Extracting prog: 7m11.98006887s Minimizing prog: 19m8.86933057s Simplifying prog options: 4m35.155023952s Extracting C: 1m3.532405593s Simplifying C: 6m17.339958913s extracting reproducer from 48 programs testing a last program of every proc single: executing 8 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): semget-semop-semop-mprotect-syz_emit_ethernet-setrlimit-syz_open_pts-pipe-semget-semop-semop-mprotect-syz_emit_ethernet-setrlimit-syz_open_pts-pipe detailed listing: executing program 0: r0 = semget(0x1, 0x7, 0x200) semop(r0, &(0x7f00000001c0)=[{0x3, 0x400, 0x1000}, {0x1, 0xf001, 0x1000}], 0x2) semop(r0, &(0x7f0000000000)=[{0x1, 0x9, 0x1000}], 0x1) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) syz_emit_ethernet(0x78, &(0x7f0000000040)={@broadcast, @random, [], {@generic={0x88a8, "9c02f00809e80a52b39d3315a8f50554d0adf2e8f5f900010000010038712cf9bb0b14f7f4aa82adb3887643d1956f59f1cc8ba5f6868d9cdae45c70341786c5ff56df4842c40a5ea2ea565779a22bc8468f0693674563b46bd03c81c3ecf7c8538140cc884025ab2817"}}}) setrlimit(0x8, &(0x7f0000001ec0)={0x9, 0x37e1790c}) syz_open_pts() pipe(&(0x7f00000000c0)) semget(0x1, 0x7, 0x200) (async) semop(r0, &(0x7f00000001c0)=[{0x3, 0x400, 0x1000}, {0x1, 0xf001, 0x1000}], 0x2) (async) semop(r0, &(0x7f0000000000)=[{0x1, 0x9, 0x1000}], 0x1) (async) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) (async) syz_emit_ethernet(0x78, &(0x7f0000000040)={@broadcast, @random, [], {@generic={0x88a8, "9c02f00809e80a52b39d3315a8f50554d0adf2e8f5f900010000010038712cf9bb0b14f7f4aa82adb3887643d1956f59f1cc8ba5f6868d9cdae45c70341786c5ff56df4842c40a5ea2ea565779a22bc8468f0693674563b46bd03c81c3ecf7c8538140cc884025ab2817"}}}) (async) setrlimit(0x8, &(0x7f0000001ec0)={0x9, 0x37e1790c}) (async) syz_open_pts() (async) pipe(&(0x7f00000000c0)) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setitimer-getitimer-socket$inet6-mknod-open-ioctl$DIOCGETQUEUES-ioctl$DIOCGETQUEUES-setsockopt-getitimer detailed listing: executing program 0: setitimer(0x0, &(0x7f00000000c0)={{0x42, 0x8000}, {0x1, 0x8001}}, 0x0) getitimer(0x0, &(0x7f0000000000)) r0 = socket$inet6(0x18, 0x3, 0x3) mknod(&(0x7f0000000000)='./file0\x00', 0x2008, 0x1ea8) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x4b) ioctl$DIOCGETQUEUES(r1, 0x80184404, &(0x7f0000000440)={0xf, 0x5, {'\x00', './file3aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', './file0\x00', './file2/file0\x00', {{0x7, 0x2}, {0x8, 0x13}, 0x2}, {{0x8}, {0x2f1a, 0x521}, 0x4}, {{0xc, 0x80009}, {0x3, 0x1000}, 0xfffffffd}, {0x5, 0xfffffffe, 0x4, 0x4}, 0x0, 0x110000, 0x6, 0x7, 0x3}}) ioctl$DIOCGETQUEUES(r1, 0x80044403, &(0x7f0000000040)={0x8, 0x9, {'\x00', './file1\x00', './file1\x00', './file0\x00', {{0x7, 0x2}, {0x9, 0x7}, 0x4}, {{0x9, 0x1}, {0x7, 0x7ff}, 0x3}, {{0x5, 0x2}, {0xc, 0x1000}, 0x3ffffffd}, {0x7, 0x0, 0x0, 0x4}, 0x0, 0x1, 0x2, 0x9, 0x4}}) setsockopt(r0, 0x29, 0xb, 0x0, 0x0) getitimer(0x0, 0xffffffffffffffff) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$speaker-writev-unveil-ioctl$BIOCSETF-sysctl$kern-ioctl$WSMOUSEIO_SETPARAMS-mprotect-sysctl$net_inet_icmp-mprotect-sysctl$net_inet_tcp-setpgid-mprotect detailed listing: executing program 0: r0 = openat$speaker(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000380)="6588652d", 0x4}], 0x1) (async) unveil(0x0, &(0x7f0000000080)='x\x00') (async) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x84, 0xf2, 0x4, 0x4}, {0x6, 0x8, 0x3, 0xc3c}]}) (async) sysctl$kern(&(0x7f0000000000)={0x1, 0x47}, 0x2, 0x0, 0x0, 0x0, 0x0) (async) ioctl$WSMOUSEIO_SETPARAMS(0xffffffffffffffff, 0x80105728, &(0x7f00000000c0)={&(0x7f0000000040)=[{0x7, 0x7}, {0x84, 0x4}]}) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) (async) sysctl$net_inet_icmp(&(0x7f0000000000)={0x4, 0x2, 0x1, 0x1}, 0x4, 0x0, 0x0, 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) (async) sysctl$net_inet_tcp(&(0x7f0000000000)={0x4, 0x2, 0x6, 0x16}, 0x3, 0x0, 0x0, 0x0, 0x0) setpgid(0x0, 0xffffffffffffffff) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-open-ioctl$DIOCGETQUEUES-openat$bpf-mprotect-openat$pf-ioctl$DIOCRADDTABLES detailed listing: executing program 0: mknod(&(0x7f0000000000)='./file0\x00', 0x2008, 0x1ea8) r0 = open(&(0x7f0000000200)='./file0\x00', 0x9da, 0xc9) ioctl$DIOCGETQUEUES(r0, 0x80044403, &(0x7f0000000040)={0x8, 0x20000009, {'\x00', './file1\x00', './file1\x00', './file0\x00', {{0x7, 0x2}, {0x9, 0x7}, 0x4}, {{0x5, 0x1}, {0x7, 0x7ff}, 0x3}, {{0x8, 0x2}, {0xc, 0x1000}, 0x3ffffffd}, {0x7, 0x1, 0x0, 0x4}, 0x0, 0x1, 0x2, 0x400000a, 0x4}}) openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$DIOCRADDTABLES(r1, 0xc450443d, &(0x7f0000000040)={{'./file0\x00', './file0\x00', 0x22, 0xde}, 0x0, 0x428, 0x0, 0x5, 0x80009, 0x6a4, 0xff, 0x2, 0x7}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_pts-write-ioctl$TIOCCHKVERAUTH-socket$inet-connect$inet-socketpair-getsockname$inet-mprotect detailed listing: executing program 0: r0 = syz_open_pts() write(r0, &(0x7f0000000100)="67d3650389295ffb9dcada8096dad19976e52edfb4f82fcabad805d3e0d115d35ba9c1cc", 0x24) ioctl$TIOCCHKVERAUTH(r0, 0x2000741e) r1 = socket$inet(0x2, 0x1, 0x6) connect$inet(r1, &(0x7f0000000040)={0x10, 0x2, 0x1, 0xffffffff}, 0x10) socketpair(0x1, 0x1, 0x8, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$inet(r2, &(0x7f0000000080), &(0x7f00000000c0)=0x10) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): kqueue1-kevent-kqueue1-kqueue1-pselect-kevent-kevent-kevent-kqueue1-kevent-kqueue1-kevent-openat$vnd-kevent-closefrom-sysctl$vm detailed listing: executing program 0: r0 = kqueue1(0x0) kevent(r0, &(0x7f0000000040)=[{{r0}, 0xfffffffffffffffa, 0xc3, 0x2, 0x4, 0xfffffffffffffffd}], 0x6, 0x0, 0x4, 0x0) (async) r1 = kqueue1(0x10004) (async) r2 = kqueue1(0x10000) pselect(0x0, 0x0, 0x0, &(0x7f00000000c0)={0x5, 0x0, 0x3, 0x8, 0x0, 0xfffffffffffffffe, 0xc140, 0x5cbf}, 0x0, 0x0) kevent(r2, 0x0, 0x0, &(0x7f0000000000), 0x40, 0x0) (async) kevent(r2, &(0x7f0000000080), 0x86, 0x0, 0xffff4b4d, 0x0) (async) kevent(r1, &(0x7f0000000040), 0x6, 0x0, 0x4, 0x0) (async) r3 = kqueue1(0x10004) kevent(0xffffffffffffffff, 0x0, 0x2004, 0x0, 0xffff4b4d, 0x0) (async) r4 = kqueue1(0x10004) kevent(r4, &(0x7f0000000000), 0x100f00, 0x0, 0xffff4b51, 0x0) (async) r5 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000000), 0x10, 0x0) kevent(r3, &(0x7f00000001c0)=[{{r0}, 0xfffffffffffffff6, 0xda, 0x2, 0xfffffffffffffff9, 0x23}, {{r1}, 0xffffffffffffffff, 0x6, 0x1, 0xa, 0x4}, {{r3}, 0xfffffffffffffff8, 0x40, 0x20, 0x4, 0x9}, {{r5}, 0xfffffffffffffff7, 0x40, 0x40000000, 0x0, 0x6}, {{r3}, 0xfffffffffffffffc, 0x9, 0x4, 0xc5c}, {{r4}, 0xfffffffffffffff6, 0x90, 0x80000000, 0x3, 0x1000}, {{r4}, 0xfffffffffffffff7, 0x16, 0x20000000, 0x100000000, 0x3}, {{r0}, 0xffffffffffffffff, 0x7, 0x4, 0x968}, {{r1}, 0xfffffffffffffff7, 0x22, 0x80, 0x5, 0x2}, {{r2}, 0xfffffffffffffffa, 0x4, 0x12}], 0x4, 0x0, 0xb4, 0x0) (async) closefrom(r0) (async) sysctl$vm(&(0x7f0000000180)={0x2, 0x8}, 0x2, &(0x7f0000000100), 0x0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv-ioctl$VNDIOCGET detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, &(0x7f00000004c0)) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) ioctl$VNDIOCGET(r1, 0xc4104603, &(0x7f0000000040)={'./file0\x00', 0x8, 0x1000, 0x1}) program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, &(0x7f00000004c0)) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, &(0x7f00000004c0)) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, &(0x7f00000004c0)) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) preadv(0xffffffffffffffff, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, &(0x7f00000004c0)) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-munmap-openat$vnd-preadv detailed listing: executing program 0: openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r0 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r0, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: ioctl$KDGKBMODE(0xffffffffffffffff, 0x40044b06, &(0x7f00000004c0)) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r0 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r0, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, &(0x7f00000004c0)) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, 0x0, 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, &(0x7f00000004c0)) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, 0x0, 0x0, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{0x0}], 0x1, 0xe000000000000000) (async) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c extracting C reproducer testing compiled C program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv program did not crash simplifying guilty program options testing program (duration=59.664681283s, {Threaded:false Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c extracting C reproducer testing compiled C program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c simplifying C reproducer testing compiled C program (duration=59.664681283s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv program did not crash testing compiled C program (duration=59.664681283s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv program did not crash testing compiled C program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv program did not crash testing compiled C program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv program did not crash testing compiled C program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv program did not crash testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program did not crash validation run: crashed=false testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program did not crash validation run: crashed=false testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c validation run: crashed=true testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c validation run: crashed=true testing program (duration=59.664681283s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$wsmuxmouse-ioctl$KDGKBMODE-munmap-openat$vnd-preadv detailed listing: executing program 0: r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000480), 0x80, 0x0) ioctl$KDGKBMODE(r0, 0x40044b06, 0x0) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) r1 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) preadv(r1, &(0x7f0000001640)=[{&(0x7f0000000000)=""/9, 0xfffffe14}], 0x1, 0xe000000000000000) program crashed: assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c validation run: crashed=true reproducing took 44m27.249449098s repro crashed as (corrupted=false): panic: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764 Stopped at db_enter+0x17: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND 177343 17362 0 0 0 0 syz-executor *469042 17362 0 0 0x4000000 1K syz-executor db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198 __assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48 uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761 uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139 spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfeb2e3d560, count: 1 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764 ddb{1}> show kasan kasan: no report recorded this boot ddb{1}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198 __assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48 uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761 uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139 spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfeb2e3d560, count: -14 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff800029a8eb70 rbx 0xffff800029a8ebe0 rdx 0 rcx 0xffff800028fe3ff0 rax 0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x5 r11 0xffffffff82bb0da0 x86_bus_space_io_read_1 r12 0xffffffff84bd03e0 .str.2 r13 0xffff800028fe4c08 r14 0xffff800028fe4e07 r15 0x1 rip 0xffffffff810b7607 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff800029a8eb70 ss 0x10 db_enter+0x17: popq %rbp ddb{1}> show proc PROC (syz-executor) tid=469042 pid=17362 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045ffb778,0xffff800045ffa2c8 process=0xffff8000298a49a8 user=0xffff800029a84000, vmspace=0xffff8000017de7a8 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 17362 177343 54827 0 7 0 0 syz-executor *17362 469042 54827 0 7 0 0x4000000 syz-executor 17362 303158 54827 0 3 0 0x4000080 fsleep syz-executor 54827 29363 99236 0 3 0x2 0x80 nanoslp syz-executor 99236 220416 79799 0 3 0x2 0x80 kqread syz-executor 79799 225619 68697 0 3 0x2 0x80 thrsleep syz-execprog 79799 286650 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 55513 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 352254 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 91187 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 37395 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 365091 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 339226 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 455276 68697 0 3 0x2 0x4000080 kqread syz-execprog 79799 463256 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 339507 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 434413 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 68697 142916 37756 0 3 0x100002 0x88 sigsusp ksh 37756 512159 65851 0 3 0x10 0x88 kqread sshd-session 65851 320140 38793 0 3 0x12 0x80 kqread sshd-session 59720 334042 1 0 3 0x100003 0x80 ttyin getty 38793 63142 1 0 3 0 0x88 kqread sshd 43197 243932 33065 74 3 0x1100012 0x80 bpf pflogd 33065 422757 1 0 3 0 0x80 sbwait pflogd 98684 230197 98532 73 3 0x1100010 0x80 kqread syslogd 98532 498551 1 0 3 0x100002 0x80 sbwait syslogd 28383 409610 1 0 3 0x100000 0x80 kqread resolvd 94150 218820 47431 77 3 0x100012 0x80 kqread dhcpleased 27130 82813 47431 77 3 0x100012 0x80 kqread dhcpleased 47431 77904 1 0 3 0 0x80 kqread dhcpleased 6782 349827 0 0 3 0x14000 0x200 bored smr 56033 320349 0 0 3 0x14000 0x200 pgzero zerothread 9285 163933 0 0 3 0x14000 0x200 aiodoned aiodoned 5334 117758 0 0 3 0x14000 0x200 syncer update 99479 191807 0 0 3 0x14000 0x200 cleaner cleaner 87139 406919 0 0 3 0x14000 0x200 reaper reaper 34067 147137 0 0 3 0x14000 0x200 pgdaemon pagedaemon 43107 418421 0 0 3 0x14000 0x200 bored viomb 62238 52283 0 0 3 0x14000 0x40000200 acpi0 acpi0 42849 511245 0 0 3 0x14000 0x40000200 idle1 66739 288006 0 0 3 0x14000 0x200 bored softnet1 97903 337907 0 0 3 0x14000 0x200 bored softnet0 70582 5073 0 0 3 0x14000 0x200 bored systqmp 57613 447119 0 0 3 0x14000 0x200 bored systq 34275 207176 0 0 3 0x14000 0x200 tmoslp softclockmp 71163 249640 0 0 3 0x14000 0x40000200 tmoslp softclock 92352 461070 0 0 3 0x14000 0x40000200 idle0 1 337956 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks Process 17362 (syz-executor) thread 0xffff800045ffaa80 (469042) exclusive rwlock amaplk r = 0 (0xffff800001d627c8) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320 #2 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464 #3 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776 #4 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] #4 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 #5 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 #6 physio+0x4a7 sys/kern/kern_physio.c:139 #7 spec_read+0x29a sys/kern/spec_vnops.c:215 #8 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #9 vn_read+0x1fc sys/kern/vfs_vnops.c:375 #10 dofilereadv+0x386 sys/kern/sys_generic.c:252 #11 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 #12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #13 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85e55840) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1 #2 sleep_finish+0x423 sys/kern/kern_synch.c:369 #3 rw_do_enter_write+0x21f sys/kern/kern_rwlock.c:298 #4 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464 #5 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776 #6 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] #6 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 #7 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 #8 physio+0x4a7 sys/kern/kern_physio.c:139 #9 spec_read+0x29a sys/kern/spec_vnops.c:215 #10 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #11 vn_read+0x1fc sys/kern/vfs_vnops.c:375 #12 dofilereadv+0x386 sys/kern/sys_generic.c:252 #13 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 #14 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #14 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #15 Xsyscall+0x128 shared rwlock vmmaplk r = 0 (0xffff8000017de8a8) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413 #2 uvm_fault_wire+0x116 uvm_fault_unwire sys/uvm/uvm_fault.c:1723 [inline] #2 uvm_fault_wire+0x116 sys/uvm/uvm_fault.c:1706 #3 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 #4 physio+0x4a7 sys/kern/kern_physio.c:139 #5 spec_read+0x29a sys/kern/spec_vnops.c:215 #6 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #7 vn_read+0x1fc sys/kern/vfs_vnops.c:375 #8 dofilereadv+0x386 sys/kern/sys_generic.c:252 #9 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 #10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #11 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11030 12234K 12234K 166960K 12163 0 pcb 17 24K 24K 166960K 17 0 rtable 83 4K 4K 166960K 171 0 pf 20 18K 20K 166960K 34 0 ifaddr 15 3K 3K 166960K 19 0 ifgroup 27 1K 1K 166960K 32 0 sysctl 1 1K 13K 166960K 5 0 counters 56 39K 39K 166960K 58 0 ioctlops 0 0K 4K 166960K 1477 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1227 79K 79K 166960K 1319 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 2 2K 2K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 292K 166960K 11964 0 file desc 4 9K 13K 166960K 145 0 proc 70 128K 144K 166960K 384 0 subproc 0 0K 1K 166960K 30 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 in_multi 22 1K 1K 166960K 33 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 1 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 25 182K 182K 166960K 25 0 exec 0 0K 2K 166960K 351 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 14 124K 124K 166960K 15 0 UVM amap 217 187K 343K 166960K 3912 0 UVM aobj 3 4K 4K 166960K 3 0 pinsyscall 1055 1737K 1737K 166960K 1299 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 5 0K 0K 166960K 10 0 temp 1 9164K 9176K 166960K 4947 0 kqueue 14 44K 44K 166960K 40 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 21 0 18 1 0 1 1 0 8 0 rtentry 176 45 0 12 2 0 2 2 0 8 0 unpcb 144 63 0 46 1 0 1 1 0 8 0 syncache 336 9 0 9 2 1 1 1 0 8 1 tcpcb 736 16 0 10 1 0 1 1 0 8 0 arp 136 6 0 2 1 0 1 1 0 8 0 inpcb 328 49 0 40 1 0 1 1 0 8 0 nd6 152 6 0 3 1 0 1 1 0 8 0 kcovpl 48 4 0 4 1 0 1 1 0 8 1 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 14 0 2 1 0 1 1 0 8 0 pfstkey 128 14 0 2 1 0 1 1 0 8 0 pfstate 448 14 0 2 2 0 2 2 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 193 0 48 10 0 10 10 0 8 0 art_table 40 194 0 48 2 0 2 2 0 8 0 art_node 32 45 0 15 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1631 0 155 93 0 93 93 0 8 0 ffsino 296 1631 0 155 114 0 114 114 0 8 0 nchpl 144 1918 0 165 65 0 65 65 0 8 0 vnodes 216 1675 0 0 94 0 94 94 0 8 0 namei 1024 6786 0 6786 3 2 1 2 0 8 1 percpumem 16 45 0 1 1 0 1 1 0 8 0 kstatmem 264 15 0 2 1 0 1 1 0 8 0 scxspl 216 11937 0 11937 4 3 1 3 1 8 1 plimitpl 152 55 0 44 1 0 1 1 0 8 0 sigapl 424 474 0 439 6 0 6 6 0 8 2 knotepl 120 57 0 0 2 0 2 2 0 8 0 kqueuepl 224 36 0 26 1 0 1 1 0 8 0 pipepl 344 185 0 178 2 0 2 2 0 8 1 fdescpl 528 458 0 439 3 0 3 3 0 8 1 filepl 160 1987 0 1907 5 1 4 5 0 8 0 lockfpl 104 6 0 4 1 0 1 1 0 8 0 lockfspl 48 4 0 2 1 0 1 1 0 8 0 sessionpl 144 38 0 29 1 0 1 1 0 8 0 pgrppl 48 54 0 44 1 0 1 1 0 8 0 ucredpl 104 141 0 128 1 0 1 1 0 8 0 zombiepl 144 439 0 439 1 0 1 1 0 8 1 processpl 1232 474 0 439 4 0 4 4 0 8 1 procpl 664 578 0 530 5 0 5 5 0 8 0 sockpl 752 133 0 104 4 0 4 4 0 8 1 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl16k 16384 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 149 0 0 19 0 19 19 0 8 0 mcl2k 2048 14 0 0 2 0 2 2 0 8 0 mextrefs 64 11 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 146 0 0 10 0 10 10 0 8 0 bufpl 272 7429 0 303 476 0 476 476 0 8 0 anonpl 32 11004 0 0 89 0 89 89 0 222 0 amapchunkpl 152 12529 0 12017 33 1 32 32 0 158 10 amappl16 200 4312 0 4173 8 0 8 8 0 8 0 amappl15 192 4 0 4 1 1 0 1 0 8 0 amappl14 184 383 0 378 1 0 1 1 0 8 0 amappl13 176 178 0 164 2 0 2 2 0 8 1 amappl12 168 728 0 709 2 0 2 2 0 8 1 amappl11 160 85 0 85 1 1 0 1 0 8 0 amappl10 152 101 0 82 2 0 2 2 0 8 1 amappl9 144 1797 0 1797 2 1 1 1 0 8 1 amappl8 136 131 0 103 2 0 2 2 0 8 1 amappl7 128 232 0 210 3 1 2 3 0 8 0 amappl6 120 140 0 136 1 0 1 1 0 8 0 amappl5 112 318 0 308 1 0 1 1 0 8 0 amappl4 104 385 0 363 2 0 2 2 0 8 1 amappl3 96 1782 0 1724 3 0 3 3 0 8 1 amappl2 88 871 0 803 5 0 5 5 0 8 2 amappl1 80 15564 0 15007 24 4 20 24 0 8 8 amappl 88 2995 0 2870 5 0 5 5 0 92 2 uvmvnodes 80 88 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 458 0 439 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 458 0 439 1 0 1 1 0 8 0 vmmpekpl 168 9551 0 9527 2 0 2 2 0 8 0 vmmpepl 168 57124 0 55511 129 0 129 129 0 357 58 vmsppl 488 457 0 439 4 0 4 4 0 8 1 rwobjpl 80 23937 0 22867 41 7 34 41 0 8 8 pdppl 4096 925 0 878 79 28 51 69 0 8 4 pvpl 32 54854 0 0 443 0 443 443 0 265 0 pmappl 256 457 0 439 2 0 2 2 0 8 0 extentpl 40 47 0 29 1 0 1 1 0 8 0 phpool 120 711 0 34 21 0 21 21 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x19: leave x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412 x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85e55040) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff85e55040) at __mp_lock+0x272 sys/kern/kern_lock.c:173 softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83 dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862 Xsoftclock() at Xsoftclock+0x27 __sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa kd_curproc sys/dev/kcov.c:580 [inline] __sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa sys/dev/kcov.c:212 syscall(ffff800029a83a40) at syscall+0x9e8 pin_check sys/sys/syscall_mi.h:89 [inline] syscall(ffff800029a83a40) at syscall+0x9e8 mi_syscall sys/sys/syscall_mi.h:164 [inline] syscall(ffff800029a83a40) at syscall+0x9e8 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b9a9e2d2a20, count: 5 ddb{0}> trace x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412 x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85e55040) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff85e55040) at __mp_lock+0x272 sys/kern/kern_lock.c:173 softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83 dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862 Xsoftclock() at Xsoftclock+0x27 __sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa kd_curproc sys/dev/kcov.c:580 [inline] __sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa sys/dev/kcov.c:212 syscall(ffff800029a83a40) at syscall+0x9e8 pin_check sys/sys/syscall_mi.h:89 [inline] syscall(ffff800029a83a40) at syscall+0x9e8 mi_syscall sys/sys/syscall_mi.h:164 [inline] syscall(ffff800029a83a40) at syscall+0x9e8 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b9a9e2d2a20, count: -10 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x17: popq %rbp db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198 __assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48 uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761 uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139 spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfeb2e3d560, count: 1 ddb{1}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198 __assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48 uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761 uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139 spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfeb2e3d560, count: -14 final repro crashed as (corrupted=false): panic: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764 Stopped at db_enter+0x17: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND 177343 17362 0 0 0 0 syz-executor *469042 17362 0 0 0x4000000 1K syz-executor db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198 __assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48 uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761 uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139 spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfeb2e3d560, count: 1 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764 ddb{1}> show kasan kasan: no report recorded this boot ddb{1}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198 __assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48 uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761 uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139 spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfeb2e3d560, count: -14 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff800029a8eb70 rbx 0xffff800029a8ebe0 rdx 0 rcx 0xffff800028fe3ff0 rax 0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x5 r11 0xffffffff82bb0da0 x86_bus_space_io_read_1 r12 0xffffffff84bd03e0 .str.2 r13 0xffff800028fe4c08 r14 0xffff800028fe4e07 r15 0x1 rip 0xffffffff810b7607 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff800029a8eb70 ss 0x10 db_enter+0x17: popq %rbp ddb{1}> show proc PROC (syz-executor) tid=469042 pid=17362 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045ffb778,0xffff800045ffa2c8 process=0xffff8000298a49a8 user=0xffff800029a84000, vmspace=0xffff8000017de7a8 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 17362 177343 54827 0 7 0 0 syz-executor *17362 469042 54827 0 7 0 0x4000000 syz-executor 17362 303158 54827 0 3 0 0x4000080 fsleep syz-executor 54827 29363 99236 0 3 0x2 0x80 nanoslp syz-executor 99236 220416 79799 0 3 0x2 0x80 kqread syz-executor 79799 225619 68697 0 3 0x2 0x80 thrsleep syz-execprog 79799 286650 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 55513 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 352254 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 91187 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 37395 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 365091 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 339226 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 455276 68697 0 3 0x2 0x4000080 kqread syz-execprog 79799 463256 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 339507 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 79799 434413 68697 0 3 0x2 0x4000080 thrsleep syz-execprog 68697 142916 37756 0 3 0x100002 0x88 sigsusp ksh 37756 512159 65851 0 3 0x10 0x88 kqread sshd-session 65851 320140 38793 0 3 0x12 0x80 kqread sshd-session 59720 334042 1 0 3 0x100003 0x80 ttyin getty 38793 63142 1 0 3 0 0x88 kqread sshd 43197 243932 33065 74 3 0x1100012 0x80 bpf pflogd 33065 422757 1 0 3 0 0x80 sbwait pflogd 98684 230197 98532 73 3 0x1100010 0x80 kqread syslogd 98532 498551 1 0 3 0x100002 0x80 sbwait syslogd 28383 409610 1 0 3 0x100000 0x80 kqread resolvd 94150 218820 47431 77 3 0x100012 0x80 kqread dhcpleased 27130 82813 47431 77 3 0x100012 0x80 kqread dhcpleased 47431 77904 1 0 3 0 0x80 kqread dhcpleased 6782 349827 0 0 3 0x14000 0x200 bored smr 56033 320349 0 0 3 0x14000 0x200 pgzero zerothread 9285 163933 0 0 3 0x14000 0x200 aiodoned aiodoned 5334 117758 0 0 3 0x14000 0x200 syncer update 99479 191807 0 0 3 0x14000 0x200 cleaner cleaner 87139 406919 0 0 3 0x14000 0x200 reaper reaper 34067 147137 0 0 3 0x14000 0x200 pgdaemon pagedaemon 43107 418421 0 0 3 0x14000 0x200 bored viomb 62238 52283 0 0 3 0x14000 0x40000200 acpi0 acpi0 42849 511245 0 0 3 0x14000 0x40000200 idle1 66739 288006 0 0 3 0x14000 0x200 bored softnet1 97903 337907 0 0 3 0x14000 0x200 bored softnet0 70582 5073 0 0 3 0x14000 0x200 bored systqmp 57613 447119 0 0 3 0x14000 0x200 bored systq 34275 207176 0 0 3 0x14000 0x200 tmoslp softclockmp 71163 249640 0 0 3 0x14000 0x40000200 tmoslp softclock 92352 461070 0 0 3 0x14000 0x40000200 idle0 1 337956 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks Process 17362 (syz-executor) thread 0xffff800045ffaa80 (469042) exclusive rwlock amaplk r = 0 (0xffff800001d627c8) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320 #2 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464 #3 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776 #4 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] #4 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 #5 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 #6 physio+0x4a7 sys/kern/kern_physio.c:139 #7 spec_read+0x29a sys/kern/spec_vnops.c:215 #8 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #9 vn_read+0x1fc sys/kern/vfs_vnops.c:375 #10 dofilereadv+0x386 sys/kern/sys_generic.c:252 #11 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 #12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #13 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85e55840) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1 #2 sleep_finish+0x423 sys/kern/kern_synch.c:369 #3 rw_do_enter_write+0x21f sys/kern/kern_rwlock.c:298 #4 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464 #5 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776 #6 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] #6 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 #7 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 #8 physio+0x4a7 sys/kern/kern_physio.c:139 #9 spec_read+0x29a sys/kern/spec_vnops.c:215 #10 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #11 vn_read+0x1fc sys/kern/vfs_vnops.c:375 #12 dofilereadv+0x386 sys/kern/sys_generic.c:252 #13 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 #14 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #14 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #15 Xsyscall+0x128 shared rwlock vmmaplk r = 0 (0xffff8000017de8a8) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413 #2 uvm_fault_wire+0x116 uvm_fault_unwire sys/uvm/uvm_fault.c:1723 [inline] #2 uvm_fault_wire+0x116 sys/uvm/uvm_fault.c:1706 #3 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 #4 physio+0x4a7 sys/kern/kern_physio.c:139 #5 spec_read+0x29a sys/kern/spec_vnops.c:215 #6 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #7 vn_read+0x1fc sys/kern/vfs_vnops.c:375 #8 dofilereadv+0x386 sys/kern/sys_generic.c:252 #9 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 #10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #11 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11030 12234K 12234K 166960K 12163 0 pcb 17 24K 24K 166960K 17 0 rtable 83 4K 4K 166960K 171 0 pf 20 18K 20K 166960K 34 0 ifaddr 15 3K 3K 166960K 19 0 ifgroup 27 1K 1K 166960K 32 0 sysctl 1 1K 13K 166960K 5 0 counters 56 39K 39K 166960K 58 0 ioctlops 0 0K 4K 166960K 1477 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1227 79K 79K 166960K 1319 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 2 2K 2K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 292K 166960K 11964 0 file desc 4 9K 13K 166960K 145 0 proc 70 128K 144K 166960K 384 0 subproc 0 0K 1K 166960K 30 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 in_multi 22 1K 1K 166960K 33 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 1 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 25 182K 182K 166960K 25 0 exec 0 0K 2K 166960K 351 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 14 124K 124K 166960K 15 0 UVM amap 217 187K 343K 166960K 3912 0 UVM aobj 3 4K 4K 166960K 3 0 pinsyscall 1055 1737K 1737K 166960K 1299 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 5 0K 0K 166960K 10 0 temp 1 9164K 9176K 166960K 4947 0 kqueue 14 44K 44K 166960K 40 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 21 0 18 1 0 1 1 0 8 0 rtentry 176 45 0 12 2 0 2 2 0 8 0 unpcb 144 63 0 46 1 0 1 1 0 8 0 syncache 336 9 0 9 2 1 1 1 0 8 1 tcpcb 736 16 0 10 1 0 1 1 0 8 0 arp 136 6 0 2 1 0 1 1 0 8 0 inpcb 328 49 0 40 1 0 1 1 0 8 0 nd6 152 6 0 3 1 0 1 1 0 8 0 kcovpl 48 4 0 4 1 0 1 1 0 8 1 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 14 0 2 1 0 1 1 0 8 0 pfstkey 128 14 0 2 1 0 1 1 0 8 0 pfstate 448 14 0 2 2 0 2 2 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 193 0 48 10 0 10 10 0 8 0 art_table 40 194 0 48 2 0 2 2 0 8 0 art_node 32 45 0 15 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1631 0 155 93 0 93 93 0 8 0 ffsino 296 1631 0 155 114 0 114 114 0 8 0 nchpl 144 1918 0 165 65 0 65 65 0 8 0 vnodes 216 1675 0 0 94 0 94 94 0 8 0 namei 1024 6786 0 6786 3 2 1 2 0 8 1 percpumem 16 45 0 1 1 0 1 1 0 8 0 kstatmem 264 15 0 2 1 0 1 1 0 8 0 scxspl 216 11937 0 11937 4 3 1 3 1 8 1 plimitpl 152 55 0 44 1 0 1 1 0 8 0 sigapl 424 474 0 439 6 0 6 6 0 8 2 knotepl 120 57 0 0 2 0 2 2 0 8 0 kqueuepl 224 36 0 26 1 0 1 1 0 8 0 pipepl 344 185 0 178 2 0 2 2 0 8 1 fdescpl 528 458 0 439 3 0 3 3 0 8 1 filepl 160 1987 0 1907 5 1 4 5 0 8 0 lockfpl 104 6 0 4 1 0 1 1 0 8 0 lockfspl 48 4 0 2 1 0 1 1 0 8 0 sessionpl 144 38 0 29 1 0 1 1 0 8 0 pgrppl 48 54 0 44 1 0 1 1 0 8 0 ucredpl 104 141 0 128 1 0 1 1 0 8 0 zombiepl 144 439 0 439 1 0 1 1 0 8 1 processpl 1232 474 0 439 4 0 4 4 0 8 1 procpl 664 578 0 530 5 0 5 5 0 8 0 sockpl 752 133 0 104 4 0 4 4 0 8 1 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl16k 16384 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 149 0 0 19 0 19 19 0 8 0 mcl2k 2048 14 0 0 2 0 2 2 0 8 0 mextrefs 64 11 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 146 0 0 10 0 10 10 0 8 0 bufpl 272 7429 0 303 476 0 476 476 0 8 0 anonpl 32 11004 0 0 89 0 89 89 0 222 0 amapchunkpl 152 12529 0 12017 33 1 32 32 0 158 10 amappl16 200 4312 0 4173 8 0 8 8 0 8 0 amappl15 192 4 0 4 1 1 0 1 0 8 0 amappl14 184 383 0 378 1 0 1 1 0 8 0 amappl13 176 178 0 164 2 0 2 2 0 8 1 amappl12 168 728 0 709 2 0 2 2 0 8 1 amappl11 160 85 0 85 1 1 0 1 0 8 0 amappl10 152 101 0 82 2 0 2 2 0 8 1 amappl9 144 1797 0 1797 2 1 1 1 0 8 1 amappl8 136 131 0 103 2 0 2 2 0 8 1 amappl7 128 232 0 210 3 1 2 3 0 8 0 amappl6 120 140 0 136 1 0 1 1 0 8 0 amappl5 112 318 0 308 1 0 1 1 0 8 0 amappl4 104 385 0 363 2 0 2 2 0 8 1 amappl3 96 1782 0 1724 3 0 3 3 0 8 1 amappl2 88 871 0 803 5 0 5 5 0 8 2 amappl1 80 15564 0 15007 24 4 20 24 0 8 8 amappl 88 2995 0 2870 5 0 5 5 0 92 2 uvmvnodes 80 88 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 458 0 439 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 458 0 439 1 0 1 1 0 8 0 vmmpekpl 168 9551 0 9527 2 0 2 2 0 8 0 vmmpepl 168 57124 0 55511 129 0 129 129 0 357 58 vmsppl 488 457 0 439 4 0 4 4 0 8 1 rwobjpl 80 23937 0 22867 41 7 34 41 0 8 8 pdppl 4096 925 0 878 79 28 51 69 0 8 4 pvpl 32 54854 0 0 443 0 443 443 0 265 0 pmappl 256 457 0 439 2 0 2 2 0 8 0 extentpl 40 47 0 29 1 0 1 1 0 8 0 phpool 120 711 0 34 21 0 21 21 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x19: leave x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412 x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85e55040) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff85e55040) at __mp_lock+0x272 sys/kern/kern_lock.c:173 softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83 dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862 Xsoftclock() at Xsoftclock+0x27 __sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa kd_curproc sys/dev/kcov.c:580 [inline] __sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa sys/dev/kcov.c:212 syscall(ffff800029a83a40) at syscall+0x9e8 pin_check sys/sys/syscall_mi.h:89 [inline] syscall(ffff800029a83a40) at syscall+0x9e8 mi_syscall sys/sys/syscall_mi.h:164 [inline] syscall(ffff800029a83a40) at syscall+0x9e8 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b9a9e2d2a20, count: 5 ddb{0}> trace x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412 x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85e55040) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff85e55040) at __mp_lock+0x272 sys/kern/kern_lock.c:173 softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83 dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862 Xsoftclock() at Xsoftclock+0x27 __sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa kd_curproc sys/dev/kcov.c:580 [inline] __sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa sys/dev/kcov.c:212 syscall(ffff800029a83a40) at syscall+0x9e8 pin_check sys/sys/syscall_mi.h:89 [inline] syscall(ffff800029a83a40) at syscall+0x9e8 mi_syscall sys/sys/syscall_mi.h:164 [inline] syscall(ffff800029a83a40) at syscall+0x9e8 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b9a9e2d2a20, count: -10 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x17: popq %rbp db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198 __assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48 uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761 uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139 spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfeb2e3d560, count: 1 ddb{1}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198 __assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48 uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761 uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline] uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706 uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169 physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139 spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286 syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfeb2e3d560, count: -14