uvm_fault(0xffffffff83aadae0, 0xffff800001651000, 0, 2) -> e kernel: page fault trap, code=2 Stopped at sysctl_sysvipc+0x539: repe movsq (%rsi),%es:(%rdi) TID PID UID PRFLAGS PFLAGS CPU COMMAND 214919 51653 32767 0x10 0 0 syz-executor * 22876 51653 32767 0x10 0x4000000 1K syz-executor sysctl_sysvipc(ffff80003c3f6568,1,200000000100,ffff80003c3f6598) at sysctl_sysvipc+0x539 sys/kern/kern_sysctl.c:2779 kern_sysctl(ffff80003c3f6564,2,200000000100,ffff80003c3f6598,0,37,b9e44ac90e0190d2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:736 sys_sysctl(ffff800045fe8a80,ffff80003c3f66d0,ffff80003c3f6620) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1 syscall(ffff80003c3f66d0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3f66d0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x71df783ec0, count: 10 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: uvm_fault(0xffffffff83aadae0, 0xffff800001651000, 0, 2) -> e ddb{1}> show kasan No such command ddb{1}> trace sysctl_sysvipc(ffff80003c3f6568,1,200000000100,ffff80003c3f6598) at sysctl_sysvipc+0x539 sys/kern/kern_sysctl.c:2779 kern_sysctl(ffff80003c3f6564,2,200000000100,ffff80003c3f6598,0,37,b9e44ac90e0190d2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:736 sys_sysctl(ffff800045fe8a80,ffff80003c3f66d0,ffff80003c3f6620) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1 syscall(ffff80003c3f66d0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3f66d0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x71df783ec0, count: -5 ddb{1}> show registers rdi 0xffff800001651000 rsi 0xfffff38060cebbd8 rbp 0xffff80003c3f6350 rbx 0x2 rdx 0xffff80002a771000 rcx 0xc rax 0xffffffff81227435 sysctl_sysvipc+0x525 r8 0xffff80003c3f6598 r9 0 r10 0xc2b38bbc45172730 r11 0xde00b8545875e09d r12 0xfffffffffffff016 r13 0xfffff38060cebbd8 r14 0x27 r15 0xffff800001651000 rip 0xffffffff81227449 sysctl_sysvipc+0x539 cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80003c3f62c0 ss 0x10 sysctl_sysvipc+0x539: repe movsq (%rsi),%es:(%rdi) ddb{1}> show proc PROC (syz-executor) tid=22876 pid=51653 tcnt=4 stat=onproc flags process=10 proc=4000000 runpri=32, usrpri=59, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045fe2fb8,0xffff800045fe9cb8 process=0xffff800045fe7040 user=0xffff80003c3f1000, vmspace=0xfffff3806cec89b8 estcpu=9, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 67178 501842 57553 32767 2 0x10 0 syz-executor 67178 232288 57553 32767 3 0x10 0x4000080 kqsel syz-executor 67178 41480 57553 32767 3 0x10 0x4000080 fsleep syz-executor 59265 101766 22493 32767 3 0x10 0x80 nanoslp syz-executor 59265 293371 22493 32767 3 0x10 0x4000080 ttyout syz-executor 59265 462547 22493 32767 3 0x10 0x4000080 ttyin syz-executor 50244 276641 69084 32767 2 0x10 0 syz-executor 50244 161367 69084 32767 2 0x10 0x4000000 syz-executor 50244 32864 69084 32767 3 0x10 0x4000080 sbwait syz-executor 50380 205553 22825 32767 3 0x10 0x80 nanoslp syz-executor 50380 223987 22825 32767 3 0x10 0x4000080 sbwait syz-executor 50380 76582 22825 32767 3 0x10 0x4000080 fsleep syz-executor 51653 214919 78787 32767 7 0x10 0 syz-executor *51653 22876 78787 32767 7 0x10 0x4000000 syz-executor 51653 253319 78787 32767 3 0x10 0x4000080 fsleep syz-executor 51653 522538 78787 32767 3 0x10 0x4000080 fsleep syz-executor 51828 108913 98722 32767 2 0x10 0xc80 syz-executor 51828 240364 98722 32767 3 0x10 0x4000080 fsleep syz-executor 51828 262643 98722 32767 3 0x10 0x4000080 pipewr syz-executor 51828 481534 98722 32767 3 0x10 0x4000080 fsleep syz-executor 57553 374721 89087 32767 3 0x10 0x80 nanoslp syz-executor 98722 301562 20732 32767 2 0x10 0xc80 syz-executor 22825 356928 39598 32767 2 0x10 0xc80 syz-executor 69084 363526 911 32767 2 0x10 0xc80 syz-executor 90913 397427 52752 32767 2 0x10 0 syz-executor 58380 379920 30979 32767 2 0x10000010 0xc80 syz-executor 22493 417355 70288 32767 2 0x10 0xc80 syz-executor 78787 517132 33824 32767 3 0x10 0x80 nanoslp syz-executor 20732 267702 15900 0 3 0x2 0x80 wait syz-executor 89087 38391 15900 0 3 0x2 0x80 wait syz-executor 39598 192636 15900 0 3 0x2 0x80 wait syz-executor 30979 507075 15900 0 3 0x2 0x80 wait syz-executor 911 360818 15900 0 3 0x2 0x80 wait syz-executor 33824 448125 15900 0 3 0x2 0x80 wait syz-executor 70288 409371 15900 0 3 0x2 0x80 wait syz-executor 52752 493708 15900 0 3 0x2 0x80 wait syz-executor 15900 399159 2183 0 3 0x2 0x80 kqread syz-executor 2183 184310 88277 0 3 0x100002 0x88 sigsusp ksh 88277 224099 78268 0 3 0x10 0x88 kqread sshd-session 78268 208890 82094 0 3 0x12 0x80 kqread sshd-session 25670 56712 1 0 3 0x100003 0x80 ttyin getty 82094 217075 1 0 3 0 0x88 kqread sshd 58039 523468 82951 73 3 0x1100010 0x80 kqread syslogd 82951 464287 1 0 3 0x100002 0x80 sbwait syslogd 78657 487935 1 0 3 0x100000 0x80 kqread resolvd 5701 472558 35645 77 3 0x100012 0x80 kqread dhcpleased 44147 264848 35645 77 3 0x100012 0x80 kqread dhcpleased 35645 362216 1 0 3 0 0x80 kqread dhcpleased 28013 429330 0 0 3 0x14000 0x200 bored smr 59804 366753 0 0 2 0x14000 0x200 zerothread 37109 132500 0 0 3 0x14000 0x200 aiodoned aiodoned 60218 185565 0 0 3 0x14000 0x200 syncer update 16163 216126 0 0 3 0x14000 0x200 cleaner cleaner 77294 402626 0 0 3 0x14000 0x200 reaper reaper 44648 213522 0 0 3 0x14000 0x200 pgdaemon pagedaemon 42329 73648 0 0 3 0x14000 0x200 bored viomb 39429 323006 0 0 3 0x14000 0x40000200 acpi0 acpi0 44472 394608 0 0 3 0x14000 0x40000200 idle1 87437 435980 0 0 3 0x14000 0x200 bored softnet1 77108 254018 0 0 3 0x14000 0x200 bored softnet0 23344 409162 0 0 3 0x14000 0x200 bored systqmp 89382 225253 0 0 3 0x14000 0x200 bored systq 9918 437535 0 0 3 0x14000 0x200 tmoslp softclockmp 23888 320420 0 0 3 0x14000 0x40000200 tmoslp softclock 54784 84750 0 0 3 0x14000 0x40000200 idle0 1 159826 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks Process 51653 (syz-executor) thread 0xffff800045fe8a80 (22876) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b13080) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 sysctl_sysvipc+0x4b5 sys/kern/kern_sysctl.c:-1 #2 kern_sysctl+0x139 sys/kern/kern_sysctl.c:736 #3 sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1 #4 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #5 Xsyscall+0x128 Process 90913 (syz-executor) thread 0xffff80002a2202b0 (397427) exclusive rrwlock inode r = 0 (0xfffff3806d1067b0) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline] #4 ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:150 #5 ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232 #6 ffs_inode_alloc+0x279 sys/ufs/ffs/ffs_alloc.c:393 #7 ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 #8 VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 #9 domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 #10 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #10 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #11 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffff3807f092c38) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576 #5 vfs_lookup+0x12b sys/kern/vfs_lookup.c:431 #6 namei+0x7c5 sys/kern/vfs_lookup.c:250 #7 domkdirat+0x8b sys/kern/vfs_syscalls.c:3048 #8 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #9 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11050 12018K 12034K 166960K 12141 0 pcb 17 12K 12K 166960K 17 0 rtable 237 6K 7K 166960K 347 0 pf 31 16K 16K 166960K 31 0 ifaddr 42 7K 7K 166960K 44 0 ifgroup 50 2K 2K 166960K 50 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 70 0 ioctlops 0 0K 2K 166960K 29 0 iov 1 0K 0K 166960K 1 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1287 81K 81K 166960K 1354 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 5 0K 0K 166960K 6 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 24 89K 125K 166960K 176 0 proc 61 115K 180K 166960K 502 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 1 0K 0K 166960K 7 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 3 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 61 281K 281K 166960K 61 0 exec 0 0K 1K 166960K 358 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 259 176K 186K 166960K 3136 0 UVM aobj 69 3K 3K 166960K 69 0 pinsyscall 45 90K 115K 166960K 1246 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 5 0 NDP 27 2K 2K 166960K 27 0 temp 37 9114K 9120K 166960K 3692 0 kqueue 14 22K 22K 166960K 32 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 33 0 30 1 0 1 1 0 8 0 rtentry 176 111 0 1 5 0 5 5 0 8 0 unpcb 144 120 0 100 4 0 4 4 0 8 3 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 26 0 21 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 90 0 81 2 0 2 2 0 8 1 nd6 152 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 452 0 0 29 0 29 29 0 8 0 art_table 40 453 0 0 5 0 5 5 0 8 0 art_node 32 111 0 11 1 0 1 1 0 8 0 semapl 72 3 0 0 1 0 1 1 0 8 0 shmpl 112 66 0 0 2 0 2 2 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1597 0 136 92 0 92 92 0 8 0 ffsino 296 1597 0 136 113 0 113 113 0 8 0 nchpl 144 1828 0 139 63 0 63 63 0 8 0 vnodes 216 1678 0 0 94 0 94 94 0 8 0 namei 1024 5448 0 5447 2 0 2 2 0 8 1 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 25 0 0 2 0 2 2 0 8 0 scxspl 216 6459 0 6459 4 2 2 3 1 8 2 plimitpl 152 76 0 49 2 0 2 2 0 8 0 sigapl 424 465 0 412 7 0 7 7 0 8 0 knotepl 120 58 0 0 2 0 2 2 0 8 0 kqueuepl 224 28 0 17 1 0 1 1 0 8 0 pipepl 344 122 0 94 3 0 3 3 0 8 0 fdescpl 528 449 0 413 4 0 4 4 0 8 0 filepl 160 1660 0 1437 12 0 12 12 0 8 2 lockfpl 104 25 0 23 1 0 1 1 0 8 0 lockfspl 48 10 0 8 1 0 1 1 0 8 0 sessionpl 144 26 0 10 1 0 1 1 0 8 0 pgrppl 48 34 0 10 1 0 1 1 0 8 0 ucredpl 104 170 0 151 1 0 1 1 0 8 0 zombiepl 144 413 0 412 1 0 1 1 0 8 0 processpl 1232 465 0 412 5 0 5 5 0 8 0 procpl 664 530 0 463 6 0 6 6 0 8 0 sockpl 752 245 0 213 10 0 10 10 0 8 6 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl16k 16384 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 117 0 0 15 0 15 15 0 8 0 mcl2k 2048 21 0 0 3 0 3 3 0 8 0 mextrefs 64 20 0 0 1 0 1 1 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 224 0 0 14 0 14 14 0 8 0 bufpl 272 2337 0 102 149 0 149 149 0 8 0 anonpl 32 3657 0 0 30 0 30 30 0 247 0 amapchunkpl 152 8789 0 8211 25 0 25 25 0 158 0 amappl16 200 1847 0 1827 5 0 5 5 0 8 3 amappl15 192 4 0 4 1 0 1 1 0 8 1 amappl14 184 404 0 403 1 0 1 1 0 8 0 amappl13 176 130 0 120 1 0 1 1 0 8 0 amappl12 168 682 0 647 2 0 2 2 0 8 0 amappl11 160 3 0 3 1 0 1 1 0 8 1 amappl10 152 56 0 46 1 0 1 1 0 8 0 amappl9 144 272 0 272 1 0 1 1 0 8 1 amappl8 136 108 0 107 1 0 1 1 0 8 0 amappl7 128 137 0 126 1 0 1 1 0 8 0 amappl6 120 150 0 148 1 0 1 1 0 8 0 amappl5 112 90 0 83 1 0 1 1 0 8 0 amappl4 104 271 0 256 1 0 1 1 0 8 0 amappl3 96 1589 0 1455 4 0 4 4 0 8 0 amappl2 88 505 0 452 2 0 2 2 0 8 0 amappl1 80 10143 0 9570 14 0 14 14 0 8 0 amappl 88 2466 0 2271 5 0 5 5 0 92 0 uvmvnodes 80 96 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 68 0 0 2 0 2 2 0 8 0 uaddrrnd 24 449 0 413 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 449 0 413 1 0 1 1 0 8 0 vmmpekpl 168 5499 0 5469 2 0 2 2 0 8 0 vmmpepl 168 37780 0 35759 96 0 96 96 0 357 4 vmsppl 488 448 0 413 7 1 6 6 0 8 0 rwobjpl 80 14375 0 13352 23 0 23 23 0 8 1 pdppl 4096 905 0 826 107 10 97 97 0 8 18 pvpl 32 11066 0 0 90 0 90 90 0 265 0 pmappl 256 448 0 413 4 1 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 427 0 13 12 0 12 12 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff83913ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 end of kernel end trace frame: 0x728570c93c40, count: 12 ddb{0}> trace x86_ipi_db(ffffffff83913ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 end of kernel end trace frame: 0x728570c93c40, count: -3 ddb{0}> machine ddbcpu 1 Stopped at sysctl_sysvipc+0x539: repe movsq (%rsi),%es:(%rdi) sysctl_sysvipc(ffff80003c3f6568,1,200000000100,ffff80003c3f6598) at sysctl_sysvipc+0x539 sys/kern/kern_sysctl.c:2779 kern_sysctl(ffff80003c3f6564,2,200000000100,ffff80003c3f6598,0,37,b9e44ac90e0190d2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:736 sys_sysctl(ffff800045fe8a80,ffff80003c3f66d0,ffff80003c3f6620) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1 syscall(ffff80003c3f66d0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3f66d0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x71df783ec0, count: 10 ddb{1}> trace sysctl_sysvipc(ffff80003c3f6568,1,200000000100,ffff80003c3f6598) at sysctl_sysvipc+0x539 sys/kern/kern_sysctl.c:2779 kern_sysctl(ffff80003c3f6564,2,200000000100,ffff80003c3f6598,0,37,b9e44ac90e0190d2) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:736 sys_sysctl(ffff800045fe8a80,ffff80003c3f66d0,ffff80003c3f6620) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1 syscall(ffff80003c3f66d0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3f66d0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x71df783ec0, count: -5