panic: kernel diagnostic assertion "va >= entry->start" failed: file "/syzkaller/managers/setuid/kernel/sys/uvm/uvm_fault.c", line 1741 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 437002 33207 32767 0x10 0 1 syz-executor *176041 33207 32767 0x10 0x4000000 0 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8343fe74) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff833ebd93,ffffffff83429334,6cd,ffffffff8333b9c0) at __assert+0x29 uvm_fault_unwire_locked(fffffd806beaf588,400000000000,400000021000) at uvm_fault_unwire_locked+0x4b4 uvm_fault_unwire(fffffd806beaf588,400000000000,400000021000) at uvm_fault_unwire+0x55 sys/uvm/uvm_fault.c:1704 sysctl_vsunlock(400000000080,20000) at sysctl_vsunlock+0x7b sys/kern/kern_sysctl.c:215 net_sysctl(ffff80003c515144,3,400000000080,ffff80003c515178,0,0,aaecce299abf829b) at net_sysctl+0x69a sys/kern/uipc_domain.c:259 sys_sysctl(ffff80003bcc3730,ffff80003c5152b0,ffff80003c515200) at sys_sysctl+0x425 syscall(ffff80003c5152b0) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c5152b0) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xe5d6c34d7f0, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: kernel diagnostic assertion "va >= entry->start" failed: file "/syzkaller/managers/setuid/kernel/sys/uvm/uvm_fault.c", line 1741 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8343fe74) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff833ebd93,ffffffff83429334,6cd,ffffffff8333b9c0) at __assert+0x29 uvm_fault_unwire_locked(fffffd806beaf588,400000000000,400000021000) at uvm_fault_unwire_locked+0x4b4 uvm_fault_unwire(fffffd806beaf588,400000000000,400000021000) at uvm_fault_unwire+0x55 sys/uvm/uvm_fault.c:1704 sysctl_vsunlock(400000000080,20000) at sysctl_vsunlock+0x7b sys/kern/kern_sysctl.c:215 net_sysctl(ffff80003c515144,3,400000000080,ffff80003c515178,0,0,aaecce299abf829b) at net_sysctl+0x69a sys/kern/uipc_domain.c:259 sys_sysctl(ffff80003bcc3730,ffff80003c5152b0,ffff80003c515200) at sys_sysctl+0x425 syscall(ffff80003c5152b0) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c5152b0) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xe5d6c34d7f0, count: -10 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80003c514ea0 rbx 0xffffffff83809dc7 cpu_info_full_primary+0x2dc7 rdx 0 rcx 0xffff80003bcc3730 rax 0xffffffff83808ff0 cpu_info_full_primary+0x1ff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x41865c7f0693b251 r11 0x4020ae7774cf023c r12 0xffffffff83809bc8 cpu_info_full_primary+0x2bc8 r13 0 r14 0 r15 0x1 rip 0xffffffff82431aa5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003c514e90 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=176041 pid=33207 tcnt=4 stat=onproc flags process=10 proc=4000000 runpri=32, usrpri=50, slppri=36, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003bcc27d0,0xffff80003bcc34b0 process=0xffff80003c0de978 user=0xffff80003c510000, vmspace=0xfffffd806beaf588 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 33207 437002 2637 32767 7 0x10 syz-executor *33207 176041 2637 32767 7 0x4000010 syz-executor 33207 283216 2637 32767 2 0x4000010 syz-executor 33207 1166 2637 32767 3 0x4000010 vmmaplk syz-executor 3207 32591 41444 32767 2 0x10 syz-executor 3207 338270 41444 32767 3 0x4000090 fsleep syz-executor 91772 16483 81188 32767 2 0x10 syz-executor 91772 196176 81188 32767 3 0x4000090 fsleep syz-executor 88359 35124 68067 32767 2 0x10 syz-executor 88359 256576 68067 32767 3 0x4000090 ttyin syz-executor 88359 263830 68067 32767 3 0x4000090 fsleep syz-executor 32992 416108 58125 0 3 0x100082 sysctllk arp 80996 98565 719 0 2 0x100002 arp 719 68532 56304 0 3 0x10008a sigsusp sh 58125 322005 38865 0 3 0x10008a sigsusp sh 51000 508837 70242 32767 2 0x10 syz-executor 41444 185643 16112 32767 3 0x90 nanoslp syz-executor 38865 235485 5057 0 3 0x80 wait syz-executor 56304 44623 13445 0 3 0x80 wait syz-executor 81188 181009 18999 32767 2 0x10 syz-executor 68067 264181 8198 32767 3 0x90 nanoslp syz-executor 2637 1852 2547 32767 3 0x90 nanoslp syz-executor 70066 97674 50042 32767 3 0x10 biowait syz-executor 13445 513295 763 0 3 0x82 wait syz-executor 18999 79930 763 0 3 0x82 wait syz-executor 16112 6250 763 0 3 0x82 wait syz-executor 5057 291280 763 0 3 0x82 wait syz-executor 2547 210876 763 0 3 0x82 wait syz-executor 70242 234722 763 0 3 0x82 wait syz-executor 50042 419329 763 0 3 0x82 wait syz-executor 8198 402987 763 0 3 0x82 wait syz-executor 763 177067 54451 0 3 0x82 kqread syz-executor 54451 299576 61618 0 3 0x10008a sigsusp ksh 61618 217751 2788 0 3 0x98 kqread sshd-session 2788 81086 44203 0 3 0x92 kqread sshd-session 22674 224466 1 0 3 0x100083 ttyin getty 44203 146671 1 0 3 0x88 kqread sshd 48950 134898 18105 73 3 0x1100090 kqread syslogd 18105 64058 1 0 3 0x100082 sbwait syslogd 41671 252845 1 0 3 0x100080 kqread resolvd 96880 357784 84091 77 3 0x100092 kqread dhcpleased 6809 379460 84091 77 3 0x100092 kqread dhcpleased 84091 289550 1 0 3 0x80 kqread dhcpleased 48854 127716 0 0 3 0x14200 bored smr 40734 62974 0 0 2 0x14200 zerothread 13232 9005 0 0 3 0x14200 aiodoned aiodoned 91641 189466 0 0 3 0x14200 syncer update 77650 2095 0 0 3 0x14200 cleaner cleaner 42614 464348 0 0 3 0x14200 reaper reaper 57089 243806 0 0 3 0x14200 pgdaemon pagedaemon 1063 90172 0 0 3 0x14200 bored viomb 38591 460561 0 0 3 0x40014200 acpi0 acpi0 1361 201791 0 0 3 0x40014200 idle1 56501 455092 0 0 3 0x14200 bored softnet3 12956 347662 0 0 3 0x14200 bored softnet2 17319 510537 0 0 3 0x14200 bored softnet1 13773 457029 0 0 3 0x14200 bored softnet0 85346 169326 0 0 3 0x14200 bored systqmp 80786 53626 0 0 3 0x14200 bored systq 49773 340316 0 0 3 0x14200 tmoslp softclockmp 88981 402457 0 0 3 0x40014200 tmoslp softclock 23928 273453 0 0 3 0x40014200 idle0 1 53476 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 33207 (syz-executor) thread 0xffff80003bcc3730 (176041) exclusive rwlock amaplk r = 0 (0xfffffd806c0f0e68) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 uvm_map_lock_entry+0x51 sys/uvm/uvm_map.c:464 #3 uvm_fault_unwire_locked+0x253 sys/uvm/uvm_fault.c:1760 #4 uvm_fault_unwire+0x55 sys/uvm/uvm_fault.c:1704 #5 sysctl_vsunlock+0x7b sys/kern/kern_sysctl.c:215 #6 net_sysctl+0x69a sys/kern/uipc_domain.c:259 #7 sys_sysctl+0x425 #8 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 #9 Xsyscall+0x128 shared rwlock vmmaplk r = 0 (0xfffffd806beaf688) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_do_enter_read+0x3af sys/kern/kern_rwlock.c:405 #2 uvm_fault_unwire+0x3e sys/uvm/uvm_fault.c:1703 #3 sysctl_vsunlock+0x7b sys/kern/kern_sysctl.c:215 #4 net_sysctl+0x69a sys/kern/uipc_domain.c:259 #5 sys_sysctl+0x425 #6 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 #7 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff838b3fa0) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 __mp_acquire_count+0x58 #2 mi_switch+0x4b7 sys/kern/sched_bsd.c:441 #3 sleep_finish+0x24f sys/kern/kern_synch.c:414 #4 rw_do_enter_write+0x1de sys/kern/kern_rwlock.c:292 #5 ip6_sysctl+0x57c sys/netinet6/ip6_input.c:1556 #6 net_sysctl+0x64a sys/kern/uipc_domain.c:256 #7 sys_sysctl+0x425 #8 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 #9 Xsyscall+0x128 exclusive rwlock sysctllk r = 0 (0xffffffff837d7c18) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 sysctl_vslock+0x45 sys/kern/kern_sysctl.c:187 #3 net_sysctl+0x5a1 sys/kern/uipc_domain.c:253 #4 sys_sysctl+0x425 #5 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 #6 Xsyscall+0x128 Process 70066 (syz-executor) thread 0xffff8000ffffa2a8 (97674) exclusive rrwlock inode r = 0 (0xfffffd806bcc81f8) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:616 #3 VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524 #4 ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:159 #5 ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1230 #6 ffs_inode_alloc+0x283 sys/ufs/ffs/ffs_alloc.c:393 #7 ufs_mkdir+0x113 sys/ufs/ufs/ufs_vnops.c:1112 #8 VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394 #9 domkdirat+0x179 sys/kern/vfs_syscalls.c:3117 #10 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #10 syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 #11 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffd806d1a5df0) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:616 #3 VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:570 #5 vfs_lookup+0x109 sys/kern/vfs_lookup.c:418 #6 namei+0x7aa sys/kern/vfs_lookup.c:250 #7 domkdirat+0x8b sys/kern/vfs_syscalls.c:3102 #8 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 #9 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10181 10953K 10966K 166960K 11260 0 pcb 17 12K 12K 166960K 17 0 rtable 204 5K 6K 166960K 311 0 pf 31 16K 16K 166960K 31 0 ifaddr 38 6K 6K 166960K 40 0 ifgroup 50 2K 2K 166960K 50 0 sysctl 1 1K 1K 166960K 1 0 counters 64 36K 36K 166960K 64 0 ioctlops 0 0K 2K 166960K 28 0 iov 0 0K 4K 166960K 2 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1332 84K 84K 166960K 1348 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 26 97K 121K 166960K 138 0 proc 58 79K 115K 166960K 459 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 in_multi 79 5K 5K 166960K 79 0 ether_multi 1 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 37 175K 175K 166960K 37 0 exec 0 0K 1K 166960K 339 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 232 73K 73K 166960K 2731 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 49 98K 113K 166960K 1152 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 2 0 NDP 23 1K 1K 166960K 23 0 temp 34 8678K 8742K 166960K 3655 0 kqueue 13 20K 22K 166960K 24 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 24 0 0 1 0 1 1 0 8 0 rtpcb 120 36 0 31 1 0 1 1 0 8 0 rtentry 160 96 0 1 4 0 4 4 0 8 0 unpcb 144 37 0 19 1 0 1 1 0 8 0 syncache 336 3 0 3 1 0 1 1 0 8 1 tcpcb 808 12 0 6 1 0 1 1 0 8 0 arp 120 17 0 0 1 0 1 1 0 8 0 inpcb 376 65 0 56 2 0 2 2 0 8 1 nd6 136 18 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 372 0 0 24 0 24 24 0 8 0 art_table 32 373 0 0 4 0 4 4 0 8 0 art_node 16 95 0 8 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1545 0 45 94 0 94 94 0 8 0 ffsino 280 1545 0 45 108 0 108 108 0 8 0 nchpl 144 1736 0 59 63 0 63 63 0 8 0 uvmvnodes 80 1626 0 0 34 0 34 34 0 8 0 vnodes 216 1626 0 0 91 0 91 91 0 8 0 namei 1024 5110 0 5109 1 0 1 1 0 8 0 percpumem 16 46 0 0 1 0 1 1 0 8 0 kstatmem 264 22 0 0 2 0 2 2 0 8 0 scxspl 216 5637 0 5636 3 1 2 2 1 8 1 plimitpl 152 34 0 10 1 0 1 1 0 8 0 sigapl 424 420 0 364 7 0 7 7 0 8 0 futexpl 64 105 0 102 1 0 1 1 0 8 0 knotepl 120 58 0 0 2 0 2 2 0 8 0 kqueuepl 216 20 0 11 1 0 1 1 0 8 0 pipepl 328 103 0 76 3 0 3 3 0 8 0 fdescpl 504 402 0 364 7 1 6 6 0 8 0 filepl 152 1454 0 1238 9 0 9 9 0 8 0 lockfpl 104 6 0 4 1 0 1 1 0 8 0 lockfspl 48 4 0 2 1 0 1 1 0 8 0 sessionpl 144 21 0 5 1 0 1 1 0 8 0 pgrppl 48 29 0 5 1 0 1 1 0 8 0 ucredpl 104 87 0 70 1 0 1 1 0 8 0 zombiepl 144 364 0 364 1 0 1 1 0 8 1 processpl 1176 420 0 364 5 0 5 5 0 8 0 procpl 656 432 0 369 6 0 6 6 0 8 0 sockpl 688 138 0 106 4 0 4 4 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 110 0 0 14 0 14 14 0 8 0 mcl2k 2048 17 0 0 3 0 3 3 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 143 0 0 9 0 9 9 0 8 0 bufpl 280 2222 0 124 150 0 150 150 0 8 0 anonpl 24 101292 0 98073 25 1 24 24 0 184 4 amapchunkpl 152 8301 0 7803 20 0 20 20 0 158 0 amappl16 200 2129 0 2116 5 0 5 5 0 8 4 amappl15 192 7 0 7 1 0 1 1 0 8 1 amappl14 184 100 0 88 1 0 1 1 0 8 0 amappl13 176 6 0 6 1 0 1 1 0 8 1 amappl12 168 997 0 959 2 0 2 2 0 8 0 amappl11 160 47 0 37 1 0 1 1 0 8 0 amappl10 152 5 0 5 1 0 1 1 0 8 1 amappl9 144 246 0 246 1 0 1 1 0 8 1 amappl8 136 25 0 24 1 0 1 1 0 8 0 amappl7 128 96 0 84 1 0 1 1 0 8 0 amappl6 120 171 0 166 1 0 1 1 0 8 0 amappl5 112 114 0 108 1 0 1 1 0 8 0 amappl4 104 274 0 260 1 0 1 1 0 8 0 amappl3 96 1188 0 1070 3 0 3 3 0 8 0 amappl2 88 610 0 552 2 0 2 2 0 8 0 amappl1 80 7446 0 6852 13 0 13 13 0 8 0 amappl 88 2395 0 2218 5 0 5 5 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 402 0 364 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 402 0 364 1 0 1 1 0 8 0 vmmpekpl 168 4864 0 4830 2 0 2 2 0 8 0 vmmpepl 168 31398 0 29420 91 0 91 91 0 357 1 vmsppl 456 401 0 364 7 1 6 6 0 8 0 rwobjpl 64 13839 0 11311 43 1 42 43 0 8 0 pdppl 4096 812 0 728 110 14 96 96 0 8 12 pvpl 32 9494 0 0 77 0 77 77 0 265 0 pmappl 248 401 0 364 4 1 3 3 0 8 0 extentpl 40 55 0 38 1 0 1 1 0 8 0 phpool 112 272 0 17 8 0 8 8 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8343fe74) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff833ebd93,ffffffff83429334,6cd,ffffffff8333b9c0) at __assert+0x29 uvm_fault_unwire_locked(fffffd806beaf588,400000000000,400000021000) at uvm_fault_unwire_locked+0x4b4 uvm_fault_unwire(fffffd806beaf588,400000000000,400000021000) at uvm_fault_unwire+0x55 sys/uvm/uvm_fault.c:1704 sysctl_vsunlock(400000000080,20000) at sysctl_vsunlock+0x7b sys/kern/kern_sysctl.c:215 net_sysctl(ffff80003c515144,3,400000000080,ffff80003c515178,0,0,aaecce299abf829b) at net_sysctl+0x69a sys/kern/uipc_domain.c:259 sys_sysctl(ffff80003bcc3730,ffff80003c5152b0,ffff80003c515200) at sys_sysctl+0x425 syscall(ffff80003c5152b0) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c5152b0) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xe5d6c34d7f0, count: -10 ddb{0}> machine ddbcpu 1