login: uvm_fault(0xffffffff839b1570, 0xffff800029ef5000, 0, 1) -> e kernel: page fault trap, code=0 Stopped at pvclock_get+0x53: movl 0(%r15),%r12d TID PID UID PRFLAGS PFLAGS CPU COMMAND *169404 64978 0 0 0x4000000 0 syz-executor pvclock_get(ffffffff838c6a50) at pvclock_get+0x53 pvclock_read_begin sys/dev/pv/pvclock.c:278 [inline] pvclock_get(ffffffff838c6a50) at pvclock_get+0x53 sys/dev/pv/pvclock.c:333 nsecuptime() at nsecuptime+0x62 tc_delta sys/kern/kern_tc.c:138 [inline] nsecuptime() at nsecuptime+0x62 binuptime sys/kern/kern_tc.c:191 [inline] nsecuptime() at nsecuptime+0x62 sys/kern/kern_tc.c:257 clockintr_dispatch(ffff80003c9073f0) at clockintr_dispatch+0xe8 sys/kern/kern_clockintr.c:180 lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482 Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2a kd_curproc sys/dev/kcov.c:585 [inline] __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2a sys/dev/kcov.c:153 _rb_find(ffffffff83643870,fffffd806cad9e30,ffff80003c907518) at _rb_find+0xc5 sys/kern/subr_tree.c:451 uvm_pagelookup(fffffd806cad9e20,22f000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline] uvm_pagelookup(fffffd806cad9e20,22f000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1214 buf_free_pages(fffffd806cad9d60) at buf_free_pages+0xec sys/kern/vfs_biomem.c:-1 buf_dealloc_mem(fffffd806cad9d60) at buf_dealloc_mem+0x14e sys/kern/vfs_biomem.c:179 buf_put(fffffd806cad9d60) at buf_put+0x1d9 sys/kern/vfs_bio.c:123 brelse(fffffd806cad9d60) at brelse+0x397 sys/kern/vfs_bio.c:932 writedisklabel(d02,ffffffff82a98980,ffff800000039000) at writedisklabel+0x1b8 sys/arch/amd64/amd64/disksubr.c:158 sdioctl(d01,84946467,ffff80000155b800,3,ffff80002a894a90) at sdioctl+0x959 sys/scsi/sd.c:921 end trace frame: 0xffff80003c907890, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: uvm_fault(0xffffffff839b1570, 0xffff800029ef5000, 0, 1) -> e ddb> trace pvclock_get(ffffffff838c6a50) at pvclock_get+0x53 pvclock_read_begin sys/dev/pv/pvclock.c:278 [inline] pvclock_get(ffffffff838c6a50) at pvclock_get+0x53 sys/dev/pv/pvclock.c:333 nsecuptime() at nsecuptime+0x62 tc_delta sys/kern/kern_tc.c:138 [inline] nsecuptime() at nsecuptime+0x62 binuptime sys/kern/kern_tc.c:191 [inline] nsecuptime() at nsecuptime+0x62 sys/kern/kern_tc.c:257 clockintr_dispatch(ffff80003c9073f0) at clockintr_dispatch+0xe8 sys/kern/kern_clockintr.c:180 lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482 Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2a kd_curproc sys/dev/kcov.c:585 [inline] __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2a sys/dev/kcov.c:153 _rb_find(ffffffff83643870,fffffd806cad9e30,ffff80003c907518) at _rb_find+0xc5 sys/kern/subr_tree.c:451 uvm_pagelookup(fffffd806cad9e20,22f000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline] uvm_pagelookup(fffffd806cad9e20,22f000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1214 buf_free_pages(fffffd806cad9d60) at buf_free_pages+0xec sys/kern/vfs_biomem.c:-1 buf_dealloc_mem(fffffd806cad9d60) at buf_dealloc_mem+0x14e sys/kern/vfs_biomem.c:179 buf_put(fffffd806cad9d60) at buf_put+0x1d9 sys/kern/vfs_bio.c:123 brelse(fffffd806cad9d60) at brelse+0x397 sys/kern/vfs_bio.c:932 writedisklabel(d02,ffffffff82a98980,ffff800000039000) at writedisklabel+0x1b8 sys/arch/amd64/amd64/disksubr.c:158 sdioctl(d01,84946467,ffff80000155b800,3,ffff80002a894a90) at sdioctl+0x959 sys/scsi/sd.c:921 VOP_IOCTL(fffffd806f5d3518,84946467,ffff80000155b800,3,fffffd8007ffd680,ffff80002a894a90) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264 vn_ioctl(fffffd806093f8f0,84946467,ffff80000155b800,ffff80002a894a90) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537 sys_ioctl(ffff80002a894a90,ffff80003c907b80,ffff80003c907ad0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80003c907b80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c907b80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x376dd997530, count: -19 ddb> show registers rdi 0xffffffff rsi 0xd rbp 0xffff80003c9072e0 rbx 0x3 rdx 0xffff8000015abac0 rcx 0 rax 0xc r8 0 r9 0 r10 0 r11 0xb6cb5fe0e3938cf8 r12 0x1268 __ALIGN_SIZE+0x268 r13 0xffffffff8388d558 th1 r14 0xffffffff838c6a50 pvclock_timecounter r15 0xffff800029ef5000 rip 0xffffffff825bfb23 pvclock_get+0x53 cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80003c907290 ss 0x10 pvclock_get+0x53: movl 0(%r15),%r12d ddb> show proc PROC (syz-executor) tid=169404 pid=64978 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=50, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a8942c8,0xffff80002a895268 process=0xffff80002a754908 user=0xffff80003c902000, vmspace=0xfffffd806cb43460 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 71019 74788 14262 0 2 0 syz-executor 71019 182225 14262 0 3 0x4000080 fsleep syz-executor 71019 456775 14262 0 3 0x4000080 fsleep syz-executor 38693 513391 48376 60929 2 0x10 syz-executor 38693 7027 48376 60929 3 0x4000090 fsleep syz-executor 58371 119196 31924 0 2 0 syz-executor 58371 162476 31924 0 3 0x4000080 fsleep syz-executor 82478 478023 72350 60929 2 0x10 syz-executor 82478 343019 72350 60929 3 0x4000090 fsleep syz-executor 64978 80387 69552 0 2 0 syz-executor *64978 169404 69552 0 7 0x4000000 syz-executor 64978 259023 69552 0 3 0x4000080 fsleep syz-executor 30388 216148 12599 60929 2 0x10 syz-executor 30388 140337 12599 60929 3 0x4000090 fsleep syz-executor 79231 300072 1197 0 3 0 vmmaplk syz-executor 79231 145500 1197 0 3 0x4000000 vmmaplk syz-executor 79231 296613 1197 0 2 0x4000000 syz-executor 46888 295482 1 0 3 0x100083 ttyin getty 14262 99333 29040 0 3 0x82 nanoslp syz-executor 72350 469852 29040 0 3 0x82 nanoslp syz-executor 2236 174700 0 0 3 0x14280 nfsidl nfsio 32343 147594 0 0 3 0x14280 nfsidl nfsio 84675 236186 0 0 3 0x14280 nfsidl nfs