panic: pmap_growkernel: no memory to grow kernel (2)
31 views
Skip to first unread message
syzbot
Apr 29, 2020, 6:20:19 PM4/29/20
to syzkaller-f...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 2338a28d Add nhop to the ifa_rtrequest() callback.
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11f948a8100000
dashboard link: https://syzkaller.appspot.com/bug?extid=eaee5b8b74e6392a6d6d
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+eaee5b...@syzkaller.appspotmail.com
panic: pmap_growkernel: no memory to grow kernel
cpuid = 1
time = 633
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002590cc20
vpanic() at vpanic+0x1c7/frame 0xfffffe002590cc80
panic() at panic+0x43/frame 0xfffffe002590cce0
pmap_growkernel() at pmap_growkernel+0x4d4/frame 0xfffffe002590cd20
vm_map_insert() at vm_map_insert+0x3f1/frame 0xfffffe002590cde0
vm_map_find() at vm_map_find+0x9cd/frame 0xfffffe002590ced0
kva_import() at kva_import+0x5e/frame 0xfffffe002590cf20
vmem_try_fetch() at vmem_try_fetch+0x12d/frame 0xfffffe002590cf70
vmem_xalloc() at vmem_xalloc+0x93d/frame 0xfffffe002590d000
kva_import_domain() at kva_import_domain+0x68/frame 0xfffffe002590d050
vmem_try_fetch() at vmem_try_fetch+0x12d/frame 0xfffffe002590d0a0
vmem_xalloc() at vmem_xalloc+0x93d/frame 0xfffffe002590d130
vmem_alloc() at vmem_alloc+0xf9/frame 0xfffffe002590d190
kmem_malloc_domainset() at kmem_malloc_domainset+0x9c/frame 0xfffffe002590d200
malloc() at malloc+0x117/frame 0xfffffe002590d260
pfioctl() at pfioctl+0x112d/frame 0xfffffe002590d790
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe002590d7f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe002590d820
vn_ioctl() at vn_ioctl+0x27c/frame 0xfffffe002590d940
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe002590d980
kern_ioctl() at kern_ioctl+0x3d4/frame 0xfffffe002590d9f0
sys_ioctl() at sys_ioctl+0x22b/frame 0xfffffe002590dac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe002590dbf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe002590dbf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x80071d48a, rsp = 0x7fffdff9af38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 23082 tid 100174 ]
Stopped at kdb_enter+0x67: movq $0,0x14a96a6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe002ae00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe002590cc00
rbp 0xfffffe002590cc20
rsi 0x40001
rdi 0xffffffff810b8f46 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe0025c59a00
r12 0xffffffff82068ea0 ddb_dbbe
r13 0
r14 0xffffffff8194403f
r15 0xffffffff8194403f
rip 0xffffffff810ae1c7 kdb_enter+0x67
rflags 0x86 ll+0x65
kdb_enter+0x67: movq $0,0x14a96a6(%rip)
db> show proc
Process 23082 (syz-executor.3) at 0xfffff80000059a40:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 20132 at 0xfffff80013232a40
ABI: FreeBSD ELF64
arguments: /root/syz-executor.3
reaper: 0xfffff80003304000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe000498c9e8
(map 0xfffffe000498c9e8)
(map.pmap 0xfffffe000498caa8)
(pmap 0xfffffe000498cb08)
threads: 5
100932 RunQ syz-executor.3
100962 Run CPU 0 syz-executor.3
100969 S pipdwt 0xfffff80003cc2460 syz-executor.3
100161 S pipdwt 0xfffff80003cd4a50 syz-executor.3
100174 Run CPU 1 syz-executor.3
db> ps
pid ppid pgrp uid state wmesg wchan cmd
23089 17279 17279 0 D pfault 0xffffffff82048040 syz-executor.2
23087 19857 19857 0 R (threaded) syz-executor.0
100903 RunQ syz-executor.0
100976 S pipdwt 0xfffff80003cbf168 syz-executor.0
100981 S uwait 0xfffff80003a33000 syz-executor.0
100982 S uwait 0xfffff80003a33700 syz-executor.0
23082 20132 20132 0 R (threaded) syz-executor.3
100932 RunQ syz-executor.3
100962 Run CPU 0 syz-executor.3
100969 S pipdwt 0xfffff80003cc2460 syz-executor.3
100161 S pipdwt 0xfffff80003cd4a50 syz-executor.3
100174 Run CPU 1 syz-executor.3
22459 1 22459 65 Ss select 0xfffff80013f75340 dhclient
21841 1 21841 0 Ss select 0xfffff80003a34740 dhclient
21838 1 21838 0 Ss select 0xfffff80013f75840 dhclient
21779 1 21779 65 Ss select 0xfffff80013920440 dhclient
21205 1 21205 0 Ss select 0xfffff800139205c0 dhclient
21202 1 21202 0 Ss select 0xfffff8000380c140 dhclient
21167 1 21167 65 Ss select 0xfffff800138fff40 dhclient
20505 1 20505 0 Ss select 0xfffff80013f758c0 dhclient
20502 1 20502 0 Ss select 0xfffff80013920740 dhclient
20479 1 20479 65 Ss select 0xfffff8004d946b40 dhclient
20132 768 20132 0 Rs syz-executor.3
19857 768 19857 0 Rs syz-executor.0
19849 1 19849 0 Ss select 0xfffff80013926440 dhclient
19846 1 19846 0 Ss select 0xfffff80003a34840 dhclient
17279 768 17279 0 Rs syz-executor.2
16392 768 16392 0 Rs syz-executor.1
768 766 766 0 S (threaded) syz-fuzzer
100094 S kqread 0xfffff80003a37d00 syz-fuzzer
100106 S uwait 0xfffff80003a36a00 syz-fuzzer
100107 S uwait 0xfffff80003a36b00 syz-fuzzer
100108 S uwait 0xfffff80003a36c00 syz-fuzzer
100109 S uwait 0xfffff8000380cc00 syz-fuzzer
100110 S uwait 0xfffff8000380cd00 syz-fuzzer
100111 S uwait 0xfffff80003a36d00 syz-fuzzer
100112 S uwait 0xfffff80003a36e00 syz-fuzzer
100113 S uwait 0xfffff80003a33600 syz-fuzzer
100114 S uwait 0xfffff80003522d00 syz-fuzzer
100130 S uwait 0xfffff800138ff800 syz-fuzzer
766 764 766 0 Ss pause 0xfffff80003d620a8 csh
764 682 764 0 Ss select 0xfffff8000380c040 sshd
748 1 748 0 Ss+ ttyin 0xfffff80003805cb0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b068b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b06cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b050b0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003b054b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003b058b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003b05cb0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003b080b0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003b084b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252c1e0 cron
682 1 682 0 Ss select 0xfffff80003a338c0 sshd
495 1 495 0 Ss select 0xfffff80003a33e40 syslogd
424 1 424 0 Ss select 0xfffff80003a33ac0 devd
423 1 423 65 Ss select 0xfffff80003a33ec0 dhclient
338 1 338 0 Ss select 0xfffff8000380c8c0 dhclient
335 1 335 0 Ss select 0xfffff80003a339c0 dhclient
23 0 0 0 DL syncer 0xffffffff82618118 [syncer]
22 0 0 0 DL vlruwt 0xfffff800033c6a40 [vnlru]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff82617438 [bufdaemon]
100074 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100086 D sdflush 0xfffff80003806ce8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263e308 [vmdaemon]
19 0 0 0 RL (threaded) [pagedaemon]
100067 RunQ [dom0]
100075 D launds 0xffffffff826328e4 [laundry: dom0]
100076 D umarecl 0xffffffff82631ff0 [uma]
18 0 0 0 DL - 0xffffffff8235fe20 [rand_harvestq]
17 0 0 0 RL [pf purge]
16 0 0 0 DL waiting 0xffffffff8261a890 [sctp_iterator]
15 0 0 0 DL - 0xffffffff82616a2c [soaiod4]
9 0 0 0 DL - 0xffffffff82616a2c [soaiod3]
8 0 0 0 DL - 0xffffffff82616a2c [soaiod2]
7 0 0 0 DL - 0xffffffff82616a2c [soaiod1]
6 0 0 0 DL (threaded) [cam]
100033 D - 0xffffffff82237b40 [doneq0]
100066 D - 0xffffffff82237a10 [scanner]
5 0 0 0 DL crypto_ 0xfffff80003202d90 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff80003202d30 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff826300c0 [crypto]
14 0 0 0 DL seqstat 0xfffff80003351488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100024 D - 0xffffffff8250b180 [g_event]
100025 D - 0xffffffff8250b188 [g_up]
100026 D - 0xffffffff8250b190 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100017 D - 0xfffff800032fac80 [thr_0]
100018 D - 0xfffff800032facc0 [thr_1]
12 0 0 0 WL (threaded) [intr]
100010 I [swi6: Giant taskq]
100013 I [swi5: fast taskq]
100016 I [swi6: task queue]
100019 I [swi3: vm]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 I [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff80003304000 [init]
10 0 0 0 DL audit_w 0xffffffff82630598 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8250b710 [swapper]
100005 D - 0xfffff80003325000 [if_config_tqg_0]
100006 D - 0xfffff80003326e00 [softirq_0]
100007 D - 0xfffff80003326d00 [softirq_1]
100008 D - 0xfffff80003326c00 [if_io_tqg_0]
100009 D - 0xfffff80003326b00 [if_io_tqg_1]
100011 D - 0xfffff80003333600 [in6m_free taskq]
100012 D - 0xfffff80003333500 [thread taskq]
100014 D - 0xfffff80003333200 [kqueue_ctx taskq]
100015 D - 0xfffff80003333100 [aiod_kick taskq]
100023 D - 0xfffff80003334800 [firmware taskq]
100028 D - 0xfffff80003331c00 [crypto_0]
100029 D - 0xfffff80003331c00 [crypto_1]
100043 D - 0xfffff80003562c00 [vtnet0 rxq 0]
100044 D - 0xfffff80003562b00 [vtnet0 txq 0]
100045 D - 0xfffff80003562a00 [vtnet0 rxq 1]
100046 D - 0xfffff80003562900 [vtnet0 txq 1]
100048 D vtbslp 0xfffff80003522680 [virtio_balloon]
100052 D - 0xfffff80003335700 [mca taskq]
100057 D - 0xffffffff81ce7760 [deadlkres]
100062 D - 0xfffff80003331800 [acpi_task_0]
100063 D - 0xfffff80003331800 [acpi_task_1]
100064 D - 0xfffff80003331800 [acpi_task_2]
100065 D - 0xfffff80003331500 [CAM taskq]
db> show all locks
Process 23082 (syz-executor.3) thread 0xfffffe0025a3ca00 (100962)
exclusive sleep mutex pmap (pmap) r = 0 (0xffffffff8266b9b0) locked @ /syzkaller/managers/main/kernel/sys/amd64/amd64/pmap.c:5419
Process 23082 (syz-executor.3) thread 0xfffffe0025c59500 (100174)
exclusive sleep mutex vm map (system) (vm map (system)) r = 0 (0xfffff80003008080) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_map.c:2075
Process 16392 (syz-executor.1) thread 0xfffffe0025c8ce00 (101036)
exclusive lockmgr ufs (ufs) r = 0 (0xfffff8005e7ee9f0) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_subr.c:2930
exclusive lockmgr ufs (ufs) r = 0 (0xfffff80009307bd8) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_lookup.c:737
Process 19 (pagedaemon) thread 0xfffffe0004cf9a00 (100067)
shared rw UMA lock (UMA lock) r = 0 (0xffffffff82043f80) locked @ /syzkaller/managers/main/kernel/sys/vm/uma_core.c:2798
exclusive sx umareclaim (umareclaim) r = 0 (0xffffffff82631ff0) locked @ /syzkaller/managers/main/kernel/sys/vm/uma_core.c:4780
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 28335 1653K 28399
kobj 332 1328K 488
newblk 8 1026K 61737
vfscache 4 1025K 4
pcb 81 551K 25886
inodedep 16 520K 29172
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 153 294K 23182
acpica 1674 185K 52709
vnet_data 1 168K 1
filedesc 20 137K 41280
pagedep 8 130K 21665
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 244 92K 724
BPF 46 88K 446
bus 964 78K 3972
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 497 63K 497
umtx 360 45K 360
temp 39 41K 22241
kdtrace 195 38K 102167
hostcache 1 32K 1
shm 1 32K 20
DEVFS3 124 31K 134
pf_rule 37 30K 438
msg 4 30K 4
ifaddr 79 28K 573
DEVFS_RULE 56 27K 56
vmem 3 26K 5
gtaskqueue 18 26K 18
lockf 232 25K 18899
kbdmux 6 22K 6
sctp_timw 71 18K 71
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
lltable 43 16K 961
ithread 98 16K 98
ether_multi 172 14K 3636
bus-sc 30 14K 1431
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 132 12K 132
select 82 11K 82
in6_multi 89 11K 2115
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
routetbl 58 10K 896
cred 35 9K 1546
bmsafemap 2 9K 27655
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
shmfd 1 8K 67
pfs_vncache 1 8K 1
sctp_ifa 60 8K 464
audit_evclass 233 8K 291
kqueue 64 7K 23097
pf_ifnet 21 6K 129
CAM DEV 3 6K 510
plimit 24 6K 3843
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
ufs_dirhash 23 5K 30
DEVFSP 78 5K 2864
taskqueue 45 5K 45
session 35 5K 324
pgrp 35 5K 444
pf_osfp 39 5K 39
pf_table 2 4K 16
memdesc 1 4K 1
MCA 32 4K 32
UMA 249 4K 249
sctp_atcl 8 4K 14288
evdev 4 4K 4
kcovinfo 64 4K 2601
hhook 13 4K 13
sctp_stro 3 3K 3852
proc-args 52 3K 4252
acpisem 22 3K 22
terminal 11 3K 11
uidinfo 4 3K 98
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 319
inpcbpolicy 57 2K 67914
dirrem 7 2K 23437
Unitno 29 2K 109827
CAM XPT 22 2K 543
in_multi 6 2K 241
acpidev 20 2K 20
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 5232
NFSD session 1 1K 1
CAM periph 4 1K 271
freefile 7 1K 23279
nhops 6 1K 19
freework 4 1K 37991
freeblks 3 1K 22498
mld 6 1K 6
sctp_ifn 6 1K 155
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
crypto 3 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
sctp_atky 11 1K 18252
encap_export_host 8 1K 8
newdirblk 3 1K 20005
mkdir 3 1K 40008
diradd 3 1K 24076
osd 3 1K 9
vnodes 1 1K 373
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 6
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
sctp_athm 8 1K 14333
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
soname 4 1K 18180
sctp_map 6 1K 7704
nexusdev 5 1K 5
filecaps 5 1K 498
entropy 2 1K 241
ip6_msource 1 1K 29
sctp_vrf 1 1K 1
ip_msource 1 1K 263
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_altq 0 0K 0
pf_temp 0 0K 0
ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 90
midi buffers 0 0K 0
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 305273
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 14359
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 2593
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 249
allocindir 0 0K 0
indirdep 0 0K 20253
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 354
ip6_moptions 0 0K 64
in6_mfilter 0 0K 132
frag6 0 0K 0
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 7252
sctp_iter 0 0K 494
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 2
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 492
sctp_aadr 0 0K 104
sctp_stri 0 0K 74
newreno data 0 0K 0
ip_moptions 0 0K 1107
in_mfilter 0 0K 1003
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 27
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 19994
export_host 0 0K 0
cl_savebuf 0 0K 99
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 4995
accf 0 0K 0
pts 0 0K 0
iov 0 0K 101806
ioctlops 0 0K 3477
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 2989
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 48
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
db> show ktr
No such command; use "help" to list available commands
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 2338a28d Add nhop to the ifa_rtrequest() callback.
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11f948a8100000
dashboard link: https://syzkaller.appspot.com/bug?extid=eaee5b8b74e6392a6d6d
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+eaee5b...@syzkaller.appspotmail.com
panic: pmap_growkernel: no memory to grow kernel
cpuid = 1
time = 633
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002590cc20
vpanic() at vpanic+0x1c7/frame 0xfffffe002590cc80
panic() at panic+0x43/frame 0xfffffe002590cce0
pmap_growkernel() at pmap_growkernel+0x4d4/frame 0xfffffe002590cd20
vm_map_insert() at vm_map_insert+0x3f1/frame 0xfffffe002590cde0
vm_map_find() at vm_map_find+0x9cd/frame 0xfffffe002590ced0
kva_import() at kva_import+0x5e/frame 0xfffffe002590cf20
vmem_try_fetch() at vmem_try_fetch+0x12d/frame 0xfffffe002590cf70
vmem_xalloc() at vmem_xalloc+0x93d/frame 0xfffffe002590d000
kva_import_domain() at kva_import_domain+0x68/frame 0xfffffe002590d050
vmem_try_fetch() at vmem_try_fetch+0x12d/frame 0xfffffe002590d0a0
vmem_xalloc() at vmem_xalloc+0x93d/frame 0xfffffe002590d130
vmem_alloc() at vmem_alloc+0xf9/frame 0xfffffe002590d190
kmem_malloc_domainset() at kmem_malloc_domainset+0x9c/frame 0xfffffe002590d200
malloc() at malloc+0x117/frame 0xfffffe002590d260
pfioctl() at pfioctl+0x112d/frame 0xfffffe002590d790
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe002590d7f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe002590d820
vn_ioctl() at vn_ioctl+0x27c/frame 0xfffffe002590d940
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe002590d980
kern_ioctl() at kern_ioctl+0x3d4/frame 0xfffffe002590d9f0
sys_ioctl() at sys_ioctl+0x22b/frame 0xfffffe002590dac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe002590dbf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe002590dbf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x80071d48a, rsp = 0x7fffdff9af38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 23082 tid 100174 ]
Stopped at kdb_enter+0x67: movq $0,0x14a96a6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe002ae00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe002590cc00
rbp 0xfffffe002590cc20
rsi 0x40001
rdi 0xffffffff810b8f46 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe0025c59a00
r12 0xffffffff82068ea0 ddb_dbbe
r13 0
r14 0xffffffff8194403f
r15 0xffffffff8194403f
rip 0xffffffff810ae1c7 kdb_enter+0x67
rflags 0x86 ll+0x65
kdb_enter+0x67: movq $0,0x14a96a6(%rip)
db> show proc
Process 23082 (syz-executor.3) at 0xfffff80000059a40:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 20132 at 0xfffff80013232a40
ABI: FreeBSD ELF64
arguments: /root/syz-executor.3
reaper: 0xfffff80003304000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe000498c9e8
(map 0xfffffe000498c9e8)
(map.pmap 0xfffffe000498caa8)
(pmap 0xfffffe000498cb08)
threads: 5
100932 RunQ syz-executor.3
100962 Run CPU 0 syz-executor.3
100969 S pipdwt 0xfffff80003cc2460 syz-executor.3
100161 S pipdwt 0xfffff80003cd4a50 syz-executor.3
100174 Run CPU 1 syz-executor.3
db> ps
pid ppid pgrp uid state wmesg wchan cmd
23089 17279 17279 0 D pfault 0xffffffff82048040 syz-executor.2
23087 19857 19857 0 R (threaded) syz-executor.0
100903 RunQ syz-executor.0
100976 S pipdwt 0xfffff80003cbf168 syz-executor.0
100981 S uwait 0xfffff80003a33000 syz-executor.0
100982 S uwait 0xfffff80003a33700 syz-executor.0
23082 20132 20132 0 R (threaded) syz-executor.3
100932 RunQ syz-executor.3
100962 Run CPU 0 syz-executor.3
100969 S pipdwt 0xfffff80003cc2460 syz-executor.3
100161 S pipdwt 0xfffff80003cd4a50 syz-executor.3
100174 Run CPU 1 syz-executor.3
22459 1 22459 65 Ss select 0xfffff80013f75340 dhclient
21841 1 21841 0 Ss select 0xfffff80003a34740 dhclient
21838 1 21838 0 Ss select 0xfffff80013f75840 dhclient
21779 1 21779 65 Ss select 0xfffff80013920440 dhclient
21205 1 21205 0 Ss select 0xfffff800139205c0 dhclient
21202 1 21202 0 Ss select 0xfffff8000380c140 dhclient
21167 1 21167 65 Ss select 0xfffff800138fff40 dhclient
20505 1 20505 0 Ss select 0xfffff80013f758c0 dhclient
20502 1 20502 0 Ss select 0xfffff80013920740 dhclient
20479 1 20479 65 Ss select 0xfffff8004d946b40 dhclient
20132 768 20132 0 Rs syz-executor.3
19857 768 19857 0 Rs syz-executor.0
19849 1 19849 0 Ss select 0xfffff80013926440 dhclient
19846 1 19846 0 Ss select 0xfffff80003a34840 dhclient
17279 768 17279 0 Rs syz-executor.2
16392 768 16392 0 Rs syz-executor.1
768 766 766 0 S (threaded) syz-fuzzer
100094 S kqread 0xfffff80003a37d00 syz-fuzzer
100106 S uwait 0xfffff80003a36a00 syz-fuzzer
100107 S uwait 0xfffff80003a36b00 syz-fuzzer
100108 S uwait 0xfffff80003a36c00 syz-fuzzer
100109 S uwait 0xfffff8000380cc00 syz-fuzzer
100110 S uwait 0xfffff8000380cd00 syz-fuzzer
100111 S uwait 0xfffff80003a36d00 syz-fuzzer
100112 S uwait 0xfffff80003a36e00 syz-fuzzer
100113 S uwait 0xfffff80003a33600 syz-fuzzer
100114 S uwait 0xfffff80003522d00 syz-fuzzer
100130 S uwait 0xfffff800138ff800 syz-fuzzer
766 764 766 0 Ss pause 0xfffff80003d620a8 csh
764 682 764 0 Ss select 0xfffff8000380c040 sshd
748 1 748 0 Ss+ ttyin 0xfffff80003805cb0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b068b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b06cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b050b0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003b054b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003b058b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003b05cb0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003b080b0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003b084b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252c1e0 cron
682 1 682 0 Ss select 0xfffff80003a338c0 sshd
495 1 495 0 Ss select 0xfffff80003a33e40 syslogd
424 1 424 0 Ss select 0xfffff80003a33ac0 devd
423 1 423 65 Ss select 0xfffff80003a33ec0 dhclient
338 1 338 0 Ss select 0xfffff8000380c8c0 dhclient
335 1 335 0 Ss select 0xfffff80003a339c0 dhclient
23 0 0 0 DL syncer 0xffffffff82618118 [syncer]
22 0 0 0 DL vlruwt 0xfffff800033c6a40 [vnlru]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff82617438 [bufdaemon]
100074 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100086 D sdflush 0xfffff80003806ce8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263e308 [vmdaemon]
19 0 0 0 RL (threaded) [pagedaemon]
100067 RunQ [dom0]
100075 D launds 0xffffffff826328e4 [laundry: dom0]
100076 D umarecl 0xffffffff82631ff0 [uma]
18 0 0 0 DL - 0xffffffff8235fe20 [rand_harvestq]
17 0 0 0 RL [pf purge]
16 0 0 0 DL waiting 0xffffffff8261a890 [sctp_iterator]
15 0 0 0 DL - 0xffffffff82616a2c [soaiod4]
9 0 0 0 DL - 0xffffffff82616a2c [soaiod3]
8 0 0 0 DL - 0xffffffff82616a2c [soaiod2]
7 0 0 0 DL - 0xffffffff82616a2c [soaiod1]
6 0 0 0 DL (threaded) [cam]
100033 D - 0xffffffff82237b40 [doneq0]
100066 D - 0xffffffff82237a10 [scanner]
5 0 0 0 DL crypto_ 0xfffff80003202d90 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff80003202d30 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff826300c0 [crypto]
14 0 0 0 DL seqstat 0xfffff80003351488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100024 D - 0xffffffff8250b180 [g_event]
100025 D - 0xffffffff8250b188 [g_up]
100026 D - 0xffffffff8250b190 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100017 D - 0xfffff800032fac80 [thr_0]
100018 D - 0xfffff800032facc0 [thr_1]
12 0 0 0 WL (threaded) [intr]
100010 I [swi6: Giant taskq]
100013 I [swi5: fast taskq]
100016 I [swi6: task queue]
100019 I [swi3: vm]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 I [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff80003304000 [init]
10 0 0 0 DL audit_w 0xffffffff82630598 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8250b710 [swapper]
100005 D - 0xfffff80003325000 [if_config_tqg_0]
100006 D - 0xfffff80003326e00 [softirq_0]
100007 D - 0xfffff80003326d00 [softirq_1]
100008 D - 0xfffff80003326c00 [if_io_tqg_0]
100009 D - 0xfffff80003326b00 [if_io_tqg_1]
100011 D - 0xfffff80003333600 [in6m_free taskq]
100012 D - 0xfffff80003333500 [thread taskq]
100014 D - 0xfffff80003333200 [kqueue_ctx taskq]
100015 D - 0xfffff80003333100 [aiod_kick taskq]
100023 D - 0xfffff80003334800 [firmware taskq]
100028 D - 0xfffff80003331c00 [crypto_0]
100029 D - 0xfffff80003331c00 [crypto_1]
100043 D - 0xfffff80003562c00 [vtnet0 rxq 0]
100044 D - 0xfffff80003562b00 [vtnet0 txq 0]
100045 D - 0xfffff80003562a00 [vtnet0 rxq 1]
100046 D - 0xfffff80003562900 [vtnet0 txq 1]
100048 D vtbslp 0xfffff80003522680 [virtio_balloon]
100052 D - 0xfffff80003335700 [mca taskq]
100057 D - 0xffffffff81ce7760 [deadlkres]
100062 D - 0xfffff80003331800 [acpi_task_0]
100063 D - 0xfffff80003331800 [acpi_task_1]
100064 D - 0xfffff80003331800 [acpi_task_2]
100065 D - 0xfffff80003331500 [CAM taskq]
db> show all locks
Process 23082 (syz-executor.3) thread 0xfffffe0025a3ca00 (100962)
exclusive sleep mutex pmap (pmap) r = 0 (0xffffffff8266b9b0) locked @ /syzkaller/managers/main/kernel/sys/amd64/amd64/pmap.c:5419
Process 23082 (syz-executor.3) thread 0xfffffe0025c59500 (100174)
exclusive sleep mutex vm map (system) (vm map (system)) r = 0 (0xfffff80003008080) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_map.c:2075
Process 16392 (syz-executor.1) thread 0xfffffe0025c8ce00 (101036)
exclusive lockmgr ufs (ufs) r = 0 (0xfffff8005e7ee9f0) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_subr.c:2930
exclusive lockmgr ufs (ufs) r = 0 (0xfffff80009307bd8) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_lookup.c:737
Process 19 (pagedaemon) thread 0xfffffe0004cf9a00 (100067)
shared rw UMA lock (UMA lock) r = 0 (0xffffffff82043f80) locked @ /syzkaller/managers/main/kernel/sys/vm/uma_core.c:2798
exclusive sx umareclaim (umareclaim) r = 0 (0xffffffff82631ff0) locked @ /syzkaller/managers/main/kernel/sys/vm/uma_core.c:4780
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 28335 1653K 28399
kobj 332 1328K 488
newblk 8 1026K 61737
vfscache 4 1025K 4
pcb 81 551K 25886
inodedep 16 520K 29172
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 153 294K 23182
acpica 1674 185K 52709
vnet_data 1 168K 1
filedesc 20 137K 41280
pagedep 8 130K 21665
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 244 92K 724
BPF 46 88K 446
bus 964 78K 3972
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 497 63K 497
umtx 360 45K 360
temp 39 41K 22241
kdtrace 195 38K 102167
hostcache 1 32K 1
shm 1 32K 20
DEVFS3 124 31K 134
pf_rule 37 30K 438
msg 4 30K 4
ifaddr 79 28K 573
DEVFS_RULE 56 27K 56
vmem 3 26K 5
gtaskqueue 18 26K 18
lockf 232 25K 18899
kbdmux 6 22K 6
sctp_timw 71 18K 71
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
lltable 43 16K 961
ithread 98 16K 98
ether_multi 172 14K 3636
bus-sc 30 14K 1431
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 132 12K 132
select 82 11K 82
in6_multi 89 11K 2115
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
routetbl 58 10K 896
cred 35 9K 1546
bmsafemap 2 9K 27655
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
shmfd 1 8K 67
pfs_vncache 1 8K 1
sctp_ifa 60 8K 464
audit_evclass 233 8K 291
kqueue 64 7K 23097
pf_ifnet 21 6K 129
CAM DEV 3 6K 510
plimit 24 6K 3843
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
ufs_dirhash 23 5K 30
DEVFSP 78 5K 2864
taskqueue 45 5K 45
session 35 5K 324
pgrp 35 5K 444
pf_osfp 39 5K 39
pf_table 2 4K 16
memdesc 1 4K 1
MCA 32 4K 32
UMA 249 4K 249
sctp_atcl 8 4K 14288
evdev 4 4K 4
kcovinfo 64 4K 2601
hhook 13 4K 13
sctp_stro 3 3K 3852
proc-args 52 3K 4252
acpisem 22 3K 22
terminal 11 3K 11
uidinfo 4 3K 98
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 319
inpcbpolicy 57 2K 67914
dirrem 7 2K 23437
Unitno 29 2K 109827
CAM XPT 22 2K 543
in_multi 6 2K 241
acpidev 20 2K 20
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 5232
NFSD session 1 1K 1
CAM periph 4 1K 271
freefile 7 1K 23279
nhops 6 1K 19
freework 4 1K 37991
freeblks 3 1K 22498
mld 6 1K 6
sctp_ifn 6 1K 155
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
crypto 3 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
sctp_atky 11 1K 18252
encap_export_host 8 1K 8
newdirblk 3 1K 20005
mkdir 3 1K 40008
diradd 3 1K 24076
osd 3 1K 9
vnodes 1 1K 373
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 6
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
sctp_athm 8 1K 14333
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
soname 4 1K 18180
sctp_map 6 1K 7704
nexusdev 5 1K 5
filecaps 5 1K 498
entropy 2 1K 241
ip6_msource 1 1K 29
sctp_vrf 1 1K 1
ip_msource 1 1K 263
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_altq 0 0K 0
pf_temp 0 0K 0
ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 90
midi buffers 0 0K 0
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 305273
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 14359
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 2593
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 249
allocindir 0 0K 0
indirdep 0 0K 20253
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 354
ip6_moptions 0 0K 64
in6_mfilter 0 0K 132
frag6 0 0K 0
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 7252
sctp_iter 0 0K 494
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 2
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 492
sctp_aadr 0 0K 104
sctp_stri 0 0K 74
newreno data 0 0K 0
ip_moptions 0 0K 1107
in_mfilter 0 0K 1003
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 27
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 19994
export_host 0 0K 0
cl_savebuf 0 0K 99
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 4995
accf 0 0K 0
pts 0 0K 0
iov 0 0K 101806
ioctlops 0 0K 3477
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 2989
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 48
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
db> show ktr
No such command; use "help" to list available commands
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Apr 30, 2020, 4:04:14 AM4/30/20
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 2338a28d Add nhop to the ifa_rtrequest() callback.
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=17364bac100000
dashboard link: https://syzkaller.appspot.com/bug?extid=eaee5b8b74e6392a6d6d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1447daa8100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+eaee5b...@syzkaller.appspotmail.com
panic: pmap_growkernel: no memory to grow kernel
cpuid = 1
time = 1588227514
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00258b2c20
vpanic() at vpanic+0x1c7/frame 0xfffffe00258b2c80
panic() at panic+0x43/frame 0xfffffe00258b2ce0
pmap_growkernel() at pmap_growkernel+0x4d4/frame 0xfffffe00258b2d20
vm_map_insert() at vm_map_insert+0x3f1/frame 0xfffffe00258b2de0
vm_map_find() at vm_map_find+0x9cd/frame 0xfffffe00258b2ed0
kva_import() at kva_import+0x5e/frame 0xfffffe00258b2f20
vmem_try_fetch() at vmem_try_fetch+0x12d/frame 0xfffffe00258b2f70
vmem_xalloc() at vmem_xalloc+0x93d/frame 0xfffffe00258b3000
kva_import_domain() at kva_import_domain+0x68/frame 0xfffffe00258b3050
vmem_try_fetch() at vmem_try_fetch+0x12d/frame 0xfffffe00258b30a0
vmem_xalloc() at vmem_xalloc+0x93d/frame 0xfffffe00258b3130
vmem_alloc() at vmem_alloc+0xf9/frame 0xfffffe00258b3190
kmem_malloc_domainset() at kmem_malloc_domainset+0x9c/frame 0xfffffe00258b3200
malloc() at malloc+0x117/frame 0xfffffe00258b3260
pfioctl() at pfioctl+0x112d/frame 0xfffffe00258b3790
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe00258b37f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe00258b3820
vn_ioctl() at vn_ioctl+0x27c/frame 0xfffffe00258b3940
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe00258b3980
kern_ioctl() at kern_ioctl+0x3d4/frame 0xfffffe00258b39f0
sys_ioctl() at sys_ioctl+0x22b/frame 0xfffffe00258b3ac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe00258b3bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe00258b3bf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x80071d48a, rsp = 0x7fffdffdcf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 866 tid 100128 ]
rdx 0xffffffff818a400b
rbx 0
rsp 0xfffffe00258b2c00
rbp 0xfffffe00258b2c20
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0x5060626f6a561eeb
r11 0xfffffe0025a4ea00
ABI: FreeBSD ELF64
arguments: /root/syz-executor.0
(map 0xfffffe0025a463d0)
(map.pmap 0xfffffe0025a46490)
(pmap 0xfffffe0025a464f0)
threads: 3
100123 RunQ syz-executor.0
100127 L *kernel 0xfffff80003a32c00 syz-executor.0
100128 Run CPU 1 syz-executor.0
876 875 424 0 L *kernel 0xfffff80003a32c00 rtsol
875 874 424 0 S select 0xfffff80003a34140 rtsol
874 804 424 0 S select 0xfffff80003a341c0 rtsol
866 784 784 0 R (threaded) syz-executor.0
100123 RunQ syz-executor.0
100127 L *kernel 0xfffff80003a32c00 syz-executor.0
100128 Run CPU 1 syz-executor.0
865 788 788 0 R (threaded) syz-executor.1
100100 RunQ syz-executor.1
100126 RunQ syz-executor.1
100131 S uwait 0xfffff8001382f380 syz-executor.1
100139 RunQ syz-executor.1
100140 S uwait 0xfffff80003a34780 syz-executor.1
864 786 786 0 T (threaded) syz-executor.2
100118 s syz-executor.2
100124 L *kernel 0xfffff80003a32c00 syz-executor.2
100137 RunQ syz-executor.2
863 787 787 0 T (threaded) syz-executor.3
100117 s syz-executor.3
100125 RunQ syz-executor.3
100129 RunQ syz-executor.3
804 790 424 0 S wait 0xfffff80003cb1a40 sh
790 424 424 0 S wait 0xfffff80003cb3000 sh
788 782 788 0 Rs syz-executor.1
787 782 787 0 Ss nanslp 0xffffffff8252c1e1 syz-executor.3
786 782 786 0 Rs syz-executor.2
784 782 784 0 Ss nanslp 0xffffffff8252c1e1 syz-executor.0
782 780 780 0 S (threaded) syz-execprog
100103 S uwait 0xfffff80003a36e00 syz-execprog
100104 S uwait 0xfffff8000380b900 syz-execprog
100105 S uwait 0xfffff8000380c300 syz-execprog
100106 S uwait 0xfffff8000380c400 syz-execprog
100107 S uwait 0xfffff8000380c500 syz-execprog
100108 S uwait 0xfffff8000380c600 syz-execprog
100110 S uwait 0xfffff80003a33980 syz-execprog
100111 S kqread 0xfffff80003cdb600 syz-execprog
100112 S uwait 0xfffff8000380ca00 syz-execprog
100113 S uwait 0xfffff8000380cb00 syz-execprog
100114 S uwait 0xfffff80003522d80 syz-execprog
780 778 780 0 Ss pause 0xfffff800134565c8 csh
778 682 778 0 Ss select 0xfffff8000380b240 sshd
495 1 495 0 Ss select 0xfffff8000380e9c0 syslogd
424 1 424 0 Ss wait 0xfffff80003d92000 devd
423 1 423 65 Ss select 0xfffff80003a33e40 dhclient
338 1 338 0 Ss select 0xfffff80003a33bc0 dhclient
335 1 335 0 Ss select 0xfffff8000380b1c0 dhclient
100069 RunQ [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100086 D sdflush 0xfffff80003b034e8 [/ worker]
100074 D launds 0xffffffff826328e4 [laundry: dom0]
100075 D umarcl 0xffffffff81545a10 [uma]
100057 D - 0xffffffff81ce7761 [deadlkres]
exclusive rw kernel vm object (kernel vm object) r = 0 (0xffffffff82632168) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_kern.c:476
vfscache 4 1025K 4
pcb 21 537K 83
inodedep 24 524K 94
pagedep 14 132K 32
bus 992 79K 3376
umtx 288 36K 288
temp 35 33K 1880
hostcache 1 32K 1
shm 1 32K 1
DEVFS3 124 31K 134
msg 4 30K 4
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18
ifaddr 70 23K 72
vmem 3 22K 4
kbdmux 6 22K 6
BPF 14 19K 14
lltable 47 18K 47
ether_multi 172 14K 177
pfs_vncache 1 8K 1
audit_evclass 233 8K 291
routetbl 57 7K 61
cred 20 5K 263
taskqueue 45 5K 45
ufs_dirhash 20 5K 24
pf_ifnet 10 5K 19
hhook 13 4K 13
diradd 25 4K 61
session 24 3K 39
pgrp 24 3K 39
mkdir 23 3K 40
select 18 3K 18
uidinfo 3 3K 11
sctp_ifa 17 3K 17
ipsec-saq 2 2K 2
ip6ndp 12 2K 21
lockf 16 2K 29
Unitno 28 2K 45
in_multi 6 2K 7
sctp_ifn 6 1K 6
igmp 6 1K 6
nhops 6 1K 6
DEVFSP 6 1K 6
osd 3 1K 9
vnodes 1 1K 1
nexusdev 5 1K 5
entropy 2 1K 41
sctp_vrf 1 1K 1
p1003.1b 1 1K 1
filecaps 1 1K 74
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
tcp_log_dev 0 0K 0
freefile 0 0K 26
freeblks 0 0K 25
freefrag 0 0K 5
allocindir 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
sctp_iter 0 0K 7
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 7
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 2
ioctlops 0 0K 102
HEAD commit: 2338a28d Add nhop to the ifa_rtrequest() callback.
git tree: freebsd
dashboard link: https://syzkaller.appspot.com/bug?extid=eaee5b8b74e6392a6d6d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1447daa8100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+eaee5b...@syzkaller.appspotmail.com
panic: pmap_growkernel: no memory to grow kernel
cpuid = 1
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00258b2c20
vpanic() at vpanic+0x1c7/frame 0xfffffe00258b2c80
panic() at panic+0x43/frame 0xfffffe00258b2ce0
pmap_growkernel() at pmap_growkernel+0x4d4/frame 0xfffffe00258b2d20
vm_map_insert() at vm_map_insert+0x3f1/frame 0xfffffe00258b2de0
vm_map_find() at vm_map_find+0x9cd/frame 0xfffffe00258b2ed0
kva_import() at kva_import+0x5e/frame 0xfffffe00258b2f20
vmem_try_fetch() at vmem_try_fetch+0x12d/frame 0xfffffe00258b2f70
vmem_xalloc() at vmem_xalloc+0x93d/frame 0xfffffe00258b3000
kva_import_domain() at kva_import_domain+0x68/frame 0xfffffe00258b3050
vmem_try_fetch() at vmem_try_fetch+0x12d/frame 0xfffffe00258b30a0
vmem_xalloc() at vmem_xalloc+0x93d/frame 0xfffffe00258b3130
vmem_alloc() at vmem_alloc+0xf9/frame 0xfffffe00258b3190
kmem_malloc_domainset() at kmem_malloc_domainset+0x9c/frame 0xfffffe00258b3200
malloc() at malloc+0x117/frame 0xfffffe00258b3260
pfioctl() at pfioctl+0x112d/frame 0xfffffe00258b3790
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe00258b37f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe00258b3820
vn_ioctl() at vn_ioctl+0x27c/frame 0xfffffe00258b3940
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe00258b3980
kern_ioctl() at kern_ioctl+0x3d4/frame 0xfffffe00258b39f0
sys_ioctl() at sys_ioctl+0x22b/frame 0xfffffe00258b3ac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe00258b3bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe00258b3bf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x80071d48a, rsp = 0x7fffdffdcf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 866 tid 100128 ]
Stopped at kdb_enter+0x67: movq $0,0x14a96a6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0x80 ll+0x5f
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rdx 0xffffffff818a400b
rbx 0
rsp 0xfffffe00258b2c00
rbp 0xfffffe00258b2c20
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0x5060626f6a561eeb
r11 0xfffffe0025a4ea00
r12 0xffffffff82068ea0 ddb_dbbe
r13 0
r14 0xffffffff8194403f
r15 0xffffffff8194403f
rip 0xffffffff810ae1c7 kdb_enter+0x67
rflags 0x86 ll+0x65
kdb_enter+0x67: movq $0,0x14a96a6(%rip)
db> show proc
Process 866 (syz-executor.0) at 0xfffff80013875000:
r13 0
r14 0xffffffff8194403f
r15 0xffffffff8194403f
rip 0xffffffff810ae1c7 kdb_enter+0x67
rflags 0x86 ll+0x65
kdb_enter+0x67: movq $0,0x14a96a6(%rip)
db> show proc
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 784 at 0xfffff8001378ea40
uid: 0 gids: 0, 0, 5
ABI: FreeBSD ELF64
arguments: /root/syz-executor.0
reaper: 0xfffff80003304000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe0025a463d0
sigparent: 20
(map 0xfffffe0025a463d0)
(map.pmap 0xfffffe0025a46490)
(pmap 0xfffffe0025a464f0)
threads: 3
100123 RunQ syz-executor.0
100127 L *kernel 0xfffff80003a32c00 syz-executor.0
100128 Run CPU 1 syz-executor.0
db> ps
pid ppid pgrp uid state wmesg wchan cmd
877 876 877 0 Ss select 0xfffff80003a34040 rtsol
pid ppid pgrp uid state wmesg wchan cmd
876 875 424 0 L *kernel 0xfffff80003a32c00 rtsol
875 874 424 0 S select 0xfffff80003a34140 rtsol
874 804 424 0 S select 0xfffff80003a341c0 rtsol
866 784 784 0 R (threaded) syz-executor.0
100123 RunQ syz-executor.0
100127 L *kernel 0xfffff80003a32c00 syz-executor.0
100128 Run CPU 1 syz-executor.0
865 788 788 0 R (threaded) syz-executor.1
100100 RunQ syz-executor.1
100126 RunQ syz-executor.1
100131 S uwait 0xfffff8001382f380 syz-executor.1
100139 RunQ syz-executor.1
100140 S uwait 0xfffff80003a34780 syz-executor.1
864 786 786 0 T (threaded) syz-executor.2
100118 s syz-executor.2
100124 L *kernel 0xfffff80003a32c00 syz-executor.2
100137 RunQ syz-executor.2
863 787 787 0 T (threaded) syz-executor.3
100117 s syz-executor.3
100125 RunQ syz-executor.3
100129 RunQ syz-executor.3
804 790 424 0 S wait 0xfffff80003cb1a40 sh
790 424 424 0 S wait 0xfffff80003cb3000 sh
788 782 788 0 Rs syz-executor.1
787 782 787 0 Ss nanslp 0xffffffff8252c1e1 syz-executor.3
786 782 786 0 Rs syz-executor.2
784 782 784 0 Ss nanslp 0xffffffff8252c1e1 syz-executor.0
782 780 780 0 S (threaded) syz-execprog
100103 S uwait 0xfffff80003a36e00 syz-execprog
100104 S uwait 0xfffff8000380b900 syz-execprog
100105 S uwait 0xfffff8000380c300 syz-execprog
100106 S uwait 0xfffff8000380c400 syz-execprog
100107 S uwait 0xfffff8000380c500 syz-execprog
100108 S uwait 0xfffff8000380c600 syz-execprog
100110 S uwait 0xfffff80003a33980 syz-execprog
100111 S kqread 0xfffff80003cdb600 syz-execprog
100112 S uwait 0xfffff8000380ca00 syz-execprog
100113 S uwait 0xfffff8000380cb00 syz-execprog
100114 S uwait 0xfffff80003522d80 syz-execprog
780 778 780 0 Ss pause 0xfffff800134565c8 csh
778 682 778 0 Ss select 0xfffff8000380b240 sshd
748 1 748 0 Ss+ ttyin 0xfffff80003805cb0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b068b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b06cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b050b0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003b054b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003b058b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003b05cb0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003b080b0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003b084b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252c1e0 cron
682 1 682 0 Ss select 0xfffff8000380c940 sshd
747 1 747 0 Ss+ ttyin 0xfffff80003b068b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b06cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b050b0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003b054b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003b058b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003b05cb0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003b080b0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003b084b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252c1e0 cron
495 1 495 0 Ss select 0xfffff8000380e9c0 syslogd
424 1 424 0 Ss wait 0xfffff80003d92000 devd
423 1 423 65 Ss select 0xfffff80003a33e40 dhclient
338 1 338 0 Ss select 0xfffff80003a33bc0 dhclient
335 1 335 0 Ss select 0xfffff8000380b1c0 dhclient
23 0 0 0 DL syncer 0xffffffff82618118 [syncer]
22 0 0 0 DL vlruwt 0xfffff800033c6a40 [vnlru]
21 0 0 0 RL (threaded) [bufdaemon]
22 0 0 0 DL vlruwt 0xfffff800033c6a40 [vnlru]
100069 RunQ [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100086 D sdflush 0xfffff80003b034e8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263e308 [vmdaemon]
19 0 0 0 RL (threaded) [pagedaemon]
100067 Run CPU 0 [dom0]
19 0 0 0 RL (threaded) [pagedaemon]
100074 D launds 0xffffffff826328e4 [laundry: dom0]
100075 D umarcl 0xffffffff81545a10 [uma]
18 0 0 0 DL - 0xffffffff8235fe20 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82b533a0 [pf purge]
100062 D - 0xfffff80003331800 [acpi_task_0]
100063 D - 0xfffff80003331800 [acpi_task_1]
100064 D - 0xfffff80003331800 [acpi_task_2]
100065 D - 0xfffff80003331500 [CAM taskq]
db> show all locks
Process 866 (syz-executor.0) thread 0xfffffe0025a4e500 (100128)
100063 D - 0xfffff80003331800 [acpi_task_1]
100064 D - 0xfffff80003331800 [acpi_task_2]
100065 D - 0xfffff80003331500 [CAM taskq]
db> show all locks
exclusive sleep mutex vm map (system) (vm map (system)) r = 0 (0xfffff80003008080) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_map.c:2075
Process 865 (syz-executor.1) thread 0xfffffe0025a7d300 (100139)
exclusive rw kernel vm object (kernel vm object) r = 0 (0xffffffff82632168) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_kern.c:476
Process 19 (pagedaemon) thread 0xfffffe0004cf9a00 (100067)
shared rw UMA lock (UMA lock) r = 0 (0xffffffff82043f80) locked @ /syzkaller/managers/main/kernel/sys/vm/uma_core.c:2798
exclusive sx umareclaim (umareclaim) r = 0 (0xffffffff82631ff0) locked @ /syzkaller/managers/main/kernel/sys/vm/uma_core.c:4780
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 28335 1653K 28399
kobj 332 1328K 488
newblk 30 1032K 237
shared rw UMA lock (UMA lock) r = 0 (0xffffffff82043f80) locked @ /syzkaller/managers/main/kernel/sys/vm/uma_core.c:2798
exclusive sx umareclaim (umareclaim) r = 0 (0xffffffff82631ff0) locked @ /syzkaller/managers/main/kernel/sys/vm/uma_core.c:4780
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 28335 1653K 28399
kobj 332 1328K 488
vfscache 4 1025K 4
pcb 21 537K 83
inodedep 24 524K 94
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 124 262K 945
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
acpica 1674 185K 52709
vnet_data 1 168K 1
filedesc 21 149K 69
vnet_data 1 168K 1
pagedep 14 132K 32
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 244 92K 277
sem 4 106K 4
DEVFS1 105 105K 122
bus 992 79K 3376
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 497 63K 497
kdtrace 192 38K 1835
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 497 63K 497
umtx 288 36K 288
temp 35 33K 1880
hostcache 1 32K 1
shm 1 32K 1
DEVFS3 124 31K 134
msg 4 30K 4
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18
ifaddr 70 23K 72
vmem 3 22K 4
kbdmux 6 22K 6
BPF 14 19K 14
lltable 47 18K 47
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ether_multi 172 14K 177
bus-sc 30 14K 1431
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 132 12K 132
in6_multi 89 11K 89
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 132 12K 132
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 2 9K 62
GEOM 60 10K 487
rman 82 10K 423
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
shmfd 1 8K 1
devstat 4 9K 4
rpc 2 8K 2
pfs_vncache 1 8K 1
audit_evclass 233 8K 291
routetbl 57 7K 61
CAM DEV 3 6K 510
kqueue 59 6K 882
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
plimit 20 5K 396
sglist 5 6K 5
CAM queue 5 6K 1528
cred 20 5K 263
taskqueue 45 5K 45
ufs_dirhash 20 5K 24
pf_ifnet 10 5K 19
memdesc 1 4K 1
MCA 32 4K 32
UMA 249 4K 249
evdev 4 4K 4
MCA 32 4K 32
UMA 249 4K 249
hhook 13 4K 13
diradd 25 4K 61
session 24 3K 39
pgrp 24 3K 39
mkdir 23 3K 40
acpisem 22 3K 22
terminal 11 3K 11
proc-args 45 3K 558
terminal 11 3K 11
select 18 3K 18
uidinfo 3 3K 11
sctp_ifa 17 3K 17
local_apic 1 2K 1
io_apic 1 2K 1
indirdep 8 2K 9
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 21
lockf 16 2K 29
Unitno 28 2K 45
CAM XPT 22 2K 543
newdirblk 12 2K 20
in_multi 6 2K 7
acpidev 20 2K 20
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 48
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
NFSD session 1 1K 1
CAM periph 4 1K 271
mld 6 1K 6
CAM periph 4 1K 271
sctp_ifn 6 1K 6
igmp 6 1K 6
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
inpcbpolicy 22 1K 190
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
crypto 3 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
DEVFSP 6 1K 6
osd 3 1K 9
vnodes 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 7
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
tcpfunc 3 1K 3
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
soname 4 1K 5807
pmchooks 1 1K 1
prison 4 1K 4
nexusdev 5 1K 5
entropy 2 1K 41
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
freework 1 1K 26
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
filecaps 1 1K 74
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
midi buffers 0 0K 0
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 1851
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 14
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 14
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 7
jfsync 0 0K 0
jtrunc 0 0K 0
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
dirrem 0 0K 28
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefile 0 0K 26
freeblks 0 0K 25
freefrag 0 0K 5
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
ip6_msource 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_iter 0 0K 7
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 7
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 214
export_host 0 0K 0
cl_savebuf 0 0K 2
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 109
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
accf 0 0K 0
pts 0 0K 0
iov 0 0K 13311
pts 0 0K 0
ioctlops 0 0K 102
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 585
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
kcovinfo 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
Fail Points 0 0K 0
Mark Johnston
Aug 5, 2021, 11:45:25 AM8/5/21
to syzbot, syzkaller-f...@googlegroups.com
Just2DamnFly BigFlynn
Nov 2, 2021, 3:34:00 AM11/2/21
to syzkaller-freebsd-bugs
Anyone know or a fix for this or the correct loader.conf and sysctls for 16gb ram laptop with tiger lake i7 integrated you with additional nvidia gourmet a current asus zenbook16 I keep getting this crash every time I attempt to do anything at all really am running St’s and I suspect that incorrect mem allocations and not doing so properly so if anyone has more info a fix or a suggestion for variables to set in boot/loader.cong and sysctl please help me thanks
Reply all
Reply to author
Forward
0 new messages