kernel: protection fault trap, code=0 Stopped at malloc+0x855: movq 0x8(%rbx),%r14 ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic the kernel did not panic ddb{1}> show kasan No such command ddb{1}> trace malloc(8,7f,1) at malloc+0x855 sys/kern/kern_malloc.c:294 ktrsyscall(ffff80002a2227d8,2,0,ffff80002a2ae790) at ktrsyscall+0x19a sys/kern/kern_ktrace.c:174 syscall(ffff80002a2ae790) at syscall+0x305 mi_syscall sys/sys/syscall_mi.h:154 [inline] syscall(ffff80002a2ae790) at syscall+0x305 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79d47d000a20, count: -4 ddb{1}> show registers rdi 0x55cc5c9627014e26 rsi 0xffffffff rbp 0xffff80002a2ae5d0 rbx 0x55cc5c96d8feb1d9 rdx 0 rcx 0xffff80002a2227d8 rax 0xffff80002999dff0 r8 0 r9 0 r10 0 r11 0x8e65ad6b64ee1c8b r12 0xffffffff r13 0xffffffff83a21ef0 kmemstats+0x1fc0 r14 0xa30c333 __kernel_phys_end+0x670c333 r15 0x55cc5c9627014e26 rip 0xffffffff81c49aa5 malloc+0x855 cs 0x8 rflags 0x10202 __ALIGN_SIZE+0xf202 rsp 0xffff80002a2ae510 ss 0x10 malloc+0x855: movq 0x8(%rbx),%r14 ddb{1}> show proc PROC (syz-executor) tid=376955 pid=6981 tcnt=1 stat=onproc flags process=2 proc=1 runpri=50, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045ffd9f8,0xffff80002a222a80 process=0xffff80002a227500 user=0xffff80002a2a9000, vmspace=0xfffffc806e1f1b80 estcpu=36, cpticks=35, pctcpu=0.23, user=0, sys=35, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 9262 141815 1079 0 2 0 0 syz-executor 9262 323677 1079 0 2 0 0x4000000 syz-executor 32067 203147 77182 0 2 0 0 syz-executor 32067 10754 77182 0 3 0 0x4000080 netcon syz-executor 45058 242810 80795 0 2 0x4000000 0 syz-executor 45058 502402 80795 0 3 0x4000000 0x4000080 fsleep syz-executor 9840 74285 76176 0 2 0 0xc80 syz-executor 9840 403580 76176 0 3 0 0x4000080 lockf syz-executor 9840 220787 76176 0 3 0 0x4000000 smrbar syz-executor 9840 346513 76176 0 3 0 0x4000080 fsleep syz-executor 40086 459811 28693 0 3 0 0x80 nanoslp syz-executor 40086 161043 28693 0 3 0 0x4000080 kqread syz-executor 40086 25468 28693 0 3 0 0x4000080 kqread syz-executor 40086 152329 28693 0 3 0 0x4000080 fsleep syz-executor 41800 22096 1 0 3 0x100003 0x80 ttyin getty 58333 14669 36695 0 3 0x100002 0x80 sbwait ndp 36695 431998 89724 0 3 0x100002 0x88 sigsusp sh 20840 222968 6630 0 3 0x2 0 biowait syz-executor 1079 453207 6630 0 7 0x2 0x1 syz-executor 77182 322873 6630 0 3 0x2 0x80 nanoslp syz-executor 28693 494436 6630 0 3 0x2 0x80 nanoslp syz-executor 76176 237454 6630 0 3 0x2 0x80 nanoslp syz-executor 89724 262077 6630 0 3 0x2 0x80 wait syz-executor 80795 172354 6630 0 3 0x2 0x80 nanoslp syz-executor * 6981 376955 6630 0 7 0x2 0x1 syz-executor 6630 107115 98223 0 2 0x2 0 syz-executor 98223 476069 38787 0 3 0x100002 0x88 sigsusp ksh 38787 14409 37454 0 3 0x10 0x88 kqread sshd-session 37454 330532 88092 0 3 0x12 0x80 kqread sshd-session 88092 520725 1 0 3 0 0x88 kqread sshd 347 29353 93525 74 3 0x1100012 0x80 bpf pflogd 93525 59274 1 0 3 0 0x80 sbwait pflogd 61417 390319 58391 73 3 0x1100010 0x80 kqread syslogd 58391 490398 1 0 3 0x100002 0x80 sbwait syslogd 75411 279646 1 0 3 0x100000 0x80 kqread resolvd 76522 100327 27347 77 3 0x100012 0x80 kqread dhcpleased 19686 266053 27347 77 3 0x100012 0x80 kqread dhcpleased 27347 300838 1 0 3 0 0x80 kqread dhcpleased 61131 146886 0 0 2 0x14000 0x40000200 smr 52974 385587 0 0 2 0x14000 0x200 zerothread 94193 178334 0 0 3 0x14000 0x200 aiodoned aiodoned 15890 100594 0 0 3 0x14000 0x200 syncer update 28959 469494 0 0 3 0x14000 0x200 cleaner cleaner 60846 343708 0 0 3 0x14000 0x200 reaper reaper 79336 392358 0 0 3 0x14000 0x200 pgdaemon pagedaemon 94500 299206 0 0 3 0x14000 0x200 bored viomb 12628 57552 0 0 3 0x14000 0x40000200 acpi0 acpi0 7661 419083 0 0 3 0x14000 0x40000200 idle1 14879 76902 0 0 3 0x14000 0x200 bored softnet1 40573 222959 0 0 3 0x14000 0x200 bored softnet0 73522 320517 0 0 3 0x14000 0x200 bored systqmp 13692 78972 0 0 3 0x14000 0x200 bored systq 55756 365519 0 0 3 0x14000 0x200 tmoslp softclockmp 20051 11277 0 0 3 0x14000 0x40000200 tmoslp softclock 50737 127758 0 0 3 0x14000 0x40000200 idle0 1 153243 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks CPU 1: exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff8392daa8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487 #2 malloc+0x2ef sys/kern/kern_malloc.c:200 #3 ktrsyscall+0x19a sys/kern/kern_ktrace.c:174 #4 syscall+0x305 mi_syscall sys/sys/syscall_mi.h:154 [inline] #4 syscall+0x305 sys/arch/amd64/amd64/trap.c:783 #5 Xsyscall+0x128 Process 20840 (syz-executor) thread 0xffff800045ff2d10 (222968) exclusive rrwlock inode r = 0 (0xfffffc806d0be310) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline] #4 ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:150 #5 ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232 #6 ffs_inode_alloc+0x279 sys/ufs/ffs/ffs_alloc.c:393 #7 ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 #8 VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 #9 domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 #10 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #10 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #11 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffc806d0beea0) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576 #5 vfs_lookup+0x12b sys/kern/vfs_lookup.c:431 #6 namei+0x7c5 sys/kern/vfs_lookup.c:250 #7 domkdirat+0x8b sys/kern/vfs_syscalls.c:3048 #8 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #9 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11068 12094K 12363K 166960K 12550 0 pcb 17 16K 21K 166960K 208 0 rtable 249 9K 9K 166960K 446 0 pf 43 19K 26K 166960K 181 0 ifaddr 46 8K 8K 166960K 60 0 ifgroup 62 2K 2K 166960K 83 0 sysctl 4 1K 9K 166960K 14 0 counters 80 37K 37K 166960K 110 0 ioctlops 0 0K 4K 166960K 1555 0 iov 0 0K 12K 166960K 8 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1296 82K 82K 166960K 1618 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 8 0K 0K 166960K 13 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 17 61K 89K 166960K 548 0 sigio 0 0K 0K 166960K 2 0 proc 72 115K 164K 166960K 591 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 31 0 in_multi 102 7K 7K 166960K 106 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 15 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 67 307K 307K 166960K 67 0 exec 0 0K 1K 166960K 412 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 230 169K 176K 166960K 6328 0 UVM aobj 70 3K 3K 166960K 70 0 pinsyscall 43 86K 105K 166960K 1708 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 13 0 NDP 14 0K 2K 166960K 39 0 temp 41 9115K 9122K 166960K 29754 0 kqueue 16 26K 28K 166960K 79 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 91 0 87 1 0 1 1 0 8 0 rtentry 176 129 0 20 6 0 6 6 0 8 0 unpcb 144 272 0 255 6 0 6 6 0 8 5 syncache 336 4 0 4 1 1 0 1 0 8 0 tcpcb 736 68 0 62 1 0 1 1 0 8 0 arp 136 21 0 2 1 0 1 1 0 8 0 inpcb 328 473 0 461 12 3 9 12 0 8 7 nd6 152 33 0 2 2 0 2 2 0 8 0 pkpcb 40 1 0 1 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 19 0 14 1 0 1 1 0 8 0 pfstscr 40 8 0 8 1 0 1 1 0 8 1 pffrag 232 1 0 0 1 0 1 1 0 482 0 pffrnode 88 1 0 0 1 0 1 1 0 8 0 pffrent 40 2 0 1 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfsrclim 320 1 0 1 1 1 0 1 0 8 0 pfanchor 1288 5 0 0 1 0 1 1 0 8 0 pfstitem 24 41 0 1 1 0 1 1 0 8 0 pfstkey 128 47 0 7 2 0 2 2 0 8 0 pfstate 448 44 0 5 5 0 5 5 0 8 0 pfrule 1360 41 0 36 2 1 1 2 0 8 0 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 565 0 75 32 1 31 32 0 8 0 art_table 40 567 0 75 6 0 6 6 0 8 0 art_node 32 129 0 30 1 0 1 1 0 8 0 sysvmsgpl 40 2 0 2 1 0 1 1 0 8 1 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 72 10 0 4 1 0 1 1 0 8 0 shmpl 112 67 0 0 2 0 2 2 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 2245 0 775 93 0 93 93 0 8 0 ffsino 296 2245 0 775 114 0 114 114 0 8 0 nchpl 144 2948 0 1244 64 0 64 64 0 8 0 rtmask 32 8 0 5 1 0 1 1 0 8 0 vnodes 216 2493 0 0 139 0 139 139 0 8 0 namei 1024 9063 0 9062 2 1 1 2 0 8 0 percpumem 16 71 0 15 1 0 1 1 0 8 0 kstatmem 264 49 0 18 3 0 3 3 0 8 0 scsiplug 72 1 0 1 1 0 1 1 0 8 1 scxspl 216 10226 0 10225 5 2 3 3 1 8 2 plimitpl 152 55 0 38 1 0 1 1 0 8 0 sigapl 424 866 0 819 7 1 6 7 0 8 0 knotepl 120 659 0 0 20 0 20 20 0 8 0 kqueuepl 224 125 0 113 2 0 2 2 0 8 1 pipepl 344 162 0 135 3 0 3 3 0 8 0 fdescpl 528 850 0 819 3 0 3 3 0 8 0 filepl 160 3772 0 3548 15 0 15 15 0 8 5 lockfpl 104 254 0 246 1 0 1 1 0 8 0 lockfspl 48 123 0 117 1 0 1 1 0 8 0 sessionpl 144 35 0 26 1 0 1 1 0 8 0 pgrppl 48 46 0 29 1 0 1 1 0 8 0 ucredpl 104 392 0 379 1 0 1 1 0 8 0 zombiepl 144 819 0 819 1 0 1 1 0 8 1 processpl 1232 866 0 819 5 0 5 5 0 8 0 procpl 664 1426 0 1370 6 0 6 6 0 8 0 sockpl 752 846 0 813 22 10 12 17 0 8 7 sockpl: pool(0xffffffff83a0dbe8:sockpl): free list modified: page 0xffff800001666000; item ordinal 6; addr 0xffff800001666088 (p 0xffff800001666000); offset 0x0=0x3 pool(sockpl): free list modified: page 0xffff800001666000; item ordinal 6; addr 0xffff800001666088 (p 0xffff800001666000); offset 0x0=0x3 mcl64k 65536 8 0 0 1 0 1 1 0 8 0 mcl16k 16384 5 0 0 1 0 1 1 0 8 0 mcl12k 12288 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 120 0 0 15 0 15 15 0 8 0 mcl2k2 2112 2 0 0 1 0 1 1 0 8 0 mcl2k 2048 39 0 0 5 0 5 5 0 8 0 mextrefs 64 36 0 0 1 0 1 1 0 8 0 mtagpl 96 14 0 0 1 0 1 1 0 8 0 mbufpl 256 223 0 0 14 0 14 14 0 8 0 bufpl 272 3293 0 106 213 0 213 213 0 8 0 anonpl 32 5593 0 0 46 0 46 46 0 247 0 amapchunkpl 152 20308 0 19820 28 0 28 28 0 158 5 amappl16 200 2218 0 2187 6 3 3 5 0 8 0 amappl15 192 4 0 4 1 1 0 1 0 8 0 amappl14 184 427 0 425 1 0 1 1 0 8 0 amappl13 176 124 0 111 1 0 1 1 0 8 0 amappl12 168 1100 0 1070 2 0 2 2 0 8 0 amappl11 160 4 0 4 1 1 0 1 0 8 0 amappl10 152 133 0 119 1 0 1 1 0 8 0 amappl9 144 275 0 275 1 1 0 1 0 8 0 amappl8 136 99 0 96 1 0 1 1 0 8 0 amappl7 128 149 0 134 1 0 1 1 0 8 0 amappl6 120 158 0 156 1 0 1 1 0 8 0 amappl5 112 99 0 89 1 0 1 1 0 8 0 amappl4 104 313 0 293 1 0 1 1 0 8 0 amappl3 96 4143 0 4041 4 0 4 4 0 8 1 amappl2 88 548 0 484 2 0 2 2 0 8 0 amappl1 80 12125 0 11495 15 1 14 15 0 8 0 amappl 88 5575 0 5422 5 0 5 5 0 92 0 uvmvnodes 80 109 0 0 3 0 3 3 0 8 0 dma8192 8192 1 0 1 1 0 1 1 0 8 1 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 20 0 19 1 0 1 1 0 8 0 aobjpl 72 69 0 0 2 0 2 2 0 8 0 uaddrrnd 24 850 0 819 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 850 0 819 1 0 1 1 0 8 0 vmmpekpl 168 8365 0 8327 2 0 2 2 0 8 0 vmmpepl 168 60397 0 58502 88 0 88 88 0 357 0 vmsppl 488 849 0 819 5 0 5 5 0 8 0 rwobjpl 80 18828 0 17687 25 0 25 25 0 8 0 pdppl 4096 1707 0 1638 93 20 73 83 0 8 4 pvpl 32 13978 0 0 113 0 113 113 0 265 0 pmappl 256 849 0 819 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 491 0 26 14 0 14 14 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp ddb{0}> trace x86_ipi_db(ffffffff83922ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 mtx_enter(ffffffff8392da98) at mtx_enter+0x377 sys/kern/kern_lock.c:454 malloc(28,7f,1) at malloc+0x2ef sys/kern/kern_malloc.c:200 ktrsyscall(ffff800045ff2fa8,b,20,ffff80002a362ae0) at ktrsyscall+0x19a sys/kern/kern_ktrace.c:174 syscall(ffff80002a362ae0) at syscall+0x305 mi_syscall sys/sys/syscall_mi.h:154 [inline] syscall(ffff80002a362ae0) at syscall+0x305 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x754114a082f0, count: -8 ddb{0}> machine ddbcpu 1 Stopped at malloc+0x855: movq 0x8(%rbx),%r14 ddb{1}> trace malloc(8,7f,1) at malloc+0x855 sys/kern/kern_malloc.c:294 ktrsyscall(ffff80002a2227d8,2,0,ffff80002a2ae790) at ktrsyscall+0x19a sys/kern/kern_ktrace.c:174 syscall(ffff80002a2ae790) at syscall+0x305 mi_syscall sys/sys/syscall_mi.h:154 [inline] syscall(ffff80002a2ae790) at syscall+0x305 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x79d47d000a20, count: -4