login: panic: releasing active pmap 0xfffffe0094c80b10 cpuid = 0 time = 1618670520 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00978d87a0 vpanic() at vpanic+0x1c7/frame 0xfffffe00978d8800 panic() at panic+0x43/frame 0xfffffe00978d8860 pmap_release() at pmap_release+0x57d/frame 0xfffffe00978d88a0 vmspace_free() at vmspace_free+0x7c/frame 0xfffffe00978d88c0 vmspace_unshare() at vmspace_unshare+0xc2/frame 0xfffffe00978d8900 vm_forkproc() at vm_forkproc+0x85/frame 0xfffffe00978d8960 fork1() at fork1+0x537/frame 0xfffffe00978d8a30 sys_rfork() at sys_rfork+0x10d/frame 0xfffffe00978d8ab0 amd64_syscall() at amd64_syscall+0x247/frame 0xfffffe00978d8bf0 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00978d8bf0 --- syscall (198, FreeBSD ELF64, nosys), rip = 0x284e1a, rsp = 0x7fffdfffdf08, rbp = 0x7fffdfffdf70 --- KDB: enter: panic [ thread pid 4673 tid 103999 ] Stopped at kdb_enter+0x67: movq $0,0x163c4ee(%rip) db> db> set $lines = 0 db> set $maxwidth = 0 db> show registers cs 0x20 ds 0x3b es 0x3b fs 0x13 gs 0x1b ss 0x28 rax 0x12 rcx 0x80 rdx 0xffffffff819b1578 rbx 0 rsp 0xfffffe00978d8780 rbp 0xfffffe00978d87a0 rsi 0x1 rdi 0 r8 0 r9 0x8080808080808080 r10 0xfffffe00978d8670 r11 0x1ff68fff59c r12 0xffffffff82267ac0 ddb_dbbe r13 0 r14 0xffffffff81a61877 r15 0xffffffff81a61877 rip 0xffffffff8112bc17 kdb_enter+0x67 rflags 0x82 kdb_enter+0x67: movq $0,0x163c4ee(%rip) db> show proc Process 4673 (syz-executor.2) at 0xfffff8001f773000: state: NORMAL uid: 0 gids: 0, 0, 5 parent: pid 789 at 0xfffff8002e3a4000 ABI: FreeBSD ELF64 flag: 0x10000080 flag2: 0 arguments: /root/syz-executor.2 reaper: 0xfffff80004457538 reapsubtree: 1 sigparent: 20 vmspace: 0xfffffe0094d1a000 (map 0xfffffe0094d1a000) (map.pmap 0xfffffe0094d1a0c0) (pmap 0xfffffe0094d1a120) threads: 2 103995 Run CPU 1 syz-executor.2 103999 Run CPU 0 syz-executor.2 db> ps pid ppid pgrp uid state wmesg wchan cmd 4676 1 787 0 R syz-executor.0 4675 1 788 0 S uwait 0xfffff8001f6ffd00 syz-executor.1 4673 789 789 0 R (threaded) syz-executor.2 103995 Run CPU 1 syz-executor.2 103999 Run CPU 0 syz-executor.2 4670 788 788 0 R (threaded) syz-executor.1 103976 RunQ syz-executor.1 104001 S uwait 0xfffff8001f585b80 syz-executor.1 4669 787 787 0 R (threaded) syz-executor.0 103992 RunQ syz-executor.0 103998 RunQ syz-executor.0 3344 3316 3344 0 Ss select 0xfffff800044d88c0 dhclient 3329 1 3329 0 Ss select 0xfffff800046cd140 dhclient 3316 3284 436 65 S select 0xfffff800046cd1c0 dhclient 3284 436 436 0 S wait 0xfffff8002e99ea70 sh 792 785 792 0 Rs syz-executor.3 789 785 789 0 Rs syz-executor.2 788 785 788 0 Rs syz-executor.1 787 785 787 0 Rs syz-executor.0 785 783 783 0 S (threaded) syz-execprog 100116 S uwait 0xfffff80004ba1900 syz-execprog 100117 S uwait 0xfffff8002e56fb80 syz-execprog 100118 S uwait 0xfffff8002e56fc80 syz-execprog 100119 S uwait 0xfffff8002e56fd80 syz-execprog 100120 S uwait 0xfffff8002e56fe80 syz-execprog 100121 S uwait 0xfffff80004ed6000 syz-execprog 100122 S uwait 0xfffff80004ed6100 syz-execprog 100123 S kqread 0xfffff8002e3e2800 syz-execprog 100124 S uwait 0xfffff80004ba1b00 syz-execprog 100125 S uwait 0xfffff80004ba1c00 syz-execprog 783 781 783 0 Ss pause 0xfffff80004f0a5e8 csh 781 694 781 0 Ss select 0xfffff800046cd540 sshd 762 1 762 0 Ss+ ttyin 0xfffff80004866cb0 getty 761 1 761 0 Ss+ ttyin 0xfffff80004bbc0b0 getty 760 1 760 0 Ss+ ttyin 0xfffff80004bbc4b0 getty 759 1 759 0 Ss+ ttyin 0xfffff80004bbc8b0 getty 758 1 758 0 Ss+ ttyin 0xfffff80004bbccb0 getty 757 1 757 0 Ss+ ttyin 0xfffff80004b4a0b0 getty 756 1 756 0 Ss+ ttyin 0xfffff80004b4a4b0 getty 755 1 755 0 Ss+ ttyin 0xfffff80004b4a8b0 getty 754 1 754 0 Ss+ ttyin 0xfffff80004b4acb0 getty 752 1 24 0 S+ piperd 0xfffff8002e3d65d0 logger 751 750 24 0 S+ nanslp 0xffffffff8273b860 sleep 750 1 24 0 S+ wait 0xfffff80004f3b000 sh 698 1 698 0 Ss nanslp 0xffffffff8273b860 cron 694 1 694 0 Ss select 0xfffff800046cfcc0 sshd 507 1 507 0 Ss select 0xfffff800046cfac0 syslogd 436 1 436 0 Ss wait 0xfffff80004e92000 devd 435 1 435 65 Ss select 0xfffff800044d8b40 dhclient 350 1 350 0 Ss select 0xfffff800046cfe40 dhclient 347 1 347 0 Ss select 0xfffff800046d0040 dhclient 23 0 0 0 DL vlruwt 0xfffff80004b9f000 [vnlru] 22 0 0 0 DL syncer 0xffffffff8282acd0 [syncer] 21 0 0 0 DL (threaded) [bufdaemon] 100080 D qsleep 0xffffffff82829d80 [bufdaemon] 100087 D - 0xffffffff8220ae00 [bufspacedaemon-0] 100097 D sdflush 0xfffff80004dc34e8 [/ worker] 20 0 0 0 DL psleep 0xffffffff82851b88 [vmdaemon] 19 0 0 0 DL (threaded) [pagedaemon] 100078 D psleep 0xffffffff82845ff8 [dom0] 100085 D launds 0xffffffff82846004 [laundry: dom0] 100086 D umarcl 0xffffffff815b99a0 [uma] 18 0 0 0 RL [rand_harvestq] 17 0 0 0 DL waiting 0xffffffff82eb4818 [sctp_iterator] 16 0 0 0 DL pftm 0xffffffff8308b3c0 [pf purge] 15 0 0 0 DL - 0xffffffff828273dc [soaiod4] 9 0 0 0 DL - 0xffffffff828273dc [soaiod3] 8 0 0 0 DL - 0xffffffff828273dc [soaiod2] 7 0 0 0 DL - 0xffffffff828273dc [soaiod1] 6 0 0 0 DL (threaded) [cam] 100043 D - 0xffffffff824470c0 [doneq0] 100044 D - 0xffffffff82447040 [async] 100077 D - 0xffffffff82446f10 [scanner] 14 0 0 0 DL seqstat 0xfffff80004511888 [sequencer 00] 5 0 0 0 DL crypto_ 0xfffff800044ae280 [crypto returns 1] 4 0 0 0 DL crypto_ 0xfffff800044ae230 [crypto returns 0] 3 0 0 0 DL crypto_ 0xffffffff82843520 [crypto] 13 0 0 0 DL (threaded) [geom] 100034 D - 0xffffffff8271b0a0 [g_event] 100035 D - 0xffffffff8271b0a8 [g_up] 100036 D - 0xffffffff8271b0b0 [g_down] 2 0 0 0 DL (threaded) [KTLS] 100027 D - 0xfffff80004344b00 [thr_0] 100028 D - 0xfffff80004344b80 [thr_1] 12 0 0 0 WL (threaded) [intr] 100014 I [swi6: task queue] 100016 I [swi6: Giant taskq] 100018 I [swi5: fast taskq] 100029 I [swi1: netisr 0] 100030 I [swi3: vm] 100031 I [swi4: clock (0)] 100032 I [swi4: clock (1)] 100045 I [irq24: virtio_pci0] 100046 I [irq25: virtio_pci0] 100047 I [irq26: virtio_pci0] 100048 I [irq27: virtio_pci0] 100049 I [irq28: virtio_pci1] 100050 I [irq29: virtio_pci1] 100051 I [irq30: virtio_pci1] 100052 I [irq31: virtio_pci1] 100053 I [irq32: virtio_pci1] 100058 I [irq10: virtio_pci2] 100060 I [irq1: atkbd0] 100061 I [irq12: psm0] 100062 I [swi0: uart uart++] 100070 I [swi1: pf send] 100083 I [swi1: hpts] 100084 I [swi1: hpts] 11 0 0 0 RL (threaded) [idle] 100003 CanRun [idle: cpu0] 100004 CanRun [idle: cpu1] 1 0 1 0 RLs [init] 10 0 0 0 DL audit_w 0xffffffff82843a30 [audit] 0 0 0 0 DLs (threaded) [kernel] 100000 D swapin 0xffffffff8271b630 [swapper] 100005 D - 0xfffff80004089800 [softirq_0] 100006 D - 0xfffff80004089700 [softirq_1] 100007 D - 0xfffff80004089600 [if_io_tqg_0] 100008 D - 0xfffff80004089500 [if_io_tqg_1] 100009 D - 0xfffff80004089400 [if_config_tqg_0] 100010 D - 0xfffff8000434bd00 [in6m_free taskq] 100011 D - 0xfffff8000434bc00 [kqueue_ctx taskq] 100012 D - 0xfffff8000434bb00 [inm_free taskq] 100013 D - 0xfffff8000434ba00 [linuxkpi_irq_wq] 100015 D - 0xfffff8000434b800 [aiod_kick taskq] 100017 D - 0xfffff8000434b600 [thread taskq] 100019 D - 0xfffff8000434b400 [linuxkpi_short_wq_0] 100020 D - 0xfffff8000434b400 [linuxkpi_short_wq_1] 100021 D - 0xfffff8000434b400 [linuxkpi_short_wq_2] 100022 D - 0xfffff8000434b400 [linuxkpi_short_wq_3] 100023 D - 0xfffff8000434b300 [linuxkpi_long_wq_0] 100024 D - 0xfffff8000434b300 [linuxkpi_long_wq_1] 100025 D - 0xfffff8000434b300 [linuxkpi_long_wq_2] 100026 D - 0xfffff8000434b300 [linuxkpi_long_wq_3] 100033 D - 0xfffff8000434b200 [firmware taskq] 100037 D - 0xfffff8000434b100 [crypto_0] 100038 D - 0xfffff8000434b100 [crypto_1] 100054 D - 0xfffff8000469fc00 [vtnet0 rxq 0] 100055 D - 0xfffff8000469fb00 [vtnet0 txq 0] 100056 D - 0xfffff8000469fa00 [vtnet0 rxq 1] 100057 D - 0xfffff8000469f900 [vtnet0 txq 1] 100059 D vtbslp 0xfffff800046d0080 [virtio_balloon] 100063 D - 0xfffff8000469f800 [mca taskq] 100066 D - 0xffffffff81e0d2f1 [deadlkres] 100073 D - 0xfffff80004b4de00 [acpi_task_0] 100074 D - 0xfffff80004b4de00 [acpi_task_1] 100075 D - 0xfffff80004b4de00 [acpi_task_2] 100076 D - 0xfffff8000434b000 [CAM taskq] 4097 1 792 0 Z syz-executor.3 2049 1 788 0 Z syz-executor.1 4098 1 789 0 Z syz-executor.2 3075 1 792 0 Z syz-executor.3 2051 1 789 0 Z syz-executor.2 1027 1 789 0 Z syz-executor.2 4100 1 788 0 Z syz-executor.1 2052 1 789 0 Z syz-executor.2 4101 1 789 0 Z syz-executor.2 3077 1 789 0 Z syz-executor.2 2053 1 792 0 Z syz-executor.3 1029 1 788 0 Z syz-executor.1 4102 1 787 0 Z syz-executor.0 2054 1 787 0 Z syz-executor.0 1030 1 792 0 Z syz-executor.3 4103 1 787 0 Z syz-executor.0 3079 1 787 0 Z syz-executor.0 3080 1 789 0 Z syz-executor.2 1032 1 787 0 Z syz-executor.0 4105 1 787 0 Z syz-executor.0 3081 1 788 0 Z syz-executor.1 4106 1 787 0 Z syz-executor.0 2058 1 788 0 Z syz-executor.1 2059 1 792 0 Z syz-executor.3 1035 1 789 0 Z syz-executor.2 2060 1 789 0 Z syz-executor.2 1036 1 788 0 Z syz-executor.1 4109 1 788 0 Z syz-executor.1 4110 1 792 0 Z syz-executor.3 3086 1 792 0 Z syz-executor.3 4111 1 787 0 Z syz-executor.0 3087 1 789 0 Z syz-executor.2 2063 1 787 0 Z syz-executor.0 3088 1 787 0 Z syz-executor.0 2064 1 792 0 Z syz-executor.3 1041 1 792 0 Z syz-executor.3 3090 1 788 0 Z syz-executor.1 2066 1 788 0 Z syz-executor.1 1042 1 789 0 Z syz-executor.2 4115 1 787 0 Z syz-executor.0 3091 1 789 0 Z syz-executor.2 2067 1 789 0 Z syz-executor.2 4116 1 788 0 Z syz-executor.1 3092 1 788 0 Z syz-executor.1 1044 1 787 0 Z syz-executor.0 4117 1 792 0 Z syz-executor.3 4118 1 789 0 Z syz-executor.2 1046 1 787 0 Z syz-executor.0 4119 1 788 0 Z syz-executor.1 3095 1 789 0 Z syz-executor.2 2071 1 788 0 Z syz-executor.1 1047 1 792 0 Z syz-executor.3 3096 1 792 0 Z syz-executor.3 2072 1 787 0 Z syz-executor.0 1048 1 788 0 Z syz-executor.1 3097 1 787 0 Z syz-executor.0 2073 1 792 0 Z syz-executor.3 4124 1 788 0 Z syz-executor.1 2076 1 788 0 Z syz-executor.1 4125 1 789 0 Z syz-executor.2 3101 1 787 0 Z syz-executor.0 1053 1 789 0 Z syz-executor.2 4126 1 792 0 Z syz-executor.3 3102 1 788 0 Z syz-executor.1 2078 1 788 0 Z syz-executor.1 2079 1 789 0 Z syz-executor.2 1055 1 788 0 Z syz-executor.1 2080 1 792 0 Z syz-executor.3 4129 1 787 0 Z syz-executor.0 3105 1 787 0 Z syz-executor.0 1057 1 792 0 Z syz-executor.3 3106 1 788 0 Z syz-executor.1 2082 1 787 0 Z syz-executor.0 1058 1 789 0 Z syz-executor.2 4131 1 788 0 Z syz-executor.1 3107 1 788 0 Z syz-executor.1 4132 1 789 0 Z syz-executor.2 4133 1 792 0 Z syz-executor.3 3109 1 792 0 Z syz-executor.3 2085 1 792 0 Z syz-executor.3 4135 1 787 0 Z syz-executor.0 1063 1 788 0 Z syz-executor.1 3112 1 789 0 Z syz-executor.2 1064 1 792 0 Z syz-executor.3 4137 1 788 0 Z syz-executor.1 2089 1 789 0 Z syz-executor.2 2090 1 787 0 Z syz-executor.0 1066 1 787 0 Z syz-executor.0 2091 1 788 0 Z syz-executor.1 1067 1 787 0 Z syz-executor.0 2092 1 792 0 Z syz-executor.3 2093 1 787 0 Z syz-executor.0 1069 1 789 0 Z syz-executor.2 4142 1 787 0 Z syz-executor.0 4143 1 788 0 Z syz-executor.1 3119 1 787 0 Z syz-executor.0 4144 1 789 0 Z syz-executor.2 3120 1 789 0 Z syz-executor.2 4145 1 792 0 Z syz-executor.3 3121 1 788 0 Z syz-executor.1 2097 1 789 0 Z syz-executor.2 1074 1 792 0 Z syz-executor.3 2099 1 792 0 Z syz-executor.3 1075 1 788 0 Z syz-executor.1 3124 1 789 0 Z syz-executor.2 2100 1 787 0 Z syz-executor.0 1076 1 789 0 Z syz-executor.2 4149 1 788 0 Z syz-executor.1 3125 1 792 0 Z syz-executor.3 2101 1 788 0 Z syz-executor.1 1078 1 788 0 Z syz-executor.1 4151 1 787 0 Z syz-executor.0 3127 1 787 0 Z syz-executor.0 4152 1 789 0 Z syz-executor.2 3128 1 792 0 Z syz-executor.3 2104 1 792 0 Z syz-executor.3 1080 1 787 0 Z syz-executor.0 4153 1 792 0 Z syz-executor.3 1081 1 792 0 Z syz-executor.3 3131 1 789 0 Z syz-executor.2 2107 1 787 0 Z syz-executor.0 4156 1 788 0 Z syz-executor.1 3132 1 788 0 Z syz-executor.1 2108 1 789 0 Z syz-executor.2 3133 1 789 0 Z syz-executor.2 2109 1 788 0 Z syz-executor.1 4159 1 789 0 Z syz-executor.2 3135 1 789 0 Z syz-executor.2 4160 1 787 0 Z syz-executor.0 2112 1 792 0 Z syz-executor.3 1088 1 789 0 Z syz-executor.2 3137 1 792 0 Z syz-executor.3 1089 1 787 0 Z syz-executor.0 4162 1 792 0 Z syz-executor.3 2114 1 787 0 Z syz-executor.0 4163 1 788 0 Z syz-executor.1 2115 1 788 0 Z syz-executor.1 4164 1 788 0 Z syz-executor.1 2116 1 787 0 Z syz-executor.0 1092 1 788 0 Z syz-executor.1 1093 1 792 0 Z syz-executor.3 4166 1 789 0 Z syz-executor.2 3142 1 788 0 Z syz-executor.1 2118 1 789 0 Z syz-executor.2 4167 1 787 0 Z syz-executor.0 3143 1 788 0 Z syz-executor.1 1095 1 789 0 Z syz-executor.2 3144 1 792 0 Z syz-executor.3 3145 1 792 0 Z syz-executor.3 2121 1 792 0 Z syz-executor.3 4170 1 792 0 Z syz-executor.3 2122 1 788 0 Z syz-executor.1 1098 1 787 0 Z syz-executor.0 4171 1 788 0 Z syz-executor.1 1099 1 788 0 Z syz-executor.1 3148 1 787 0 Z syz-executor.0 1100 1 788 0 Z syz-executor.1 4173 1 789 0 Z syz-executor.2 3149 1 788 0 Z syz-executor.1 3150 1 789 0 Z syz-executor.2 1102 1 792 0 Z syz-executor.3 2127 1 792 0 Z syz-executor.3 1103 1 787 0 Z syz-executor.0 4176 1 789 0 Z syz-executor.2 3152 1 788 0 Z syz-executor.1 2128 1 787 0 Z syz-executor.0 2129 1 789 0 Z sy