Fatal trap NUM: page fault in __mtx_assert

5 views
Skip to first unread message

syzbot

unread,
Jun 3, 2022, 6:06:27 AM6/3/22
to syzkaller-f...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 1326017849ee hwpmc: Add IDs for few more Intel Atom CPUs.
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=1559f941f00000
dashboard link: https://syzkaller.appspot.com/bug?extid=6e348d00590179004961
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6e348d...@syzkaller.appspotmail.com

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x1b8
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff81602161
stack pointer = 0x0:0xfffffe0053b23cd0
frame pointer = 0x0:0xfffffe0053b23d10
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (swi1: netisr 0)
trap number = 12
panic: page fault
cpuid = 1
time = 1654250735
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc7/frame 0xfffffe0053b234b0
kdb_backtrace() at kdb_backtrace+0xd3/frame 0xfffffe0053b23610
vpanic() at vpanic+0x254/frame 0xfffffe0053b236f0
panic() at panic+0xb5/frame 0xfffffe0053b237b0
trap_fatal() at trap_fatal+0x6bd/frame 0xfffffe0053b238d0
trap_pfault() at trap_pfault+0x182/frame 0xfffffe0053b23a10
trap() at trap+0x5b3/frame 0xfffffe0053b23c00
calltrap() at calltrap+0x8/frame 0xfffffe0053b23c00
--- trap 0xc, rip = 0xffffffff81602161, rsp = 0xfffffe0053b23cd0, rbp = 0xfffffe0053b23d10 ---
__mtx_assert() at __mtx_assert+0x111/frame 0xfffffe0053b23d10
sorwakeup_locked() at sorwakeup_locked+0x36/frame 0xfffffe0053b23d50
sctp_add_to_readq() at sctp_add_to_readq+0x718/frame 0xfffffe0053b23df0
sctp_queue_data_to_stream() at sctp_queue_data_to_stream+0x77a/frame 0xfffffe0053b23f90
sctp_process_data() at sctp_process_data+0x2c06/frame 0xfffffe0053b24680
sctp_common_input_processing() at sctp_common_input_processing+0x168d/frame 0xfffffe0053b248a0
sctp6_input_with_port() at sctp6_input_with_port+0x597/frame 0xfffffe0053b24a70
sctp6_input() at sctp6_input+0x1f/frame 0xfffffe0053b24a90
ip6_input() at ip6_input+0x1f70/frame 0xfffffe0053b24cf0
swi_net() at swi_net+0x2ed/frame 0xfffffe0053b24d90
ithread_loop() at ithread_loop+0x4ee/frame 0xfffffe0053b24ef0
fork_exit() at fork_exit+0xd0/frame 0xfffffe0053b24f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0053b24f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100031 ]
Stopped at kdb_enter+0x6b: movq $0,0x275b6aa(%rip)
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0xffffffff8172b3e6 printf+0xf6
rdx 0x1
rbx 0
rsp 0xfffffe0053b235f0
rbp 0xfffffe0053b23610
rsi 0
rdi 0xffffffff8172b448 printf+0x158
r8 0
r9 0xffffffff
r10 0
r11 0xbf
r12 0
r13 0xfffffe0053e9a560
r14 0xffffffff82b598a0 .str.26
r15 0xffffffff82b598a0 .str.26
rip 0xffffffff8171af6b kdb_enter+0x6b
rflags 0x46
kdb_enter+0x6b: movq $0,0x275b6aa(%rip)
db> show proc
Process 12 (intr) at 0xfffffe0053de0548:
state: NORMAL
uid: 0 gids: 0
parent: pid 0 at 0xffffffff83e19c80
ABI: null
flag: 0x10000284 flag2: 0
reaper: 0xffffffff83e19c80 reapsubtree: 12
sigparent: 20
vmspace: 0xffffffff83e1ac20
(map 0xffffffff83e1ac20)
(map.pmap 0xffffffff83e1ace0)
(pmap 0xffffffff83e1ad48)
threads: 22
100015 I [swi5: fast taskq]
100018 I [swi6: task queue]
100019 I [swi6: Giant taskq]
100031 Run CPU 1 [swi1: netisr 0]
100032 RunQ [swi1: hpts]
100033 I [swi1: hpts]
100046 I [irq24: virtio_pci0]
100047 I [irq25: virtio_pci0]
100048 I [irq26: virtio_pci0]
100049 I [irq27: virtio_pci0]
100050 I [irq28: virtio_pci1]
100051 I [irq29: virtio_pci1]
100052 I [irq30: virtio_pci1]
100053 I [irq31: virtio_pci1]
100054 I [irq32: virtio_pci1]
100059 I [irq33: virtio_pci2]
100060 I [irq34: virtio_pci2]
100061 I [irq35: virtio_pci2]
100063 I [irq1: atkbd0]
100064 I [irq12: psm0]
100065 I [swi0: uart uart++]
100069 I [swi1: pf send]
db> ps
pid ppid pgrp uid state wmesg wchan cmd
894 1 894 0 Ss select 0xfffffe00578fc940 rtsol
893 809 809 0 RE syz-executor.3
891 1 891 0 Ss select 0xfffffe00578fc9c0 rtsol
890 1 890 0 Ss select 0xfffffe0056f6a040 rtsol
884 788 430 0 S kqread 0xfffffe00585f0900 rtsol
809 774 809 0 Rs syz-executor.3
801 774 801 0 Ss piperd 0xfffffe0058bdc2e8 syz-executor.2
788 782 430 0 S wait 0xfffffe009eff9000 sh
782 430 430 0 S wait 0xfffffe009eff9548 sh
779 774 779 0 Ss piperd 0xfffffe0058bdbba0 syz-executor.1
778 774 778 0 Ss piperd 0xfffffe009efd22e8 syz-executor.0
774 772 772 0 S (threaded) syz-fuzzer
100114 S uwait 0xfffffe0058b2d700 syz-fuzzer
100116 S uwait 0xfffffe0057328c00 syz-fuzzer
100117 S uwait 0xfffffe0057328b00 syz-fuzzer
100118 S uwait 0xfffffe0057328900 syz-fuzzer
100119 S uwait 0xfffffe0057328800 syz-fuzzer
100120 S uwait 0xfffffe0058b2e700 syz-fuzzer
100121 S uwait 0xfffffe0058b2e600 syz-fuzzer
100122 S kqread 0xfffffe0007957500 syz-fuzzer
772 770 772 0 Ss pause 0xfffffe009c322b40 csh
770 688 770 0 Ss select 0xfffffe0056f6b8c0 sshd
754 1 754 0 Rs+ getty
753 1 753 0 Ss+ ttyin 0xfffffe00579c5cb0 getty
752 1 752 0 Ss+ ttyin 0xfffffe00579c60b0 getty
751 1 751 0 Ss+ ttyin 0xfffffe0057472cb0 getty
750 1 750 0 Ss+ ttyin 0xfffffe00579c64b0 getty
749 1 749 0 Ss+ ttyin 0xfffffe00579c68b0 getty
748 1 748 0 Ss+ ttyin 0xfffffe00579c6cb0 getty
747 1 747 0 Ss+ ttyin 0xfffffe00579c70b0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00579c74b0 getty
744 1 18 0 S+ piperd 0xfffffe0058bdd000 logger
743 742 18 0 S+ nanslp 0xffffffff83e43c81 sleep
742 1 18 0 S+ wait 0xfffffe0058cb0a90 sh
692 1 692 0 Ss nanslp 0xffffffff83e43c80 cron
688 1 688 0 Ss select 0xfffffe0056f6aac0 sshd
501 1 501 0 Ss select 0xfffffe0056f6adc0 syslogd
430 1 430 0 Ss wait 0xfffffe0058cb2000 devd
429 1 429 65 Ss select 0xfffffe0056f6b140 dhclient
344 1 344 0 Ss select 0xfffffe0056f6aec0 dhclient
341 1 341 0 Ss select 0xfffffe0056f6bf40 dhclient
17 0 0 0 DL vlruwt 0xfffffe0056fa0548 [vnlru]
16 0 0 0 DL syncer 0xffffffff83f694e0 [syncer]
15 0 0 0 DL (threaded) [bufdaemon]
100079 D psleep 0xffffffff83f67ae0 [bufdaemon]
100082 D - 0xffffffff83211f80 [bufspacedaemon-0]
100095 D sdflush 0xfffffe0058b92ce8 [/ worker]
9 0 0 0 DL psleep 0xffffffff83f9b5c0 [vmdaemon]
8 0 0 0 DL (threaded) [pagedaemon]
100077 D psleep 0xffffffff83f8f478 [dom0]
100083 D launds 0xffffffff83f8f484 [laundry: dom0]
100084 D umarcl 0xffffffff81e4b940 [uma]
7 0 0 0 DL - 0xffffffff83c002a8 [rand_harvestq]
6 0 0 0 RL [pf purge]
5 0 0 0 DL waiting 0xffffffff84807460 [sctp_iterator]
4 0 0 0 DL (threaded) [cam]
100044 D - 0xffffffff83aa3240 [doneq0]
100045 D - 0xffffffff83aa31c0 [async]
100076 D - 0xffffffff83aa3040 [scanner]
14 0 0 0 DL seqstat 0xfffffe0053fd7488 [sequencer 00]
3 0 0 0 DL (threaded) [crypto]
100040 D crypto_ 0xffffffff83f8aca0 [crypto]
100041 D crypto_ 0xfffffe0053ecd830 [crypto returns 0]
100042 D crypto_ 0xfffffe0053ecd880 [crypto returns 1]
13 0 0 0 DL (threaded) [geom]
100035 D - 0xffffffff83e19280 [g_event]
100036 D - 0xffffffff83e192a0 [g_up]
100037 D - 0xffffffff83e192c0 [g_down]
2 0 0 0 WL (threaded) [clock]
100029 I [clock (0)]
100030 I [clock (1)]
12 0 0 0 RL (threaded) [intr]
100015 I [swi5: fast taskq]
100018 I [swi6: task queue]
100019 I [swi6: Giant taskq]
100031 Run CPU 1 [swi1: netisr 0]
100032 RunQ [swi1: hpts]
100033 I [swi1: hpts]
100046 I [irq24: virtio_pci0]
100047 I [irq25: virtio_pci0]
100048 I [irq26: virtio_pci0]
100049 I [irq27: virtio_pci0]
100050 I [irq28: virtio_pci1]
100051 I [irq29: virtio_pci1]
100052 I [irq30: virtio_pci1]
100053 I [irq31: virtio_pci1]
100054 I [irq32: virtio_pci1]
100059 I [irq33: virtio_pci2]
100060 I [irq34: virtio_pci2]
100061 I [irq35: virtio_pci2]
100063 I [irq1: atkbd0]
100064 I [irq12: psm0]
100065 I [swi0: uart uart++]
100069 I [swi1: pf send]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffffe0053de1000 [init]
10 0 0 0 DL audit_w 0xffffffff83f8b780 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff83e19c80 [swapper]
100005 D - 0xfffffe0053e84100 [if_config_tqg_0]
100006 D - 0xfffffe0053e84000 [softirq_0]
100007 D - 0xfffffe0053e83e00 [softirq_1]
100008 D - 0xfffffe0053e83d00 [if_io_tqg_0]
100009 D - 0xfffffe0053e83c00 [if_io_tqg_1]
100010 D - 0xfffffe000795a100 [inm_free taskq]
100011 D - 0xfffffe000795a000 [linuxkpi_irq_wq]
100012 D - 0xfffffe0007959e00 [in6m_free taskq]
100013 D - 0xfffffe0007959d00 [deferred_unmount ta]
100014 D - 0xfffffe0007959c00 [thread taskq]
100016 D - 0xfffffe0007959a00 [kqueue_ctx taskq]
100017 D - 0xfffffe0007959900 [pci_hp taskq]
100020 D - 0xfffffe0007959600 [aiod_kick taskq]
100021 D - 0xfffffe0007959500 [linuxkpi_short_wq_0]
100022 D - 0xfffffe0007959500 [linuxkpi_short_wq_1]
100023 D - 0xfffffe0007959500 [linuxkpi_short_wq_2]
100024 D - 0xfffffe0007959500 [linuxkpi_short_wq_3]
100025 D - 0xfffffe0007959400 [linuxkpi_long_wq_0]
100026 D - 0xfffffe0007959400 [linuxkpi_long_wq_1]
100027 D - 0xfffffe0007959400 [linuxkpi_long_wq_2]
100028 D - 0xfffffe0007959400 [linuxkpi_long_wq_3]
100034 D - 0xfffffe0007959300 [firmware taskq]
100038 D - 0xfffffe0007959200 [crypto_0]
100039 D - 0xfffffe0007959200 [crypto_1]
100055 D - 0xfffffe0007959000 [vtnet0 rxq 0]
100056 D - 0xfffffe0007958e00 [vtnet0 txq 0]
100057 D - 0xfffffe0007958d00 [vtnet0 rxq 1]
100058 D - 0xfffffe0007958c00 [vtnet0 txq 1]
100062 D vtbslp 0xfffffe0056f6c000 [virtio_balloon]
100066 D - 0xffffffff82b5f721 [deadlkres]
100070 D - 0xfffffe000795a200 [mca taskq]
100071 D - 0xfffffe00585ef600 [acpi_task_0]
100072 D - 0xfffffe00585ef600 [acpi_task_1]
100073 D - 0xfffffe00585ef600 [acpi_task_2]
100075 D - 0xfffffe0007959100 [CAM taskq]
db> show all locks
Process 893 (syz-executor.3) thread 0xfffffe0058ca9720 (100094)
exclusive sleep mutex sctp-inp (inp) r = 0 (0xfffffe00a149b528) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_pcb.c:3340
exclusive rw sctp-info (sctp-info) r = 0 (0xfffffe0053c15358) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_pcb.c:3339
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffffe00a149b548) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_pcb.c:3338
Process 12 (intr) thread 0xfffffe0053e9a560 (100031)
exclusive sleep mutex so_rcv (so_rcv) r = 0 (0xfffffe0058de9920) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctputil.c:4847
exclusive sleep mutex sctp-read (inpr) r = 0 (0xfffffe00a149b568) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctputil.c:4875
exclusive sleep mutex sctp-tcb (tcb) r = 0 (0xfffffe00a5c1ca50) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_pcb.c:2138
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
tcp_hpts 7 4801K 7
devbuf 4217 4323K 4242
sysctloid 35322 2081K 35393
vtbuf 24 1968K 46
kobj 328 1312K 490
newblk 409 1126K 492
vfscache 3 1025K 3
pcb 25 539K 82
inodedep 68 538K 123
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
subproc 118 230K 969
acpica 1674 184K 57552
vnet_data 1 168K 1
vmem 3 146K 4
tidhash 3 141K 3
linker 358 134K 386
pagedep 20 133K 61
tfo_ccache 1 128K 1
DEVFS1 109 109K 126
sem 4 106K 4
filedesc 12 89K 125
bus 995 81K 5208
mtx_pool 2 72K 2
syncache 1 68K 1
module 514 65K 514
acpitask 1 64K 1
ddb_capture 1 64K 1
umtx 308 39K 308
kdtrace 186 37K 1068
temp 34 33K 1877
DEVFS3 128 32K 138
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
gtaskqueue 18 26K 18
kbdmux 6 22K 6
DEVFS_RULE 56 20K 56
ifaddr 66 19K 68
BPF 14 19K 14
ufs_mount 4 17K 5
proc 3 17K 3
tty 16 16K 16
ithread 97 16K 97
routetbl 124 16K 395
bus-sc 34 15K 1681
lltable 43 14K 43
KTRACE 100 13K 100
ifnet 7 13K 7
ether_multi 152 13K 162
eventhandler 136 12K 136
kenv 95 12K 95
rman 88 11K 431
GEOM 61 11K 490
CAM queue 5 11K 1528
dirrem 35 9K 59
in6_multi 65 9K 65
bmsafemap 2 9K 91
UART 12 9K 12
devstat 4 9K 4
ksem 1 8K 1
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
kqueue 55 8K 908
pfs_nodes 20 8K 20
audit_evclass 237 8K 296
taskqueue 63 7K 63
sglist 5 7K 5
CAM DEV 3 6K 510
cred 24 6K 206
plimit 21 6K 348
ufs_dirhash 24 5K 24
UMA 272 5K 272
freefile 35 5K 53
pf_ifnet 10 5K 19
vt 11 5K 11
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
DEVFSP 60 4K 64
diradd 30 4K 90
mkdir 28 4K 102
acpisem 28 4K 28
session 27 4K 37
hhook 15 4K 17
kcovinfo 52 4K 52
proc-args 83 4K 1980
pwddesc 50 4K 902
terminal 11 3K 11
indirdep 10 3K 10
uidinfo 3 3K 8
sctp_timw 8 2K 8
local_apic 1 2K 1
io_apic 1 2K 1
fpukern_ctx 2 2K 2
newdirblk 16 2K 51
ipsec-saq 2 2K 2
selfd 32 2K 14745
ip6ndp 12 2K 13
lockf 16 2K 26
sctp_ifa 13 2K 14
Unitno 27 2K 47
CAM XPT 22 2K 543
msi 12 2K 12
in_multi 6 2K 8
select 11 2K 32
ipsecpolicy 2 2K 2
acpidev 20 2K 20
sctp_atcl 3 2K 28
clone 9 2K 9
tun 7 2K 7
sctp_stro 1 1K 11
softdep 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
nhops 6 1K 8
vnodemarker 2 1K 10
NFSD session 1 1K 1
CAM periph 4 1K 271
ipsec 3 1K 3
sctp_ifn 6 1K 14
mld 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
crypto 4 1K 4
encap_export_host 12 1K 12
sctp_stri 1 1K 2
pfil 4 1K 4
procdesc 4 1K 10
cdev 2 1K 2
inpcbpolicy 15 1K 183
osd 9 1K 25
chacha20random 1 1K 1
CC Mem 5 1K 14
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
freework 1 1K 57
vnodes 1 1K 1
CAM SIM 2 1K 2
feeder 7 1K 7
sctp_atky 4 1K 40
tcpfunc 3 1K 3
loginclass 3 1K 6
prison 6 1K 6
lkpikmalloc 5 1K 6
aesni_data 2 1K 2
cryptodev 2 1K 42
nexusdev 8 1K 8
apmdev 1 1K 1
atkbddev 2 1K 2
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
CAM path 4 1K 1034
pmchooks 1 1K 1
soname 4 1K 3484
filecaps 4 1K 78
sctp_vrf 1 1K 1
vnet 1 1K 1
entropy 2 1K 38
pmc 1 1K 1
acpiintr 1 1K 1
sctp_athm 3 1K 29
sctp_map 2 1K 22
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
ipcomp 0 0K 0
esp 0 0K 0
ah 0 0K 0
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
tcp_do 0 0K 0
tcp_fsb 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 12
sctp_iter 0 0K 12
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 12
sctp_aadr 0 0K 0
mqdata 0 0K 0
filemon 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
madt_table 0 0K 2
smartpqi 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
ixl 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
iavf 0 0K 0
axgbe 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
xen_intr 0 0K 0
NFSD V4state 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
bounce 0 0K 0
busdma 0 0K 0
qpidrv 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
isci 0 0K 0
iommu_dmamap 0 0K 0
hyperv_socket 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
DEVFS4 0 0K 0
vm_fictitious 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xen_acpi 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
UMAHash 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 17
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 3
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freeblks 0 0K 56
freefrag 0 0K 2
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
vtfont 0 0K 0
BACKLIGHT 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
pvscsi 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
ktls_ocf 0 0K 0
AHCI driver 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS_RX 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EN 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5DUMP 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
seq_file 0 0K 0
lkpiskb 0 0K 0
radix 0 0K 0
idr 0 0K 0
lkpindev 0 0K 0
lkpifw 0 0K 0
lkpi80211 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 4
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
tcp_hwpace 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
LRO 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
VN POLL 0 0K 0
agp 0 0K 0
statfs 0 0K 226
namei_tracker 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 2
nvme_da 0 0K 0
acpipwr 0 0K 0
acpi_perf 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
CAM CCB 0 0K 523
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 95
ktls 0 0K 0
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
accf 0 0K 0
pts 0 0K 0
iov 0 0K 13796
ioctlops 0 0K 103
eventfd 0 0K 0
Witness 0 0K 0
stack 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
mps 0 0K 0
sbuf 0 0K 288
mpr_user 0 0K 0
firmware 0 0K 0
compressor 0 0K 0
MPRSAS 0 0K 0
SWAP 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
sysctltmp 0 0K 657
sysctl 0 0K 3
md_sectors 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
md_disk 0 0K 0
malodev 0 0K 0
LED 0 0K 0
ix_sriov 0 0K 0
cache 0 0K 0
aacraidcam 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
aacraid_buf 0 0K 0
aaccam 0 0K 0
boottrace 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
XZ_DEC 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
tmpfs dir 0 0K 0
tmpfs name 0 0K 0
tmpfs mount 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree
mbuf_jumbo_page 4096 8320 1078 585245 0 254 38494208 0
pbuf 2624 0 989 0 0 2 2595136 0
mbuf 256 8622 1040 882745 0 254 2473472 0
BUF TRIE 144 170 11618 419 0 62 1697472 0
malloc-384 384 4169 31 4509 0 30 1612800 0
malloc-128 128 11652 221 11735 0 126 1519744 0
malloc-4096 4096 328 2 493 0 2 1351680 0
RADIX NODE 144 8454 249 39404 0 62 1253232 0
UMA Slabs 0 112 10572 6 10572 0 126 1184736 0
sctp_asoc 2256 1 509 11 0 254 1150560 0
mbuf_cluster 2048 508 0 508 0 254 1040384 0
vmem btag 56 16980 123 16980 0 254 957768 0
FFS inode 1160 509 23 563 0 8 617120 0
tcpcb 1104 5 506 14 0 254 564144 0
VM OBJECT 264 1873 77 27403 0 30 514800 0
socket 960 32 476 1431 0 254 487680 0
lkpimm 168 1 2327 1 0 62 391104 0
lkpicurr 168 2 2326 2 0 62 391104 0
sctp_raddr 736 1 516 11 0 254 380512 0
malloc-65536 65536 4 1 140 0 1 327680 0
sctp_ep 1208 1 259 16 0 254 314080 0
256 Bucket 2048 143 9 2691 0 8 311296 0
malloc-64 64 4124 475 5640 0 254 294336 0
VNODE 448 546 84 602 0 30 282240 0
THREAD 1808 134 20 165 0 8 278432 0
malloc-4096 4096 57 7 908 0 2 262144 0
MAP ENTRY 96 2223 423 95173 0 126 254016 0
malloc-16384 16384 9 6 224 0 1 245760 0
malloc-16 16 14655 345 14729 0 254 240000 0
DEVCTL 1024 22 198 150 0 0 225280 0
malloc-256 256 671 79 1259 0 62 192000 0
malloc-32 32 5361 561 5792 0 254 189504 0
UMA Zones 768 244 0 244 0 16 187392 0
malloc-128 128 1211 184 26880 0 126 178560 0
malloc-1024 1024 121 23 337 0 16 147456 0
FFS2 dinode 256 509 61 562 0 62 145920 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-65536 65536 0 2 68 0 1 131072 0
unpcb 256 14 496 1206 0 254 130560 0
mbuf_packet 256 1 507 190 0 254 130048 0
ertt_txseginfo 40 2721 410 5524 0 254 125240 0
S VFS Cache 104 1000 170 1071 0 126 121680 0
FPU_save_area 832 136 8 6021 0 16 119808 0
ksiginfo 112 48 996 5910 0 126 116928 0
VMSPACE 2552 34 8 891 0 4 107184 0
malloc-128 128 525 250 3833 0 126 99200 0
malloc-2048 2048 5 43 1082 0 8 98304 0
UMA Kegs 384 230 3 230 0 30 89472 0
PROC 1352 50 16 901 0 8 89232 0
128 Bucket 1024 53 30 547 0 16 84992 0
tcp_bbr_map 128 336 315 1158 0 126 83328 0
filedesc0 1072 51 19 902 0 8 75040 0
malloc-8192 8192 6 3 135 0 1 73728 0
g_bio 408 0 180 4796 0 30 73440 0
malloc-64 64 560 511 807 0 254 68544 0
malloc-64 64 524 547 1633 0 254 68544 0
malloc-128 128 381 146 571 0 126 67456 0
malloc-128 128 352 175 1194 0 126 67456 0
malloc-65536 65536 1 0 1 0 1 65536 0
malloc-65536 65536 1 0 1 0 1 65536 0
malloc-65536 65536 1 0 1 0 1 65536 0
malloc-32768 32768 0 2 120 0 1 65536 0
malloc-4096 4096 13 3 27 0 2 65536 0
malloc-256 256 183 72 231 0 62 65280 0
malloc-256 256 121 134 866 0 62 65280 0
malloc-128 128 153 250 642 0 126 51584 0
malloc-128 128 187 216 305 0 126 51584 0
32 Bucket 256 59 136 8367 0 62 49920 0
DIRHASH 1024 35 13 35 0 16 49152 0
NAMEI 1024 0 48 13354 0 16 49152 0
malloc-8192 8192 6 0 6 0 1 49152 0
malloc-2048 2048 5 19 211 0 8 49152 0
malloc-1024 1024 27 21 39 0 16 49152 0
malloc-1024 1024 6 42 530 0 16 49152 0
malloc-384 384 81 39 180 0 30 46080 0
syncache 168 0 264 4 0 254 44352 0
clpbuf 2624 0 16 16 0 16 41984 0
malloc-8192 8192 4 1 6 0 1 40960 0
malloc-8192 8192 5 0 5 0 1 40960 0
malloc-4096 4096 5 5 634 0 2 40960 0
pcpu-8 8 4632 488 4788 0 254 40960 0
sctp_readq 152 1 259 1 0 254 39520 0
sctp_chunk 152 1 259 1 0 254 39520 0
Mountpoints 2752 2 12 2 0 4 38528 0
udp_inpcb 424 6 84 162 0 30 38160 0
pipe 744 20 30 337 0 16 37200 0
64 Bucket 512 65 7 2563 0 30 36864 0
malloc-64 64 0 567 13414 0 254 36288 0
malloc-64 64 196 371 216 0 254 36288 0
malloc-64 64 150 417 15798 0 254 36288 0
malloc-64 64 79 488 1214 0 254 36288 0
malloc-64 64 18 549 45 0 254 36288 0
malloc-128 128 59 220 222 0 126 35712 0
routing nhops 256 26 109 33 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
malloc-384 384 67 23 73 0 30 34560 0
malloc-256 256 2 133 328 0 62 34560 0
malloc-256 256 46 89 50 0 62 34560 0
malloc-256 256 50 85 691 0 62 34560 0
malloc-256 256 31 104 60 0 62 34560 0
malloc-256 256 14 121 571 0 62 34560 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 2 0 17 0 1 32768 0
malloc-2048 2048 3 13 65 0 8 32768 0
malloc-2048 2048 7 9 30 0 8 32768 0
malloc-2048 2048 11 5 12 0 8 32768 0
malloc-1024 1024 8 24 18 0 16 32768 0
malloc-1024 1024 6 26 1003 0 16 32768 0
malloc-512 512 11 53 19 0 30 32768 0
malloc-512 512 3 61 170 0 30 32768 0
malloc-512 512 3 61 4 0 30 32768 0
malloc-512 512 2 62 17 0 30 32768 0
pcpu-64 64 493 19 493 0 254 32768 0
sctp_stream_msg_out 112 0 288 1 0 254 32256 0
KNOTE 160 31 169 16603 0 62 32000 0
ttyinq 160 135 65 300 0 62 32000 0
tcp_bbr_pcb 832 1 35 7 0 16 29952 0
cpuset 104 7 272 7 0 126 29016 0
sctp_laddr 48 0 588 12 0 254 28224 0
malloc-32 32 271 611 3131 0 254 28224 0
4 Bucket 48 6 582 51 0 254 28224 0
tcp_inpcb 424 5 58 14 0 30 26712 0
ripcb 424 4 59 7 0 30 26712 0
da_ccb 544 0 49 1300 0 16 26656 0
TURNSTILE 136 155 34 155 0 62 25704 0
malloc-4096 4096 2 4 230 0 2 24576 0
malloc-4096 4096 6 0 6 0 2 24576 0
rtentry 176 29 109 33 0 62 24288 0
PGRP 88 27 249 37 0 126 24288 0
rl_entry 40 37 569 37 0 254 24240 0
Files 80 185 115 7361 0 126 24000 0
8 Bucket 80 39 261 492 0 126 24000 0
malloc-384 384 39 21 41 0 30 23040 0
malloc-384 384 5 55 30 0 30 23040 0
malloc-384 384 46 14 46 0 30 23040 0
SLEEPQUEUE 88 155 101 155 0 126 22528 0
hostcache 64 2 313 2 0 254 20160 0
udpcb 32 6 624 162 0 254 20160 0
udp_inpcb ports 32 3 627 33 0 254 20160 0
tcp_inpcb ports 32 3 627 9 0 254 20160 0
ertt 72 5 275 14 0 126 20160 0
PWD 32 14 616 138 0 254 20160 0
malloc-32 32 5 625 29 0 254 20160 0
malloc-32 32 145 485 441 0 254 20160 0
malloc-32 32 86 544 952 0 254 20160 0
malloc-32 32 122 508 124 0 254 20160 0
malloc-32 32 55 575 226 0 254 20160 0
malloc-32 32 23 607 1074 0 254 20160 0
16 Bucket 144 45 95 240 0 62 20160 0
2 Bucket 32 51 579 313 0 254 20160 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-8192 8192 2 0 2 0 1 16384 0
malloc-4096 4096 3 1 3 0 2 16384 0
malloc-2048 2048 3 5 3 0 8 16384 0
malloc-2048 2048 1 7 1 0 8 16384 0
malloc-2048 2048 2 6 2 0 8 16384 0
malloc-1024 1024 4 12 4 0 16 16384 0
malloc-1024 1024 1 15 1 0 16 16384 0
malloc-512 512 0 32 1 0 30 16384 0
SMR CPU 32 7 504 7 0 254 16352 0
vtnet_tx_hdr 24 1 667 291699 0 254 16032 0
malloc-16 16 478 522 3438 0 254 16000 0
kenv 258 15 45 1039 0 30 15480 0
mqnode 416 3 33 3 0 30 14976 0
vmem 1856 1 7 1 0 8 14848 0
SMR SHARED 24 7 504 7 0 254 12264 0
malloc-16 16 9 741 225 0 254 12000 0
malloc-16 16 22 728 135 0 254 12000 0
malloc-16 16 20 730 60 0 254 12000 0
malloc-16 16 39 711 26296 0 254 12000 0
malloc-16 16 35 715 1444 0 254 12000 0
malloc-16 16 29 721 101 0 254 12000 0
malloc-384 384 0 30 1 0 30 11520 0
malloc-384 384 1 29 1 0 30 11520 0
malloc-8192 8192 1 0 1 0 1 8192 0
malloc-8192 8192 1 0 1 0 1 8192 0
pcpu-16 16 14 498 14 0 254 8192 0
UMA Slabs 1 176 10 12 10 0 62 3872 0
KMAP ENTRY 96 12 27 14 0 0 3744 0
pcpu-4 4 1 511 1 0 254 2048 0
FFS1 dinode 128 0 0 0 0 126 0 0
ada_ccb 272 0 0 0 0 30 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
cdg_qdiffsample 16 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 248 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 254 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 312 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 184 0 0 0 0 62 0 0
tcp_rack_pcb 896 0 0 0 0 16 0 0
tcp_rack_map 120 0 0 0 0 126 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
tcptw 72 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
tcp_log_id_node 120 0 0 0 0 126 0 0
tcp_log_id_bucket 176 0 0 0 0 62 0 0
tcp_log 416 0 0 0 0 254 0 0
tcpreass 48 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
udplite_inpcb ports 32 0 0 0 0 254 0 0
udplite_inpcb 424 0 0 0 0 30 0 0
ripcb ports 32 0 0 0 0 254 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 272 0 0 0 0 30 0 0
AIOCB 552 0 0 0 0 16 0 0
AIOP 32 0 0 0 0 254 0 0
AIO 208 0 0 0 0 62 0 0
TMPFS node 224 0 0 0 0 62 0 0
mqnotifier 216 0

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Aug 28, 2022, 10:45:29 AM8/28/22
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: b875d4f5ddcb nfsd: Update console message for no session f..
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=13db9fa3080000
dashboard link: https://syzkaller.appspot.com/bug?extid=6e348d00590179004961
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13b4cee7080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6e348d...@syzkaller.appspotmail.com

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x1b8
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff81603d81
stack pointer = 0x28:0xfffffe0053ab2cd0
frame pointer = 0x28:0xfffffe0053ab2d10
code segment = base 0x0, limit 0xfffff, type 0x1b

= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled,
FreeBSD/amd64resume, IOPL = 0
(ci-freebsd-maicurrent process = 12 (swi1: netisr 0)
n-5.c.syzkaller.rdi: 1b8 rsi: ffffffff836cc400 rdx: 0
internal) (ttyu0rcx: fffffe00033eee30 r8: fffff78000000000 r9: 20000000000
rax: fff)

login: ffe00033eee30 rbx: 1a0 rbp: fffffe0053ab2d10
r10: 0 r11: bf r12: 1
r13: 4 r14: 1b8 r15: fffffe0053ea93a0
trap number = 12
panic: page fault
cpuid = 1
time = 1661691219
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc7/frame 0xfffffe0053ab24b0
kdb_backtrace() at kdb_backtrace+0xd3/frame 0xfffffe0053ab2610
vpanic() at vpanic+0x254/frame 0xfffffe0053ab26f0
panic() at panic+0xb5/frame 0xfffffe0053ab27b0
trap_fatal() at trap_fatal+0x7ed/frame 0xfffffe0053ab28d0
trap_pfault() at trap_pfault+0x182/frame 0xfffffe0053ab2a10
trap() at trap+0x5e1/frame 0xfffffe0053ab2c00
calltrap() at calltrap+0x8/frame 0xfffffe0053ab2c00
--- trap 0xc, rip = 0xffffffff81603d81, rsp = 0xfffffe0053ab2cd0, rbp = 0xfffffe0053ab2d10 ---
__mtx_assert() at __mtx_assert+0x111/frame 0xfffffe0053ab2d10
sorwakeup_locked() at sorwakeup_locked+0x36/frame 0xfffffe0053ab2d50
sctp_add_to_readq() at sctp_add_to_readq+0x717/frame 0xfffffe0053ab2df0
sctp_queue_data_to_stream() at sctp_queue_data_to_stream+0x77a/frame 0xfffffe0053ab2f90
sctp_process_data() at sctp_process_data+0x2bfc/frame 0xfffffe0053ab3680
sctp_common_input_processing() at sctp_common_input_processing+0x168d/frame 0xfffffe0053ab38a0
sctp6_input_with_port() at sctp6_input_with_port+0x597/frame 0xfffffe0053ab3a70
sctp6_input() at sctp6_input+0x1f/frame 0xfffffe0053ab3a90
ip6_input() at ip6_input+0x1ec5/frame 0xfffffe0053ab3cf0
swi_net() at swi_net+0x2ed/frame 0xfffffe0053ab3d90
ithread_loop() at ithread_loop+0x4ee/frame 0xfffffe0053ab3ef0
fork_exit() at fork_exit+0xd0/frame 0xfffffe0053ab3f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0053ab3f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100029 ]
Stopped at kdb_enter+0x6b: movq $0,0x2765d8a(%rip)
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0x28
rax 0x12
rcx 0xfffffe00033eee30
rdx 0xdffff7c000000000
rbx 0
rsp 0xfffffe0053ab25f0
rbp 0xfffffe0053ab2610
rsi 0x1
rdi 0
r8 0x3
r9 0xffffffff
r10 0
r11 0xbf
r12 0
r13 0xfffffe0053ea93a0
r14 0xffffffff82b6a360 .str.26
r15 0xffffffff82b6a360 .str.26
rip 0xffffffff8171d40b kdb_enter+0x6b
rflags 0x46
kdb_enter+0x6b: movq $0,0x2765d8a(%rip)
db> show proc
Process 12 (intr) at 0xfffffe0053de9548:
state: NORMAL
uid: 0 gids: 0
parent: pid 0 at 0xffffffff83e267e0
ABI: null
flag: 0x10000284 flag2: 0
reaper: 0xffffffff83e267e0 reapsubtree: 12
sigparent: 20
vmspace: 0xffffffff83e27780
(map 0xffffffff83e27780)
(map.pmap 0xffffffff83e27840)
(pmap 0xffffffff83e278b0)
threads: 22
100014 I [swi6: Giant taskq]
100016 I [swi5: fast taskq]
100019 I [swi6: task queue]
100029 Run CPU 1 [swi1: netisr 0]
100032 I [swi1: hpts]
100033 I [swi1: hpts]
100046 I [irq24: virtio_pci0]
100047 I [irq25: virtio_pci0]
100048 I [irq26: virtio_pci0]
100049 I [irq27: virtio_pci0]
100050 I [irq28: virtio_pci1]
100051 I [irq29: virtio_pci1]
100052 I [irq30: virtio_pci1]
100053 I [irq31: virtio_pci1]
100054 I [irq32: virtio_pci1]
100059 I [irq33: virtio_pci2]
100060 I [irq34: virtio_pci2]
100061 I [irq35: virtio_pci2]
100063 I [irq1: atkbd0]
100064 I [irq12: psm0]
100065 I [swi0: uart uart++]
100069 I [swi1: pf send]
db> ps
pid ppid pgrp uid state wmesg wchan cmd
838 789 789 0 S (threaded) syz-executor.2
100130 S nanslp 0xffffffff83e50940 syz-executor.2
100145 S connec 0xfffffe0058c3e49a syz-executor.2
100146 S uwait 0xfffffe0058ad7800 syz-executor.2
837 824 837 0 Ss select 0xfffffe0092591440 dhclient
834 787 787 0 LE *sctp-in 0xfffffe005788ba80 syz-executor.3
833 785 785 0 LE *sctp-in 0xfffffe005788ba80 syz-executor.1
832 784 784 0 LE *sctp-tc 0xfffffe0057326e40 syz-executor.0
831 1 831 0 Ss select 0xfffffe00925914c0 dhclient
824 810 430 65 S select 0xfffffe00925915c0 dhclient
810 430 430 0 S wait 0xfffffe0058d2f000 sh
789 782 789 0 Ss nanslp 0xffffffff83e50940 syz-executor.2
787 782 787 0 Ss nanslp 0xffffffff83e50940 syz-executor.3
785 782 785 0 Ss nanslp 0xffffffff83e50940 syz-executor.1
784 782 784 0 Ss nanslp 0xffffffff83e50940 syz-executor.0
782 780 780 0 S (threaded) syz-execprog
100093 S uwait 0xfffffe005787bd00 syz-execprog
100114 S uwait 0xfffffe005787a080 syz-execprog
100115 S uwait 0xfffffe005787a180 syz-execprog
100116 S wait 0xfffffe0058b91548 syz-execprog
100117 S wait 0xfffffe0058b91548 syz-execprog
100119 S uwait 0xfffffe005787ad80 syz-execprog
100120 S wait 0xfffffe0058b91548 syz-execprog
100121 S wait 0xfffffe0058b91548 syz-execprog
100122 S uwait 0xfffffe0092592880 syz-execprog
100123 S uwait 0xfffffe005787a580 syz-execprog
100124 S kqread 0xfffffe000817e400 syz-execprog
780 778 780 0 Ss pause 0xfffffe00928295f8 csh
778 688 778 0 Ss select 0xfffffe0092592dc0 sshd
754 1 754 0 Ss+ ttyin 0xfffffe0057475cb0 getty
753 1 753 0 Ss+ ttyin 0xfffffe0057950cb0 getty
752 1 752 0 Ss+ ttyin 0xfffffe00579510b0 getty
751 1 751 0 Ss+ ttyin 0xfffffe00574748b0 getty
750 1 750 0 Ss+ ttyin 0xfffffe0057474cb0 getty
749 1 749 0 Ss+ ttyin 0xfffffe00579514b0 getty
748 1 748 0 Ss+ ttyin 0xfffffe00579518b0 getty
747 1 747 0 Ss+ ttyin 0xfffffe0057951cb0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00579520b0 getty
692 1 692 0 Ss nanslp 0xffffffff83e50940 cron
688 1 688 0 Ss select 0xfffffe00925931c0 sshd
501 1 501 0 Ss select 0xfffffe0092593240 syslogd
430 1 430 0 Ss wait 0xfffffe0058b93a90 devd
429 1 429 65 Ss select 0xfffffe0092593440 dhclient
344 1 344 0 Ss select 0xfffffe00925934c0 dhclient
341 1 341 0 Ss select 0xfffffe0058ad7bc0 dhclient
17 0 0 0 DL vlruwt 0xfffffe0056f9c548 [vnlru]
16 0 0 0 DL syncer 0xffffffff83f75ea0 [syncer]
15 0 0 0 DL (threaded) [bufdaemon]
100079 D psleep 0xffffffff83f744a0 [bufdaemon]
100082 D - 0xffffffff83212100 [bufspacedaemon-0]
100095 D sdflush 0xfffffe0056f658e8 [/ worker]
9 0 0 0 DL psleep 0xffffffff83fa7fc0 [vmdaemon]
8 0 0 0 DL (threaded) [pagedaemon]
100077 D psleep 0xffffffff83f9be78 [dom0]
100080 D launds 0xffffffff83f9be84 [laundry: dom0]
100081 D umarcl 0xffffffff81e5ae10 [uma]
7 0 0 0 DL - 0xffffffff83c0cde8 [rand_harvestq]
6 0 0 0 DL pftm 0xffffffff84b6e550 [pf purge]
5 0 0 0 DL waiting 0xffffffff849a8640 [sctp_iterator]
4 0 0 0 DL (threaded) [cam]
100044 D - 0xffffffff83aaf340 [doneq0]
100045 D - 0xffffffff83aaf2c0 [async]
100076 D - 0xffffffff83aaf140 [scanner]
14 0 0 0 DL seqstat 0xfffffe0053fb6088 [sequencer 00]
3 0 0 0 DL (threaded) [crypto]
100040 D crypto_ 0xffffffff83f975a0 [crypto]
100041 D crypto_ 0xfffffe0053c8ee30 [crypto returns 0]
100042 D crypto_ 0xfffffe0053c8ee80 [crypto returns 1]
13 0 0 0 DL (threaded) [geom]
100035 D - 0xffffffff83e25dc0 [g_event]
100036 D - 0xffffffff83e25de0 [g_up]
100037 D - 0xffffffff83e25e00 [g_down]
2 0 0 0 WL (threaded) [clock]
100030 I [clock (0)]
100031 I [clock (1)]
12 0 0 0 RL (threaded) [intr]
100014 I [swi6: Giant taskq]
100016 I [swi5: fast taskq]
100019 I [swi6: task queue]
100029 Run CPU 1 [swi1: netisr 0]
100032 I [swi1: hpts]
100033 I [swi1: hpts]
100046 I [irq24: virtio_pci0]
100047 I [irq25: virtio_pci0]
100048 I [irq26: virtio_pci0]
100049 I [irq27: virtio_pci0]
100050 I [irq28: virtio_pci1]
100051 I [irq29: virtio_pci1]
100052 I [irq30: virtio_pci1]
100053 I [irq31: virtio_pci1]
100054 I [irq32: virtio_pci1]
100059 I [irq33: virtio_pci2]
100060 I [irq34: virtio_pci2]
100061 I [irq35: virtio_pci2]
100063 I [irq1: atkbd0]
100064 I [irq12: psm0]
100065 I [swi0: uart uart++]
100069 I [swi1: pf send]
11 0 0 0 RL (threaded) [idle]
100003 Run CPU 0 [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffffe0053dea000 [init]
10 0 0 0 DL audit_w 0xffffffff83f98140 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff83e267e0 [swapper]
100005 D - 0xfffffe0008181d00 [if_config_tqg_0]
100006 D - 0xfffffe0008181c00 [softirq_0]
100007 D - 0xfffffe0008181b00 [softirq_1]
100008 D - 0xfffffe0008181a00 [if_io_tqg_0]
100009 D - 0xfffffe0008181900 [if_io_tqg_1]
100010 D - 0xfffffe0008181800 [in6m_free taskq]
100011 D - 0xfffffe0008181700 [linuxkpi_irq_wq]
100012 D - 0xfffffe0008181600 [aiod_kick taskq]
100013 D - 0xfffffe0008181500 [deferred_unmount ta]
100015 D - 0xfffffe0008181300 [thread taskq]
100017 D - 0xfffffe0008181100 [kqueue_ctx taskq]
100018 D - 0xfffffe0008181000 [pci_hp taskq]
100020 D - 0xfffffe0008180d00 [inm_free taskq]
100021 D - 0xfffffe0008180c00 [linuxkpi_short_wq_0]
100022 D - 0xfffffe0008180c00 [linuxkpi_short_wq_1]
100023 D - 0xfffffe0008180c00 [linuxkpi_short_wq_2]
100024 D - 0xfffffe0008180c00 [linuxkpi_short_wq_3]
100025 D - 0xfffffe0008180b00 [linuxkpi_long_wq_0]
100026 D - 0xfffffe0008180b00 [linuxkpi_long_wq_1]
100027 D - 0xfffffe0008180b00 [linuxkpi_long_wq_2]
100028 D - 0xfffffe0008180b00 [linuxkpi_long_wq_3]
100034 D - 0xfffffe0008180a00 [firmware taskq]
100038 D - 0xfffffe0008180900 [crypto_0]
100039 D - 0xfffffe0008180900 [crypto_1]
100055 D - 0xfffffe0008180500 [vtnet0 rxq 0]
100056 D - 0xfffffe0008180400 [vtnet0 txq 0]
100057 D - 0xfffffe0008180300 [vtnet0 rxq 1]
100058 D - 0xfffffe0008180200 [vtnet0 txq 1]
100062 D vtbslp 0xfffffe0056f4fe80 [virtio_balloon]
100066 D - 0xffffffff82b703c0 [deadlkres]
100071 D - 0xfffffe00579d1000 [acpi_task_0]
100072 D - 0xfffffe00579d1000 [acpi_task_1]
100073 D - 0xfffffe00579d1000 [acpi_task_2]
100074 D - 0xfffffe0008182100 [mca taskq]
100075 D - 0xfffffe0008180600 [CAM taskq]
db> show all locks
Process 834 (syz-executor.3) thread 0xfffffe0057881560 (100111)
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffffe0092cca720) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3338
Process 833 (syz-executor.1) thread 0xfffffe0058d18ac0 (100109)
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffffe0092ccb548) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3338
Process 832 (syz-executor.0) thread 0xfffffe0058dd6560 (100118)
exclusive sleep mutex sctp-inp (inp) r = 0 (0xfffffe0092c5a9e0) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3340
exclusive rw sctp-info (sctp-info) r = 0 (0xfffffe0053c40f88) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3339
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffffe0092c5aa00) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3338
Process 12 (intr) thread 0xfffffe0053ea93a0 (100029)
exclusive sleep mutex so_rcv (so_rcv) r = 0 (0xfffffe0058d93560) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctputil.c:4847
exclusive sleep mutex sctp-read (inpr) r = 0 (0xfffffe0092c5aa20) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctputil.c:4875
exclusive sleep mutex sctp-tcb (tcb) r = 0 (0xfffffe0092d8da50) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:2138
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
tcp_hpts 7 4801K 7
devbuf 4217 4323K 4245
sysctloid 35217 2075K 35288
vtbuf 24 1968K 46
kobj 329 1316K 490
newblk 31 1032K 494
vfscache 3 1025K 3
pcb 40 559K 77
inodedep 26 522K 97
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
subproc 107 218K 897
acpica 1674 184K 58077
vnet_data 1 168K 1
tidhash 3 141K 3
vmem 3 138K 4
filedesc 18 137K 72
linker 358 134K 386
pagedep 15 132K 34
tfo_ccache 1 128K 1
DEVFS1 109 109K 126
sem 4 106K 4
bus 998 82K 5211
mtx_pool 2 72K 2
syncache 1 68K 1
module 516 65K 516
acpitask 1 64K 1
ddb_capture 1 64K 1
kdtrace 193 40K 986
umtx 308 39K 308
BPF 22 36K 22
temp 34 33K 1902
DEVFS3 128 32K 138
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
gtaskqueue 18 26K 18
kbdmux 6 22K 6
DEVFS_RULE 56 20K 56
ifaddr 67 19K 69
ufs_mount 4 17K 5
proc 3 17K 3
tty 16 16K 16
routetbl 130 16K 410
ithread 97 16K 97
bus-sc 34 15K 1681
lltable 43 14K 43
KTRACE 100 13K 100
eventhandler 151 13K 151
ifnet 7 13K 7
ether_multi 152 13K 162
kenv 95 12K 95
rman 88 11K 431
GEOM 61 11K 478
CAM queue 5 11K 1528
in6_multi 65 9K 65
bmsafemap 2 9K 64
UART 12 9K 12
devstat 4 9K 4
ksem 1 8K 1
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
cred 30 8K 250
pfs_nodes 20 8K 20
audit_evclass 237 8K 296
sctp_atcl 18 7K 25
taskqueue 63 7K 63
sglist 5 7K 5
CAM DEV 3 6K 510
kqueue 51 6K 843
plimit 21 6K 381
ufs_dirhash 24 5K 24
UMA 271 5K 271
pf_ifnet 10 5K 19
vt 11 5K 11
sctp_stro 4 4K 5
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
acpisem 28 4K 28
hhook 15 4K 17
diradd 26 4K 63
session 25 4K 38
mkdir 24 3K 42
proc-args 76 3K 1943
pwddesc 46 3K 839
terminal 11 3K 11
uidinfo 3 3K 9
lockf 20 3K 33
sctp_stri 4 2K 10
local_apic 1 2K 1
io_apic 1 2K 1
fpukern_ctx 2 2K 2
indirdep 8 2K 10
ipsec-saq 2 2K 2
selfd 31 2K 7780
ip6ndp 12 2K 13
Unitno 30 2K 47
sctp_ifa 13 2K 14
CAM XPT 22 2K 543
msi 12 2K 12
newdirblk 12 2K 21
in_multi 6 2K 8
ipsecpolicy 2 2K 2
acpidev 20 2K 20
select 10 2K 34
clone 9 2K 9
tun 7 2K 7
softdep 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
nhops 6 1K 8
vnodemarker 2 1K 40
NFSD session 1 1K 1
sctp_atky 22 1K 35
CAM periph 4 1K 271
sctp_ifn 6 1K 14
ipsec 3 1K 3
mld 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
DEVFSP 10 1K 15
crypto 4 1K 4
encap_export_host 12 1K 12
inpcbpolicy 16 1K 185
CC Mem 8 1K 17
pfil 4 1K 4
cdev 2 1K 2
osd 12 1K 28
chacha20random 1 1K 1
sctp_athm 18 1K 30
sctp_timw 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
dirrem 1 1K 29
vnodes 1 1K 1
CAM SIM 2 1K 2
procdesc 2 1K 8
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 7
prison 6 1K 6
lkpikmalloc 5 1K 6
aesni_data 2 1K 2
sctp_map 8 1K 10
tcp_fsb 1 1K 5
cryptodev 2 1K 49
nexusdev 8 1K 8
apmdev 1 1K 1
atkbddev 2 1K 2
freefile 1 1K 27
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
CAM path 4 1K 1034
soname 5 1K 3483
pmchooks 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
entropy 2 1K 42
pmc 1 1K 1
acpiintr 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
filecaps 2 1K 72
freework 1 1K 27
p1003.1b 1 1K 1
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 5
sctp_iter 0 0K 10
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 10
sctp_aadr 0 0K 0
tcp_do 0 0K 0
mqdata 0 0K 0
filemon 0 0K 0
ipcomp 0 0K 0
esp 0 0K 0
ah 0 0K 0
savedino 0 0K 18
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 6
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freeblks 0 0K 26
ip6opt 0 0K 3
statfs 0 0K 206
namei_tracker 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 2
nvme_da 0 0K 0
acpipwr 0 0K 0
acpi_perf 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
CAM CCB 0 0K 523
biobuf 0 0K 0
aio 0 0K 0
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 0
iov 0 0K 14079
ioctlops 0 0K 96
eventfd 0 0K 0
Witness 0 0K 0
stack 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
mps 0 0K 0
sbuf 0 0K 288
mpr_user 0 0K 0
firmware 0 0K 0
compressor 0 0K 0
MPRSAS 0 0K 0
SWAP 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
sysctltmp 0 0K 673
sysctl 0 0K 3
md_sectors 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
md_disk 0 0K 0
malodev 0 0K 0
LED 0 0K 0
ix_sriov 0 0K 0
cache 0 0K 0
aacraidcam 0 0K 0
kcovinfo 0 0K 0
mbuf_jumbo_page 4096 8320 1078 12269 0 254 38494208 0
mbuf 256 8631 1031 27514 0 254 2473472 0
pbuf 2624 0 778 0 0 2 2041472 0
BUF TRIE 144 172 11588 456 0 62 1693440 0
malloc-128 128 12469 148 12513 0 126 1614976 0
malloc-384 384 4156 44 4157 0 30 1612800 0
malloc-4096 4096 329 1 493 0 2 1351680 0
UMA Slabs 0 112 10625 25 10625 0 126 1192800 0
sctp_asoc 2256 4 506 5 0 254 1150560 0
mbuf_cluster 2048 508 0 508 0 254 1040384 0
vmem btag 56 16851 108 16851 0 254 949704 0
FFS inode 1160 509 23 536 0 8 617120 0
sctp_ep 1208 10 500 15 0 254 616080 0
tcpcb 1104 8 503 17 0 254 564144 0
RADIX NODE 144 3628 119 22640 0 62 539568 0
socket 960 39 469 1417 0 254 487680 0
VM OBJECT 264 1692 48 26653 0 30 459360 0
ertt_txseginfo 40 10562 447 12967 0 254 440360 0
lkpimm 168 1 2327 1 0 62 391104 0
lkpicurr 168 2 2326 2 0 62 391104 0
sctp_raddr 736 4 513 5 0 254 380512 0
256 Bucket 2048 139 13 1053 0 8 311296 0
THREAD 1824 143 11 146 0 8 280896 0
malloc-64 64 3937 410 4760 0 254 278208 0
VNODE 448 544 59 573 0 30 270144 0
malloc-65536 65536 4 0 4 0 1 262144 0
malloc-16 16 14588 412 14676 0 254 240000 0
DEVCTL 1024 21 199 149 0 0 225280 0
MAP ENTRY 96 2064 204 92185 0 126 217728 0
malloc-4096 4096 49 3 839 0 2 212992 0
tcp_bbr_map 128 1344 299 1680 0 126 210304 0
malloc-65536 65536 1 2 61 0 1 196608 0
malloc-65536 65536 2 1 10 0 1 196608 0
UMA Zones 768 243 1 243 0 16 187392 0
malloc-32 32 5334 336 5414 0 254 181440 0
malloc-16384 16384 9 2 34 0 1 180224 0
malloc-128 128 1135 260 27281 0 126 178560 0
malloc-2048 2048 6 74 1229 0 8 163840 0
malloc-1024 1024 123 21 141 0 16 147456 0
FFS2 dinode 256 509 61 536 0 62 145920 0
malloc-256 256 70 500 666 0 62 145920 0
FPU_save_area 832 145 17 203 0 16 134784 0
S VFS Cache 104 1012 275 1053 0 126 133848 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-65536 65536 0 2 136 0 1 131072 0
unpcb 256 11 499 1191 0 254 130560 0
mbuf_packet 256 5 503 141 0 254 130048 0
ksiginfo 112 46 998 104 0 126 116928 0
VMSPACE 2560 32 10 823 0 4 107520 0
malloc-32768 32768 0 3 120 0 1 98304 0
UMA Kegs 384 229 4 229 0 30 89472 0
128 Bucket 1024 48 35 515 0 16 84992 0
clpbuf 2624 0 32 16 0 16 83968 0
malloc-8192 8192 8 2 10 0 1 81920 0
malloc-4096 4096 15 5 31 0 2 81920 0
sctp_chunk 152 4 516 6 0 254 79040 0
PROC 1352 48 9 838 0 8 77064 0
g_bio 408 0 180 4943 0 30 73440 0
malloc-64 64 521 550 1633 0 254 68544 0
malloc-128 128 356 171 551 0 126 67456 0
malloc-32768 32768 2 0 2 0 1 65536 0
malloc-4096 4096 15 1 15 0 2 65536 0
malloc-256 256 163 92 531 0 62 65280 0
malloc-256 256 213 42 514 0 62 65280 0
sctp_stream_msg_out 112 3 537 5 0 254 60480 0
filedesc0 1072 49 7 839 0 8 60032 0
64 Bucket 512 69 35 1711 0 30 53248 0
malloc-64 64 273 546 13983 0 254 52416 0
malloc-64 64 478 341 945 0 254 52416 0
malloc-128 128 159 244 208 0 126 51584 0
malloc-128 128 181 222 541 0 126 51584 0
malloc-256 256 79 116 477 0 62 49920 0
malloc-256 256 67 128 266 0 62 49920 0
malloc-256 256 90 105 531 0 62 49920 0
32 Bucket 256 65 130 8515 0 62 49920 0
DIRHASH 1024 35 13 35 0 16 49152 0
NAMEI 1024 0 48 13390 0 16 49152 0
malloc-16384 16384 3 0 3 0 1 49152 0
malloc-2048 2048 13 11 13 0 8 49152 0
malloc-1024 1024 4 44 1535 0 16 49152 0
syncache 168 0 264 5 0 254 44352 0
malloc-8192 8192 5 0 5 0 1 40960 0
pcpu-8 8 4650 470 4806 0 254 40960 0
pipe 728 20 35 313 0 16 40040 0
sctp_readq 152 1 259 2 0 254 39520 0
udp_inpcb 424 6 84 163 0 30 38160 0
da_ccb 544 0 70 1338 0 16 38080 0
malloc-64 64 24 543 62 0 254 36288 0
malloc-64 64 196 371 9374 0 254 36288 0
malloc-64 64 53 514 870 0 254 36288 0
malloc-64 64 69 498 79 0 254 36288 0
malloc-128 128 35 244 103 0 126 35712 0
malloc-128 128 36 243 3303 0 126 35712 0
malloc-128 128 74 205 942 0 126 35712 0
routing nhops 256 27 108 34 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
malloc-384 384 25 65 96 0 30 34560 0
malloc-384 384 52 38 52 0 30 34560 0
malloc-384 384 59 31 59 0 30 34560 0
malloc-256 256 9 126 11 0 62 34560 0
malloc-256 256 24 111 989 0 62 34560 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 1 1 16 0 1 32768 0
malloc-16384 16384 0 2 160 0 1 32768 0
malloc-8192 8192 3 1 29 0 1 32768 0
malloc-8192 8192 2 2 103 0 1 32768 0
malloc-8192 8192 4 0 4 0 1 32768 0
malloc-2048 2048 2 14 14 0 8 32768 0
malloc-2048 2048 4 12 74 0 8 32768 0
malloc-2048 2048 0 16 50 0 8 32768 0
malloc-2048 2048 11 5 16 0 8 32768 0
malloc-2048 2048 4 12 4 0 8 32768 0
malloc-1024 1024 6 26 49 0 16 32768 0
malloc-1024 1024 6 26 168 0 16 32768 0
malloc-1024 1024 14 18 14 0 16 32768 0
malloc-1024 1024 19 13 19 0 16 32768 0
malloc-1024 1024 2 30 18 0 16 32768 0
malloc-512 512 1 63 118 0 30 32768 0
malloc-512 512 5 59 5 0 30 32768 0
malloc-512 512 0 64 15 0 30 32768 0
malloc-512 512 5 59 92 0 30 32768 0
malloc-512 512 12 52 18 0 30 32768 0
pcpu-64 64 493 19 493 0 254 32768 0
tcp_rack_pcb 896 1 35 5 0 16 32256 0
ttyinq 160 135 65 300 0 62 32000 0
tcp_bbr_pcb 832 4 32 5 0 16 29952 0
cpuset 104 7 272 7 0 126 29016 0
sctp_laddr 48 0 588 12 0 254 28224 0
16 Bucket 144 52 144 237 0 62 28224 0
4 Bucket 48 5 583 52 0 254 28224 0
tcp_inpcb 424 8 55 17 0 30 26712 0
ripcb 424 2 61 5 0 30 26712 0
TURNSTILE 136 155 34 155 0 62 25704 0
malloc-4096 4096 3 3 7 0 2 24576 0
malloc-4096 4096 4 2 627 0 2 24576 0
PGRP 88 25 251 38 0 126 24288 0
rl_entry 40 39 567 39 0 254 24240 0
rtentry 168 30 114 34 0 62 24192 0
Files 80 138 162 7312 0 126 24000 0
8 Bucket 80 43 257 311 0 126 24000 0
malloc-384 384 3 57 25 0 30 23040 0
malloc-384 384 19 41 26 0 30 23040 0
malloc-384 384 20 40 384 0 30 23040 0
malloc-384 384 39 21 41 0 30 23040 0
SLEEPQUEUE 88 155 101 155 0 126 22528 0
udpcb 32 6 624 163 0 254 20160 0
hostcache 64 1 314 1 0 254 20160 0
tcp_inpcb ports 32 6 624 11 0 254 20160 0
udp_inpcb ports 32 3 627 40 0 254 20160 0
ertt 72 8 272 17 0 126 20160 0
PWD 32 16 614 116 0 254 20160 0
malloc-32 32 244 386 324 0 254 20160 0
malloc-32 32 129 501 218 0 254 20160 0
malloc-32 32 140 490 1662 0 254 20160 0
malloc-32 32 58 572 943 0 254 20160 0
malloc-32 32 26 604 67 0 254 20160 0
malloc-32 32 107 523 344 0 254 20160 0
malloc-32 32 37 593 2822 0 254 20160 0
2 Bucket 32 51 579 316 0 254 20160 0
KNOTE 160 26 99 149 0 62 20000 0
Mountpoints 2752 2 5 2 0 4 19264 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-8192 8192 2 0 2 0 1 16384 0
malloc-8192 8192 2 0 2 0 1 16384 0
malloc-4096 4096 1 3 208 0 2 16384 0
malloc-2048 2048 5 3 5 0 8 16384 0
malloc-1024 1024 2 14 2 0 16 16384 0
malloc-512 512 1 31 1 0 30 16384 0
malloc-512 512 0 32 1 0 30 16384 0
SMR CPU 32 7 504 7 0 254 16352 0
kenv 258 15 45 1040 0 30 15480 0
mqnode 416 3 33 3 0 30 14976 0
vmem 1856 1 7 1 0 8 14848 0
SMR SHARED 24 7 504 7 0 254 12264 0
malloc-16 16 21 729 93 0 254 12000 0
malloc-16 16 47 703 308 0 254 12000 0
malloc-16 16 76 674 255 0 254 12000 0
malloc-16 16 219 531 4484 0 254 12000 0
malloc-16 16 8 742 10 0 254 12000 0
malloc-16 16 276 474 279 0 254 12000 0
malloc-16 16 26 724 26472 0 254 12000 0
malloc-4096 4096 1 1 1 0 2 8192 0
vtnet_tx_hdr 24 3 331 14011 0 254 8016 0
pcpu-16 16 7 249 7 0 254 4096 0
UMA Slabs 1 176 10 12 10 0 62 3872 0
KMAP ENTRY 96 12 27 14 0 0 3744 0
pcpu-4 4 1 511 1 0 254 2048 0
FFS1 dinode 128 0 0 0 0 126 0 0
ada_ccb 272 0 0 0 0 30 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
cdg_qdiffsample 16 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 248 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 254 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 312 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 184 0 0 0 0 62 0 0
tcp_rack_map 120 0 0 0 0 126 0 0
ipq 56 0 0 0 0 254 0 0

syzbot

unread,
Sep 10, 2022, 9:50:31 PM9/10/22
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: 13604a80f7a4 iscsi(4): Remove a double word in a source co..
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=136415f0880000
dashboard link: https://syzkaller.appspot.com/bug?extid=6e348d00590179004961
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13254d77080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17a3b577080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6e348d...@syzkaller.appspotmail.com

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0x1b8
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff81603131
stack pointer = 0x28:0xfffffe0053aa8cd0
frame pointer = 0x28:0xfffffe0053aa8d10
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (swi1: netisr 0)

rdi: 1b8 rsi: ffffffff836cc400 rdx:
FreeBSD/amd64 0
(ci-freebsd-maircx: fffffe00033eee30 r8: fffff78000000000 r9: 20000000000
n-2.c.syzkaller.rax: fffffe00033eee30 rbx: 1a0 rbp: fffffe0053aa8d10
r10: 0 r11: bf r12: 1
internal) (ttyu0r13: 4 r14: 1b8 r15: fffffe0053e8b560
)

login: trap number = 12
panic: page fault
cpuid = 0
time = 1662858102
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc7/frame 0xfffffe0053aa84b0
kdb_backtrace() at kdb_backtrace+0xd3/frame 0xfffffe0053aa8610
vpanic() at vpanic+0x254/frame 0xfffffe0053aa86f0
panic() at panic+0xb5/frame 0xfffffe0053aa87b0
trap_fatal() at trap_fatal+0x7ed/frame 0xfffffe0053aa88d0
trap_pfault() at trap_pfault+0x182/frame 0xfffffe0053aa8a10
trap() at trap+0x5e1/frame 0xfffffe0053aa8c00
calltrap() at calltrap+0x8/frame 0xfffffe0053aa8c00
--- trap 0xc, rip = 0xffffffff81603131, rsp = 0xfffffe0053aa8cd0, rbp = 0xfffffe0053aa8d10 ---
__mtx_assert() at __mtx_assert+0x111/frame 0xfffffe0053aa8d10
sorwakeup_locked() at sorwakeup_locked+0x36/frame 0xfffffe0053aa8d50
sctp_add_to_readq() at sctp_add_to_readq+0x717/frame 0xfffffe0053aa8df0
sctp_queue_data_to_stream() at sctp_queue_data_to_stream+0x77a/frame 0xfffffe0053aa8f90
sctp_process_data() at sctp_process_data+0x2bfc/frame 0xfffffe0053aa9680
sctp_common_input_processing() at sctp_common_input_processing+0x168d/frame 0xfffffe0053aa98a0
sctp6_input_with_port() at sctp6_input_with_port+0x597/frame 0xfffffe0053aa9a70
sctp6_input() at sctp6_input+0x1f/frame 0xfffffe0053aa9a90
ip6_input() at ip6_input+0x1ebf/frame 0xfffffe0053aa9cf0
swi_net() at swi_net+0x2ed/frame 0xfffffe0053aa9d90
ithread_loop() at ithread_loop+0x4ee/frame 0xfffffe0053aa9ef0
fork_exit() at fork_exit+0xd0/frame 0xfffffe0053aa9f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0053aa9f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100031 ]
Stopped at kdb_enter+0x6b: movq $0,0x27566aa(%rip)
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0x28
rax 0x12
rcx 0xfffffe00033eee30
rdx 0xdffff7c000000000
rbx 0
rsp 0xfffffe0053aa85f0
rbp 0xfffffe0053aa8610
rsi 0x1
rdi 0
r8 0x3
r9 0xffffffff
r10 0
r11 0xbf
r12 0
r13 0xfffffe0053e8b560
r14 0xffffffff82b6d3e0 .str.26
r15 0xffffffff82b6d3e0 .str.26
rip 0xffffffff8171caeb kdb_enter+0x6b
rflags 0x46
kdb_enter+0x6b: movq $0,0x27566aa(%rip)
db> show proc
Process 12 (intr) at 0xfffffe0053dda560:
state: NORMAL
uid: 0 gids: 0
parent: pid 0 at 0xffffffff83e167e0
ABI: null
flag: 0x10000284 flag2: 0
reaper: 0xffffffff83e167e0 reapsubtree: 12
sigparent: 20
vmspace: 0xffffffff83e17780
(map 0xffffffff83e17780)
(map.pmap 0xffffffff83e17840)
(pmap 0xffffffff83e178b0)
threads: 22
100013 I [swi6: Giant taskq]
100015 I [swi5: fast taskq]
100018 I [swi6: task queue]
100031 Run CPU 0 [swi1: netisr 0]
100032 Run CPU 1 [swi1: hpts]
100033 I [swi1: hpts]
100046 I [irq24: virtio_pci0]
100047 I [irq25: virtio_pci0]
100048 I [irq26: virtio_pci0]
100049 I [irq27: virtio_pci0]
100050 I [irq28: virtio_pci1]
100051 I [irq29: virtio_pci1]
100052 I [irq30: virtio_pci1]
100053 I [irq31: virtio_pci1]
100054 I [irq32: virtio_pci1]
100059 I [irq33: virtio_pci2]
100060 I [irq34: virtio_pci2]
100061 I [irq35: virtio_pci2]
100063 I [irq1: atkbd0]
100064 I [irq12: psm0]
100065 RunQ [swi0: uart uart++]
100069 I [swi1: pf send]
db> ps
pid ppid pgrp uid state wmesg wchan cmd
7325 803 799 0 LE *sctp-in 0xfffffe0057886900 syz-executor2212783
7324 802 799 0 LE *sctp-in 0xfffffe0057886900 syz-executor2212783
7323 805 799 0 LE *sctp-tc 0xfffffe0057886000 syz-executor2212783
7322 804 799 0 LE *sctp-in 0xfffffe0057886900 syz-executor2212783
805 801 799 0 S nanslp 0xffffffff83e40941 syz-executor2212783
804 801 799 0 S nanslp 0xffffffff83e40941 syz-executor2212783
803 801 799 0 S nanslp 0xffffffff83e40941 syz-executor2212783
802 801 799 0 S nanslp 0xffffffff83e40941 syz-executor2212783
801 799 799 0 S nanslp 0xffffffff83e40941 syz-executor2212783
799 797 799 0 Ss pause 0xfffffe00579a00c8 csh
797 688 797 0 Ss select 0xfffffe0092b57040 sshd
754 1 754 0 Ss+ ttyin 0xfffffe0056f5acb0 getty
753 1 753 0 Ss+ ttyin 0xfffffe00579c1cb0 getty
752 1 752 0 Ss+ ttyin 0xfffffe00579c20b0 getty
751 1 751 0 Ss+ ttyin 0xfffffe00579c24b0 getty
750 1 750 0 Ss+ ttyin 0xfffffe00579c28b0 getty
749 1 749 0 Ss+ ttyin 0xfffffe00574900b0 getty
748 1 748 0 Ss+ ttyin 0xfffffe00579c2cb0 getty
747 1 747 0 Ss+ ttyin 0xfffffe00579c30b0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00579c34b0 getty
692 1 692 0 Ss nanslp 0xffffffff83e40940 cron
688 1 688 0 Ss select 0xfffffe0007980540 sshd
501 1 501 0 Ds biowr 0xfffffe00079966c8 syslogd
430 1 430 0 Ss select 0xfffffe00079807c0 devd
429 1 429 65 Ss select 0xfffffe0007980640 dhclient
344 1 344 0 Ss select 0xfffffe0007980740 dhclient
341 1 341 0 Ss select 0xfffffe0007980cc0 dhclient
17 0 0 0 DL syncer 0xffffffff83f65de0 [syncer]
16 0 0 0 DL vlruwt 0xfffffe0056fa4010 [vnlru]
15 0 0 0 DL (threaded) [bufdaemon]
100079 D psleep 0xffffffff83f64400 [bufdaemon]
100082 D - 0xffffffff83212100 [bufspacedaemon-0]
100094 D sdflush 0xfffffe005748f4e8 [/ worker]
9 0 0 0 DL psleep 0xffffffff83f97e80 [vmdaemon]
8 0 0 0 DL (threaded) [pagedaemon]
100077 D psleep 0xffffffff83f8bd38 [dom0]
100080 D launds 0xffffffff83f8bd44 [laundry: dom0]
100081 D umarcl 0xffffffff81e5d9f0 [uma]
7 0 0 0 DL - 0xffffffff83bfcde8 [rand_harvestq]
6 0 0 0 DL pftm 0xffffffff84b62330 [pf purge]
5 0 0 0 DL waiting 0xffffffff84743640 [sctp_iterator]
4 0 0 0 RL (threaded) [cam]
100044 RunQ [doneq0]
100045 D - 0xffffffff83a9f2c0 [async]
100076 D - 0xffffffff83a9f140 [scanner]
14 0 0 0 DL seqstat 0xfffffe0056efcc88 [sequencer 00]
3 0 0 0 DL (threaded) [crypto]
100040 D crypto_ 0xffffffff83f87460 [crypto]
100041 D crypto_ 0xfffffe0053f6c030 [crypto returns 0]
100042 D crypto_ 0xfffffe0053f6c080 [crypto returns 1]
13 0 0 0 DL (threaded) [geom]
100035 D - 0xffffffff83e15dc0 [g_event]
100036 D - 0xffffffff83e15de0 [g_up]
100037 D - 0xffffffff83e15e00 [g_down]
2 0 0 0 WL (threaded) [clock]
100029 I [clock (0)]
100030 I [clock (1)]
12 0 0 0 RL (threaded) [intr]
100013 I [swi6: Giant taskq]
100015 I [swi5: fast taskq]
100018 I [swi6: task queue]
100031 Run CPU 0 [swi1: netisr 0]
100032 Run CPU 1 [swi1: hpts]
100033 I [swi1: hpts]
100046 I [irq24: virtio_pci0]
100047 I [irq25: virtio_pci0]
100048 I [irq26: virtio_pci0]
100049 I [irq27: virtio_pci0]
100050 I [irq28: virtio_pci1]
100051 I [irq29: virtio_pci1]
100052 I [irq30: virtio_pci1]
100053 I [irq31: virtio_pci1]
100054 I [irq32: virtio_pci1]
100059 I [irq33: virtio_pci2]
100060 I [irq34: virtio_pci2]
100061 I [irq35: virtio_pci2]
100063 I [irq1: atkbd0]
100064 I [irq12: psm0]
100065 RunQ [swi0: uart uart++]
100069 I [swi1: pf send]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffffe0053ddb010 [init]
10 0 0 0 DL audit_w 0xffffffff83f88000 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff83e167e0 [swapper]
100005 D - 0xfffffe0053c82700 [softirq_0]
100006 D - 0xfffffe0053c82600 [softirq_1]
100007 D - 0xfffffe0053c82500 [if_io_tqg_0]
100008 D - 0xfffffe0053c82400 [if_io_tqg_1]
100009 D - 0xfffffe0053c82300 [if_config_tqg_0]
100010 D - 0xfffffe000817bd00 [in6m_free taskq]
100011 D - 0xfffffe000817bc00 [linuxkpi_irq_wq]
100012 D - 0xfffffe000817bb00 [deferred_unmount ta]
100014 D - 0xfffffe000817b900 [thread taskq]
100016 D - 0xfffffe000817b700 [kqueue_ctx taskq]
100017 D - 0xfffffe000817b600 [pci_hp taskq]
100019 D - 0xfffffe000817b400 [inm_free taskq]
100020 D - 0xfffffe000817b300 [aiod_kick taskq]
100021 D - 0xfffffe000817b200 [linuxkpi_short_wq_0]
100022 D - 0xfffffe000817b200 [linuxkpi_short_wq_1]
100023 D - 0xfffffe000817b200 [linuxkpi_short_wq_2]
100024 D - 0xfffffe000817b200 [linuxkpi_short_wq_3]
100025 D - 0xfffffe000817b100 [linuxkpi_long_wq_0]
100026 D - 0xfffffe000817b100 [linuxkpi_long_wq_1]
100027 D - 0xfffffe000817b100 [linuxkpi_long_wq_2]
100028 D - 0xfffffe000817b100 [linuxkpi_long_wq_3]
100034 D - 0xfffffe000817b000 [firmware taskq]
100038 D - 0xfffffe000817ae00 [crypto_0]
100039 D - 0xfffffe000817ae00 [crypto_1]
100055 D - 0xfffffe000817ac00 [vtnet0 rxq 0]
100056 D - 0xfffffe000817ab00 [vtnet0 txq 0]
100057 D - 0xfffffe000817aa00 [vtnet0 rxq 1]
100058 D - 0xfffffe000817a900 [vtnet0 txq 1]
100062 D vtbslp 0xfffffe0007982100 [virtio_balloon]
100066 D - 0xffffffff82b73440 [deadlkres]
100071 D - 0xfffffe0057901c00 [acpi_task_0]
100072 D - 0xfffffe0057901c00 [acpi_task_1]
100073 D - 0xfffffe0057901c00 [acpi_task_2]
100074 D - 0xfffffe000817c100 [mca taskq]
100075 D - 0xfffffe000817ad00 [CAM taskq]
db> show all locks
Process 7325 (syz-executor2212783) thread 0xfffffe0058bcd560 (100093)
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffffe0092bb4a00) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3338
Process 7324 (syz-executor2212783) thread 0xfffffe0058df8560 (100098)
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffffe0092bb88f8) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3338
Process 7323 (syz-executor2212783) thread 0xfffffe0092e443a0 (102346)
exclusive sleep mutex sctp-inp (inp) r = 0 (0xfffffe0092bb5420) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3340
exclusive rw sctp-info (sctp-info) r = 0 (0xfffffe00081d6f58) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3339
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffffe0092bb5440) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3338
Process 7322 (syz-executor2212783) thread 0xfffffe0092e221e0 (102123)
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffffe0092bb4548) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:3338
Process 501 (syslogd) thread 0xfffffe0058df7e40 (100099)
exclusive lockmgr bufwait (bufwait) r = 0 (0xfffffe0007996748) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_bio.c:3988
exclusive lockmgr ufs (ufs) r = 0 (0xfffffe0092658cb0) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_syscalls.c:3562
Process 12 (intr) thread 0xfffffe0053e8b560 (100031)
exclusive sleep mutex so_rcv (so_rcv) r = 0 (0xfffffe008fe53560) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctputil.c:4847
exclusive sleep mutex sctp-read (inpr) r = 0 (0xfffffe0092bb5460) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctputil.c:4875
exclusive sleep mutex sctp-tcb (tcb) r = 0 (0xfffffe0092daebf0) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:2138
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
tcp_hpts 7 4801K 7
devbuf 4217 4323K 4245
sysctloid 35217 2075K 35288
vtbuf 24 1968K 46
kobj 329 1316K 493
newblk 9 1026K 7102
vfscache 3 1025K 3
pcb 27 546K 13036
inodedep 61 535K 6592
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
subproc 112 206K 7393
acpica 1674 184K 58126
vmem 3 146K 5
tidhash 3 141K 3
linker 358 134K 386
pagedep 9 130K 6527
tfo_ccache 1 128K 1
IP reass 1 128K 1
vnet_data 1 112K 1
sem 4 106K 4
DEVFS1 105 105K 114
bus 998 82K 5213
mtx_pool 2 72K 2
syncache 1 68K 1
module 516 65K 516
acpitask 1 64K 1
ddb_capture 1 64K 1
umtx 330 42K 330
kdtrace 187 39K 21556
temp 17 33K 1741
hostcache 1 32K 1
shm 1 32K 1
DEVFS3 124 31K 134
msg 4 30K 4
gtaskqueue 18 26K 18
sctp_timw 94 24K 94
kbdmux 6 22K 6
DEVFS_RULE 56 20K 56
BPF 10 18K 10
ufs_mount 4 17K 5
proc 3 17K 3
tty 16 16K 16
ithread 97 16K 97
bus-sc 34 15K 1682
dirrem 52 13K 6531
KTRACE 100 13K 100
eventhandler 151 13K 151
kenv 95 12K 95
ifaddr 30 12K 32
rman 88 11K 431
GEOM 61 11K 483
routetbl 50 11K 176
CAM queue 5 11K 1528
bmsafemap 2 9K 6557
UART 12 9K 12
devstat 4 9K 4
ksem 1 8K 1
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
cred 30 8K 364
pfs_nodes 20 8K 20
audit_evclass 237 8K 296
taskqueue 63 7K 63
freefile 52 7K 6521
sglist 5 7K 5
CAM DEV 3 6K 510
plimit 20 5K 557
ufs_dirhash 24 5K 24
sctp_atcl 12 5K 19495
UMA 271 5K 271
vt 11 5K 11
ifnet 3 5K 3
sctp_stro 4 4K 6499
memdesc 1 4K 1
MCA 32 4K 32
filedesc 1 4K 1
evdev 4 4K 4
acpisem 28 4K 28
hhook 15 4K 17
ether_multi 40 4K 50
lltable 11 4K 12
pf_ifnet 5 3K 6
in6_multi 25 3K 25
kqueue 45 3K 7328
terminal 11 3K 11
pwddesc 41 3K 7326
session 19 3K 45
uidinfo 3 3K 19
proc-args 64 3K 8374
sctp_stri 4 2K 12994
local_apic 1 2K 1
io_apic 1 2K 1
fpukern_ctx 2 2K 2
ipsec-saq 2 2K 2
lockf 16 2K 44
Unitno 27 2K 39
CAM XPT 22 2K 543
msi 12 2K 12
selfd 22 2K 93531
ipsecpolicy 2 2K 2
acpidev 20 2K 20
clone 9 2K 9
freework 5 2K 6521
softdep 1 1K 1
mkdir 8 1K 13022
freeblks 4 1K 6520
sahead 1 1K 1
secasvar 1 1K 1
vnodemarker 2 1K 144
NFSD session 1 1K 1
CAM periph 4 1K 271
select 7 1K 29
sctp_atky 16 1K 32491
ipsec 3 1K 3
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
sctp_ifa 5 1K 6
crypto 4 1K 19489
ip6ndp 4 1K 5
encap_export_host 12 1K 12
newdirblk 4 1K 6511
diradd 4 1K 6552
in_multi 2 1K 4
pfil 4 1K 4
cdev 2 1K 2
inpcbpolicy 14 1K 13137
CC Mem 7 1K 13005
osd 11 1K 13016
chacha20random 1 1K 1
sctp_ifn 2 1K 6
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFSP 4 1K 6508
DEVFS 9 1K 10
mld 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1
CAM SIM 2 1K 2
feeder 7 1K 7
sctp_athm 12 1K 25992
tcpfunc 3 1K 3
loginclass 3 1K 7
prison 6 1K 6
lkpikmalloc 5 1K 6
aesni_data 2 1K 2
cryptodev 2 1K 19538
sctp_map 8 1K 12998
nexusdev 8 1K 8
apmdev 1 1K 1
atkbddev 2 1K 2
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
CAM path 4 1K 1034
procdesc 1 1K 6
pmchooks 1 1K 1
soname 4 1K 48943
tun 3 1K 3
sctp_vrf 1 1K 1
vnet 1 1K 1
entropy 2 1K 44
pmc 1 1K 1
acpiintr 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
filecaps 1 1K 82
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
mqdata 0 0K 0
tcp_do 0 0K 0
tcp_fsb 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 6499
sctp_iter 0 0K 4
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 4
sctp_aadr 0 0K 0
ipcomp 0 0K 0
esp 0 0K 0
ah 0 0K 0
savedino 0 0K 6107
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 24
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 2
allocindir 0 0K 0
indirdep 0 0K 3
ip6opt 0 0K 3
statfs 0 0K 6738
namei_tracker 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 3
nvme_da 0 0K 0
acpipwr 0 0K 0
acpi_perf 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
CAM CCB 0 0K 523
biobuf 0 0K 0
aio 0 0K 0
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 0
iov 0 0K 20593
ioctlops 0 0K 86
eventfd 0 0K 0
Witness 0 0K 0
stack 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
mps 0 0K 0
sbuf 0 0K 288
mpr_user 0 0K 0
firmware 0 0K 0
compressor 0 0K 0
MPRSAS 0 0K 0
SWAP 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
sysctltmp 0 0K 665
sysctl 0 0K 3
md_sectors 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
md_disk 0 0K 0
malodev 0 0K 0
LED 0 0K 0
ix_sriov 0 0K 0
cache 0 0K 0
aacraidcam 0 0K 0
kcovinfo 0 0K 0
mbuf_jumbo_page 4096 8320 1078 16888 0 254 38494208 0
mbuf 256 8585 1077 5663070 0 254 2473472 0
pbuf 2624 0 794 0 0 2 2083456 0
BUF TRIE 144 169 11591 664 0 62 1693440 0
malloc-4096 4096 393 7 8390 0 2 1638400 0
malloc-384 384 4187 13 4188 0 30 1612800 0
malloc-128 128 11600 273 18125 0 126 1519744 0
UMA Slabs 0 112 10604 10 10604 0 126 1188768 0
sctp_asoc 2256 4 506 6499 0 254 1150560 0
mbuf_cluster 2048 508 0 508 0 254 1040384 0
vmem btag 56 16850 109 16850 0 254 949704 0
FFS inode 1160 501 31 7022 0 8 617120 0
sctp_ep 1208 4 506 6499 0 254 616080 0
tcpcb 1104 7 504 13005 0 254 564144 0
RADIX NODE 144 3340 211 106761 0 62 511344 0
socket 960 26 482 20830 0 254 487680 0
malloc-65536 65536 7 0 7 0 1 458752 0
256 Bucket 2048 170 40 17161 0 8 430080 0
VM OBJECT 264 1447 173 156895 0 30 427680 0
lkpimm 168 1 2327 1 0 62 391104 0
lkpicurr 168 2 2326 2 0 62 391104 0
sctp_raddr 736 4 513 6499 0 254 380512 0
ertt_txseginfo 40 7391 285 5453338 0 254 307040 0
THREAD 1824 141 24 14229 0 8 300960 0
VNODE 448 531 99 7054 0 30 282240 0
malloc-64 64 4066 281 30581 0 254 278208 0
malloc-16 16 14609 641 53674 0 254 244000 0
DEVCTL 1024 0 220 124 0 0 225280 0
MAP ENTRY 96 1718 424 344618 0 126 205632 0
malloc-128 128 1249 270 37019 0 126 194432 0
malloc-32 32 5365 557 32038 0 254 189504 0
UMA Zones 768 243 1 243 0 16 187392 0
malloc-256 256 127 563 20310 0 62 176640 0
malloc-384 384 81 369 6643 0 30 172800 0
malloc-256 256 122 508 20033 0 62 161280 0
FPU_save_area 832 143 37 14327 0 16 149760 0
tcp_bbr_map 128 876 271 1423062 0 126 146816 0
malloc-128 128 675 472 7283 0 126 146816 0
S VFS Cache 104 1032 372 7585 0 126 146016 0
FFS2 dinode 256 501 69 7022 0 62 145920 0
malloc-65536 65536 0 2 136 0 1 131072 0
malloc-65536 65536 0 2 54 0 1 131072 0
malloc-2048 2048 6 58 522 0 8 131072 0
malloc-1024 1024 105 23 114 0 16 131072 0
unpcb 256 7 503 1177 0 254 130560 0
mbuf_packet 256 7 501 45590 0 254 130048 0
128 Bucket 1024 59 56 8207 0 16 117760 0
ksiginfo 112 55 989 140 0 126 116928 0
VMSPACE 2560 28 14 7310 0 4 107520 0
PROC 1368 44 22 7325 0 8 90288 0
malloc-8192 8192 9 2 137 0 1 90112 0
UMA Kegs 384 229 4 229 0 30 89472 0
malloc-256 256 160 155 14906 0 62 80640 0
sctp_readq 152 1 519 5203 0 254 79040 0
sctp_chunk 152 4 516 11699 0 254 79040 0
filedesc0 1072 45 25 7326 0 8 75040 0
g_bio 408 4 176 6011 0 30 73440 0
64 Bucket 512 90 46 3936 0 30 69632 0
malloc-64 64 561 510 22607 0 254 68544 0
malloc-128 128 292 235 304 0 126 67456 0
malloc-128 128 347 180 1226 0 126 67456 0
malloc-65536 65536 1 0 1 0 1 65536 0
malloc-65536 65536 1 0 1 0 1 65536 0
malloc-32768 32768 0 2 120 0 1 65536 0
malloc-32768 32768 2 0 2 0 1 65536 0
malloc-16384 16384 3 1 163 0 1 65536 0
32 Bucket 256 80 175 3318 0 62 65280 0
sctp_stream_msg_out 112 0 540 6496 0 254 60480 0
malloc-8192 8192 7 0 7 0 1 57344 0
tcp_inpcb 424 7 119 13005 0 30 53424 0
malloc-128 128 141 262 7146 0 126 51584 0
malloc-256 256 128 67 141 0 62 49920 0
malloc-256 256 70 125 7012 0 62 49920 0
malloc-256 256 118 77 760 0 62 49920 0
malloc-256 256 9 186 26301 0 62 49920 0
DIRHASH 1024 35 13 35 0 16 49152 0
NAMEI 1024 0 48 52414 0 16 49152 0
malloc-16384 16384 3 0 3 0 1 49152 0
malloc-2048 2048 7 17 6528 0 8 49152 0
malloc-1024 1024 34 14 42 0 16 49152 0
malloc-1024 1024 9 39 7028 0 16 49152 0
malloc-512 512 14 82 13004 0 30 49152 0
malloc-384 384 39 81 19522 0 30 46080 0
tcp_bbr_pcb 832 4 50 6498 0 16 44928 0
syncache 168 0 264 5 0 254 44352 0
clpbuf 2624 0 16 21 0 16 41984 0
malloc-8192 8192 5 0 5 0 1 40960 0
Mountpoints 2752 2 12 2 0 4 38528 0
udp_inpcb 424 6 84 128 0 30 38160 0
da_ccb 544 1 69 1617 0 16 38080 0
pcpu-8 8 4223 385 4251 0 254 36864 0
malloc-64 64 118 449 6639 0 254 36288 0
malloc-64 64 111 456 27725 0 254 36288 0
malloc-64 64 89 478 93630 0 254 36288 0
malloc-64 64 491 76 696 0 254 36288 0
malloc-64 64 20 547 293 0 254 36288 0
malloc-128 128 20 259 21 0 126 35712 0
malloc-128 128 64 215 13153 0 126 35712 0
routing nhops 256 10 125 17 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
malloc-384 384 53 37 393 0 30 34560 0
malloc-256 256 16 119 49 0 62 34560 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 1 1 16 0 1 32768 0
malloc-4096 4096 3 5 6741 0 2 32768 0
malloc-4096 4096 8 0 8 0 2 32768 0
malloc-2048 2048 3 13 3 0 8 32768 0
malloc-2048 2048 4 12 67 0 8 32768 0
malloc-2048 2048 7 9 530 0 8 32768 0
malloc-2048 2048 7 9 198 0 8 32768 0
malloc-1024 1024 6 26 209 0 16 32768 0
malloc-1024 1024 4 28 4 0 16 32768 0
malloc-1024 1024 6 26 964 0 16 32768 0
malloc-512 512 5 59 315 0 30 32768 0
malloc-512 512 3 61 3 0 30 32768 0
pcpu-64 64 494 18 494 0 254 32768 0
ttyinq 160 135 65 300 0 62 32000 0
Files 80 75 325 46052 0 126 32000 0
cpuset 104 7 272 7 0 126 29016 0
sctp_laddr 48 0 588 4 0 254 28224 0
tcp_inpcb ports 32 5 877 6500 0 254 28224 0
PWD 32 14 868 6628 0 254 28224 0
16 Bucket 144 57 139 408 0 62 28224 0
4 Bucket 48 7 581 162 0 254 28224 0
ripcb 424 1 62 4 0 30 26712 0
TURNSTILE 136 166 23 166 0 62 25704 0
PGRP 88 19 257 45 0 126 24288 0
rl_entry 40 38 568 38 0 254 24240 0
rtentry 168 13 131 17 0 62 24192 0
pipe 728 6 27 316 0 16 24024 0
8 Bucket 80 50 250 1566 0 126 24000 0
SLEEPQUEUE 88 166 90 166 0 126 22528 0
hostcache 64 1 314 1 0 254 20160 0
udpcb 32 6 624 128 0 254 20160 0
udp_inpcb ports 32 3 627 40 0 254 20160 0
ertt 72 7 273 13005 0 126 20160 0
malloc-64 64 2 313 29 0 254 20160 0
malloc-32 32 6 624 56 0 254 20160 0
malloc-32 32 287 343 489 0 254 20160 0
malloc-32 32 74 556 86 0 254 20160 0
malloc-32 32 41 589 737 0 254 20160 0
malloc-32 32 41 589 28829 0 254 20160 0
malloc-32 32 51 579 7775 0 254 20160 0
2 Bucket 32 44 586 447 0 254 20160 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-8192 8192 1 1 3 0 1 16384 0
malloc-4096 4096 3 1 87 0 2 16384 0
malloc-2048 2048 1 7 1 0 8 16384 0
malloc-1024 1024 8 8 9 0 16 16384 0
malloc-512 512 0 32 1 0 30 16384 0
malloc-512 512 0 32 10 0 30 16384 0
SMR CPU 32 7 504 7 0 254 16352 0
vtnet_tx_hdr 24 0 668 5461249 0 254 16032 0
malloc-16 16 304 696 500 0 254 16000 0
kenv 258 15 45 1038 0 30 15480 0
mqnode 416 3 33 3 0 30 14976 0
vmem 1856 1 7 1 0 8 14848 0
SMR SHARED 24 7 504 7 0 254 12264 0
malloc-32 32 80 298 93 0 254 12096 0
KNOTE 160 0 75 8 0 62 12000 0
malloc-16 16 19 731 13024 0 254 12000 0
malloc-16 16 18 732 132 0 254 12000 0
malloc-16 16 23 727 25 0 254 12000 0
malloc-16 16 185 565 2994 0 254 12000 0
malloc-16 16 15 735 52675 0 254 12000 0
malloc-16 16 42 708 14388 0 254 12000 0
malloc-384 384 1 29 2 0 30 11520 0
malloc-384 384 20 10 21 0 30 11520 0
malloc-8192 8192 1 0 1 0 1 8192 0
malloc-8192 8192 1 0 1 0 1 8192 0
malloc-8192 8192 1 0 1 0 1 8192 0
malloc-4096 4096 0 2 7 0 2 8192 0
malloc-4096 4096 0 2 2 0 2 8192 0
pcpu-16 16 14 498 14 0 254 8192 0
UMA Slabs 1 176 9 13 9 0 62 3872 0
ripcb ports 32 0 0 0 0 254 0 0
udplite_inpcb ports 32 0 0 0 0 254 0 0
udplite_inpcb 424 0 0 0 0 30 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 272 0 0 0 0 30 0 0
AIOCB 552 0 0 0 0 16 0 0
AIO 208 0 0 0 0 62 0 0
TMPFS node 224 0 0 0 0 62 0 0
NCLNODE 608 0 0 0 0 16 0 0
mqnotifier 216 0 0 0 0 62
Reply all
Reply to author
Forward
0 new messages