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1585 0 117 92 0 92 92 0 8 0 ffsino 296 1585 0 117 114 0 114 114 0 8 0 nchpl 144 1802 0 101 64 0 64 64 0 8 0 vnodes 216 1680 0 0 94 0 94 94 0 8 0 namei 1024 5579 0 5579 1 0 1 1 0 8 1 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 27 0 0 2 0 2 2 0 8 0 scxspl 216 6188 0 6188 4 2 2 3 1 8 2 plimitpl 152 31 0 13 1 0 1 1 0 8 0 sigapl 424 478 0 429 7 0 7 7 0 8 0 knotepl 120 301 0 0 10 0 10 10 0 8 0 kqueuepl 224 26 0 14 1 0 1 1 0 8 0 pipepl 344 129 0 102 3 0 3 3 0 8 0 fdescpl 528 462 0 429 3 0 3 3 0 8 0 filepl 160 1648 0 1424 10 0 10 10 0 8 0 lockfpl 104 7 0 4 1 0 1 1 0 8 0 lockfspl 48 5 0 2 1 0 1 1 0 8 0 sessionpl 144 24 0 15 1 0 1 1 0 8 0 pgrppl 48 32 0 15 1 0 1 1 0 8 0 ucredpl 104 97 0 84 1 0 1 1 0 8 0 zombiepl 144 429 0 429 1 0 1 1 0 8 1 processpl 1232 478 0 429 5 0 5 5 0 8 0 procpl 664 517 0 457 6 0 6 6 0 8 0 sockpl 752 161 0 128 4 0 4 4 0 8 0 mcl16k 16384 3 0 0 1 0 1 1 0 8 0 mcl8k 8192 1 0 0 1 0 1 1 0 8 0 mcl4k 4096 111 0 0 14 0 14 14 0 8 0 mcl2k 2048 18 0 0 3 0 3 3 0 8 0 mextrefs 64 15 0 0 1 0 1 1 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 119 0 0 8 0 8 8 0 8 0 bufpl 272 2303 0 105 147 0 147 147 0 8 0 anonpl 32 3866 0 0 32 0 32 32 0 247 0 amapchunkpl 152 8787 0 8268 22 1 21 21 0 158 0 amappl16 200 1982 0 1964 5 0 5 5 0 8 4 amappl15 192 28 0 28 1 0 1 1 0 8 1 amappl14 184 459 0 457 1 0 1 1 0 8 0 amappl13 176 136 0 123 1 0 1 1 0 8 0 amappl12 168 744 0 713 2 0 2 2 0 8 0 amappl11 160 24 0 24 1 0 1 1 0 8 1 amappl10 152 71 0 57 1 0 1 1 0 8 0 amappl9 144 278 0 278 1 0 1 1 0 8 1 amappl8 136 101 0 99 1 0 1 1 0 8 0 amappl7 128 154 0 140 1 0 1 1 0 8 0 amappl6 120 153 0 151 1 0 1 1 0 8 0 amappl5 112 101 0 91 1 0 1 1 0 8 0 amappl4 104 298 0 279 1 0 1 1 0 8 0 amappl3 96 1562 0 1455 3 0 3 3 0 8 0 amappl2 88 582 0 506 2 0 2 2 0 8 0 amappl1 80 10654 0 10013 15 0 15 15 0 8 0 amappl 88 2489 0 2320 4 0 4 4 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma65536 65536 1 0 1 1 0 1 1 0 8 1 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 5 0 1 1 0 1 1 0 8 0 uaddrrnd 24 462 0 429 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 462 0 429 1 0 1 1 0 8 0 vmmpekpl 168 5848 0 5819 2 0 2 2 0 8 0 vmmpepl 168 39605 0 37634 87 0 87 87 0 357 1 vmsppl 488 461 0 429 5 0 5 5 0 8 0 rwobjpl 80 15077 0 14003 24 0 24 24 0 8 1 pdppl 4096 931 0 858 101 16 85 85 0 8 12 pvpl 32 9688 0 0 79 0 79 79 0 265 0 pmappl 256 461 0 429 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 415 0 19 12 0 12 12 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff83967ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 sys/arch/amd64/amd64/bus_space.c:670 comcnputc(800,29) at comcnputc+0x250 comcn_read_reg sys/dev/ic/com.c:1671 [inline] comcnputc(800,29) at comcnputc+0x250 sys/dev/ic/com.c:1274 cnputc(29) at cnputc+0x67 sys/dev/cons.c:218 db_putchar(29) at db_putchar+0x36d sys/ddb/db_output.c:155 kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1 db_printf(ffffffff83460681) at db_printf+0x9b sys/kern/subr_prf.c:-1 fault(ffffffff8351d362) at fault+0xa7 sys/arch/amd64/amd64/trap.c:161 kpageflttrap(ffff80003c3fb060,98) at kpageflttrap+0x37d sys/arch/amd64/amd64/trap.c:296 kerntrap(ffff80003c3fb060) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff80003c3c6a88,fffffb0069157880,ffff80003c3fb240) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691 end trace frame: 0xffff80003c3fb2b0, count: 0 ddb{0}> trace x86_ipi_db(ffffffff83967ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 sys/arch/amd64/amd64/bus_space.c:670 comcnputc(800,29) at comcnputc+0x250 comcn_read_reg sys/dev/ic/com.c:1671 [inline] comcnputc(800,29) at comcnputc+0x250 sys/dev/ic/com.c:1274 cnputc(29) at cnputc+0x67 sys/dev/cons.c:218 db_putchar(29) at db_putchar+0x36d sys/ddb/db_output.c:155 kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1 db_printf(ffffffff83460681) at db_printf+0x9b sys/kern/subr_prf.c:-1 fault(ffffffff8351d362) at fault+0xa7 sys/arch/amd64/amd64/trap.c:161 kpageflttrap(ffff80003c3fb060,98) at kpageflttrap+0x37d sys/arch/amd64/amd64/trap.c:296 kerntrap(ffff80003c3fb060) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff80003c3c6a88,fffffb0069157880,ffff80003c3fb240) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691 sys_futimes(ffff80003c3c6a88,ffff80003c3fb390,ffff80003c3fb2e0) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2733 syscall(ffff80003c3fb390) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3fb390) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xd133c6cff10, count: -17 ddb{0}> machine ddbcpu 1 Stopped at proc_trampoline+0xc7: movl $0,%gs:0x688 proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x7b8a80953ae0, count: 14 ddb{1}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x7b8a80953ae0, count: -1