g íàŸ2tj" e kernel: page fault trap, code=0 Stopped at rtable_satoplen+0x150: movzbl 0xffffffffffffffff(%r13),%r12d ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic kernel page fault uvm_fault(0xffffffff824fdf28, 0xffff800000b6b074, 0, 1) -> e rtable_satoplen(2,ffff800000b6af78) at rtable_satoplen+0x150 sys/net/rtable.c:894 end trace frame: 0xffff800014916870, count: 0 ddb> trace rtable_satoplen(2,ffff800000b6af78) at rtable_satoplen+0x150 sys/net/rtable.c:894 rtable_lookup(0,fffffd800534f720,ffff800000b6af78,ffff800000b6af58,4) at rtable_lookup+0xe0 sys/net/rtable.c:391 rtrequest_delete(ffff800014916910,4,ffff800000ae8800,ffff8000149169e0,0) at rtrequest_delete+0xe3 sys/net/route.c:775 rt_ifa_del(ffff800000b6af00,800100,ffff800000b6af58,0) at rt_ifa_del+0x3c3 sys/net/route.c:1191 in_purgeaddr(ffff800000b6af00) at in_purgeaddr+0xc6 in_remove_prefix sys/netinet/in.c:738 [inline] in_purgeaddr(ffff800000b6af00) at in_purgeaddr+0xc6 in_ifscrub sys/netinet/in.c:562 [inline] in_purgeaddr(ffff800000b6af00) at in_purgeaddr+0xc6 sys/netinet/in.c:678 in_ifinit(ffff800000ae8800,ffff800000b6af00,ffff800014916d60,1) at in_ifinit+0x234 sys/netinet/in.c:664 in_ioctl_change_ifaddr(8040691a,ffff800014916d50,ffff800000ae8800,1) at in_ioctl_change_ifaddr+0x5de sys/netinet/in.c:452 in_ioctl(8040691a,ffff800014916d50,ffff800000ae8800,1) at in_ioctl+0x205 sys/netinet/in.c:234 ifioctl(fffffd802d8fd790,8040691a,ffff800014916d50,ffff8000159489f8) at ifioctl+0xb34 sys/net/if.c:2202 sys_ioctl(ffff8000159489f8,ffff800014916e68,ffff800014916eb0) at sys_ioctl+0x5b9 syscall(ffff800014916f30) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555 Xsyscall(6,0,ffffffffffffff36,0,3,1905a604010) at Xsyscall+0x128 end of kernel end trace frame: 0x192e3821a80, count: -12 ddb> show registers rdi 0 rsi 0xfd rbp 0xffff8000149167d0 rbx 0xffffffffffffff07 rdx 0xffff800000b6af7c rcx 0xffff800000b6b075 rax 0xffff800000b6b075 r8 0x4 r9 0x5 r10 0x3fc30ee699201d9 r11 0x4cdb1d9a3613063f r12 0 r13 0xffff800000b6b075 r14 0xffffffff82480ed8 inetdomain r15 0x4 rip 0xffffffff818195e0 rtable_satoplen+0x150 cs 0x8 rflags 0x10283 __ALIGN_SIZE+0xf283 rsp 0xffff800014916780 ss 0x10 rtable_satoplen+0x150: movzbl 0xffffffffffffffff(%r13),%r12d ddb> show proc PROC (syz-executor.1) pid=63641 stat=onproc flags process=0 proc=4000000 pri=56, usrpri=56, nice=20 forw=0xffffffffffffffff, list=0xffff800015949650,0xffffffff8255d430 process=0xffff8000148a2d98 user=0xffff800014911000, vmspace=0xfffffd803f013550 estcpu=36, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 54926 134116 22781 0 2 0 syz-executor.1 *54926 63641 22781 0 7 0x4000000 syz-executor.1 22781 44067 5296 0 3 0x82 nanosleep syz-executor.1 7824 84923 0 0 3 0x14200 acct acct 68016 13431 5296 0 3 0x82 piperd syz-executor.0 74412 285349 0 0 3 0x14200 bored sosplice 5296 393442 77722 0 3 0x82 thrsleep syz-fuzzer 5296 455467 77722 0 3 0x4000082 nanosleep syz-fuzzer 5296 192517 77722 0 3 0x4000082 thrsleep syz-fuzzer 5296 61447 77722 0 3 0x4000082 thrsleep syz-fuzzer 5296 419864 77722 0 3 0x4000082 thrsleep syz-fuzzer 5296 123990 77722 0 3 0x4000082 thrsleep syz-fuzzer 5296 40389 77722 0 3 0x4000082 thrsleep syz-fuzzer 5296 234682 77722 0 2 0x4000002 syz-fuzzer 77722 49266 94583 0 3 0x10008a pause ksh 94583 450178 64892 0 3 0x92 select sshd 83017 244309 1 0 3 0x100083 ttyin getty 64892 472062 1 0 3 0x80 select sshd 43002 167613 31228 73 3 0x100090 kqread syslogd 31228 324651 1 0 3 0x100082 netio syslogd 60605 320248 1 77 3 0x100090 poll dhclient 27646 442948 1 0 3 0x80 poll dhclient 82037 7738 0 0 2 0x14200 zerothread 92025 399679 0 0 3 0x14200 aiodoned aiodoned 70702 14912 0 0 3 0x14200 syncer update 67300 143579 0 0 3 0x14200 cleaner cleaner 46839 155709 0 0 3 0x14200 reaper reaper 48461 174433 0 0 3 0x14200 pgdaemon pagedaemon 18864 330192 0 0 3 0x14200 bored crynlk 27248 311940 0 0 3 0x14200 bored crypto 88595 476847 0 0 3 0x40014200 acpi0 acpi0 62890 119620 0 0 3 0x14200 bored softnet 44658 436295 0 0 3 0x14200 bored systqmp 41384 339681 0 0 3 0x14200 bored systq 53957 143174 0 0 3 0x40014200 bored softclock 47851 397961 0 0 3 0x40014200 idle0 97375 84711 0 0 3 0x14200 bored smr 1 257700 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9568 6372K 7375K 78643K 17197 0 0 pcb 13 8K 8K 78643K 540 0 0 rtable 103 5K 6K 78643K 1767 0 0 ifaddr 83 17K 17K 78643K 471 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 0 0K 2K 78643K 156 0 0 iov 0 0K 24K 78643K 726 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1227 77K 78K 78643K 3597 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 33 0 0 VM map 26 6K 6K 78643K 48 0 0 sem 12 0K 1K 78643K 1044 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1793 195K 288K 78643K 12645 0 0 file desc 5 13K 25K 78643K 2682 0 0 sigio 0 0K 0K 78643K 56 0 0 proc 49 38K 63K 78643K 992 0 0 subproc 32 2K 2K 78643K 189 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 3144 0 0 in_multi 25 1K 2K 78643K 279 0 0 ether_multi 1 0K 0K 78643K 25 0 0 mrt 0 0K 0K 78643K 12 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 78 344K 344K 78643K 78 0 0 exec 0 0K 1K 78643K 653 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 135 201K 202K 78643K 7408 0 0 UVM aobj 130 4K 4K 78643K 139 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 0K 78643K 583 0 0 NDP 22 0K 0K 78643K 147 0 0 temp 226 3544K 4184K 78643K 94331 0 0 kqueue 0 0K 0K 78643K 26 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 60 0 56 1 0 1 1 0 8 0 rtpcb 80 380 0 378 1 0 1 1 0 8 0 rtentry 112 317 0 280 2 0 2 2 0 8 0 unpcb 120 4275 0 4266 6 5 1 2 0 8 0 syncache 264 12 0 12 7 6 1 1 0 8 1 tcpqe 32 321 0 321 5 4 1 1 0 8 1 tcpcb 544 3695 0 3690 9 8 1 2 0 8 0 ipq 40 20 0 20 7 7 0 1 0 8 0 ipqe 40 370 0 370 7 7 0 1 0 8 0 inpcb 280 5627 0 5618 7 5 2 3 0 8 1 rttmr 72 6 0 5 1 0 1 1 0 8 0 ip6q 72 2 0 2 2 2 0 1 0 8 0 ip6af 40 6 0 6 2 2 0 1 0 8 0 nd6 48 33 0 31 2 1 1 1 0 8 0 pkpcb 40 11 0 11 3 3 0 1 0 8 0 swfcl 56 5 0 0 1 0 1 1 0 8 0 ppxss 1128 56 0 56 7 6 1 1 0 8 1 art_heap8 4096 15 0 13 6 3 3 3 0 8 1 art_heap4 256 1161 0 959 21 7 14 16 0 8 1 art_table 32 1176 0 972 4 2 2 3 0 8 0 art_node 16 314 0 280 1 0 1 1 0 8 0 sysvmsgpl 40 28 0 16 1 0 1 1 0 8 0 semupl 112 3 0 3 2 2 0 1 0 8 0 semapl 112 1040 0 1030 1 0 1 1 0 8 0 shmpl 112 137 0 9 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 5737 0 4334 46 0 46 46 0 8 0 ffsino 240 5737 0 4334 83 0 83 83 0 8 0 nchpl 144 10841 0 10394 60 41 19 60 0 8 0 uvmvnodes 72 6333 0 0 116 0 116 116 0 8 0 vnodes 208 6333 0 0 334 0 334 334 0 8 0 namei 1024 35485 0 35485 1 0 1 1 0 8 1 vcpupl 1984 24 0 0 3 0 3 3 0 8 0 vmpool 520 46 0 22 2 0 2 2 0 8 0 scsiplug 64 6 0 6 3 3 0 1 0 8 0 scxspl 192 33844 0 33844 23 21 2 7 0 8 2 plimitpl 152 244 0 237 1 0 1 1 0 8 0 sigapl 432 2826 0 2813 2 0 2 2 0 8 0 futexpl 56 87681 0 87681 1 0 1 1 0 8 1 knotepl 112 629 0 610 1 0 1 1 0 8 0 kqueuepl 104 711 0 709 1 0 1 1 0 8 0 pipepl 112 3130 0 3111 9 7 2 2 0 8 1 fdescpl 424 2827 0 2813 2 0 2 2 0 8 0 filepl 120 30307 0 30210 14 10 4 6 0 8 1 lockfpl 104 1105 0 1104 1 0 1 1 0 8 0 lockfspl 48 381 0 380 1 0 1 1 0 8 0 sessionpl 112 26 0 16 1 0 1 1 0 8 0 pgrppl 48 42 0 32 1 0 1 1 0 8 0 ucredpl 96 3084 0 3077 1 0 1 1 0 8 0 zombiepl 144 2813 0 2813 1 0 1 1 0 8 1 processpl 864 2843 0 2813 4 0 4 4 0 8 0 procpl 632 6179 0 6141 5 1 4 5 0 8 0 sosppl 128 56 0 56 11 11 0 1 0 8 0 sockpl 384 10347 0 10327 18 14 4 7 0 8 1 mcl64k 65536 1167 0 1167 95 94 1 33 0 8 1 mcl16k 16384 41 0 41 9 8 1 1 0 8 1 mcl12k 12288 106 0 106 3 2 1 1 0 8 1 mcl9k 9216 66 0 66 6 5 1 1 0 8 1 mcl8k 8192 144 0 144 3 2 1 1 0 8 1 mcl4k 4096 345 0 345 2 1 1 1 0 8 1 mcl2k2 2112 24 0 24 8 7 1 1 0 8 1 mcl2k 2048 73488 0 73442 19 12 7 15 0 8 0 mtagpl 80 190 0 184 3 2 1 2 0 8 0 mbufpl 256 147439 0 147336 91 79 12 40 0 8 2 bufpl 256 18833 0 12500 396 0 396 396 0 8 0 anonpl 16 354840 0 339771 158 64 94 109 0 62 9 amapchunkpl 152 13565 0 13456 41 35 6 15 0 158 0 amappl16 192 18364 0 17225 154 86 68 79 0 8 8 amappl15 184 3 0 2 1 0 1 1 0 8 0 amappl14 176 720 0 716 1 0 1 1 0 8 0 amappl13 168 435 0 433 1 0 1 1 0 8 0 amappl12 160 550 0 545 1 0 1 1 0 8 0 amappl11 152 119 0 108 1 0 1 1 0 8 0 amappl10 144 30 0 29 4 3 1 1 0 8 0 amappl9 136 1575 0 1568 1 0 1 1 0 8 0 amappl8 128 1128 0 1094 2 0 2 2 0 8 0 amappl7 120 74 0 69 1 0 1 1 0 8 0 amappl6 112 109 0 98 1 0 1 1 0 8 0 amappl5 104 941 0 930 1 0 1 1 0 8 0 amappl4 96 3016 0 2989 1 0 1 1 0 8 0 amappl3 88 443 0 433 1 0 1 1 0 8 0 amappl2 80 21740 0 21672 3 1 2 3 0 8 0 amappl1 72 59775 0 59370 26 17 9 20 0 8 0 amappl 80 6576 0 6527 2 0 2 2 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 138 0 9 3 0 3 3 0 8 0 uaddrrnd 24 2873 0 2813 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 2873 0 2813 1 0 1 1 0 8 0 vmmpekpl 168 23851 0 23816 2 0 2 2 0 8 0 vmmpepl 168 346321 0 344051 245 102 143 143 0 357 39 vmsppl 272 2826 0 2813 2 1 1 2 0 8 0 pdppl 4096 5752 0 5694 9 1 8 8 0 8 0 pvpl 32 909339 0 891624 332 100 232 258 0 265 46 pmappl 200 2872 0 2835 4 1 3 3 0 8 1 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 751 0 218 17 1 16 16 0 8 0