uvm_fault(0xffffffff82808b38, 0x7f853d9bf188, 0, 2) -> e kernel: page fault trap, code=0 Stopped at pmap_page_remove+0x33d: xchgq %rax,0(%r12,%rcx,1) ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic kernel page fault uvm_fault(0xffffffff82808b38, 0x7f853d9bf188, 0, 2) -> e pmap_page_remove(fffffd80052c3f80) at pmap_page_remove+0x33d _atomic_swap_64 machine/atomic.h:117 [inline] pmap_page_remove(fffffd80052c3f80) at pmap_page_remove+0x33d sys/arch/amd64/amd64/pmap.c:1946 end trace frame: 0xffff80001d6966e0, count: 0 ddb> trace pmap_page_remove(fffffd80052c3f80) at pmap_page_remove+0x33d _atomic_swap_64 machine/atomic.h:117 [inline] pmap_page_remove(fffffd80052c3f80) at pmap_page_remove+0x33d sys/arch/amd64/amd64/pmap.c:1946 uvm_anfree_list(fffffd8057a2e670,ffff80001d696700) at uvm_anfree_list+0x4e sys/uvm/uvm_anon.c:104 amap_wipeout(fffffd805e953170) at amap_wipeout+0x171 sys/uvm/uvm_amap.c:461 uvm_unmap_detach(ffff80001d6967c0,1) at uvm_unmap_detach+0x163 sys/uvm/uvm_map.c:1586 uvm_map_teardown(fffffd806bc0a220) at uvm_map_teardown+0x22c sys/uvm/uvm_map.c:2759 uvmspace_free(fffffd806bc0a220) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3646 uvm_exit(ffff8000ffffae70) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297 reaper(ffff80001d652110) at reaper+0x15c sys/kern/kern_exit.c:456 end trace frame: 0x0, count: -8 ddb> show registers rdi 0 rsi 0 rbp 0xffff80001d696690 rbx 0 rdx 0x1 rcx 0x7f8000000000 rax 0 r8 0xffffffff81edc1dd amap_free+0x6d r9 0x7 r10 0x4c7f71c0b01d8ba9 r11 0xa944e86d83ca3d41 r12 0x53d9bf188 r13 0xfffffd8050efd2e0 r14 0x800000006c3b6000 r15 0xfffffd80052c3e80 rip 0xffffffff81053dfd pmap_page_remove+0x33d cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80001d696600 ss 0x10 pmap_page_remove+0x33d: xchgq %rax,0(%r12,%rcx,1) ddb> show proc PROC (reaper) pid=402414 stat=onproc flags process=14000 proc=200 pri=86, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff80001d651ea0,0xffff80001d652600 process=0xffff8000ffffce68 user=0xffff80001d691000, vmspace=0xffffffff82808b38 estcpu=36, cpticks=67, pctcpu=19.39 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 51500 203962 71714 0 2 0x10008a sh 71714 349327 64858 0 3 0x82 wait syz-executor.0 19974 473947 41419 0 3 0x10008a pause sh 41419 509810 64858 0 3 0x82 wait syz-executor.1 64858 5145 2514 0 3 0x82 thrsleep syz-fuzzer 64858 22571 2514 0 3 0x4000082 nanosleep syz-fuzzer 64858 252456 2514 0 3 0x4000082 thrsleep syz-fuzzer 64858 58068 2514 0 3 0x4000082 thrsleep syz-fuzzer 64858 495818 2514 0 3 0x4000082 thrsleep syz-fuzzer 64858 322998 2514 0 3 0x4000082 thrsleep syz-fuzzer 64858 349307 2514 0 3 0x4000082 thrsleep syz-fuzzer 64858 191688 2514 0 3 0x4000082 kqread syz-fuzzer 64858 52235 2514 0 3 0x4000082 thrsleep syz-fuzzer 2514 259574 23773 0 3 0x10008a pause ksh 23773 46583 35189 0 3 0x92 select sshd 10514 225882 1 0 3 0x100083 ttyin getty 35189 3958 1 0 3 0x80 select sshd 32210 207628 45517 73 2 0x100010 syslogd 45517 88211 1 0 3 0x100082 netio syslogd 88463 8031 1 77 3 0x100090 poll dhclient 46548 459184 1 0 3 0x80 poll dhclient 69925 24050 0 0 3 0x14200 bored smr 12603 154038 0 0 2 0x14200 zerothread 1707 167368 0 0 3 0x14200 aiodoned aiodoned 2816 68672 0 0 3 0x14200 syncer update 19158 412029 0 0 3 0x14200 cleaner cleaner *94108 402414 0 0 7 0x14200 reaper 26804 464888 0 0 3 0x14200 pgdaemon pagedaemon 41 11811 0 0 3 0x14200 bored crynlk 43750 209712 0 0 3 0x14200 bored crypto 84284 29698 0 0 3 0x40014200 acpi0 acpi0 99246 80370 0 0 2 0x14200 softnet 66876 330154 0 0 3 0x14200 bored systqmp 4101 129438 0 0 3 0x14200 bored systq 34871 405330 0 0 3 0x40014200 bored softclock 27206 347799 0 0 3 0x40014200 idle0 1 407545 0 0 2 0x82 init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 9456 6325K 6588K 78643K 10639 0 pcb 13 8K 8K 78643K 65 0 rtable 64 2K 7K 78643K 331 0 ifaddr 34 8K 13K 78643K 89 0 counters 19 16K 16K 78643K 21 0 ioctlops 0 0K 4K 78643K 23 0 iov 0 0K 12K 78643K 10 0 mount 1 1K 1K 78643K 1 0 vnodes 1219 77K 77K 78643K 1275 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 1K 78643K 2 0 VM map 2 0K 0K 78643K 2 0 sem 12 0K 0K 78643K 14 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1809 195K 288K 78643K 12938 0 file desc 6 17K 25K 78643K 90 0 proc 49 38K 55K 78643K 392 0 subproc 34 2K 2K 78643K 68 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 5 0 in_multi 26 1K 2K 78643K 57 0 ether_multi 1 0K 0K 78643K 3 0 mrt 0 0K 0K 78643K 4 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 31 148K 148K 78643K 31 0 exec 0 0K 1K 78643K 187 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 7 26K 26K 78643K 7 0 UVM amap 128 23K 33K 78643K 1096 0 UVM aobj 2 2K 2K 78643K 2 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 12 0 NDP 5 0K 0K 78643K 12 0 temp 61 3839K 3903K 78643K 2070 0 kqueue 3 4K 5K 78643K 7 0 SYN cache 2 16K 16K 78643K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 6 0 4 1 0 1 1 0 8 0 rtpcb 80 21 0 19 1 0 1 1 0 8 0 rtentry 112 52 0 29 2 0 2 2 0 8 0 unpcb 120 63 0 55 1 0 1 1 0 8 0 syncache 264 4 0 4 1 1 0 1 0 8 0 tcpqe 32 464 0 464 1 1 0 1 0 8 0 tcpcb 544 38 0 34 2 1 1 2 0 8 0 inpcb 280 146 0 139 2 1 1 2 0 8 0 rttmr 72 2 0 2 1 1 0 1 0 8 0 nd6 48 7 0 7 1 1 0 1 0 8 0 pfrktable 1344 56 0 56 1 1 0 1 0 8 0 pftag 88 16 0 16 1 1 0 1 0 8 0 pfrule 1360 8 0 8 1 1 0 1 0 8 0 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 218 0 116 13 6 7 13 0 8 0 art_table 32 220 0 116 2 0 2 2 0 8 0 art_node 16 51 0 30 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 112 10 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1480 0 84 88 0 88 88 0 8 0 ffsino 240 1480 0 84 83 0 83 83 0 8 0 nchpl 144 1774 0 186 60 0 60 60 0 8 0 uvmvnodes 72 1573 0 0 29 0 29 29 0 8 0 vnodes 208 1573 0 0 83 0 83 83 0 8 0 namei 1024 4510 0 4510 2 1 1 1 0 8 1 pfiaddrpl 120 16 0 16 1 1 0 1 0 8 0 scxspl 192 5452 0 5452 1 0 1 1 0 8 1 plimitpl 152 20 0 12 1 0 1 1 0 8 0 sigapl 424 270 0 241 4 0 4 4 0 8 0 futexpl 56 1183 0 1183 2 2 0 1 0 8 0 knotepl 112 87 0 64 1 0 1 1 0 8 0 kqueuepl 144 10 0 8 1 0 1 1 0 8 0 pipepl 272 88 0 78 1 0 1 1 0 8 0 fdescpl 432 256 0 241 2 0 2 2 0 8 0 filepl 120 1460 0 1365 4 1 3 4 0 8 0 lockfpl 104 28 0 27 1 0 1 1 0 8 0 lockfspl 48 11 0 10 1 0 1 1 0 8 0 sessionpl 112 19 0 8 1 0 1 1 0 8 0 pgrppl 48 19 0 8 1 0 1 1 0 8 0 ucredpl 96 70 0 63 1 0 1 1 0 8 0 zombiepl 144 241 0 238 2 1 1 1 0 8 0 processpl 920 270 0 238 4 0 4 4 0 8 0 procpl 624 340 0 300 6 2 4 4 0 8 0 sockpl 400 230 0 213 5 3 2 5 0 8 0 mcl64k 65536 7 0 7 1 1 0 1 0 8 0 mcl9k 9216 1 0 1 1 1 0 1 0 8 0 mcl8k 8192 3 0 3 1 1 0 1 0 8 0 mcl4k 4096 13 0 13 2 2 0 1 0 8 0 mcl2k 2048 74890 0 74832 18 8 10 18 0 8 0 mtagpl 80 6 0 6 2 2 0 1 0 8 0 mbufpl 256 119200 0 119135 12 3 9 11 0 8 0 bufpl 280 4682 0 126 326 0 326 326 0 8 0 anonpl 16 47259 0 35642 84 1 83 83 0 107 18 amapchunkpl 152 1657 0 1529 17 0 17 17 0 158 10 amappl16 192 1169 0 329 44 0 44 44 0 8 0 amappl15 184 1 0 0 1 0 1 1 0 8 0 amappl14 176 33 0 27 1 0 1 1 0 8 0 amappl13 168 31 0 26 1 0 1 1 0 8 0 amappl12 160 22 0 18 1 0 1 1 0 8 0 amappl11 152 61 0 52 1 0 1 1 0 8 0 amappl10 144 16 0 10 1 0 1 1 0 8 0 amappl9 136 394 0 393 1 0 1 1 0 8 0 amappl8 128 352 0 310 2 0 2 2 0 8 0 amappl7 120 112 0 98 1 0 1 1 0 8 0 amappl6 112 41 0 36 1 0 1 1 0 8 0 amappl5 104 200 0 187 1 0 1 1 0 8 0 amappl4 96 420 0 393 1 0 1 1 0 8 0 amappl3 88 101 0 94 1 0 1 1 0 8 0 amappl2 80 1185 0 1131 2 0 2 2 0 8 0 amappl1 72 14459 0 13995 22 12 10 17 0 8 1 amappl 80 617 0 574 3 1 2 2 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 64 1 0 0 1 0 1 1 0 8 0 uaddrrnd 24 256 0 241 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 256 0 241 1 0 1 1 0 8 0 vmmpekpl 168 6054 0 6029 2 0 2 2 0 8 0 vmmpepl 168 39854 0 37941 139 17 122 126 0 357 34 vmsppl 272 255 0 240 3 1 2 2 0 8 0 pdppl 4096 518 0 480 7 1 6 6 0 8 1 pvpl 32 182685 0 167974 305 15 290 305 0 265 123 pmappl 200 255 0 240 1 0 1 1 0 8 0 extentpl 40 53 0 36 1 0 1 1 0 8 0 phpool 112 252 0 33 7 0 7 7 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace pmap_page_remove(fffffd80052c3f80) at pmap_page_remove+0x33d _atomic_swap_64 machine/atomic.h:117 [inline] pmap_page_remove(fffffd80052c3f80) at pmap_page_remove+0x33d sys/arch/amd64/amd64/pmap.c:1946 uvm_anfree_list(fffffd8057a2e670,ffff80001d696700) at uvm_anfree_list+0x4e sys/uvm/uvm_anon.c:104 amap_wipeout(fffffd805e953170) at amap_wipeout+0x171 sys/uvm/uvm_amap.c:461 uvm_unmap_detach(ffff80001d6967c0,1) at uvm_unmap_detach+0x163 sys/uvm/uvm_map.c:1586 uvm_map_teardown(fffffd806bc0a220) at uvm_map_teardown+0x22c sys/uvm/uvm_map.c:2759 uvmspace_free(fffffd806bc0a220) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3646 uvm_exit(ffff8000ffffae70) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297 reaper(ffff80001d652110) at reaper+0x15c sys/kern/kern_exit.c:456 end trace frame: 0x0, count: -8 ddb> machine ddbcpu 1 No such command ddb> trace pmap_page_remove(fffffd80052c3f80) at pmap_page_remove+0x33d _atomic_swap_64 machine/atomic.h:117 [inline] pmap_page_remove(fffffd80052c3f80) at pmap_page_remove+0x33d sys/arch/amd64/amd64/pmap.c:1946 uvm_anfree_list(fffffd8057a2e670,ffff80001d696700) at uvm_anfree_list+0x4e sys/uvm/uvm_anon.c:104 amap_wipeout(fffffd805e953170) at amap_wipeout+0x171 sys/uvm/uvm_amap.c:461 uvm_unmap_detach(ffff80001d6967c0,1) at uvm_unmap_detach+0x163 sys/uvm/uvm_map.c:1586 uvm_map_teardown(fffffd806bc0a220) at uvm_map_teardown+0x22c sys/uvm/uvm_map.c:2759 uvmspace_free(fffffd806bc0a220) at uvmspace_free+0x86 sys/uvm/uvm_map.c:3646 uvm_exit(ffff8000ffffae70) at uvm_exit+0x29 sys/uvm/uvm_glue.c:297 reaper(ffff80001d652110) at reaper+0x15c sys/kern/kern_exit.c:456 end trace frame: 0x0, count: -8