kernel: protection fault trap, code=0 Stopped at malloc+0x855: movq 0x8(%rbx),%r14 ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic the kernel did not panic ddb{0}> show kasan No such command ddb{0}> trace malloc(10,7f,1) at malloc+0x855 sys/kern/kern_malloc.c:294 dofilewritev(ffff80002a222010,f8,ffff80002a2e6cc8,0,ffff80002a2e6d80) at dofilewritev+0x24f sys/kern/sys_generic.c:-1 sys_write(ffff80002a222010,ffff80002a2e6e30,ffff80002a2e6d80) at sys_write+0xa2 sys/kern/sys_generic.c:300 syscall(ffff80002a2e6e30) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a2e6e30) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79c44d79c010, count: -5 ddb{0}> show registers rdi 0x91c02856b26a2825 rsi 0x1000000fe rbp 0xffff80002a2e6c00 rbx 0x91c02857b26a28db rdx 0 rcx 0xffff80002a222010 rax 0xffffffff83955ff0 cpu_info_full_primary+0x1ff0 r8 0xffff80002a2e6d80 r9 0x3 r10 0 r11 0xce5757615b0c0f91 r12 0x1000000fe r13 0xffffffff83ac58c0 kmemstats+0x1fc0 r14 0xa30c333 __kernel_phys_end+0x670c333 r15 0x91c02856b26a2825 rip 0xffffffff8239d745 malloc+0x855 cs 0x8 rflags 0x10286 __ALIGN_SIZE+0xf286 rsp 0xffff80002a2e6b40 ss 0x10 malloc+0x855: movq 0x8(%rbx),%r14 ddb{0}> show proc PROC (syz-executor) tid=380097 pid=50383 tcnt=1 stat=onproc flags process=2 proc=0 runpri=77, usrpri=77, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a2222a8,0xffff80002a222550 process=0xffff800045ff7028 user=0xffff80002a2e1000, vmspace=0xfffff3800b1cb5b8 estcpu=36, cpticks=39, pctcpu=0.10, user=1, sys=15, intr=23 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 66810 286188 74998 0 3 0 0x80 nanoslp syz-executor 66810 130767 74998 0 3 0 0x4000080 kqsel syz-executor 66810 214507 74998 0 3 0 0x4000080 fsleep syz-executor 66810 384409 74998 0 3 0 0x4000080 fsleep syz-executor 11214 198785 62867 0 2 0 0 syz-executor 11214 101305 62867 0 3 0 0x4000080 fsleep syz-executor 62775 463047 1 0 2 0x1000 0x4080000 syz-executor 62775 164618 1 0 3 0x1000 0x4002000 suspend syz-executor 95642 53482 97785 0 3 0x2 0x80 piperd syz-executor 49497 355702 97785 0 3 0x2 0x80 piperd syz-executor 29206 380110 97785 0 3 0x2 0x80 piperd syz-executor 62867 195661 97785 0 3 0x2 0x80 nanoslp syz-executor *50383 380097 97785 0 7 0x2 0 syz-executor 74998 178946 97785 0 3 0x2 0x80 nanoslp syz-executor 85952 362596 97785 0 3 0x2 0x80 piperd syz-executor 97785 478227 1 0 3 0x2 0x80 nanoslp syz-executor 1963 103247 35673 0 3 0x10 0x88 kqread sshd-session 35673 409328 21687 0 3 0x12 0x80 kqread sshd-session 40900 389899 1 0 3 0x100003 0x80 ttyin getty 21687 12287 1 0 3 0 0x88 kqread sshd 73006 84376 38399 74 3 0x1100012 0x80 bpf pflogd 38399 44492 1 0 3 0 0x80 sbwait pflogd 53158 375369 37386 73 3 0x1100010 0x80 kqread syslogd 37386 522414 1 0 3 0x100002 0x80 sbwait syslogd 78921 372729 1 0 3 0x100000 0x80 kqread resolvd 95712 368107 34413 77 3 0x100012 0x80 kqread dhcpleased 54648 183635 34413 77 3 0x100012 0x80 kqread dhcpleased 34413 428863 1 0 3 0 0x80 kqread dhcpleased 54150 59246 0 0 3 0x14000 0x200 bored smr 41861 272750 0 0 7 0x14000 0x200 zerothread 52218 511041 0 0 3 0x14000 0x200 aiodoned aiodoned 28797 111331 0 0 3 0x14000 0x200 syncer update 46957 198235 0 0 3 0x14000 0x200 cleaner cleaner 78460 194596 0 0 3 0x14000 0x200 reaper reaper 43330 19723 0 0 3 0x14000 0x200 pgdaemon pagedaemon 55949 174442 0 0 3 0x14000 0x200 bored viomb 60605 128818 0 0 3 0x14000 0x40000200 acpi0 acpi0 15339 493802 0 0 3 0x14000 0x40000200 idle1 35705 330672 0 0 3 0x14000 0x200 bored softnet1 31151 507551 0 0 3 0x14000 0x200 bored softnet0 71437 463582 0 0 3 0x14000 0x200 bored systqmp 72297 266271 0 0 3 0x14000 0x200 bored systq 74971 54731 0 0 3 0x14000 0x200 tmoslp softclockmp 10341 474343 0 0 3 0x14000 0x40000200 tmoslp softclock 24587 54651 0 0 3 0x14000 0x40000200 idle0 1 112582 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff83958c08) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487 #2 malloc+0x2ef sys/kern/kern_malloc.c:200 #3 dofilewritev+0x24f sys/kern/sys_generic.c:-1 #4 sys_write+0xa2 sys/kern/sys_generic.c:300 #5 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11059 12087K 12354K 166960K 12708 0 pcb 17 14K 15K 166960K 88 0 rtable 250 8K 8K 166960K 385 0 pf 33 17K 24K 166960K 90 0 ifaddr 43 7K 8K 166960K 55 0 ifgroup 52 2K 2K 166960K 81 0 sysctl 3 1K 9K 166960K 8 0 counters 70 37K 38K 166960K 88 0 ioctlops 0 0K 4K 166960K 1593 0 iov 0 0K 16K 166960K 9 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1395 88K 88K 166960K 1749 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 7 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 25 0 dirhash 12 2K 2K 166960K 21 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 12 41K 236K 166960K 417 0 sigio 0 0K 0K 166960K 67 0 proc 71 115K 164K 166960K 576 0 subproc 72 4K 5K 166960K 108 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 26 0 in_multi 99 7K 7K 166960K 101 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 18 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 61 281K 281K 166960K 61 0 exec 0 0K 1K 166960K 442 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 201 150K 168K 166960K 5512 0 UVM aobj 12 4K 4K 166960K 12 0 pinsyscall 36 72K 102K 166960K 1560 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 10 0 NDP 12 0K 2K 166960K 35 0 temp 39 9115K 9132K 166960K 15578 0 kqueue 13 20K 26K 166960K 67 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 51 0 47 1 0 1 1 0 8 0 rtentry 176 117 0 5 6 0 6 6 0 8 0 unpcb 144 292 0 275 1 0 1 1 0 8 0 syncache 336 9 0 9 1 1 0 1 0 8 0 tcpcb 736 141 0 137 7 6 1 7 0 8 0 arp 136 19 0 1 1 0 1 1 0 8 0 inpcb 328 389 0 382 11 10 1 7 0 8 0 nd6 152 26 0 0 1 0 1 1 0 8 0 pkpcb 40 1 0 1 1 1 0 1 0 8 0 kcovpl 48 12 0 4 1 0 1 1 0 8 0 ppxss 1192 5 0 5 1 1 0 1 0 8 0 pppxif 1576 1 0 1 1 1 0 1 0 8 0 pffrag 232 6 0 1 1 0 1 1 0 482 0 pffrnode 88 6 0 1 1 0 1 1 0 8 0 pffrent 40 7 0 2 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfsrclim 320 1 0 1 1 1 0 1 0 8 0 pfstlim 224 1 0 1 1 1 0 1 0 8 0 pfanchor 1288 3 0 0 1 0 1 1 0 8 0 pftag 88 1 0 0 1 0 1 1 0 8 0 pfqueue 320 1 0 1 1 1 0 1 0 8 0 pfstitem 24 47 0 14 1 0 1 1 0 8 0 pfstkey 128 47 0 14 2 0 2 2 0 8 0 pfstate 448 47 0 14 5 0 5 5 0 8 0 pfrule 1360 23 0 18 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 467 0 8 29 0 29 29 0 8 0 art_table 40 468 0 8 5 0 5 5 0 8 0 art_node 32 117 0 15 1 0 1 1 0 8 0 semapl 72 23 0 13 1 0 1 1 0 8 0 shmpl 112 9 0 0 1 0 1 1 0 8 0 dirhash 1024 23 0 6 3 0 3 3 0 8 0 dino2pl 256 2050 0 576 93 0 93 93 0 8 0 ffsino 296 2050 0 576 114 0 114 114 0 8 0 nchpl 144 2569 0 862 64 0 64 64 0 8 0 vnodes 216 2448 0 0 136 0 136 136 0 8 0 namei 1024 8864 0 8864 2 1 1 2 0 8 1 percpumem 16 60 0 9 1 0 1 1 0 8 0 kstatmem 264 41 0 14 3 1 2 3 0 8 0 scsiplug 72 2 0 2 1 1 0 1 0 8 0 scxspl 216 9028 0 9028 11 3 8 8 1 8 8 plimitpl 152 161 0 145 1 0 1 1 0 8 0 sigapl 424 713 0 672 7 1 6 7 0 8 0 knotepl 120 405 0 0 13 0 13 13 0 8 0 kqueuepl 224 96 0 86 1 0 1 1 0 8 0 pipepl 344 188 0 160 6 3 3 6 0 8 0 fdescpl 528 697 0 672 3 0 3 3 0 8 0 filepl 160 3743 0 3523 17 5 12 16 0 8 2 lockfpl 104 399 0 397 2 1 1 2 0 8 0 lockfspl 48 83 0 81 1 0 1 1 0 8 0 sessionpl 144 35 0 26 1 0 1 1 0 8 0 pgrppl 48 51 0 34 1 0 1 1 0 8 0 ucredpl 104 350 0 337 1 0 1 1 0 8 0 zombiepl 144 672 0 672 1 0 1 1 0 8 1 processpl 1232 713 0 672 5 1 4 5 0 8 0 procpl 664 1199 0 1152 6 0 6 6 0 8 0 sockpl 752 803 0 775 14 10 4 10 0 8 1 mcl64k 65536 5 0 0 1 0 1 1 0 8 0 mcl16k 16384 1 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl9k128 9344 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 128 0 0 16 0 16 16 0 8 0 mcl2k2 2112 2 0 0 1 0 1 1 0 8 0 mcl2k 2048 23 0 0 3 0 3 3 0 8 0 mextrefs 64 27 0 0 1 0 1 1 0 8 0 mtagpl 96 40 0 0 1 0 1 1 0 8 0 mbufpl 256 223 0 0 14 0 14 14 0 8 0 bufpl 272 3031 0 106 195 0 195 195 0 8 0 anonpl 32 5630 0 0 46 0 46 46 0 247 0 amapchunkpl 152 16132 0 15760 29 3 26 28 0 158 6 amappl16 200 830 0 803 4 1 3 3 0 8 0 amappl15 192 13 0 13 1 1 0 1 0 8 0 amappl14 184 443 0 442 1 0 1 1 0 8 0 amappl13 176 123 0 111 1 0 1 1 0 8 0 amappl12 168 945 0 921 2 0 2 2 0 8 0 amappl11 160 2 0 2 1 1 0 1 0 8 0 amappl10 152 66 0 52 1 0 1 1 0 8 0 amappl9 144 275 0 274 1 0 1 1 0 8 0 amappl8 136 122 0 120 1 0 1 1 0 8 0 amappl7 128 151 0 138 1 0 1 1 0 8 0 amappl6 120 154 0 154 1 1 0 1 0 8 0 amappl5 112 93 0 83 1 0 1 1 0 8 0 amappl4 104 293 0 273 1 0 1 1 0 8 0 amappl3 96 3294 0 3208 4 0 4 4 0 8 0 amappl2 88 543 0 481 2 0 2 2 0 8 0 amappl1 80 11536 0 10960 15 2 13 15 0 8 0 amappl 88 4736 0 4604 5 0 5 5 0 92 0 uvmvnodes 80 104 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 254 0 254 2 2 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 11 0 0 1 0 1 1 0 8 0 uaddrrnd 24 697 0 672 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 697 0 672 1 0 1 1 0 8 0 vmmpekpl 168 7704 0 7662 3 0 3 3 0 8 0 vmmpepl 168 51471 0 49832 87 0 87 87 0 357 5 vmsppl 488 696 0 672 5 1 4 5 0 8 0 rwobjpl 80 16389 0 15392 23 0 23 23 0 8 0 pdppl 4096 1401 0 1344 99 34 65 83 0 8 8 pvpl 32 12220 0 0 99 0 99 99 0 265 0 pmappl 256 696 0 672 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 479 0 45 13 0 13 13 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace malloc(10,7f,1) at malloc+0x855 sys/kern/kern_malloc.c:294 dofilewritev(ffff80002a222010,f8,ffff80002a2e6cc8,0,ffff80002a2e6d80) at dofilewritev+0x24f sys/kern/sys_generic.c:-1 sys_write(ffff80002a222010,ffff80002a2e6e30,ffff80002a2e6d80) at sys_write+0xa2 sys/kern/sys_generic.c:300 syscall(ffff80002a2e6e30) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a2e6e30) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79c44d79c010, count: -5 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 pagezero() at pagezero+0x33 end trace frame: 0x0, count: -4