*cpu1: uvm_fault(0xfffff1800d5939a8, 0x98, 0, 1) -> e ddb{0}> show kasan No such command ddb{0}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x726231163650, count: -1 ddb{0}> show registers rdi 0 rsi 0 rbp 0xffff80003c3e0b50 rbx 0 rdx 0 rcx 0xffff80003afc02c0 rax 0x2a r8 0xffff80003c3e0a80 r9 0 r10 0xf41dc361c36e46bf r11 0x59d87584f7558542 r12 0 r13 0xffffffff813a1ea8 Xdoreti+0x18 r14 0 r15 0 rip 0xffffffff81c074c7 proc_trampoline+0xc7 cs 0x8 rflags 0x246 rsp 0xffff80003c3e0ad0 ss 0x10 proc_trampoline+0xc7: movl $0,%gs:0x688 ddb{0}> show proc PROC (syz-executor) tid=348854 pid=12734 tcnt=4 stat=onproc flags process=0 proc=0 runpri=50, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003afc1a18,0xffff80003afc1260 process=0xffff800045fef508 user=0xffff80003c3db000, vmspace=0xfffff1800d593d78 estcpu=36, cpticks=2, pctcpu=0.0, user=1, sys=0, intr=1 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 85031 294959 9899 -1 2 0x10 0 syz-executor 85031 333604 9899 -1 7 0x10 0x4000000 syz-executor *12734 348854 34200 0 7 0 0 syz-executor 12734 72572 34200 0 3 0 0x4000080 fsleep syz-executor 12734 404667 34200 0 3 0 0x4000080 fsleep syz-executor 12734 449545 34200 0 3 0 0x4000080 fsleep syz-executor 76682 303085 49651 0 2 0 0 syz-executor 76682 267743 49651 0 3 0 0x4000080 fsleep syz-executor 46431 112422 47908 0 2 0 0 syz-executor 46431 349586 47908 0 3 0 0x4000080 fsleep syz-executor 46431 20654 47908 0 3 0 0x4000080 fsleep syz-executor 23963 61764 33664 0 2 0 0 syz-executor 23963 270338 33664 0 3 0 0x4000080 fsleep syz-executor 23963 149187 33664 0 3 0 0x4000080 fsleep syz-executor 24354 2429 14910 0 3 0 0x80 nanoslp syz-executor 24354 331839 14910 0 3 0 0x4000080 kqread syz-executor 24354 21451 14910 0 3 0 0x4000080 fsleep syz-executor 41032 158765 84947 0 3 0 0x80 nanoslp syz-executor 41032 307920 84947 0 3 0 0x4000080 kqread syz-executor 41032 511208 84947 0 3 0 0x4000080 fsleep syz-executor 83960 156316 40835 0 3 0x11 0x80 nanoslp syz-executor 83960 35103 40835 0 3 0x11 0x4000080 ttyretype syz-executor 83960 441665 40835 0 3 0x11 0x4000080 fsleep syz-executor 47908 331687 322 0 3 0x2 0x80 nanoslp syz-executor 9899 450101 322 0 3 0x2 0x80 nanoslp syz-executor 34200 206428 322 0 3 0x2 0x80 nanoslp syz-executor 40835 192067 322 0 3 0x2 0x80 nanoslp syz-executor 49651 229992 322 0 3 0x2 0x80 nanoslp syz-executor 33664 4073 322 0 3 0x2 0x80 nanoslp syz-executor 14910 251512 322 0 3 0x2 0x80 nanoslp syz-executor 84947 87234 322 0 3 0x2 0x80 nanoslp syz-executor 322 63348 17266 0 3 0x2 0x80 kqread syz-executor 17266 364160 76148 0 3 0x100002 0x88 sigsusp ksh 76148 222824 48504 0 3 0x10 0x88 kqread sshd-session 48504 8194 30058 0 3 0x12 0x80 kqread sshd-session 62895 441559 1 0 3 0x100003 0x80 ttyin getty 30058 176742 1 0 3 0 0x88 kqread sshd 8483 413016 78842 74 3 0x1100012 0x80 bpf pflogd 78842 134617 1 0 3 0 0x80 sbwait pflogd 67620 523058 5170 73 3 0x1100010 0x80 kqread syslogd 5170 283053 1 0 3 0x100002 0x80 sbwait syslogd 61693 101142 1 0 3 0x100000 0x80 kqread resolvd 53059 113066 15763 77 3 0x100012 0x80 kqread dhcpleased 45697 417479 15763 77 3 0x100012 0x80 kqread dhcpleased 15763 77068 1 0 3 0 0x80 kqread dhcpleased 73694 517507 0 0 3 0x14000 0x200 pause smr 91038 82286 0 0 2 0x14000 0x200 zerothread 73549 54025 0 0 3 0x14000 0x200 aiodoned aiodoned 10466 175535 0 0 3 0x14000 0x200 syncer update 25362 260317 0 0 3 0x14000 0x200 cleaner cleaner 42884 364120 0 0 3 0x14000 0x200 reaper reaper 94397 479064 0 0 3 0x14000 0x200 pgdaemon pagedaemon 39960 485158 0 0 3 0x14000 0x200 bored viomb 79345 64122 0 0 3 0x14000 0x40000200 acpi0 acpi0 64317 325256 0 0 3 0x14000 0x40000200 idle1 5035 139876 0 0 3 0x14000 0x200 bored softnet1 41761 219833 0 0 3 0x14000 0x200 bored softnet0 22281 112083 0 0 3 0x14000 0x200 bored systqmp 53012 202205 0 0 3 0x14000 0x200 bored systq 16214 300136 0 0 3 0x14000 0x200 tmoslp softclockmp 2396 380278 0 0 3 0x14000 0x40000200 tmoslp softclock 45528 154182 0 0 3 0x14000 0x40000200 idle0 1 477013 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex &sched_lock r = 0 (0xffffffff839fabf8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487 #2 sleep_finish+0x1d6 sys/kern/kern_synch.c:357 #3 sys_futex+0xb90 futex_wait sys/kern/sys_futex.c:306 [inline] #3 sys_futex+0xb90 sys/kern/sys_futex.c:155 #4 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #5 Xsyscall+0x128 Process 85031 (syz-executor) thread 0xffff80003afc14e8 (333604) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a02300) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline] #1 syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783 #2 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11078 12353K 13022K 166960K 12493 0 pcb 17 12K 12K 166960K 40 0 rtable 248 7K 9K 166960K 388 0 pf 35 17K 23K 166960K 66 0 ifaddr 43 7K 8K 166960K 52 0 ifgroup 55 2K 2K 166960K 71 0 sysctl 3 1K 9K 166960K 7 0 counters 70 37K 37K 166960K 80 0 ioctlops 0 0K 4K 166960K 1543 0 iov 0 0K 12K 166960K 8 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1395 88K 88K 166960K 1628 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 4 0 VM map 2 1K 1K 166960K 2 0 sem 4 0K 0K 166960K 4 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 18 65K 93K 166960K 262 0 proc 72 115K 180K 166960K 572 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 2 0K 0K 166960K 19 0 in_multi 99 6K 6K 166960K 101 0 ether_multi 1 0K 0K 166960K 2 0 mrt 1 0K 0K 166960K 8 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 67 307K 307K 166960K 67 0 exec 0 0K 1K 166960K 401 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 254 159K 173K 166960K 4198 0 UVM aobj 6 2K 2K 166960K 6 0 pinsyscall 43 86K 108K 166960K 1458 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 7 0 NDP 12 0K 2K 166960K 32 0 temp 37 9118K 9134K 166960K 4439 0 kqueue 19 27K 27K 166960K 54 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 40 0 37 1 0 1 1 0 8 0 rtentry 176 113 0 2 6 0 6 6 0 8 0 unpcb 144 155 0 138 4 0 4 4 0 8 3 syncache 336 6 0 6 2 1 1 1 0 8 1 tcpcb 736 43 0 39 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 157 0 147 2 0 2 2 0 8 0 nd6 152 24 0 0 1 0 1 1 0 8 0 pkpcb 40 1 0 1 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 2 0 2 1 0 1 1 0 8 1 pppxif 1576 1 0 1 1 0 1 1 0 8 1 pfstscr 40 4 0 4 1 0 1 1 0 8 1 pffrag 232 1 0 0 1 0 1 1 0 482 0 pffrnode 88 1 0 0 1 0 1 1 0 8 0 pffrent 40 1 0 0 1 0 1 1 0 8 0 pfosfp 40 1429 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1429 0 714 21 0 21 21 0 8 0 pfrktable 1344 3 0 3 1 0 1 1 0 8 1 pfsrclim 320 1 0 0 1 0 1 1 0 8 0 pfanchor 1288 1 0 1 1 0 1 1 0 8 1 pftag 88 1 0 1 1 0 1 1 0 8 1 pfstitem 24 33 0 0 1 0 1 1 0 8 0 pfstkey 128 37 0 4 2 0 2 2 0 8 0 pfstate 448 35 0 2 4 0 4 4 0 8 0 pfrule 1360 22 0 17 2 1 1 2 0 8 0 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 459 0 6 29 0 29 29 0 8 0 art_table 40 461 0 6 5 0 5 5 0 8 0 art_node 32 113 0 12 1 0 1 1 0 8 0 sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1 semapl 72 2 0 0 1 0 1 1 0 8 0 shmpl 112 3 0 0 1 0 1 1 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 1798 0 330 93 0 93 93 0 8 0 ffsino 296 1798 0 330 114 0 114 114 0 8 0 nchpl 144 2169 0 462 64 0 64 64 0 8 0 vnodes 216 2111 0 0 118 0 118 118 0 8 0 namei 1024 6997 0 6997 2 0 2 2 0 8 2 percpumem 16 56 0 5 1 0 1 1 0 8 0 pfiaddrpl 120 1 0 1 1 0 1 1 0 8 1 kstatmem 264 35 0 8 3 0 3 3 0 8 1 scsiplug 72 1 0 1 1 0 1 1 0 8 1 scxspl 216 7520 0 7520 5 4 1 4 1 8 1 plimitpl 152 50 0 31 1 0 1 1 0 8 0 sigapl 424 591 0 543 7 0 7 7 0 8 1 knotepl 120 302 0 0 10 0 10 10 0 8 0 kqueuepl 224 55 0 42 1 0 1 1 0 8 0 pipepl 344 141 0 114 3 0 3 3 0 8 0 fdescpl 528 575 0 543 3 0 3 3 0 8 0 filepl 160 2516 0 2290 14 0 14 14 0 8 4 lockfpl 104 81 0 78 1 0 1 1 0 8 0 lockfspl 48 39 0 36 1 0 1 1 0 8 0 sessionpl 144 31 0 21 1 0 1 1 0 8 0 pgrppl 48 40 0 22 1 0 1 1 0 8 0 ucredpl 104 235 0 220 1 0 1 1 0 8 0 zombiepl 144 543 0 543 1 0 1 1 0 8 1 processpl 1232 591 0 543 5 0 5 5 0 8 1 procpl 664 792 0 729 6 0 6 6 0 8 0 sockpl 752 355 0 325 10 0 10 10 0 8 6 mcl64k 65536 6 0 0 1 0 1 1 0 8 0 mcl16k 16384 3 0 0 1 0 1 1 0 8 0 mcl9k128 9344 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 4 0 0 1 0 1 1 0 8 0 mcl4k 4096 128 0 0 16 0 16 16 0 8 0 mcl2k 2048 20 0 0 3 0 3 3 0 8 0 mextrefs 64 18 0 0 1 0 1 1 0 8 0 mtagpl 96 4 0 0 1 0 1 1 0 8 0 mbufpl 256 200 0 0 13 0 13 13 0 8 0 bufpl 272 2527 0 108 162 0 162 162 0 8 0 anonpl 32 11559 0 0 94 0 94 94 0 247 0 amapchunkpl 152 12248 0 11686 27 0 27 27 0 158 5 amappl16 200 2395 0 2370 26 11 15 26 0 8 8 amappl15 192 8 0 8 2 2 0 1 0 8 0 amappl14 184 444 0 442 1 0 1 1 0 8 0 amappl13 176 127 0 115 1 0 1 1 0 8 0 amappl12 168 856 0 824 2 0 2 2 0 8 0 amappl11 160 48 0 48 1 1 0 1 0 8 0 amappl10 152 65 0 51 1 0 1 1 0 8 0 amappl9 144 277 0 276 2 1 1 1 0 8 0 amappl8 136 111 0 109 1 0 1 1 0 8 0 amappl7 128 151 0 138 1 0 1 1 0 8 0 amappl6 120 154 0 153 1 0 1 1 0 8 0 amappl5 112 120 0 109 1 0 1 1 0 8 0 amappl4 104 309 0 290 1 0 1 1 0 8 0 amappl3 96 2202 0 2090 3 0 3 3 0 8 0 amappl2 88 701 0 624 2 0 2 2 0 8 0 amappl1 80 11156 0 10540 16 0 16 16 0 8 3 amappl 88 3421 0 3238 5 0 5 5 0 92 0 uvmvnodes 80 102 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 5 0 0 1 0 1 1 0 8 0 uaddrrnd 24 576 0 544 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 576 0 544 1 0 1 1 0 8 0 vmmpekpl 168 6648 0 6614 3 0 3 3 0 8 0 vmmpepl 168 46853 0 44867 106 0 106 106 0 357 19 vmsppl 488 575 0 544 5 0 5 5 0 8 1 rwobjpl 80 16668 0 15600 31 0 31 31 0 8 5 pdppl 4096 1159 0 1088 103 32 71 85 0 8 0 pvpl 32 19244 0 0 156 0 156 156 0 265 0 pmappl 256 575 0 544 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 444 0 36 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x726231163650, count: -1 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 sys/arch/amd64/amd64/bus_space.c:670 comcnputc(800,20) at comcnputc+0xd0 comcn_read_reg sys/dev/ic/com.c:1671 [inline] comcnputc(800,20) at comcnputc+0xd0 sys/dev/ic/com.c:1264 cnputc(20) at cnputc+0x67 sys/dev/cons.c:218 db_putchar(2d) at db_putchar+0x126 db_force_whitespace sys/ddb/db_output.c:102 [inline] db_putchar(2d) at db_putchar+0x126 sys/ddb/db_output.c:153 kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1 db_printf(ffffffff834626a5) at db_printf+0x9b sys/kern/subr_prf.c:-1 fault(ffffffff8351ee28) at fault+0xa7 sys/arch/amd64/amd64/trap.c:161 kpageflttrap(ffff80003c3d43c0,98) at kpageflttrap+0x37d sys/arch/amd64/amd64/trap.c:296 kerntrap(ffff80003c3d43c0) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff80003afc14e8,fffff1806550f870,ffff80003c3d45a0) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691 end trace frame: 0xffff80003c3d4610, count: 0 ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 sys/arch/amd64/amd64/bus_space.c:670 comcnputc(800,20) at comcnputc+0xd0 comcn_read_reg sys/dev/ic/com.c:1671 [inline] comcnputc(800,20) at comcnputc+0xd0 sys/dev/ic/com.c:1264 cnputc(20) at cnputc+0x67 sys/dev/cons.c:218 db_putchar(2d) at db_putchar+0x126 db_force_whitespace sys/ddb/db_output.c:102 [inline] db_putchar(2d) at db_putchar+0x126 sys/ddb/db_output.c:153 kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1 db_printf(ffffffff834626a5) at db_printf+0x9b sys/kern/subr_prf.c:-1 fault(ffffffff8351ee28) at fault+0xa7 sys/arch/amd64/amd64/trap.c:161 kpageflttrap(ffff80003c3d43c0,98) at kpageflttrap+0x37d sys/arch/amd64/amd64/trap.c:296 kerntrap(ffff80003c3d43c0) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff80003afc14e8,fffff1806550f870,ffff80003c3d45a0) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691 sys_futimes(ffff80003afc14e8,ffff80003c3d46f0,ffff80003c3d4640) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2733 syscall(ffff80003c3d46f0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3d46f0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfee36cc9870, count: -17