uvm_fault(0xfffff4006fa3b7a8, 0x0, 0, 1) -> e kernel: page fault trap, code=0 Stopped at sys_shmat+0x453: movq 0(%r15),%rdi TID PID UID PRFLAGS PFLAGS CPU COMMAND 381683 33688 0 0 0 1 syz-executor *390254 6494 0 0 0x4000000 0K syz-executor sys_shmat(ffff80003c402fb8,ffff800038fa3140,ffff800038fa3090) at sys_shmat+0x453 sys/kern/sysv_shm.c:290 syscall(ffff800038fa3140) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800038fa3140) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x727cd37d9b0, count: 12 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: uvm_fault(0xfffff4006fa3b7a8, 0x0, 0, 1) -> e ddb{0}> trace sys_shmat(ffff80003c402fb8,ffff800038fa3140,ffff800038fa3090) at sys_shmat+0x453 sys/kern/sysv_shm.c:290 syscall(ffff800038fa3140) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800038fa3140) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x727cd37d9b0, count: -3 ddb{0}> show registers rdi 0xffff80002f780000 rsi 0x20d rbp 0xffff800038fa3060 rbx 0xfffff40064aa7e70 rdx 0xffff80002f780000 rcx 0x1 rax 0x1 r8 0x180 r9 0xfffff400097fd478 r10 0x89e9cf813df43098 r11 0x35369beea4f64106 r12 0xffff80003c402fb8 r13 0xffff800001605010 r14 0x3 r15 0 rip 0xffffffff82007213 sys_shmat+0x453 cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff800038fa2fd0 ss 0x10 sys_shmat+0x453: movq 0(%r15),%rdi ddb{0}> show proc PROC (syz-executor) tid=390254 pid=6494 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=76, usrpri=76, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003c403a18,0xffff80003c4022d0 process=0xffff80002a37c9b8 user=0xffff800038f9e000, vmspace=0xfffff4006fa3b7a8 estcpu=26, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 47118 62215 52078 0 2 0 syz-executor 7306 425101 54558 0 3 0x80 nanoslp syz-executor 7306 483724 54558 0 3 0x4000000 inode syz-executor 7306 269741 54558 0 2 0x4000000 syz-executor 33688 381683 83962 0 7 0 syz-executor 33688 318311 83962 0 2 0x4000000 syz-executor 33688 291075 83962 0 3 0x4000080 fsleep syz-executor 33688 462177 83962 0 2 0x4000000 syz-executor 68542 429897 46102 0 2 0 syz-executor 68542 339859 46102 0 3 0x4000080 fsleep syz-executor 6494 90697 75102 0 2 0 syz-executor 6494 38692 75102 0 2 0x4000000 syz-executor * 6494 390254 75102 0 7 0x4000000 syz-executor 52332 437217 93639 0 2 0 syz-executor 52332 46070 93639 0 3 0x4000080 fsleep syz-executor 93795 391501 71209 0 2 0x3 syz-executor 46102 292320 71209 0 2 0x3 syz-executor 83962 246032 71209 0 2 0x3 syz-executor 15596 296523 71209 0 2 0x2 syz-executor 75102 215651 71209 0 2 0x3 syz-executor 93639 379753 71209 0 2 0x3 syz-executor 54558 214596 71209 0 2 0x3 syz-executor 52078 22617 71209 0 2 0x3 syz-executor 71209 337087 57246 0 3 0x82 kqread syz-executor 57246 222382 46820 0 3 0x10008a sigsusp ksh 46820 261241 36433 0 3 0x98 kqread sshd-session 36433 122379 70061 0 3 0x92 kqread sshd-session 24612 243741 1 0 3 0x100083 ttyin getty 70061 71926 1 0 3 0x88 kqread sshd 29841 361956 96668 74 3 0x1100092 bpf pflogd 96668 513587 1 0 3 0x80 sbwait pflogd 84802 366450 60302 73 3 0x1100090 kqread syslogd 60302 517091 1 0 3 0x100082 sbwait syslogd 75124 392275 1 0 3 0x100080 kqread resolvd 16772 77278 15153 77 3 0x100092 kqread dhcpleased 63094 89363 15153 77 3 0x100092 kqread dhcpleased 15153 3570 1 0 3 0x80 kqread dhcpleased 20336 424628 0 0 3 0x14200 bored smr 22986 307959 0 0 2 0x14200 zerothread 8934 86348 0 0 3 0x14200 aiodoned aiodoned 51899 240977 0 0 3 0x14200 syncer update 48665 491387 0 0 3 0x14200 cleaner cleaner 89681 12185 0 0 3 0x14200 reaper reaper 10676 207139 0 0 3 0x14200 pgdaemon pagedaemon 83982 242531 0 0 3 0x14200 bored viomb 28000 242942 0 0 3 0x40014200 acpi0 acpi0 13633 145206 0 0 3 0x40014200 idle1 53526 422996 0 0 3 0x14200 bored softnet1 74939 363691 0 0 3 0x14200 bored softnet0 63863 214745 0 0 3 0x14200 bored systqmp 23733 375168 0 0 3 0x14200 bored systq 87127 337467 0 0 3 0x14200 tmoslp softclockmp 74340 155227 0 0 3 0x40014200 tmoslp softclock 12927 173871 0 0 3 0x40014200 idle0 1 511666 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 7306 (syz-executor) thread 0xffff8000397b8fb0 (269741) exclusive rrwlock inode r = 0 (0xfffff4006b7c5a08) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline] #4 ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:150 #5 ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232 #6 ufs_lookup+0x16bd sys/ufs/ufs/ufs_lookup.c:573 #7 VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85 #8 vfs_lookup+0x963 sys/kern/vfs_lookup.c:580 #9 namei+0x7c5 sys/kern/vfs_lookup.c:250 #10 domknodat+0xb4 sys/kern/vfs_syscalls.c:1530 #11 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #11 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #12 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffff4006b7c5568) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576 #5 vfs_lookup+0x12b sys/kern/vfs_lookup.c:431 #6 namei+0x7c5 sys/kern/vfs_lookup.c:250 #7 domknodat+0xb4 sys/kern/vfs_syscalls.c:1530 #8 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #9 Xsyscall+0x128 Process 33688 (syz-executor) thread 0xffff80003c402a88 (318311) exclusive rwlock fdlock r = 0 (0xffff8000397aacd0) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 sys_socket+0x203 sys/kern/uipc_syscalls.c:106 #3 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #3 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #4 Xsyscall+0x128 Process 6494 (syz-executor) thread 0xffff80003c402fb8 (390254) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a04e80) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1 #2 malloc+0xe3 sys/kern/kern_malloc.c:175 #3 sys_shmat+0x9f sys/kern/sysv_shm.c:-1 #4 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #5 Xsyscall+0x128 Process 52332 (syz-executor) thread 0xffff8000397b94e0 (437217) exclusive rwlock vmmaplk r = 0 (0xfffff4006cd5ce70) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5170 #3 uvm_map_protect+0xe0 sys/uvm/uvm_map.c:3075 #4 sys_mprotect+0x351 sys/uvm/uvm_mmap.c:590 #5 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11058 12095K 12217K 166960K 12203 0 pcb 18 12K 12K 166960K 23 0 rtable 239 6K 7K 166960K 361 0 pf 34 17K 21K 166960K 53 0 ifaddr 43 7K 7K 166960K 46 0 ifgroup 55 2K 2K 166960K 57 0 sysctl 1 1K 9K 166960K 6 0 counters 70 37K 37K 166960K 72 0 ioctlops 0 0K 4K 166960K 1556 0 iov 0 0K 12K 166960K 2 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1294 81K 82K 166960K 1399 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 3 5K 5K 166960K 4 0 VM map 2 1K 1K 166960K 2 0 sem 4 0K 0K 166960K 5 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 16 57K 89K 166960K 195 0 proc 73 131K 180K 166960K 556 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 6 0 in_multi 99 7K 7K 166960K 101 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 4 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 55 254K 254K 166960K 55 0 exec 0 0K 1K 166960K 399 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 224 151K 160K 166960K 3806 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 41 82K 101K 166960K 1391 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 12 0K 2K 166960K 29 0 temp 36 9114K 9178K 166960K 6988 0 kqueue 13 20K 27K 166960K 37 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 38 0 35 1 0 1 1 0 8 0 rtentry 176 112 0 1 6 0 6 6 0 8 0 unpcb 144 115 0 98 4 0 4 4 0 8 3 syncache 336 5 0 5 2 1 1 1 0 8 1 tcpcb 736 17 0 13 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 158 0 150 7 0 7 7 0 8 6 nd6 152 25 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 1 0 1 1 0 1 1 0 8 1 pffrag 232 2 0 1 1 0 1 1 0 482 0 pffrnode 88 2 0 1 1 0 1 1 0 8 0 pffrent 40 4 0 3 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 26 0 0 1 0 1 1 0 8 0 pfstkey 128 26 0 0 1 0 1 1 0 8 0 pfstate 448 26 0 0 3 0 3 3 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 454 0 0 29 0 29 29 0 8 0 art_table 40 455 0 0 5 0 5 5 0 8 0 art_node 32 112 0 11 1 0 1 1 0 8 0 semapl 72 3 0 1 1 0 1 1 0 8 0 shmpl 112 1 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1665 0 196 93 0 93 93 0 8 0 ffsino 296 1665 0 196 114 0 114 114 0 8 0 nchpl 144 1950 0 252 64 0 64 64 0 8 0 vnodes 216 1777 0 0 99 0 99 99 0 8 0 namei 1024 6348 0 6345 3 2 1 2 0 8 0 percpumem 16 51 0 1 1 0 1 1 0 8 0 kstatmem 264 29 0 2 2 0 2 2 0 8 0 scxspl 216 6797 0 6797 4 3 1 3 1 8 1 plimitpl 152 33 0 16 1 0 1 1 0 8 0 sigapl 424 524 0 478 7 1 6 7 0 8 0 knotepl 120 103 0 0 4 0 4 4 0 8 0 kqueuepl 224 40 0 31 1 0 1 1 0 8 0 pipepl 344 134 0 106 3 0 3 3 0 8 0 fdescpl 528 508 0 478 3 0 3 3 0 8 0 filepl 160 2146 0 1931 13 0 13 13 0 8 3 lockfpl 104 106 0 104 1 0 1 1 0 8 0 lockfspl 48 49 0 47 1 0 1 1 0 8 0 sessionpl 144 24 0 15 1 0 1 1 0 8 0 pgrppl 48 32 0 15 1 0 1 1 0 8 0 ucredpl 104 149 0 135 1 0 1 1 0 8 0 zombiepl 144 519 0 519 1 0 1 1 0 8 1 processpl 1232 524 0 478 5 1 4 5 0 8 0 procpl 664 641 0 586 6 0 6 6 0 8 0 sockpl 752 315 0 287 11 1 10 10 0 8 7 mcl64k 65536 4 0 0 1 0 1 1 0 8 0 mcl16k 16384 5 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl9k128 9344 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 119 0 0 15 0 15 15 0 8 0 mcl2k 2048 18 0 0 3 0 3 3 0 8 0 mtagpl 96 1 0 0 1 0 1 1 0 8 0 mbufpl 256 145 0 0 10 0 10 10 0 8 0 bufpl 272 2490 0 106 160 1 159 159 0 8 0 anonpl 32 5376 0 0 44 0 44 44 0 247 0 amapchunkpl 152 10675 0 10230 32 0 32 32 0 158 12 amappl16 200 1842 0 1818 7 4 3 5 0 8 0 amappl15 192 6 0 5 1 0 1 1 0 8 0 amappl14 184 442 0 441 1 0 1 1 0 8 0 amappl13 176 127 0 115 1 0 1 1 0 8 0 amappl12 168 766 0 737 2 0 2 2 0 8 0 amappl11 160 4 0 4 1 1 0 1 0 8 0 amappl10 152 65 0 51 1 0 1 1 0 8 0 amappl9 144 295 0 294 1 0 1 1 0 8 0 amappl8 136 106 0 104 1 0 1 1 0 8 0 amappl7 128 149 0 136 1 0 1 1 0 8 0 amappl6 120 175 0 174 1 0 1 1 0 8 0 amappl5 112 104 0 94 1 0 1 1 0 8 0 amappl4 104 302 0 283 1 0 1 1 0 8 0 amappl3 96 1905 0 1801 4 0 4 4 0 8 0 amappl2 88 559 0 501 2 0 2 2 0 8 0 amappl1 80 10816 0 10206 14 0 14 14 0 8 1 amappl 88 3043 0 2890 5 0 5 5 0 92 1 uvmvnodes 80 103 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 3 0 0 1 0 1 1 0 8 0 uaddrrnd 24 508 0 478 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 508 0 478 1 0 1 1 0 8 0 vmmpekpl 168 6220 0 6182 2 0 2 2 0 8 0 vmmpepl 168 41926 0 40079 90 3 87 87 0 357 1 vmsppl 488 507 0 478 6 1 5 5 0 8 1 rwobjpl 80 15477 0 14455 24 0 24 24 0 8 1 pdppl 4096 1023 0 956 107 36 71 83 0 8 4 pvpl 32 11330 0 0 92 0 92 92 0 265 0 pmappl 256 507 0 478 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 441 0 43 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace sys_shmat(ffff80003c402fb8,ffff800038fa3140,ffff800038fa3090) at sys_shmat+0x453 sys/kern/sysv_shm.c:290 syscall(ffff800038fa3140) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800038fa3140) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x727cd37d9b0, count: -3 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 end of kernel end trace frame: 0x7e919c90d070, count: 12 ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 end of kernel end trace frame: 0x7e919c90d070, count: -3