uvm_fault(0xfffffd807eb7e8a0, 0x7f820254ba88, 0, 2) -> e kernel: page fault trap, code=2 Stopped at pmap_page_remove+0x43d: xchgq %rax,0(%r12,%rcx,1) TID PID UID PRFLAGS PFLAGS CPU COMMAND pmap_page_remove(fffffd8007081f80) at pmap_page_remove+0x43d _atomic_swap_64 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:117 [inline] pmap_page_remove(fffffd8007081f80) at pmap_page_remove+0x43d sys/arch/amd64/amd64/pmap.c:2014 uvm_anfree_list(fffffd807e9d7bb8,0) at uvm_anfree_list+0xd6 sys/uvm/uvm_anon.c:112 amap_wipeout(fffffd806ff953c0) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:-1 uvm_unmap_detach(ffff80002a813ba0,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353 uvm_map_teardown(fffffd807eb7e8a0) at uvm_map_teardown+0x357 sys/uvm/uvm_map.c:2525 exit1(ffff80002a7b87d8,43,0,1) at exit1+0x6e6 sys/kern/kern_exit.c:259 sys_exit(ffff80002a7b87d8,ffff80002a813d60,ffff80002a813cb0) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a813d60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a813d60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x753519e71af0, count: 6 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: uvm_fault(0xfffffd807eb7e8a0, 0x7f820254ba88, 0, 2) -> e ddb> trace pmap_page_remove(fffffd8007081f80) at pmap_page_remove+0x43d _atomic_swap_64 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:117 [inline] pmap_page_remove(fffffd8007081f80) at pmap_page_remove+0x43d sys/arch/amd64/amd64/pmap.c:2014 uvm_anfree_list(fffffd807e9d7bb8,0) at uvm_anfree_list+0xd6 sys/uvm/uvm_anon.c:112 amap_wipeout(fffffd806ff953c0) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:-1 uvm_unmap_detach(ffff80002a813ba0,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353 uvm_map_teardown(fffffd807eb7e8a0) at uvm_map_teardown+0x357 sys/uvm/uvm_map.c:2525 exit1(ffff80002a7b87d8,43,0,1) at exit1+0x6e6 sys/kern/kern_exit.c:259 sys_exit(ffff80002a7b87d8,ffff80002a813d60,ffff80002a813cb0) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a813d60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a813d60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x753519e71af0, count: -9 ddb> show registers rdi 0 rsi 0 rbp 0xffff80002a813aa0 rbx 0x800000007ea6a001 rdx 0 rcx 0x7f8000000000 rax 0 r8 0x404f19c7000 r9 0 r10 0x9349bbc880b7f068 r11 0xd10f0ad6812836fa r12 0x20254ba88 r13 0xfffffd806922ab50 r14 0 r15 0xfffffd8007081f80 rip 0xffffffff817bbbad pmap_page_remove+0x43d cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80002a813a10 ss 0x10 pmap_page_remove+0x43d: xchgq %rax,0(%r12,%rcx,1) ddb> show proc PROC (syz-executor) tid=404290 pid=91679 tcnt=0 stat=onproc flags process=a proc=2000 runpri=50, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1 forw=0xffffffffffffffff, list=0xffff80002a7b82a8,0xffff80002a7b9248 process=0xffff80002a7dc910 user=0xffff80002a80e000, vmspace=0xfffffd807eb7e8a0 estcpu=36, cpticks=24, pctcpu=0.0, user=0, sys=2, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 66394 166526 86537 0 2 0 syz-executor 66394 360166 86537 0 3 0x4000080 fsleep syz-executor 89126 426701 2338 0 2 0 syz-executor 89126 287883 2338 0 3 0x4000080 fsleep syz-executor 25132 155047 8547 0 3 0 vmmaplk syz-executor 25132 356786 8547 0 3 0x4000080 fifor syz-executor 25132 234975 8547 0 2 0x4000000 syz-executor 32044 453875 40484 0 2 0 syz-executor 32044 230620 40484 0 2 0x4000000 syz-executor 32044 324806 40484 0 2 0x4000000 syz-executor 32044 508465 40484 0 3 0x4000080 fsleep syz-executor 28843 102217 96385 0 2 0 syz-executor 28843 392522 96385 0 2 0x4000000 syz-executor 28843 141876 96385 0 3 0x4000080 fsleep syz-executor 28843 103498 96385 0 3 0x4000080 fsleep syz-executor 67251 46297 0 0 3 0x14200 acct acct 27395 449904 39900 0 2 0x2 syz-executor 60712 348790 1 0 3 0x100083 ttyin getty 40484 496982 39900 0 2 0x2 syz-executor 8547 296492 39900 0 2 0x2 syz-executor 20136 34273 39900 0 2 0x3 syz-executor 86537 325521 39900 0 2 0x2 syz-executor 96385 383588 39900 0 2 0x2 syz-executor 2338 451537 39900 0 2 0x2 syz-executor 39900 421738 85451 0 2 0x2 syz-executor 85451 450644 66055 0 3 0x10008a sigsusp ksh 66055 227946 56979 0 3 0x98 kqread sshd-session 56979 42443 82453 0 3 0x92 kqread sshd-session 82453 269406 1 0 3 0x88 kqread sshd 14902 343619 26784 73 3 0x1100090 kqread syslogd 26784 30252 1 0 3 0x100082 sbwait syslogd 21904 238872 1 0 3 0x100080 kqread resolvd 6885 469987 23061 77 3 0x100092 kqread dhcpleased 4937 225067 23061 77 3 0x100092 kqread dhcpleased 23061 217760 1 0 3 0x80 kqread dhcpleased 94946 154487 0 0 3 0x14200 bored smr 5185 479079 0 0 2 0x14200 zerothread 42012 269523 0 0 3 0x14200 aiodoned aiodoned 67234 392332 0 0 3 0x14200 syncer update 43421 207343 0 0 3 0x14200 cleaner cleaner 71034 480808 0 0 3 0x14200 reaper reaper 34136 162880 0 0 3 0x14200 pgdaemon pagedaemon 92009 462923 0 0 3 0x14200 bored viomb 58175 451799 0 0 3 0x40014200 acpi0 acpi0 11575 266487 0 0 3 0x14200 bored softnet0 63847 121907 0 0 3 0x14200 bored systqmp 61069 139563 0 0 3 0x14200 bored systq 91081 386366 0 0 3 0x40014200 tmoslp softclock 18002 136083 0 0 3 0x40014200 idle0 1 269028 0 0 3 0x82 wait init 0 0 -1 0 3 0x10010200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10211 11178K 11593K 166960K 13513 0 pcb 17 16K 18K 166960K 337 0 rtable 178 7K 9K 166960K 544 0 pf 29 12K 14K 166960K 120 0 ifaddr 31 5K 8K 166960K 100 0 ifgroup 49 2K 2K 166960K 167 0 sysctl 4 1K 9K 166960K 12 0 counters 32 17K 18K 166960K 127 0 ioctlops 0 0K 4K 166960K 380 0 iov 0 0K 16K 166960K 79 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1488 93K 94K 166960K 2693 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 9K 166960K 22 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 54 0 dirhash 12 2K 2K 166960K 27 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 15 53K 89K 166960K 1237 0 sigio 0 0K 0K 166960K 30 0 proc 60 59K 91K 166960K 699 0 subproc 63 3K 4K 166960K 90 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 279 0 in_multi 65 4K 6K 166960K 147 0 ether_multi 1 0K 0K 166960K 4 0 mrt 0 0K 0K 166960K 7 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 259 1155K 1155K 166960K 259 0 exec 0 0K 1K 166960K 674 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 3 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 234 160K 184K 166960K 12961 0 UVM aobj 31 6K 6K 166960K 38 0 pinsyscall 36 72K 92K 166960K 2370 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 70 0 NDP 10 0K 1K 166960K 72 0 temp 64 8668K 8745K 166960K 74993 0 kqueue 13 20K 34K 166960K 235 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 116 0 113 1 0 1 1 0 8 0 rtentry 136 153 0 85 4 0 4 4 0 8 0 unpcb 144 694 0 675 2 1 1 2 0 8 0 syncache 336 5 0 5 1 1 0 1 0 8 0 tcpqe 32 3 0 3 1 1 0 1 0 8 0 tcpcb 736 511 0 504 12 5 7 7 0 8 5 arp 96 25 0 14 1 0 1 1 0 8 0 ipq 40 1 0 0 1 0 1 1 0 8 0 ipqe 40 1 0 0 1 0 1 1 0 8 0 inpcb 328 1637 0 1627 15 8 7 10 0 8 5 nd6 112 32 0 16 1 0 1 1 0 8 0 pkpcb 40 7 0 7 2 1 1 1 0 8 1 kcovpl 48 10 0 3 1 0 1 1 0 8 0 ppxss 1072 83 0 83 2 1 1 1 0 8 1 pppxif 1384 4 0 4 1 1 0 1 0 8 0 pfrktable 1344 2 0 2 1 1 0 1 0 8 0 rttmr 136 1 0 1 1 0 1 1 0 8 1 art_heap8 4096 4 0 0 4 0 4 4 0 8 0 art_heap4 256 626 0 312 29 3 26 29 0 8 5 art_table 40 630 0 312 5 0 5 5 0 8 0 art_node 32 152 0 93 1 0 1 1 0 8 0 sysvmsgpl 40 12 0 10 1 0 1 1 0 8 0 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 112 51 0 41 1 0 1 1 0 8 0 shmpl 112 32 0 6 1 0 1 1 0 8 0 dirhash 1024 28 0 11 3 0 3 3 0 8 0 dino2pl 256 3788 0 2299 95 0 95 95 0 8 0 ffsino 256 3788 0 2299 95 0 95 95 0 8 0 nchpl 144 5516 0 3825 64 0 64 64 0 8 0 rtmask 32 14 0 14 2 1 1 1 0 8 1 vnodes 216 4678 0 0 260 0 260 260 0 8 0 namei 1024 19813 0 19812 3 2 1 2 0 8 0 vcpupl 3904 3 0 1 1 0 1 1 0 8 0 vmpool 800 3 0 1 1 0 1 1 0 8 0 kstatmem 264 102 0 82 2 0 2 2 0 8 0 scsiplug 72 7 0 7 2 1 1 1 0 8 1 scxspl 216 17311 0 17310 8 7 1 8 1 8 0 plimitpl 152 394 0 378 1 0 1 1 0 8 0 sigapl 424 1547 0 1505 8 2 6 8 0 8 0 knotepl 120 128545 0 128497 29 18 11 17 0 8 8 kqueuepl 184 520 0 511 8 2 6 6 0 8 5 pipepl 304 222 0 195 3 0 3 3 0 8 0 fdescpl 448 1509 0 1482 5 1 4 5 0 8 0 filepl 120 10769 0 10568 17 5 12 13 0 8 3 lockfpl 104 573 0 569 2 0 2 2 0 8 1 lockfspl 48 164 0 160 1 0 1 1 0 8 0 sessionpl 144 26 0 18 1 0 1 1 0 8 0 pgrppl 48 53 0 37 1 0 1 1 0 8 0 ucredpl 104 1925 0 1913 1 0 1 1 0 8 0 zombiepl 144 1785 0 1783 1 0 1 1 0 8 0 processpl 1152 1547 0 1505 5 1 4 5 0 8 0 procpl 664 3318 0 3265 9 2 7 7 0 8 1 sosppl 176 4 0 4 2 1 1 1 0 8 1 sockpl 552 2537 0 2505 16 8 8 11 0 8 5 mcl64k 65536 58 0 58 2 1 1 1 0 8 1 mcl16k 16384 3 0 3 2 1 1 1 0 8 1 mcl8k 8192 84 0 83 2 1 1 1 0 8 0 mcl4k 4096 3950 0 3899 14 6 8 14 0 8 1 mcl2k2 2112 1 0 1 1 1 0 1 0 8 0 mcl2k 2048 1899 0 1898 2 0 2 2 0 8 1 mtagpl 96 316 0 101 6 0 6 6 0 8 0 mbufpl 256 17355 0 17004 27 0 27 27 0 8 2 bufpl 280 5426 0 134 378 0 378 378 0 8 0 anonpl 24 230530 0 225390 86 30 56 69 0 187 16 amapchunkpl 152 44947 0 44414 48 11 37 37 0 158 11 amappl16 200 3494 0 3404 44 29 15 28 0 8 8 amappl14 184 2 0 2 2 1 1 1 0 8 1 amappl13 176 428 0 427 1 0 1 1 0 8 0 amappl12 168 1863 0 1826 2 0 2 2 0 8 0 amappl11 160 9 0 9 1 1 0 1 0 8 0 amappl10 152 43 0 33 1 0 1 1 0 8 0 amappl9 144 258 0 258 1 1 0 1 0 8 0 amappl8 136 19 0 16 1 0 1 1 0 8 0 amappl7 128 85 0 84 1 0 1 1 0 8 0 amappl6 120 302 0 290 1 0 1 1 0 8 0 amappl5 112 70 0 62 1 0 1 1 0 8 0 amappl4 104 399 0 373 1 0 1 1 0 8 0 amappl3 96 8697 0 8596 5 1 4 4 0 8 0 amappl2 88 533 0 478 2 0 2 2 0 8 0 amappl1 80 13828 0 13298 13 0 13 13 0 8 0 amappl 88 12014 0 11850 5 0 5 5 0 92 0 uvmvnodes 80 131 0 0 3 0 3 3 0 8 0 dma65536 65536 1 0 1 1 1 0 1 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 257 0 257 2 1 1 1 0 8 1 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 19 0 18 1 0 1 1 0 8 0 aobjpl 72 37 0 7 1 0 1 1 0 8 0 uaddrrnd 24 1509 0 1482 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1509 0 1482 1 0 1 1 0 8 0 vmmpekpl 168 12482 0 12439 3 0 3 3 0 8 0 vmmpepl 168 99207 0 97402 109 18 91 101 0 357 5 vmsppl 368 1508 0 1481 4 1 3 4 0 8 0 rwobjpl 40 26634 0 25573 15 1 14 15 0 8 0 pdppl 4096 3030 0 2966 108 40 68 78 0 8 4 pvpl 32 661291 0 651088 165 41 124 146 0 265 19 pmappl 216 1511 0 1482 2 0 2 2 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 412 0 65 11 0 11 11 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace pmap_page_remove(fffffd8007081f80) at pmap_page_remove+0x43d _atomic_swap_64 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:117 [inline] pmap_page_remove(fffffd8007081f80) at pmap_page_remove+0x43d sys/arch/amd64/amd64/pmap.c:2014 uvm_anfree_list(fffffd807e9d7bb8,0) at uvm_anfree_list+0xd6 sys/uvm/uvm_anon.c:112 amap_wipeout(fffffd806ff953c0) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:-1 uvm_unmap_detach(ffff80002a813ba0,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353 uvm_map_teardown(fffffd807eb7e8a0) at uvm_map_teardown+0x357 sys/uvm/uvm_map.c:2525 exit1(ffff80002a7b87d8,43,0,1) at exit1+0x6e6 sys/kern/kern_exit.c:259 sys_exit(ffff80002a7b87d8,ffff80002a813d60,ffff80002a813cb0) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a813d60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a813d60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x753519e71af0, count: -9 ddb> machine ddbcpu 1 No such command ddb> trace pmap_page_remove(fffffd8007081f80) at pmap_page_remove+0x43d _atomic_swap_64 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:117 [inline] pmap_page_remove(fffffd8007081f80) at pmap_page_remove+0x43d sys/arch/amd64/amd64/pmap.c:2014 uvm_anfree_list(fffffd807e9d7bb8,0) at uvm_anfree_list+0xd6 sys/uvm/uvm_anon.c:112 amap_wipeout(fffffd806ff953c0) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:-1 uvm_unmap_detach(ffff80002a813ba0,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353 uvm_map_teardown(fffffd807eb7e8a0) at uvm_map_teardown+0x357 sys/uvm/uvm_map.c:2525 exit1(ffff80002a7b87d8,43,0,1) at exit1+0x6e6 sys/kern/kern_exit.c:259 sys_exit(ffff80002a7b87d8,ffff80002a813d60,ffff80002a813cb0) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a813d60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a813d60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x753519e71af0, count: -9