*cpu1: uvm_fault(0xfffffd807a443a68, 0x2b0, 0, 1) -> e ddb{0}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x78a513996340, count: -1 ddb{0}> show registers rdi 0 rsi 0 rbp 0xffff80002a117f60 rbx 0 rdx 0 rcx 0xffff80002a0b4808 rax 0x2a r8 0xffff80002a117e90 r9 0 r10 0xe9764a488a30af38 r11 0x55c02f9683c4dffc r12 0 r13 0xffffffff829ba668 Xdoreti+0x18 r14 0 r15 0 rip 0xffffffff818d34c7 proc_trampoline+0xc7 cs 0x8 rflags 0x246 rsp 0xffff80002a117ee0 ss 0x10 proc_trampoline+0xc7: movl $0,%gs:0x680 ddb{0}> show proc PROC (syz-executor) tid=488350 pid=59063 tcnt=2 stat=onproc flags process=8000000 proc=0 runpri=86, usrpri=86, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a111758,0xffff80002a0b4590 process=0xffff8000fffe5fb8 user=0xffff80002a112000, vmspace=0xfffffd8077a2dc08 estcpu=36, cpticks=2, pctcpu=0.0, user=2, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 61519 130479 45462 0 2 0x8000000 syz-executor 51794 464050 22231 0 2 0x8000000 syz-executor 51794 261304 22231 0 3 0xc000000 vm_terminate syz-executor 51794 322623 22231 0 7 0xc000000 syz-executor *59063 488350 14409 0 7 0x8000000 syz-executor 59063 397363 14409 0 3 0xc000000 smrbar syz-executor 28788 360447 35869 0 3 0x8000080 nanoslp syz-executor 28788 45480 35869 0 3 0xc000080 ttyin syz-executor 28788 451451 35869 0 3 0xc000080 fsleep syz-executor 28818 349664 1 0 3 0x8000080 nanoslp init 12505 95399 24819 0 3 0x8000002 biowait syz-executor 35669 312402 24819 0 3 0x8000082 wait syz-executor 83881 23057 24819 0 3 0x8000082 wait syz-executor 22231 449162 24819 0 3 0x8000082 nanoslp syz-executor 45462 431034 24819 0 3 0x8000082 nanoslp syz-executor 35869 299259 24819 0 3 0x8000082 nanoslp syz-executor 14409 360192 24819 0 3 0x8000082 nanoslp syz-executor 36506 386813 24819 0 3 0x8000002 biowait syz-executor 14227 505959 0 0 3 0x14200 bored sosplice 24819 47046 67480 0 3 0x8000082 kqread syz-executor 67480 420944 28541 0 3 0x810008a sigsusp ksh 28541 497636 70112 0 3 0x18000098 kqread sshd-session 70112 461234 13379 0 3 0x18000092 kqread sshd-session 13379 339196 1 0 3 0x18000088 kqread sshd 12352 362383 62875 74 3 0x19100092 bpf pflogd 62875 335918 1 0 3 0x18000080 sbwait pflogd 78859 89882 20633 73 3 0x19100090 kqread syslogd 20633 316598 1 0 3 0x18100082 sbwait syslogd 95910 511304 1 0 3 0x18100080 kqread resolvd 91307 408040 67869 77 3 0x18100092 kqread dhcpleased 63202 323648 67869 77 3 0x18100092 kqread dhcpleased 67869 219774 1 0 3 0x18000080 kqread dhcpleased 27205 302783 0 0 2 0x40014200 smr 70287 514516 0 0 2 0x14200 zerothread 57749 228777 0 0 3 0x14200 aiodoned aiodoned 42005 211068 0 0 3 0x14200 syncer update 22947 345169 0 0 3 0x14200 cleaner cleaner 2918 461681 0 0 3 0x14200 reaper reaper 8165 139351 0 0 3 0x14200 pgdaemon pagedaemon 7744 300637 0 0 3 0x14200 bored viomb 50851 223475 0 0 3 0x40014200 acpi0 acpi0 95877 270834 0 0 3 0x40014200 idle1 17579 79515 0 0 3 0x14200 bored softnet3 52551 292401 0 0 3 0x14200 bored softnet2 4519 383709 0 0 3 0x14200 bored softnet1 39130 1694 0 0 3 0x14200 bored softnet0 30942 96560 0 0 3 0x14200 bored systqmp 21718 483337 0 0 3 0x14200 bored systq 8487 455599 0 0 3 0x14200 tmoslp softclockmp 32631 57517 0 0 3 0x40014200 tmoslp softclock 92714 132708 0 0 3 0x40014200 idle0 1 410428 0 0 3 0x8080082 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex &sched_lock r = 0 (0xffffffff835551e8) #0 witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5b8 sys/kern/subr_witness.c:1151 #1 mtx_enter_try+0x178 #2 mtx_enter+0x60 sys/kern/kern_lock.c:239 #3 sleep_finish+0x1a9 sys/kern/kern_synch.c:400 #4 refcnt_finalize+0xd6 sys/kern/kern_synch.c:848 #5 vm_terminate+0x16d #6 vmmioctl+0x3c5 sys/dev/vmm/vmm.c:248 #7 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #8 vn_ioctl+0xf6 sys/kern/vfs_vnops.c:525 #9 sys_ioctl+0x67c #10 syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline] #10 syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 #11 Xsyscall+0x128 Process 51794 (syz-executor) thread 0xffff80002a1105a0 (322623) Process 59063 (syz-executor) thread 0xffff80002a0b4580 (397363) Process 12505 (syz-executor) thread 0xffff80002a110828 (95399) Process 36506 (syz-executor) thread 0xffff800029fd9448 (386813) ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10298 10430K 11330K 166960K 30097 0 pcb 18 24K 26K 166960K 2868 0 rtable 220 17K 19K 166960K 7068 0 pf 65 22K 30K 166960K 965 0 ifaddr 50 10K 12K 166960K 936 0 ifgroup 105 4K 4K 166960K 1210 0 sysctl 4 1K 5K 166960K 33 0 counters 86 39K 39K 166960K 730 0 ioctlops 0 0K 8K 166960K 3896 0 iov 0 0K 32K 166960K 1371 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1652 104K 104K 166960K 17386 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 32K 56K 166960K 239 0 VM map 2 1K 1K 166960K 2 0 sem 20 61K 66K 166960K 70 0 dirhash 15 2K 3K 166960K 225 0 ACPI 1697 195K 286K 166960K 12548 0 file desc 16 57K 89K 166960K 11934 0 sigio 1 0K 0K 166960K 485 0 proc 66 79K 128K 166960K 6323 0 subproc 104 6K 7K 166960K 2373 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 1774 0 in_multi 64 4K 7K 166960K 2370 0 ether_multi 1 0K 0K 166960K 139 0 mrt 2 0K 0K 166960K 27 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 307 1367K 1367K 166960K 307 0 exec 0 0K 1K 166960K 5073 0 pfkey data 0 0K 0K 166960K 50 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 271 179K 196K 166960K 106191 0 UVM aobj 129 8K 8K 166960K 136 0 pinsyscall 40 80K 101K 166960K 17564 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 1K 166960K 825 0 NDP 23 0K 1K 166960K 712 0 temp 79 6824K 6960K 166960K 1901456 0 kqueue 13 20K 34K 166960K 1634 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 24 0 0 1 0 1 1 0 8 0 rtpcb 120 1898 0 1895 17 16 1 3 0 8 0 rtentry 112 2466 0 2382 6 2 4 4 0 8 0 unpcb 144 13572 0 13554 73 69 4 9 0 8 3 syncache 336 16 0 16 9 9 0 1 0 8 0 tcpqe 32 4 30 4 2 2 0 1 0 8 0 tcpcb 808 5737 0 5727 128 119 9 17 0 8 7 arp 120 472 0 455 1 0 1 1 0 8 0 ipq 40 52 0 46 3 2 1 1 0 8 0 ipqe 40 569 0 562 3 2 1 1 0 8 0 inpcb 336 19500 0 19482 146 136 10 15 0 8 7 nd6 136 627 0 602 3 1 2 2 0 8 0 pkpcb 40 74 0 74 17 16 1 1 0 8 1 kcovpl 48 182 0 174 1 0 1 1 0 8 0 ppxss 1168 102 0 102 18 17 1 1 0 8 1 pfstscr 40 12 0 11 1 0 1 1 0 8 0 pffrag 232 1 0 1 1 1 0 1 0 482 0 pffrnode 88 1 0 1 1 1 0 1 0 8 0 pffrent 40 1 0 1 1 1 0 1 0 8 0 pfosfp 40 1429 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1429 0 714 21 0 21 21 0 8 0 pfrktable 1344 1 0 1 1 1 0 1 0 8 0 pfanchor 1288 6 0 0 1 0 1 1 0 8 0 pftag 88 3 0 2 1 0 1 1 0 8 0 pfqueue 264 1 0 1 1 1 0 1 0 8 0 pfstitem 24 56 0 46 1 0 1 1 0 8 0 pfstkey 128 111 0 99 2 1 1 2 0 8 0 pfstate 376 95 0 89 4 2 2 4 0 8 0 pfrule 1344 49 0 38 4 3 1 2 0 8 0 art_heap8 4096 8 0 5 5 2 3 5 0 8 0 art_heap4 256 8920 0 8557 66 39 27 30 0 8 1 art_table 32 8928 0 8562 4 0 4 4 0 8 0 art_node 16 2440 0 2364 1 0 1 1 0 8 0 sysvmsgpl 40 14 0 8 3 2 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 112 63 0 45 1 0 1 1 0 8 0 shmpl 112 133 0 7 4 0 4 4 0 8 0 dirhash 1024 163 0 143 3 0 3 3 0 8 0 dino2pl 256 22113 0 20239 118 0 118 118 0 8 0 ffsino 272 22113 0 20239 126 0 126 126 0 8 0 nchpl 144 37160 0 35227 73 0 73 73 0 8 0 uvmvnodes 80 9285 0 0 190 0 190 190 0 8 0 vnodes 216 9285 0 0 516 0 516 516 0 8 0 namei 1024 171745 0 171744 19 18 1 2 0 8 0 percpumem 16 379 0 322 1 0 1 1 0 8 0 vcpupl 3904 94 0 3 12 0 12 12 0 8 0 vmpool 696 120 0 29 10 1 9 9 0 8 0 kstatmem 264 690 0 644 11 7 4 4 0 8 0 scsiplug 72 25 0 25 14 13 1 1 0 8 1 scxspl 216 189076 0 189074 33 31 2 8 1 8 1 plimitpl 152 3853 0 3835 1 0 1 1 0 8 0 sigapl 424 11927 0 11878 13 7 6 9 0 8 0 futexpl 64 181568 0 181567 13 12 1 1 0 8 0 knotepl 120 1166 0 0 25 0 25 25 0 8 0 kqueuepl 216 4474 0 4465 40 39 1 9 0 8 0 pipepl 320 3225 0 3197 56 49 7 8 0 8 4 fdescpl 496 11876 0 11846 14 9 5 5 0 8 0 filepl 152 119721 0 119458 161 141 20 32 0 8 5 lockfpl 104 6047 0 6044 12 10 2 2 0 8 1 lockfspl 48 2201 0 2198 1 0 1 1 0 8 0 sessionpl 144 205 0 197 1 0 1 1 0 8 0 pgrppl 48 862 0 846 1 0 1 1 0 8 0 ucredpl 104 23833 0 23819 1 0 1 1 0 8 0 zombiepl 144 11880 0 11878 2 1 1 1 0 8 0 processpl 1160 11927 0 11878 6 1 5 6 0 8 0 procpl 648 28374 0 28320 19 12 7 8 0 8 0 srpgc 96 65 0 65 16 15 1 1 0 8 1 sosppl 168 70 0 70 21 20 1 1 0 8 1 sockpl 664 35252 0 35215 245 234 11 28 0 8 6 mcl64k 65536 7 0 0 1 0 1 1 0 8 0 mcl16k 16384 9 0 0 2 0 2 2 0 8 0 mcl12k 12288 3 0 0 1 0 1 1 0 8 0 mcl9k 9216 3 0 0 1 0 1 1 0 8 0 mcl8k 8192 15 0 0 2 0 2 2 0 8 0 mcl4k 4096 11 0 0 2 0 2 2 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 417 0 0 30 6 24 30 0 8 0 mtagpl 96 28 0 0 1 0 1 1 0 8 0 mbufpl 256 1584 0 0 69 0 69 69 0 8 0 bufpl 280 36363 0 29002 664 63 601 664 0 8 0 anonpl 24 1320625 0 1311335 302 195 107 107 0 185 24 amapchunkpl 152 344280 0 343680 126 94 32 45 0 158 4 amappl16 200 24986 0 24705 215 180 35 41 0 8 8 amappl15 192 11 0 11 3 3 0 1 0 8 0 amappl14 184 491 0 479 1 0 1 1 0 8 0 amappl13 176 5 0 5 2 2 0 1 0 8 0 amappl12 168 15287 0 15259 3 1 2 2 0 8 0 amappl11 160 50 0 35 1 0 1 1 0 8 0 amappl10 152 5 0 4 2 1 1 1 0 8 0 amappl9 144 153 0 153 1 1 0 1 0 8 0 amappl8 136 20 0 17 1 0 1 1 0 8 0 amappl7 128 462 0 450 1 0 1 1 0 8 0 amappl6 120 1905 0 1902 1 0 1 1 0 8 0 amappl5 112 839 0 825 1 0 1 1 0 8 0 amappl4 104 868 0 848 1 0 1 1 0 8 0 amappl3 96 71475 0 71355 5 1 4 4 0 8 0 amappl2 88 3143 0 3077 2 0 2 2 0 8 0 amappl1 80 54017 0 53452 20 6 14 15 0 8 0 amappl 88 103600 0 103413 6 0 6 6 0 92 0 dma16384 16384 2 0 2 2 1 1 1 0 8 1 dma8192 8192 2 0 2 2 2 0 1 0 8 0 dma4096 4096 3 0 3 2 2 0 1 0 8 0 dma2048 2048 1 0 1 1 1 0 1 0 8 0 dma1024 1024 5 0 4 1 0 1 1 0 8 0 dma512 512 2 0 2 2 1 1 1 0 8 1 dma256 256 9 0 9 4 4 0 1 0 8 0 dma128 128 255 0 255 3 3 0 1 0 8 0 dma64 64 10 0 10 4 4 0 1 0 8 0 dma32 32 8 0 8 2 2 0 1 0 8 0 dma16 16 55 0 54 1 0 1 1 0 8 0 aobjpl 72 135 0 7 3 0 3 3 0 8 0 uaddrrnd 24 11996 0 11875 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 11996 0 11875 1 0 1 1 0 8 0 vmmpekpl 168 99708 0 99642 7 3 4 4 0 8 0 vmmpepl 168 709568 0 707389 253 130 123 123 0 357 11 vmsppl 440 11995 0 11875 16 2 14 14 0 8 0 rwobjpl 56 180417 0 169798 176 18 158 158 0 8 3 pdppl 4096 23999 0 23841 480 318 162 164 0 8 4 pvpl 32 45087 0 0 362 0 362 362 0 265 0 pmappl 248 11995 0 11875 8 0 8 8 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 1238 0 675 17 0 17 17 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x78a513996340, count: -1 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666 acpitimer_delay(1) at acpitimer_delay+0x58 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline] acpitimer_delay(1) at acpitimer_delay+0x58 sys/dev/acpi/acpitimer.c:120 comcnputc(800,a) at comcnputc+0x29b sys/dev/ic/com.c:1269 cnputc(a) at cnputc+0x61 sys/dev/cons.c:218 db_putchar(a) at db_putchar+0x774 sys/ddb/db_output.c:168 kprintf() at kprintf+0x843 db_printf(ffffffff8308ddf1) at db_printf+0x9b fault(ffffffff8303b91c) at fault+0xa7 sys/arch/amd64/amd64/trap.c:157 kpageflttrap(ffff80002a0b0790,2b0) at kpageflttrap+0x385 sys/arch/amd64/amd64/trap.c:290 kerntrap(ffff80002a0b0790) at kerntrap+0x14a sys/arch/amd64/amd64/trap.c:332 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b end trace frame: 0xffff80002a0b0880, count: 0 ddb{1}> trace x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666 acpitimer_delay(1) at acpitimer_delay+0x58 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline] acpitimer_delay(1) at acpitimer_delay+0x58 sys/dev/acpi/acpitimer.c:120 comcnputc(800,a) at comcnputc+0x29b sys/dev/ic/com.c:1269 cnputc(a) at cnputc+0x61 sys/dev/cons.c:218 db_putchar(a) at db_putchar+0x774 sys/ddb/db_output.c:168 kprintf() at kprintf+0x843 db_printf(ffffffff8308ddf1) at db_printf+0x9b fault(ffffffff8303b91c) at fault+0xa7 sys/arch/amd64/amd64/trap.c:157 kpageflttrap(ffff80002a0b0790,2b0) at kpageflttrap+0x385 sys/arch/amd64/amd64/trap.c:290 kerntrap(ffff80002a0b0790) at kerntrap+0x14a sys/arch/amd64/amd64/trap.c:332 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b vm_terminate(ffff80002a0b0ae0) at vm_terminate+0xb0 sys/dev/vmm/vmm.c:674 vmmioctl(a00,80045604,ffff80002a0b0ae0,81,ffff80002a1105a0) at vmmioctl+0x3c5 sys/dev/vmm/vmm.c:248 VOP_IOCTL(fffffd807e441440,80045604,ffff80002a0b0ae0,81,fffffd807f7d3680,ffff80002a1105a0) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 vn_ioctl(fffffd806017bc88,80045604,ffff80002a0b0ae0,ffff80002a1105a0) at vn_ioctl+0xf6 sys/kern/vfs_vnops.c:525 sys_ioctl(ffff80002a1105a0,ffff80002a0b0cc0,ffff80002a0b0c10) at sys_ioctl+0x67c syscall(ffff80002a0b0cc0) at syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline] syscall(ffff80002a0b0cc0) at syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x8ea83c91b60, count: -21