kernel: protection fault trap, code=0 Stopped at lf_advlock+0x224: addl $0x1,0x28(%rbx) ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic the kernel did not panic ddb{0}> trace lf_advlock(ffff800000dd2820,0,fffffd8069e46ba8,2,ffff8000285c5010,40) at lf_advlock+0x224 ls_ref sys/kern/vfs_lockf.c:138 [inline] lf_advlock(ffff800000dd2820,0,fffffd8069e46ba8,2,ffff8000285c5010,40) at lf_advlock+0x224 sys/kern/vfs_lockf.c:278 VOP_ADVLOCK(fffffd807c430d88,fffffd8069e46ba8,2,ffff8000285c5010,40) at VOP_ADVLOCK+0x75 sys/kern/vfs_vops.c:612 closef(fffffd807be117b8,ffff8000212db8b0) at closef+0xe9 finishdup(ffff8000212db8b0,fffffd807be117b8,6,3,ffff8000285c5190,2) at finishdup+0x31c sys/kern/kern_descrip.c:686 syscall(ffff8000285c5210) at syscall+0x606 mi_syscall sys/sys/syscall_mi.h:110 [inline] syscall(ffff8000285c5210) at syscall+0x606 sys/arch/amd64/amd64/trap.c:623 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdb9ff4affc0, count: -6 ddb{0}> show registers rdi 0 rsi 0 rbp 0xffff8000285c4f60 rbx 0xdead4110dead4110 rdx 0 rcx 0x6 rax 0xffff8000212db8b0 r8 0xffff8000285c5010 r9 0x40 r10 0 r11 0xce91e9fabb0935f r12 0xffff800000dd2820 r13 0x2 r14 0xffff8000285c5010 r15 0 rip 0xffffffff813bf3e4 lf_advlock+0x224 cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff8000285c4ec0 ss 0x10 lf_advlock+0x224: addl $0x1,0x28(%rbx) ddb{0}> show proc PROC (syz-executor.2) pid=501669 stat=onproc flags process=1010 proc=4080000 pri=32, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff8000212da860,0xffff8000212db350 process=0xffff80002859e198 user=0xffff8000285c0000, vmspace=0xfffffd8069e34760 estcpu=36, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 4009 1853 89275 32767 3 0x4081010 lockflk syz-executor.2 4009 181191 89275 32767 3 0x4081010 lockflk syz-executor.2 * 4009 501669 89275 32767 7 0x4081010 syz-executor.2 4009 487871 89275 32767 3 0x4003010 suspend syz-executor.2 84361 149486 58351 32767 3 0x90 nanoslp syz-executor.7 84361 16803 58351 32767 3 0x4000090 netio syz-executor.7 84361 375589 58351 32767 3 0x4000090 fsleep syz-executor.7 58351 238008 38446 32767 3 0x90 nanoslp syz-executor.7 38446 474736 38187 0 3 0x82 wait syz-executor.7 94193 226217 0 0 3 0x14200 bored sosplice 8778 184294 72242 32767 3 0x10 biowait syz-executor.5 72242 7607 38187 0 3 0x82 wait syz-executor.5 89275 382667 3362 32767 2 0x490 syz-executor.2 96079 202313 57708 32767 7 0x10 syz-executor.6 41496 198901 85443 32767 3 0x90 piperd syz-executor.4 57708 176827 38187 0 3 0x82 wait syz-executor.6 3957 478093 68359 32767 2 0x490 syz-executor.3 68359 376112 38187 0 3 0x82 wait syz-executor.3 85443 227339 38187 0 3 0x82 wait syz-executor.4 25365 492076 26529 32767 3 0x90 piperd syz-executor.1 3362 298025 38187 0 3 0x82 wait syz-executor.2 26529 202531 38187 0 3 0x82 wait syz-executor.1 78191 261583 41506 32767 3 0x90 piperd syz-executor.0 41506 86406 38187 0 3 0x82 wait syz-executor.0 38187 239323 19267 0 3 0x82 wait syz-fuzzer 38187 354398 19267 0 3 0x4000082 thrsleep syz-fuzzer 38187 108413 19267 0 3 0x4000082 wait syz-fuzzer 38187 489186 19267 0 3 0x4000082 wait syz-fuzzer 38187 921 19267 0 3 0x4000082 thrsleep syz-fuzzer 38187 405947 19267 0 3 0x4000082 wait syz-fuzzer 38187 298766 19267 0 3 0x4000082 thrsleep syz-fuzzer 38187 170425 19267 0 3 0x4000082 wait syz-fuzzer 38187 278563 19267 0 3 0x4000082 wait syz-fuzzer 38187 429041 19267 0 3 0x4000082 thrsleep syz-fuzzer 38187 279889 19267 0 3 0x4000082 thrsleep syz-fuzzer 38187 411252 19267 0 3 0x4000082 wait syz-fuzzer 38187 468389 19267 0 3 0x4000082 thrsleep syz-fuzzer 38187 65009 19267 0 2 0x4000082 syz-fuzzer 38187 174222 19267 0 3 0x4000082 wait syz-fuzzer 38187 47008 19267 0 3 0x4000082 thrsleep syz-fuzzer 19267 513621 78067 0 3 0x10008a sigsusp ksh 78067 361525 23254 0 3 0x9a kqread sshd 60485 214935 1 0 3 0x100083 ttyin getty 23254 481952 1 0 3 0x88 kqread sshd 53459 51812 90659 73 3 0x1100010 biowait syslogd 90659 204003 1 0 3 0x100082 netio syslogd 16368 249881 1 0 3 0x100080 kqread resolvd 21458 143332 2929 77 3 0x100092 kqread dhcpleased 72835 135063 2929 77 3 0x100092 kqread dhcpleased 2929 467377 1 0 3 0x80 kqread dhcpleased 47357 396496 0 0 3 0x14200 bored smr 34055 523565 0 0 3 0x14200 pgzero zerothread 91863 423255 0 0 3 0x14200 aiodoned aiodoned 19878 176223 0 0 3 0x14200 syncer update 66580 299420 0 0 3 0x14200 cleaner cleaner 63130 345971 0 0 3 0x14200 reaper reaper 54987 148945 0 0 3 0x14200 pgdaemon pagedaemon 27617 134726 0 0 3 0x14200 bored viomb 97391 47010 0 0 3 0x40014200 acpi0 acpi0 97704 157945 0 0 3 0x40014200 idle1 96121 231554 0 0 3 0x14200 bored softnet3 72286 72761 0 0 3 0x14200 bored softnet2 88758 255541 0 0 3 0x14200 bored softnet1 31484 209961 0 0 3 0x14200 bored softnet0 68323 503246 0 0 3 0x14200 bored systqmp 3263 267449 0 0 3 0x14200 bored systq 69906 21919 0 0 2 0x40014200 softclock 68784 54762 0 0 3 0x40014200 idle0 1 510452 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 4009 (syz-executor.2) thread 0xffff8000212db8b0 (501669) exclusive rwlock lockflk r = 0 (0xffffffff82b83740) #0 witness_lock+0x447 #1 lf_advlock+0x196 sys/kern/vfs_lockf.c:260 #2 VOP_ADVLOCK+0x75 sys/kern/vfs_vops.c:612 #3 closef+0xe9 #4 finishdup+0x31c sys/kern/kern_descrip.c:686 #5 syscall+0x606 mi_syscall sys/sys/syscall_mi.h:110 [inline] #5 syscall+0x606 sys/arch/amd64/amd64/trap.c:623 #6 Xsyscall+0x128 Process 8778 (syz-executor.5) thread 0xffff8000212b6030 (184294) exclusive rrwlock inode r = 0 (0xfffffd8068d122b8) #0 witness_lock+0x447 #1 rw_enter+0x3e6 sys/kern/kern_rwlock.c:310 #2 rrw_enter+0x8c sys/kern/kern_rwlock.c:465 #3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518 #4 ufs_ihashins+0x46 sys/ufs/ufs/ufs_ihash.c:140 #5 ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1343 #6 ffs_inode_alloc+0x1c2 sys/ufs/ffs/ffs_alloc.c:394 #7 ufs_mkdir+0xf8 sys/ufs/ufs/ufs_vnops.c:1149 #8 VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388 #9 domkdirat+0x125 sys/kern/vfs_syscalls.c:3073 #10 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #10 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 #11 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffd8067740928) #0 witness_lock+0x447 #1 rw_enter+0x3e6 sys/kern/kern_rwlock.c:310 #2 rrw_enter+0x8c sys/kern/kern_rwlock.c:465 #3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518 #4 vn_lock+0x84 sys/kern/vfs_vnops.c:564 #5 vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418 #6 namei+0x55a sys/kern/vfs_lookup.c:250 #7 domkdirat+0x79 sys/kern/vfs_syscalls.c:3058 #8 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #8 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 #9 Xsyscall+0x128 Process 96079 (syz-executor.6) thread 0xffff8000212b6dc8 (202313) exclusive rrwlock inode r = 0 (0xfffffd8067740e78) #0 witness_lock+0x447 #1 rw_enter+0x3e6 sys/kern/kern_rwlock.c:310 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82d0b998) #0 witness_lock+0x447 #1 syscall+0x5cd mi_syscall sys/sys/syscall_mi.h:110 [inline] #1 syscall+0x5cd sys/arch/amd64/amd64/trap.c:623 #2 Xsyscall+0x128 Process 53459 (syslogd) thread 0xffff8000211ad058 (51812) exclusive rrwlock inode r = 0 (0xfffffd806e583a30) #0 witness_lock+0x447 #1 rw_enter+0x3e6 sys/kern/kern_rwlock.c:310 #2 rrw_enter+0x8c sys/kern/kern_rwlock.c:465 #3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518 #4 vn_lock+0x84 sys/kern/vfs_vnops.c:564 #5 sys_fsync+0xf9 sys/kern/vfs_syscalls.c:2896 #6 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #6 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 #7 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10210 6412K 6419K 78643K 11296 0 pcb 13 12K 14K 78643K 17 0 rtable 240 6K 7K 78643K 1285 0 pf 29 8K 8K 78643K 33 0 ifaddr 44 15K 15K 78643K 54 0 ifgroup 50 2K 2K 78643K 58 0 sysctl 2 0K 0K 78643K 2 0 counters 60 35K 35K 78643K 64 0 ioctlops 0 0K 2K 78643K 59 0 iov 0 0K 28K 78643K 1903 0 mount 1 1K 1K 78643K 1 0 log 0 0K 0K 78643K 4 0 vnodes 1279 80K 80K 78643K 3752 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 3 5K 9K 78643K 157 0 VM map 2 1K 1K 78643K 2 0 sem 12 0K 0K 78643K 4588 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1697 195K 286K 78643K 12548 0 file desc 20 73K 109K 78643K 10354 0 sigio 0 0K 0K 78643K 1090 0 proc 56 78K 115K 78643K 1091 0 subproc 104 6K 6K 78643K 130 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 946 0 in_multi 99 7K 7K 78643K 269 0 ether_multi 1 0K 0K 78643K 45 0 mrt 2 0K 0K 78643K 2 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 253 1129K 1129K 78643K 253 0 exec 0 0K 1K 78643K 1627 0 tdb 3 0K 0K 78643K 3 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 8 62K 64K 78643K 10 0 UVM amap 431 95K 108K 78643K 104342 0 UVM aobj 131 7K 7K 78643K 131 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 236 0 NDP 11 0K 2K 78643K 33 0 temp 74 5864K 5944K 78643K 27014 0 kqueue 12 18K 26K 78643K 781 0 SYN cache 2 16K 16K 78643K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 22 0 0 1 0 1 1 0 8 0 rtpcb 120 924 0 921 12 11 1 3 0 8 0 rtentry 112 156 0 43 4 0 4 4 0 8 0 unpcb 144 12091 0 12074 73 71 2 7 0 8 1 syncache 296 75 0 75 14 13 1 1 0 8 1 tcpqe 32 97 0 97 12 11 1 1 0 8 1 tcpcb 808 5046 0 5036 96 91 5 14 0 8 3 arp 120 24 0 5 1 0 1 1 0 8 0 ipq 40 22 0 22 5 4 1 1 0 8 1 ipqe 40 64 0 64 5 4 1 1 0 8 1 inpcb 368 11081 0 11062 98 93 5 19 0 8 2 ip6q 72 2 0 0 1 0 1 1 0 8 0 ip6af 40 2 0 0 1 0 1 1 0 8 0 nd6 136 51 0 25 6 5 1 2 0 8 0 kcovpl 48 10 0 2 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 623 0 161 32 2 30 31 0 8 0 art_table 32 624 0 161 4 0 4 4 0 8 0 art_node 16 155 0 52 1 0 1 1 0 8 0 sysvmsgpl 40 35 0 18 1 0 1 1 0 8 0 semupl 112 4 0 4 2 2 0 1 0 8 0 semapl 112 4585 0 4575 1 0 1 1 0 8 0 shmpl 112 128 0 0 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 16417 0 14969 91 0 91 91 0 8 0 ffsino 272 16417 0 14969 97 0 97 97 0 8 0 nchpl 144 30568 0 28924 63 0 63 63 0 8 0 uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0 vnodes 216 5926 0 0 330 0 330 330 0 8 0 namei 1024 101100 0 101098 4 3 1 2 0 8 0 percpumem 16 45 0 2 1 0 1 1 0 8 0 kstatmem 264 26 0 4 2 0 2 2 0 8 0 scxspl 216 88090 0 88088 28 26 2 8 0 8 1 plimitpl 152 1730 0 1706 14 13 1 2 0 8 0 sigapl 424 10647 0 10597 7 0 7 7 0 8 0 futexpl 64 110513 0 110512 2 1 1 1 0 8 0 knotepl 120 462 0 0 12 1 11 11 0 8 0 kqueuepl 216 2355 0 2347 39 38 1 5 0 8 0 pipepl 320 2677 0 2649 54 51 3 9 0 8 0 fdescpl 496 10629 0 10598 7 2 5 6 0 8 0 filepl 152 79207 0 78960 86 74 12 20 0 8 1 lockfpl 104 2742 0 2739 2 1 1 2 0 8 0 lockfspl 48 456 0 453 1 0 1 1 0 8 0 sessionpl 144 25 0 9 1 0 1 1 0 8 0 pgrppl 48 194 0 178 1 0 1 1 0 8 0 ucredpl 104 13824 0 13806 1 0 1 1 0 8 0 zombiepl 144 10598 0 10597 1 0 1 1 0 8 0 processpl 1072 10647 0 10597 4 0 4 4 0 8 0 procpl 696 29351 0 29280 14 5 9 9 0 8 1 sosppl 168 139 0 138 13 12 1 1 0 8 0 sockpl 488 24424 0 24391 424 415 9 29 0 8 4 mcl64k 65536 25 0 0 3 0 3 3 0 8 0 mcl16k 16384 18 0 0 3 1 2 3 0 8 0 mcl12k 12288 19 0 0 2 0 2 2 0 8 0 mcl9k 9216 25 0 0 2 0 2 2 0 8 0 mcl8k 8192 25 0 0 3 0 3 3 0 8 0 mcl4k 4096 18 0 0 3 0 3 3 0 8 1 mcl2k2 2112 4 0 0 1 0 1 1 0 8 0 mcl2k 2048 336 0 0 37 4 33 37 0 8 0 mtagpl 96 18 0 0 1 0 1 1 0 8 0 mbufpl 256 1516 0 0 81 0 81 81 0 8 0 bufpl 288 18972 0 12657 452 0 452 452 0 8 0 anonpl 24 1181078 0 1168478 240 134 106 126 0 186 5 amapchunkpl 152 336632 0 335753 110 63 47 49 0 158 8 amappl16 200 28328 0 27949 142 120 22 35 0 8 0 amappl15 192 77 0 76 1 0 1 1 0 8 0 amappl14 184 161 0 149 2 1 1 2 0 8 0 amappl13 176 9 0 9 1 1 0 1 0 8 0 amappl12 168 11301 0 11268 3 1 2 2 0 8 0 amappl11 160 91 0 80 1 0 1 1 0 8 0 amappl10 152 32 0 23 1 0 1 1 0 8 0 amappl9 144 282 0 281 2 1 1 2 0 8 0 amappl8 136 570 0 425 6 0 6 6 0 8 0 amappl7 128 137 0 120 1 0 1 1 0 8 0 amappl6 120 409 0 388 2 1 1 2 0 8 0 amappl5 112 364 0 358 1 0 1 1 0 8 0 amappl4 104 886 0 846 3 1 2 3 0 8 0 amappl3 96 64788 0 64697 9 6 3 4 0 8 0 amappl2 88 12195 0 12126 4 2 2 3 0 8 0 amappl1 80 44521 0 44007 22 9 13 22 0 8 0 amappl 88 103431 0 103183 7 0 7 7 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 130 0 0 3 0 3 3 0 8 0 uaddrrnd 24 10629 0 10598 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 10629 0 10598 1 0 1 1 0 8 0 vmmpekpl 168 89681 0 89626 3 0 3 3 0 8 0 vmmpepl 168 624001 0 621601 210 91 119 129 0 357 1 vmsppl 464 10628 0 10598 6 1 5 5 0 8 0 rwobjpl 56 166352 0 158831 118 8 110 111 0 8 0 pdppl 4096 21266 0 21196 236 154 82 88 0 8 12 pvpl 32 3113521 0 3095117 526 304 222 363 0 265 45 pmappl 248 10628 0 10598 4 1 3 3 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 1243 0 350 28 1 27 27 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace lf_advlock(ffff800000dd2820,0,fffffd8069e46ba8,2,ffff8000285c5010,40) at lf_advlock+0x224 ls_ref sys/kern/vfs_lockf.c:138 [inline] lf_advlock(ffff800000dd2820,0,fffffd8069e46ba8,2,ffff8000285c5010,40) at lf_advlock+0x224 sys/kern/vfs_lockf.c:278 VOP_ADVLOCK(fffffd807c430d88,fffffd8069e46ba8,2,ffff8000285c5010,40) at VOP_ADVLOCK+0x75 sys/kern/vfs_vops.c:612 closef(fffffd807be117b8,ffff8000212db8b0) at closef+0xe9 finishdup(ffff8000212db8b0,fffffd807be117b8,6,3,ffff8000285c5190,2) at finishdup+0x31c sys/kern/kern_descrip.c:686 syscall(ffff8000285c5210) at syscall+0x606 mi_syscall sys/sys/syscall_mi.h:110 [inline] syscall(ffff8000285c5210) at syscall+0x606 sys/arch/amd64/amd64/trap.c:623 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdb9ff4affc0, count: -6 ddb{0}> machine ddbcpu 1