Fatal trap 9: general protection fault in sctp_lower_sosend
3 views
Skip to first unread message
syzbot
May 14, 2020, 6:02:18 AM5/14/20
to syzkaller-f...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 55e6d575 [ath] Extend the colours to 4, not 2.
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=103d6806100000
dashboard link: https://syzkaller.appspot.com/bug?extid=bc02585076c3cc977f9b
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bc0258...@syzkaller.appspotmail.com
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff81330f1a
stack pointer = 0x28:0xfffffe0025a0e5e0
frame pointer = 0x28:0xfffffe0025a0e7b0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 9532 (syz-executor.3)
trap number = 9
panic: general protection fault
cpuid = 0
time = 1589450494
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025a0e2b0
vpanic() at vpanic+0x1c7/frame 0xfffffe0025a0e310
panic() at panic+0x43/frame 0xfffffe0025a0e370
trap_fatal() at trap_fatal+0x4ca/frame 0xfffffe0025a0e3f0
trap() at trap+0xda/frame 0xfffffe0025a0e510
calltrap() at calltrap+0x8/frame 0xfffffe0025a0e510
--- trap 0x9, rip = 0xffffffff81330f1a, rsp = 0xfffffe0025a0e5e0, rbp = 0xfffffe0025a0e7b0 ---
sctp_lower_sosend() at sctp_lower_sosend+0x52ea/frame 0xfffffe0025a0e7b0
sctp_sosend() at sctp_sosend+0x501/frame 0xfffffe0025a0e8e0
sosend() at sosend+0xc6/frame 0xfffffe0025a0e950
kern_sendit() at kern_sendit+0x33d/frame 0xfffffe0025a0ea00
sendit() at sendit+0x224/frame 0xfffffe0025a0ea60
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe0025a0eac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe0025a0ebf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0025a0ebf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x28289a, rsp = 0x7fffdfffdf08, rbp = 0x7fffdfffdf70 ---
KDB: enter: panic
[ thread pid 9532 tid 101044 ]
Stopped at kdb_enter+0x67: movq $0,0x14abca6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe0026c00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe0025a0e290
rbp 0xfffffe0025a0e2b0
rsi 0x40001
rdi 0xffffffff810b5836 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe002588d600
r12 0xffffffff82068e40 ddb_dbbe
r13 0
r14 0xffffffff8193aae2
r15 0xffffffff8193aae2
rip 0xffffffff810aab47 kdb_enter+0x67
rflags 0x86 ll+0x65
kdb_enter+0x67: movq $0,0x14abca6(%rip)
db> show proc
Process 9532 (syz-executor.3) at 0xfffff80017bb6000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 9446 at 0xfffff80017a3d520
ABI: FreeBSD ELF64
arguments: /root/syz-executor.3
reaper: 0xfffff80003307000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe002585e9e8
(map 0xfffffe002585e9e8)
(map.pmap 0xfffffe002585eaa8)
(pmap 0xfffffe002585eb08)
threads: 3
100788 S nanslp 0xffffffff8252b161 syz-executor.3
101044 Run CPU 0 syz-executor.3
101052 S uwait 0xfffff80003ba7e00 syz-executor.3
db> ps
pid ppid pgrp uid state wmesg wchan cmd
9532 9446 9446 0 R (threaded) syz-executor.3
100788 S nanslp 0xffffffff8252b161 syz-executor.3
101044 Run CPU 0 syz-executor.3
101052 S uwait 0xfffff80003ba7e00 syz-executor.3
9531 9471 9471 0 S (threaded) syz-executor.2
100747 S nanslp 0xffffffff8252b161 syz-executor.2
101031 S sbwait 0xfffffe00239fd0f4 syz-executor.2
101043 S uwait 0xfffff80017536500 syz-executor.2
9530 4465 4465 0 S (threaded) syz-executor.1
100336 S nanslp 0xffffffff8252b161 syz-executor.1
100126 S sbwait 0xfffffe00239cf804 syz-executor.1
101032 S uwait 0xfffff80017537e80 syz-executor.1
9529 4562 4562 0 S (threaded) syz-executor.0
100597 S nanslp 0xffffffff8252b161 syz-executor.0
101022 S sbwait 0xfffffe001cfd2c6c syz-executor.0
101025 S uwait 0xfffff8001793b300 syz-executor.0
101041 S uwait 0xfffff8001793b480 syz-executor.0
101042 S uwait 0xfffff80017536a80 syz-executor.0
9471 768 9471 0 Ss nanslp 0xffffffff8252b161 syz-executor.2
9454 9435 9454 0 Ss select 0xfffff80017b108c0 dhclient
9446 768 9446 0 Ss nanslp 0xffffffff8252b161 syz-executor.3
9438 1 9438 0 Ss select 0xfffff80017c79d40 dhclient
9435 9428 424 65 S select 0xfffff80017b10640 dhclient
9428 424 424 0 S wait 0xfffff80017212520 sh
5854 1 5854 65 Ss select 0xfffff8001793cec0 dhclient
5363 1 5363 0 Ss select 0xfffff8001793bd40 dhclient
5359 1 5359 0 Ss select 0xfffff80017c7e240 dhclient
5341 1 5341 65 Ss select 0xfffff8001793d540 dhclient
4875 1 4875 0 Ss select 0xfffff80017c79b40 dhclient
4872 1 4872 0 Ss select 0xfffff80017eb72c0 dhclient
4562 768 4562 0 Ss nanslp 0xffffffff8252b161 syz-executor.0
4465 768 4465 0 Ss nanslp 0xffffffff8252b161 syz-executor.1
768 766 766 0 S (threaded) syz-fuzzer
100084 S uwait 0xfffff80003ba5980 syz-fuzzer
100110 S uwait 0xfffff80003ba5e80 syz-fuzzer
100111 S uwait 0xfffff80003ba8000 syz-fuzzer
100112 S uwait 0xfffff80003ba8100 syz-fuzzer
100113 S uwait 0xfffff80003ba8200 syz-fuzzer
100114 S kqread 0xfffff800031fa000 syz-fuzzer
100115 S uwait 0xfffff8001753d000 syz-fuzzer
100116 S uwait 0xfffff80003c09380 syz-fuzzer
100117 S uwait 0xfffff80003e10000 syz-fuzzer
100118 S uwait 0xfffff80003c09500 syz-fuzzer
100275 S uwait 0xfffff80017537c80 syz-fuzzer
766 764 766 0 Ss pause 0xfffff80003d98ae8 csh
764 682 764 0 Ss select 0xfffff800175366c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000383ccb0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b2e4b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b2e8b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b2ecb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003b2d0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003b2d4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003b2d8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003b2dcb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003b300b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252b160 cron
682 1 682 0 Ss select 0xfffff80003e108c0 sshd
495 1 495 0 Ss select 0xfffff80003c09440 syslogd
424 1 424 0 Ss wait 0xfffff80003d57000 devd
423 1 423 65 Ss select 0xfffff80003c0cf40 dhclient
338 1 338 0 Ss select 0xfffff80003e1b0c0 dhclient
335 1 335 0 Ss select 0xfffff80003c09740 dhclient
23 0 0 0 DL vlruwt 0xfffff800033dc520 [vnlru]
22 0 0 0 DL syncer 0xffffffff82617098 [syncer]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff826163b0 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100085 D sdflush 0xfffff80003c5ece8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263d288 [vmdaemon]
19 0 0 0 DL (threaded) [pagedaemon]
100067 D psleep 0xffffffff82631858 [dom0]
100074 D launds 0xffffffff82631864 [laundry: dom0]
100075 D umarcl 0xffffffff8153dc40 [uma]
18 0 0 0 DL - 0xffffffff8235edd8 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82b533a0 [pf purge]
16 0 0 0 DL waiting 0xffffffff82619810 [sctp_iterator]
15 0 0 0 DL - 0xffffffff826159ac [soaiod4]
9 0 0 0 DL - 0xffffffff826159ac [soaiod3]
8 0 0 0 DL - 0xffffffff826159ac [soaiod2]
7 0 0 0 DL - 0xffffffff826159ac [soaiod1]
6 0 0 0 DL (threaded) [cam]
100033 D - 0xffffffff82236b40 [doneq0]
100066 D - 0xffffffff82236a10 [scanner]
5 0 0 0 DL crypto_ 0xfffff80003204e90 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff80003204e30 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff8262f040 [crypto]
14 0 0 0 DL seqstat 0xfffff8000335f488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100024 D - 0xffffffff8250a100 [g_event]
100025 D - 0xffffffff8250a108 [g_up]
100026 D - 0xffffffff8250a110 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100017 D - 0xfffff80003319680 [thr_0]
100018 D - 0xfffff800033196c0 [thr_1]
12 0 0 0 WL (threaded) [intr]
100010 I [swi6: Giant taskq]
100013 I [swi5: fast taskq]
100016 I [swi6: task queue]
100019 I [swi3: vm]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 I [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 Run CPU 1 [idle: cpu1]
1 0 1 0 SLs wait 0xfffff80003307000 [init]
10 0 0 0 DL audit_w 0xffffffff8262f518 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8250a690 [swapper]
100005 D - 0xfffff8000320fb00 [if_config_tqg_0]
100006 D - 0xfffff8000320f900 [softirq_0]
100007 D - 0xfffff8000320f700 [softirq_1]
100008 D - 0xfffff8000320f500 [if_io_tqg_0]
100009 D - 0xfffff8000320f300 [if_io_tqg_1]
100011 D - 0xfffff800031fcd00 [in6m_free taskq]
100012 D - 0xfffff800031fcc00 [thread taskq]
100014 D - 0xfffff800031fca00 [kqueue_ctx taskq]
100015 D - 0xfffff800031fc900 [aiod_kick taskq]
100023 D - 0xfffff800031fc700 [firmware taskq]
100028 D - 0xfffff800031fc500 [crypto_0]
100029 D - 0xfffff800031fc500 [crypto_1]
100043 D - 0xfffff800031fc200 [vtnet0 rxq 0]
100044 D - 0xfffff800031fc100 [vtnet0 txq 0]
100045 D - 0xfffff800031fc000 [vtnet0 rxq 1]
100046 D - 0xfffff800031fbe00 [vtnet0 txq 1]
100048 D vtbslp 0xfffff800034f0580 [virtio_balloon]
100052 D - 0xfffff800031fbc00 [mca taskq]
100056 D - 0xffffffff81cdc171 [deadlkres]
100061 D - 0xfffff80003b7e000 [acpi_task_0]
100062 D - 0xfffff80003b7e000 [acpi_task_1]
100063 D - 0xfffff80003b7e000 [acpi_task_2]
100065 D - 0xfffff800031fc300 [CAM taskq]
db> show all locks
Process 9532 (syz-executor.3) thread 0xfffffe002588d100 (101044)
exclusive sleep mutex sctp-send-tcb (tcbs) r = 0 (0xfffffe00259463a0) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_output.c:13221
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 27747 1619K 27811
kobj 332 1328K 491
newblk 50 1037K 31583
vfscache 4 1025K 4
pcb 93 594K 5775
inodedep 30 527K 11206
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 143 285K 9615
acpica 1674 185K 52709
vnet_data 1 168K 1
filedesc 22 153K 15999
pagedep 15 132K 8307
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 237 95K 452
bus 977 79K 3611
mtx_pool 2 72K 2
BPF 38 71K 254
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 499 63K 499
ifaddr 144 60K 275
umtx 360 45K 360
kdtrace 196 38K 40817
temp 35 33K 9099
hostcache 1 32K 1
shm 1 32K 15
DEVFS3 124 31K 134
msg 4 30K 4
sctp_atcl 53 27K 2484
DEVFS_RULE 56 27K 56
vmem 3 26K 5
gtaskqueue 18 26K 18
sctp_stro 25 25K 641
kbdmux 6 22K 6
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
lockf 136 16K 10532
lltable 42 15K 397
ether_multi 172 14K 1581
bus-sc 30 14K 1431
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 132 12K 132
in6_multi 89 11K 883
select 80 10K 80
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 2 9K 11077
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
sctp_timw 32 8K 32
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 233 8K 291
kqueue 63 7K 9537
CAM DEV 3 6K 510
plimit 23 6K 1776
cred 23 6K 696
vt 11 6K 11
ufs_dirhash 27 6K 27
sglist 5 6K 5
CAM queue 5 6K 1528
sctp_ifa 39 5K 190
pf_ifnet 12 5K 113
DEVFSP 76 5K 1178
taskqueue 45 5K 45
freework 18 5K 17750
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
kcovinfo 64 4K 1054
UMA 247 4K 247
session 31 4K 169
pgrp 31 4K 169
routetbl 19 4K 465
sctp_atky 78 4K 3148
dirrem 13 4K 9612
hhook 13 4K 13
acpisem 22 3K 22
terminal 11 3K 11
proc-args 50 3K 2095
uidinfo 3 3K 120
local_apic 1 2K 1
io_apic 1 2K 1
mkdir 16 2K 15630
ipsec-saq 2 2K 2
ip6ndp 12 2K 136
freefile 13 2K 9433
Unitno 29 2K 41353
CAM XPT 22 2K 543
diradd 12 2K 9886
sctp_stri 3 2K 68
in_multi 6 2K 101
pf_osfp 12 2K 12
newdirblk 11 2K 7815
freeblks 5 2K 9208
acpidev 20 2K 20
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
inpcbpolicy 32 1K 24786
clone 8 1K 8
vnodemarker 2 1K 1570
NFSD session 1 1K 1
CAM periph 4 1K 271
sctp_athm 53 1K 2523
sctp_map 50 1K 1234
indirdep 3 1K 10524
mld 6 1K 6
sctp_ifn 6 1K 64
igmp 6 1K 6
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
crypto 3 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
ip_msource 6 1K 128
osd 3 1K 9
vnodes 1 1K 175
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 6
soname 7 1K 9661
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
ip6_msource 2 1K 15
tcpfunc 2 1K 2
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
nexusdev 5 1K 5
entropy 2 1K 130
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
filecaps 4 1K 286
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_table 0 0K 96
pf_rule 0 0K 142
pf_altq 0 0K 0
pf_temp 0 0K 0
ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 69
midi buffers 0 0K 0
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 85119
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 6264
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 780
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 232
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 70
ip6_moptions 0 0K 28
in6_mfilter 0 0K 69
frag6 0 0K 5
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 784
sctp_iter 0 0K 213
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 10
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 203
sctp_aadr 0 0K 99
newreno data 0 0K 0
ip_moptions 0 0K 118
in_mfilter 0 0K 276
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 13
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 7898
export_host 0 0K 0
cl_savebuf 0 0K 115
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 2082
accf 0 0K 0
pts 0 0K 0
iov 0 0K 47681
ioctlops 0 0K 883
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 1626
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 6
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree
mbuf_jumbo_page 4096 4553 4337 25104 0 254 36413440 0
mbuf_cluster 2048 9780 126 9780 0 254 20287488 0
mbuf 256 6245 3408 349337 0 254 2471168 0
mbuf_packet 256 8232 1420 101302 0 254 2470912 0
tcp_log 408 0 5340 80901 0 254 2178720 0
512 512 4145 87 4785 0 30 2166784 0
RADIX NODE 144 13145 516 485790 0 62 1967184 0
BUF TRIE 144 510 12986 68088 0 62 1943424 0
UMA Slabs 0 112 16461 0 16461 0 126 1843632 0
g_bio 408 0 3660 338130 0 30 1493280 0
4096 4096 332 4 491 0 2 1376256 0
128 128 10027 327 19497 0 126 1325312 0
sctp_asoc 2288 25 485 617 0 254 1166880 0
pbuf 832 0 889 0 0 2 739648 0
sctp_ep 1280 25 485 1833 0 254 652800 0
256 Bucket 2048 235 39 1059 0 8 561152 0
2048 2048 2 270 85153 0 8 557056 0
tcpcb 1032 22 495 2028 0 254 533544 0
socket 904 58 455 29532 0 254 463752 0
VM OBJECT 264 1510 140 160376 0 30 435600 0
VNODE 488 832 40 10445 0 30 425536 0
sctp_raddr 736 25 492 635 0 254 380512 0
32768 32768 2 9 9422 0 1 360448 0
tcp_bbr_map 128 54 2488 57742 0 126 325376 0
THREAD 1776 154 26 21831 0 8 319680 0
4096 4096 62 10 9537 0 2 294912 0
256 256 103 1022 31823 0 62 288000 0
65536 65536 4 0 4 0 1 262144 0
ripcb 488 4 508 556 0 254 249856 0
udplite_inpcb 488 4 508 21096 0 254 249856 0
tcp_inpcb 488 22 490 2028 0 254 249856 0
udp_inpcb 488 2 510 1106 0 254 249856 0
FFS2 dinode 256 795 75 10405 0 62 222720 0
16384 16384 9 4 8097 0 1 212992 0
MAP ENTRY 96 1585 557 607397 0 126 205632 0
64 64 2671 416 2699 0 254 197568 0
65536 65536 1 2 26 0 1 196608 0
65536 65536 2 1 114 0 1 196608 0
128 128 1134 385 24723 0 126 194432 0
16 16 11670 330 11964 0 254 192000 0
4096 4096 35 9 221 0 2 180224 0
32 32 4383 279 5457 0 254 149184 0
vmem btag 56 2276 375 2311 0 254 148456 0
16384 16384 3 6 59 0 1 147456 0
1024 1024 121 23 239 0 16 147456 0
FFS inode 160 795 80 10406 0 62 140000 0
VMSPACE 2536 38 16 9511 0 4 136944 0
65536 65536 0 2 897 0 1 131072 0
65536 65536 2 0 2 0 1 131072 0
2048 2048 26 38 1834 0 8 131072 0
unpcb 256 19 491 2649 0 254 130560 0
512 512 33 207 13341 0 30 122880 0
128 Bucket 1024 85 30 1243 0 16 117760 0
ksiginfo 112 65 979 282 0 126 116928 0
clpbuf 832 0 128 24389 0 16 106496 0
PROC 1312 60 21 9532 0 8 106272 0
256 256 213 177 40732 0 62 99840 0
filedesc0 1088 61 30 9533 0 8 99008 0
S VFS Cache 108 613 287 12103 0 126 97200 0
256 256 150 225 11373 0 62 96000 0
512 512 82 102 2868 0 30 94208 0
syncache 168 0 528 12 0 254 88704 0
32 Bucket 256 183 162 44924 0 62 88320 0
64 Bucket 512 106 61 33614 0 30 85504 0
128 128 309 342 8722 0 126 83328 0
256 256 55 260 29599 0 62 80640 0
sctp_readq 152 2 518 51 0 254 79040 0
sctp_chunk 152 37 483 672 0 254 79040 0
512 512 100 52 296 0 30 77824 0
UMA Zones 768 96 0 96 0 16 73728 0
1024 1024 4 64 275 0 16 69632 0
64 64 401 670 45082 0 254 68544 0
64 64 514 557 1780 0 254 68544 0
64 64 548 522 11578 0 254 68480 0
128 128 236 291 26438 0 126 67456 0
65536 65536 0 1 8 0 1 65536 0
8192 8192 3 5 23 0 1 65536 0
2048 2048 11 21 107 0 8 65536 0
1024 1024 27 37 668 0 16 65536 0
512 512 84 36 233 0 30 61440 0
sctp_stream_msg_out 112 18 522 138 0 254 60480 0
8192 8192 4 3 32 0 1 57344 0
4096 4096 9 5 515 0 2 57344 0
selfd 64 155 664 85624 0 254 52416 0
128 128 192 211 14021 0 126 51584 0
128 128 167 236 751 0 126 51584 0
256 256 71 124 11147 0 62 49920 0
256 256 127 68 2147 0 62 49920 0
256 256 9 186 13933 0 62 49920 0
pipe 760 21 44 1494 0 16 49400 0
DIRHASH 1024 36 12 36 0 16 49152 0
NAMEI 1024 0 48 76033 0 16 49152 0
16384 16384 2 1 3 0 1 49152 0
2048 2048 7 17 146 0 8 49152 0
2048 2048 7 17 660 0 8 49152 0
512 512 74 22 395 0 30 49152 0
tcp_bbr_pcb 832 18 36 219 0 16 44928 0
Files 80 223 327 62480 0 126 44000 0
8192 8192 3 2 18 0 1 40960 0
8192 8192 4 1 85 0 1 40960 0
64 pcpu 8 4052 556 6670 0 254 36864 0
64 64 11 556 148 0 254 36288 0
64 64 176 391 9790 0 254 36288 0
64 64 86 481 2287 0 254 36288 0
64 64 64 503 836 0 254 36288 0
32 32 394 740 46858 0 254 36288 0
UMA Kegs 384 86 8 86 0 30 36096 0
128 128 43 236 238 0 126 35712 0
128 128 84 195 2338 0 126 35712 0
routing nhops 256 13 122 278 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
256 256 35 100 247 0 62 34560 0
TURNSTILE 136 181 71 181 0 62 34272 0
SLEEPQUEUE 88 181 203 181 0 126 33792 0
32768 32768 1 0 1 0 1 32768 0
32768 32768 0 1 112 0 1 32768 0
4096 4096 3 5 11 0 2 32768 0
4096 4096 3 5 7901 0 2 32768 0
2048 2048 2 14 2 0 8 32768 0
2048 2048 1 15 885 0 8 32768 0
1024 1024 1 31 4224 0 16 32768 0
1024 1024 2 30 102 0 16 32768 0
1024 1024 16 16 16 0 16 32768 0
1024 1024 19 13 19 0 16 32768 0
1024 1024 1 31 52 0 16 32768 0
512 512 1 63 193 0 30 32768 0
mt_stats_zone 64 438 74 438 0 254 32768 0
16 Bucket 144 81 142 53160 0 62 32112 0
KNOTE 160 27 173 58398 0 62 32000 0
ttyinq 160 135 65 300 0 62 32000 0
8 Bucket 80 91 309 35561 0 126 32000 0
tcp_log_node 120 0 264 42 0 126 31680 0
VNODEPOLL 120 0 264 12 0 126 31680 0
cpuset 104 7 272 7 0 126 29016 0
sctp_laddr 48 0 588 763 0 254 28224 0
hostcache 96 1 293 1 0 254 28224 0
PWD 32 21 861 7829 0 254 28224 0
4 Bucket 48 6 582 26045 0 254 28224 0
rtentry 200 31 109 278 0 62 28000 0
KMAP ENTRY 96 12 279 12 0 126 27936 0
8192 8192 3 0 3 0 1 24576 0
rl_entry 40 92 514 102 0 254 24240 0
2 Bucket 32 80 676 12962 0 254 24192 0
vtnet_tx_hdr 24 0 1002 226132 0 254 24048 0
udpcb 32 6 624 22202 0 254 20160 0
32 32 98 532 2330 0 254 20160 0
32 32 26 604 814 0 254 20160 0
32 32 78 552 9291 0 254 20160 0
32 32 79 551 25597 0 254 20160 0
32 32 38 592 2650 0 254 20160 0
procdesc 136 4 141 66 0 62 19720 0
L VFS Cache 328 1 59 18 0 30 19680 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
16384 16384 1 0 1 0 1 16384 0
16384 16384 1 0 1 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0
2048 2048 1 7 21 0 8 16384 0
512 512 2 30 130 0 30 16384 0
rentr 24 0 668 233 0 254 16032 0
mt_zone 24 438 230 438 0 254 16032 0
MAP 216 2 69 2 0 62 15336 0
vmem 1856 1 7 1 0 8 14848 0
tcp_log_bucket 184 0 66 4 0 62 12144 0
32 32 3 375 218 0 254 12096 0
16 16 11 739 672 0 254 12000 0
16 16 34 716 4330 0 254 12000 0
16 16 100 650 3573 0 254 12000 0
16 16 14 736 109 0 254 12000 0
16 16 296 454 1481 0 254 12000 0
16 16 18 732 23997 0 254 12000 0
Mountpoints 2816 2 2 2 0 4 11264 0
4096 4096 0 2 1 0 2 8192 0
4096 4096 0 2 156 0 2 8192 0
SMR CPU 32 1 254 1 0 254 8160 0
16 16 193 307 1245 0 254 8000 0
SMR SHARED 24 1 254 1 0 254 6120 0
UMA Slabs 1 176 7 13 7 0 62 3520 0
int pcpu 4 18 494 18 0 254 2048 0
FFS1 dinode 128 0 0 0 0 126 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 256 0 0 0 0 62 0 0
pf table entries 216 0 0 0 0 62 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 296 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 48 0 0 0 0 254 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
tcpreass 48 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
tcptw 88 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 280 0 0 0 0 30 0 0
AIOCB 752 0 0 0 0 16 0 0
AIOP 32 0 0 0 0 254 0 0
AIO 208 0 0 0 0 62 0 0
NCLNODE 592 0 0 0 0 16 0 0
LTS VFS Cache 368 0 0 0 0 30 0 0
STS VFS Cache 148 0 0 0 0 62 0 0
crypto_session 72 0 0 0 0 126 0 0
cryptop 240 0 0 0 0 62 0 0
nvme_request 128 0 0 0 0 126 0 0
FPU_save_area 832 0 0 0 0 16 0 0
DMAR_MAP_ENTRY 128 0 0 0 0 126 0 0
ktls_session 192 0 0 0 0 62 0 0
mbuf_jumbo_16k 16384 0 0 0 0 254 0 0
mbuf_jumbo_9k 9216 0 0 0 0 254 0 0
audit_record 1280 0 0 0 0 8 0 0
domainset 40 0 0 0 0 254 0 0
MAC labels 40 0 0 0 0 254 0 0
vnpbuf 832 0 0 0 0 62 0 0
mdpbuf 832 0 0 0 0 4 0 0
nfspbuf 832 0 0 0 0 16 0 0
swwbuf 832 0 0 0 0 8 0 0
swrbuf 832 0 0 0 0 16 0 0
umtx_shm 88 0 0 0 0 126 0 0
umtx pi 96 0 0 0 0 126 0 0
rangeset pctrie nodes 144 0 0 0 0 62 0 0
65536 65536 0 0 0 0 1 0 0
65536 65536 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
8192 8192 0 0 0 0 1 0 0
fakepg 104 0 0 0 0 126 0 0
UMA Hash 256 0 0 0 0 62 0 0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 55e6d575 [ath] Extend the colours to 4, not 2.
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=103d6806100000
dashboard link: https://syzkaller.appspot.com/bug?extid=bc02585076c3cc977f9b
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bc0258...@syzkaller.appspotmail.com
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff81330f1a
stack pointer = 0x28:0xfffffe0025a0e5e0
frame pointer = 0x28:0xfffffe0025a0e7b0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 9532 (syz-executor.3)
trap number = 9
panic: general protection fault
cpuid = 0
time = 1589450494
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025a0e2b0
vpanic() at vpanic+0x1c7/frame 0xfffffe0025a0e310
panic() at panic+0x43/frame 0xfffffe0025a0e370
trap_fatal() at trap_fatal+0x4ca/frame 0xfffffe0025a0e3f0
trap() at trap+0xda/frame 0xfffffe0025a0e510
calltrap() at calltrap+0x8/frame 0xfffffe0025a0e510
--- trap 0x9, rip = 0xffffffff81330f1a, rsp = 0xfffffe0025a0e5e0, rbp = 0xfffffe0025a0e7b0 ---
sctp_lower_sosend() at sctp_lower_sosend+0x52ea/frame 0xfffffe0025a0e7b0
sctp_sosend() at sctp_sosend+0x501/frame 0xfffffe0025a0e8e0
sosend() at sosend+0xc6/frame 0xfffffe0025a0e950
kern_sendit() at kern_sendit+0x33d/frame 0xfffffe0025a0ea00
sendit() at sendit+0x224/frame 0xfffffe0025a0ea60
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe0025a0eac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe0025a0ebf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0025a0ebf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x28289a, rsp = 0x7fffdfffdf08, rbp = 0x7fffdfffdf70 ---
KDB: enter: panic
[ thread pid 9532 tid 101044 ]
Stopped at kdb_enter+0x67: movq $0,0x14abca6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe0026c00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe0025a0e290
rbp 0xfffffe0025a0e2b0
rsi 0x40001
rdi 0xffffffff810b5836 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe002588d600
r12 0xffffffff82068e40 ddb_dbbe
r13 0
r14 0xffffffff8193aae2
r15 0xffffffff8193aae2
rip 0xffffffff810aab47 kdb_enter+0x67
rflags 0x86 ll+0x65
kdb_enter+0x67: movq $0,0x14abca6(%rip)
db> show proc
Process 9532 (syz-executor.3) at 0xfffff80017bb6000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 9446 at 0xfffff80017a3d520
ABI: FreeBSD ELF64
arguments: /root/syz-executor.3
reaper: 0xfffff80003307000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe002585e9e8
(map 0xfffffe002585e9e8)
(map.pmap 0xfffffe002585eaa8)
(pmap 0xfffffe002585eb08)
threads: 3
100788 S nanslp 0xffffffff8252b161 syz-executor.3
101044 Run CPU 0 syz-executor.3
101052 S uwait 0xfffff80003ba7e00 syz-executor.3
db> ps
pid ppid pgrp uid state wmesg wchan cmd
9532 9446 9446 0 R (threaded) syz-executor.3
100788 S nanslp 0xffffffff8252b161 syz-executor.3
101044 Run CPU 0 syz-executor.3
101052 S uwait 0xfffff80003ba7e00 syz-executor.3
9531 9471 9471 0 S (threaded) syz-executor.2
100747 S nanslp 0xffffffff8252b161 syz-executor.2
101031 S sbwait 0xfffffe00239fd0f4 syz-executor.2
101043 S uwait 0xfffff80017536500 syz-executor.2
9530 4465 4465 0 S (threaded) syz-executor.1
100336 S nanslp 0xffffffff8252b161 syz-executor.1
100126 S sbwait 0xfffffe00239cf804 syz-executor.1
101032 S uwait 0xfffff80017537e80 syz-executor.1
9529 4562 4562 0 S (threaded) syz-executor.0
100597 S nanslp 0xffffffff8252b161 syz-executor.0
101022 S sbwait 0xfffffe001cfd2c6c syz-executor.0
101025 S uwait 0xfffff8001793b300 syz-executor.0
101041 S uwait 0xfffff8001793b480 syz-executor.0
101042 S uwait 0xfffff80017536a80 syz-executor.0
9471 768 9471 0 Ss nanslp 0xffffffff8252b161 syz-executor.2
9454 9435 9454 0 Ss select 0xfffff80017b108c0 dhclient
9446 768 9446 0 Ss nanslp 0xffffffff8252b161 syz-executor.3
9438 1 9438 0 Ss select 0xfffff80017c79d40 dhclient
9435 9428 424 65 S select 0xfffff80017b10640 dhclient
9428 424 424 0 S wait 0xfffff80017212520 sh
5854 1 5854 65 Ss select 0xfffff8001793cec0 dhclient
5363 1 5363 0 Ss select 0xfffff8001793bd40 dhclient
5359 1 5359 0 Ss select 0xfffff80017c7e240 dhclient
5341 1 5341 65 Ss select 0xfffff8001793d540 dhclient
4875 1 4875 0 Ss select 0xfffff80017c79b40 dhclient
4872 1 4872 0 Ss select 0xfffff80017eb72c0 dhclient
4562 768 4562 0 Ss nanslp 0xffffffff8252b161 syz-executor.0
4465 768 4465 0 Ss nanslp 0xffffffff8252b161 syz-executor.1
768 766 766 0 S (threaded) syz-fuzzer
100084 S uwait 0xfffff80003ba5980 syz-fuzzer
100110 S uwait 0xfffff80003ba5e80 syz-fuzzer
100111 S uwait 0xfffff80003ba8000 syz-fuzzer
100112 S uwait 0xfffff80003ba8100 syz-fuzzer
100113 S uwait 0xfffff80003ba8200 syz-fuzzer
100114 S kqread 0xfffff800031fa000 syz-fuzzer
100115 S uwait 0xfffff8001753d000 syz-fuzzer
100116 S uwait 0xfffff80003c09380 syz-fuzzer
100117 S uwait 0xfffff80003e10000 syz-fuzzer
100118 S uwait 0xfffff80003c09500 syz-fuzzer
100275 S uwait 0xfffff80017537c80 syz-fuzzer
766 764 766 0 Ss pause 0xfffff80003d98ae8 csh
764 682 764 0 Ss select 0xfffff800175366c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000383ccb0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b2e4b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b2e8b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b2ecb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003b2d0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003b2d4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003b2d8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003b2dcb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003b300b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252b160 cron
682 1 682 0 Ss select 0xfffff80003e108c0 sshd
495 1 495 0 Ss select 0xfffff80003c09440 syslogd
424 1 424 0 Ss wait 0xfffff80003d57000 devd
423 1 423 65 Ss select 0xfffff80003c0cf40 dhclient
338 1 338 0 Ss select 0xfffff80003e1b0c0 dhclient
335 1 335 0 Ss select 0xfffff80003c09740 dhclient
23 0 0 0 DL vlruwt 0xfffff800033dc520 [vnlru]
22 0 0 0 DL syncer 0xffffffff82617098 [syncer]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff826163b0 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100085 D sdflush 0xfffff80003c5ece8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263d288 [vmdaemon]
19 0 0 0 DL (threaded) [pagedaemon]
100067 D psleep 0xffffffff82631858 [dom0]
100074 D launds 0xffffffff82631864 [laundry: dom0]
100075 D umarcl 0xffffffff8153dc40 [uma]
18 0 0 0 DL - 0xffffffff8235edd8 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82b533a0 [pf purge]
16 0 0 0 DL waiting 0xffffffff82619810 [sctp_iterator]
15 0 0 0 DL - 0xffffffff826159ac [soaiod4]
9 0 0 0 DL - 0xffffffff826159ac [soaiod3]
8 0 0 0 DL - 0xffffffff826159ac [soaiod2]
7 0 0 0 DL - 0xffffffff826159ac [soaiod1]
6 0 0 0 DL (threaded) [cam]
100033 D - 0xffffffff82236b40 [doneq0]
100066 D - 0xffffffff82236a10 [scanner]
5 0 0 0 DL crypto_ 0xfffff80003204e90 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff80003204e30 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff8262f040 [crypto]
14 0 0 0 DL seqstat 0xfffff8000335f488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100024 D - 0xffffffff8250a100 [g_event]
100025 D - 0xffffffff8250a108 [g_up]
100026 D - 0xffffffff8250a110 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100017 D - 0xfffff80003319680 [thr_0]
100018 D - 0xfffff800033196c0 [thr_1]
12 0 0 0 WL (threaded) [intr]
100010 I [swi6: Giant taskq]
100013 I [swi5: fast taskq]
100016 I [swi6: task queue]
100019 I [swi3: vm]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 I [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 Run CPU 1 [idle: cpu1]
1 0 1 0 SLs wait 0xfffff80003307000 [init]
10 0 0 0 DL audit_w 0xffffffff8262f518 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8250a690 [swapper]
100005 D - 0xfffff8000320fb00 [if_config_tqg_0]
100006 D - 0xfffff8000320f900 [softirq_0]
100007 D - 0xfffff8000320f700 [softirq_1]
100008 D - 0xfffff8000320f500 [if_io_tqg_0]
100009 D - 0xfffff8000320f300 [if_io_tqg_1]
100011 D - 0xfffff800031fcd00 [in6m_free taskq]
100012 D - 0xfffff800031fcc00 [thread taskq]
100014 D - 0xfffff800031fca00 [kqueue_ctx taskq]
100015 D - 0xfffff800031fc900 [aiod_kick taskq]
100023 D - 0xfffff800031fc700 [firmware taskq]
100028 D - 0xfffff800031fc500 [crypto_0]
100029 D - 0xfffff800031fc500 [crypto_1]
100043 D - 0xfffff800031fc200 [vtnet0 rxq 0]
100044 D - 0xfffff800031fc100 [vtnet0 txq 0]
100045 D - 0xfffff800031fc000 [vtnet0 rxq 1]
100046 D - 0xfffff800031fbe00 [vtnet0 txq 1]
100048 D vtbslp 0xfffff800034f0580 [virtio_balloon]
100052 D - 0xfffff800031fbc00 [mca taskq]
100056 D - 0xffffffff81cdc171 [deadlkres]
100061 D - 0xfffff80003b7e000 [acpi_task_0]
100062 D - 0xfffff80003b7e000 [acpi_task_1]
100063 D - 0xfffff80003b7e000 [acpi_task_2]
100065 D - 0xfffff800031fc300 [CAM taskq]
db> show all locks
Process 9532 (syz-executor.3) thread 0xfffffe002588d100 (101044)
exclusive sleep mutex sctp-send-tcb (tcbs) r = 0 (0xfffffe00259463a0) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_output.c:13221
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 27747 1619K 27811
kobj 332 1328K 491
newblk 50 1037K 31583
vfscache 4 1025K 4
pcb 93 594K 5775
inodedep 30 527K 11206
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 143 285K 9615
acpica 1674 185K 52709
vnet_data 1 168K 1
filedesc 22 153K 15999
pagedep 15 132K 8307
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 237 95K 452
bus 977 79K 3611
mtx_pool 2 72K 2
BPF 38 71K 254
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 499 63K 499
ifaddr 144 60K 275
umtx 360 45K 360
kdtrace 196 38K 40817
temp 35 33K 9099
hostcache 1 32K 1
shm 1 32K 15
DEVFS3 124 31K 134
msg 4 30K 4
sctp_atcl 53 27K 2484
DEVFS_RULE 56 27K 56
vmem 3 26K 5
gtaskqueue 18 26K 18
sctp_stro 25 25K 641
kbdmux 6 22K 6
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
lockf 136 16K 10532
lltable 42 15K 397
ether_multi 172 14K 1581
bus-sc 30 14K 1431
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 132 12K 132
in6_multi 89 11K 883
select 80 10K 80
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 2 9K 11077
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
sctp_timw 32 8K 32
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 233 8K 291
kqueue 63 7K 9537
CAM DEV 3 6K 510
plimit 23 6K 1776
cred 23 6K 696
vt 11 6K 11
ufs_dirhash 27 6K 27
sglist 5 6K 5
CAM queue 5 6K 1528
sctp_ifa 39 5K 190
pf_ifnet 12 5K 113
DEVFSP 76 5K 1178
taskqueue 45 5K 45
freework 18 5K 17750
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
kcovinfo 64 4K 1054
UMA 247 4K 247
session 31 4K 169
pgrp 31 4K 169
routetbl 19 4K 465
sctp_atky 78 4K 3148
dirrem 13 4K 9612
hhook 13 4K 13
acpisem 22 3K 22
terminal 11 3K 11
proc-args 50 3K 2095
uidinfo 3 3K 120
local_apic 1 2K 1
io_apic 1 2K 1
mkdir 16 2K 15630
ipsec-saq 2 2K 2
ip6ndp 12 2K 136
freefile 13 2K 9433
Unitno 29 2K 41353
CAM XPT 22 2K 543
diradd 12 2K 9886
sctp_stri 3 2K 68
in_multi 6 2K 101
pf_osfp 12 2K 12
newdirblk 11 2K 7815
freeblks 5 2K 9208
acpidev 20 2K 20
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
inpcbpolicy 32 1K 24786
clone 8 1K 8
vnodemarker 2 1K 1570
NFSD session 1 1K 1
CAM periph 4 1K 271
sctp_athm 53 1K 2523
sctp_map 50 1K 1234
indirdep 3 1K 10524
mld 6 1K 6
sctp_ifn 6 1K 64
igmp 6 1K 6
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
crypto 3 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
ip_msource 6 1K 128
osd 3 1K 9
vnodes 1 1K 175
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 6
soname 7 1K 9661
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
ip6_msource 2 1K 15
tcpfunc 2 1K 2
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
nexusdev 5 1K 5
entropy 2 1K 130
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
filecaps 4 1K 286
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_table 0 0K 96
pf_rule 0 0K 142
pf_altq 0 0K 0
pf_temp 0 0K 0
ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 69
midi buffers 0 0K 0
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 85119
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 6264
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 780
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 232
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 70
ip6_moptions 0 0K 28
in6_mfilter 0 0K 69
frag6 0 0K 5
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 784
sctp_iter 0 0K 213
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 10
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 203
sctp_aadr 0 0K 99
newreno data 0 0K 0
ip_moptions 0 0K 118
in_mfilter 0 0K 276
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 13
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 7898
export_host 0 0K 0
cl_savebuf 0 0K 115
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 2082
accf 0 0K 0
pts 0 0K 0
iov 0 0K 47681
ioctlops 0 0K 883
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 1626
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 6
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree
mbuf_jumbo_page 4096 4553 4337 25104 0 254 36413440 0
mbuf_cluster 2048 9780 126 9780 0 254 20287488 0
mbuf 256 6245 3408 349337 0 254 2471168 0
mbuf_packet 256 8232 1420 101302 0 254 2470912 0
tcp_log 408 0 5340 80901 0 254 2178720 0
512 512 4145 87 4785 0 30 2166784 0
RADIX NODE 144 13145 516 485790 0 62 1967184 0
BUF TRIE 144 510 12986 68088 0 62 1943424 0
UMA Slabs 0 112 16461 0 16461 0 126 1843632 0
g_bio 408 0 3660 338130 0 30 1493280 0
4096 4096 332 4 491 0 2 1376256 0
128 128 10027 327 19497 0 126 1325312 0
sctp_asoc 2288 25 485 617 0 254 1166880 0
pbuf 832 0 889 0 0 2 739648 0
sctp_ep 1280 25 485 1833 0 254 652800 0
256 Bucket 2048 235 39 1059 0 8 561152 0
2048 2048 2 270 85153 0 8 557056 0
tcpcb 1032 22 495 2028 0 254 533544 0
socket 904 58 455 29532 0 254 463752 0
VM OBJECT 264 1510 140 160376 0 30 435600 0
VNODE 488 832 40 10445 0 30 425536 0
sctp_raddr 736 25 492 635 0 254 380512 0
32768 32768 2 9 9422 0 1 360448 0
tcp_bbr_map 128 54 2488 57742 0 126 325376 0
THREAD 1776 154 26 21831 0 8 319680 0
4096 4096 62 10 9537 0 2 294912 0
256 256 103 1022 31823 0 62 288000 0
65536 65536 4 0 4 0 1 262144 0
ripcb 488 4 508 556 0 254 249856 0
udplite_inpcb 488 4 508 21096 0 254 249856 0
tcp_inpcb 488 22 490 2028 0 254 249856 0
udp_inpcb 488 2 510 1106 0 254 249856 0
FFS2 dinode 256 795 75 10405 0 62 222720 0
16384 16384 9 4 8097 0 1 212992 0
MAP ENTRY 96 1585 557 607397 0 126 205632 0
64 64 2671 416 2699 0 254 197568 0
65536 65536 1 2 26 0 1 196608 0
65536 65536 2 1 114 0 1 196608 0
128 128 1134 385 24723 0 126 194432 0
16 16 11670 330 11964 0 254 192000 0
4096 4096 35 9 221 0 2 180224 0
32 32 4383 279 5457 0 254 149184 0
vmem btag 56 2276 375 2311 0 254 148456 0
16384 16384 3 6 59 0 1 147456 0
1024 1024 121 23 239 0 16 147456 0
FFS inode 160 795 80 10406 0 62 140000 0
VMSPACE 2536 38 16 9511 0 4 136944 0
65536 65536 0 2 897 0 1 131072 0
65536 65536 2 0 2 0 1 131072 0
2048 2048 26 38 1834 0 8 131072 0
unpcb 256 19 491 2649 0 254 130560 0
512 512 33 207 13341 0 30 122880 0
128 Bucket 1024 85 30 1243 0 16 117760 0
ksiginfo 112 65 979 282 0 126 116928 0
clpbuf 832 0 128 24389 0 16 106496 0
PROC 1312 60 21 9532 0 8 106272 0
256 256 213 177 40732 0 62 99840 0
filedesc0 1088 61 30 9533 0 8 99008 0
S VFS Cache 108 613 287 12103 0 126 97200 0
256 256 150 225 11373 0 62 96000 0
512 512 82 102 2868 0 30 94208 0
syncache 168 0 528 12 0 254 88704 0
32 Bucket 256 183 162 44924 0 62 88320 0
64 Bucket 512 106 61 33614 0 30 85504 0
128 128 309 342 8722 0 126 83328 0
256 256 55 260 29599 0 62 80640 0
sctp_readq 152 2 518 51 0 254 79040 0
sctp_chunk 152 37 483 672 0 254 79040 0
512 512 100 52 296 0 30 77824 0
UMA Zones 768 96 0 96 0 16 73728 0
1024 1024 4 64 275 0 16 69632 0
64 64 401 670 45082 0 254 68544 0
64 64 514 557 1780 0 254 68544 0
64 64 548 522 11578 0 254 68480 0
128 128 236 291 26438 0 126 67456 0
65536 65536 0 1 8 0 1 65536 0
8192 8192 3 5 23 0 1 65536 0
2048 2048 11 21 107 0 8 65536 0
1024 1024 27 37 668 0 16 65536 0
512 512 84 36 233 0 30 61440 0
sctp_stream_msg_out 112 18 522 138 0 254 60480 0
8192 8192 4 3 32 0 1 57344 0
4096 4096 9 5 515 0 2 57344 0
selfd 64 155 664 85624 0 254 52416 0
128 128 192 211 14021 0 126 51584 0
128 128 167 236 751 0 126 51584 0
256 256 71 124 11147 0 62 49920 0
256 256 127 68 2147 0 62 49920 0
256 256 9 186 13933 0 62 49920 0
pipe 760 21 44 1494 0 16 49400 0
DIRHASH 1024 36 12 36 0 16 49152 0
NAMEI 1024 0 48 76033 0 16 49152 0
16384 16384 2 1 3 0 1 49152 0
2048 2048 7 17 146 0 8 49152 0
2048 2048 7 17 660 0 8 49152 0
512 512 74 22 395 0 30 49152 0
tcp_bbr_pcb 832 18 36 219 0 16 44928 0
Files 80 223 327 62480 0 126 44000 0
8192 8192 3 2 18 0 1 40960 0
8192 8192 4 1 85 0 1 40960 0
64 pcpu 8 4052 556 6670 0 254 36864 0
64 64 11 556 148 0 254 36288 0
64 64 176 391 9790 0 254 36288 0
64 64 86 481 2287 0 254 36288 0
64 64 64 503 836 0 254 36288 0
32 32 394 740 46858 0 254 36288 0
UMA Kegs 384 86 8 86 0 30 36096 0
128 128 43 236 238 0 126 35712 0
128 128 84 195 2338 0 126 35712 0
routing nhops 256 13 122 278 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
256 256 35 100 247 0 62 34560 0
TURNSTILE 136 181 71 181 0 62 34272 0
SLEEPQUEUE 88 181 203 181 0 126 33792 0
32768 32768 1 0 1 0 1 32768 0
32768 32768 0 1 112 0 1 32768 0
4096 4096 3 5 11 0 2 32768 0
4096 4096 3 5 7901 0 2 32768 0
2048 2048 2 14 2 0 8 32768 0
2048 2048 1 15 885 0 8 32768 0
1024 1024 1 31 4224 0 16 32768 0
1024 1024 2 30 102 0 16 32768 0
1024 1024 16 16 16 0 16 32768 0
1024 1024 19 13 19 0 16 32768 0
1024 1024 1 31 52 0 16 32768 0
512 512 1 63 193 0 30 32768 0
mt_stats_zone 64 438 74 438 0 254 32768 0
16 Bucket 144 81 142 53160 0 62 32112 0
KNOTE 160 27 173 58398 0 62 32000 0
ttyinq 160 135 65 300 0 62 32000 0
8 Bucket 80 91 309 35561 0 126 32000 0
tcp_log_node 120 0 264 42 0 126 31680 0
VNODEPOLL 120 0 264 12 0 126 31680 0
cpuset 104 7 272 7 0 126 29016 0
sctp_laddr 48 0 588 763 0 254 28224 0
hostcache 96 1 293 1 0 254 28224 0
PWD 32 21 861 7829 0 254 28224 0
4 Bucket 48 6 582 26045 0 254 28224 0
rtentry 200 31 109 278 0 62 28000 0
KMAP ENTRY 96 12 279 12 0 126 27936 0
8192 8192 3 0 3 0 1 24576 0
rl_entry 40 92 514 102 0 254 24240 0
2 Bucket 32 80 676 12962 0 254 24192 0
vtnet_tx_hdr 24 0 1002 226132 0 254 24048 0
udpcb 32 6 624 22202 0 254 20160 0
32 32 98 532 2330 0 254 20160 0
32 32 26 604 814 0 254 20160 0
32 32 78 552 9291 0 254 20160 0
32 32 79 551 25597 0 254 20160 0
32 32 38 592 2650 0 254 20160 0
procdesc 136 4 141 66 0 62 19720 0
L VFS Cache 328 1 59 18 0 30 19680 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
16384 16384 1 0 1 0 1 16384 0
16384 16384 1 0 1 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0
2048 2048 1 7 21 0 8 16384 0
512 512 2 30 130 0 30 16384 0
rentr 24 0 668 233 0 254 16032 0
mt_zone 24 438 230 438 0 254 16032 0
MAP 216 2 69 2 0 62 15336 0
vmem 1856 1 7 1 0 8 14848 0
tcp_log_bucket 184 0 66 4 0 62 12144 0
32 32 3 375 218 0 254 12096 0
16 16 11 739 672 0 254 12000 0
16 16 34 716 4330 0 254 12000 0
16 16 100 650 3573 0 254 12000 0
16 16 14 736 109 0 254 12000 0
16 16 296 454 1481 0 254 12000 0
16 16 18 732 23997 0 254 12000 0
Mountpoints 2816 2 2 2 0 4 11264 0
4096 4096 0 2 1 0 2 8192 0
4096 4096 0 2 156 0 2 8192 0
SMR CPU 32 1 254 1 0 254 8160 0
16 16 193 307 1245 0 254 8000 0
SMR SHARED 24 1 254 1 0 254 6120 0
UMA Slabs 1 176 7 13 7 0 62 3520 0
int pcpu 4 18 494 18 0 254 2048 0
FFS1 dinode 128 0 0 0 0 126 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 256 0 0 0 0 62 0 0
pf table entries 216 0 0 0 0 62 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 296 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 48 0 0 0 0 254 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
tcpreass 48 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
tcptw 88 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 280 0 0 0 0 30 0 0
AIOCB 752 0 0 0 0 16 0 0
AIOP 32 0 0 0 0 254 0 0
AIO 208 0 0 0 0 62 0 0
NCLNODE 592 0 0 0 0 16 0 0
LTS VFS Cache 368 0 0 0 0 30 0 0
STS VFS Cache 148 0 0 0 0 62 0 0
crypto_session 72 0 0 0 0 126 0 0
cryptop 240 0 0 0 0 62 0 0
nvme_request 128 0 0 0 0 126 0 0
FPU_save_area 832 0 0 0 0 16 0 0
DMAR_MAP_ENTRY 128 0 0 0 0 126 0 0
ktls_session 192 0 0 0 0 62 0 0
mbuf_jumbo_16k 16384 0 0 0 0 254 0 0
mbuf_jumbo_9k 9216 0 0 0 0 254 0 0
audit_record 1280 0 0 0 0 8 0 0
domainset 40 0 0 0 0 254 0 0
MAC labels 40 0 0 0 0 254 0 0
vnpbuf 832 0 0 0 0 62 0 0
mdpbuf 832 0 0 0 0 4 0 0
nfspbuf 832 0 0 0 0 16 0 0
swwbuf 832 0 0 0 0 8 0 0
swrbuf 832 0 0 0 0 16 0 0
umtx_shm 88 0 0 0 0 126 0 0
umtx pi 96 0 0 0 0 126 0 0
rangeset pctrie nodes 144 0 0 0 0 62 0 0
65536 65536 0 0 0 0 1 0 0
65536 65536 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
8192 8192 0 0 0 0 1 0 0
fakepg 104 0 0 0 0 126 0 0
UMA Hash 256 0 0 0 0 62 0 0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Jun 15, 2020, 7:10:17 PM6/15/20
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 58a1a1f8 if_vtnet: let vtnet_rx_vq_intr() and vtnet_rxq_tq..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1670e599100000
dashboard link: https://syzkaller.appspot.com/bug?extid=bc02585076c3cc977f9b
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17a92849100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bc0258...@syzkaller.appspotmail.com
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff8133b775
stack pointer = 0x0:0xfffffe0025a4a5d0
frame pointer = 0x0:0xfffffe0025a4a7a0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025a4a2a0
vpanic() at vpanic+0x1c7/frame 0xfffffe0025a4a300
panic() at panic+0x43/frame 0xfffffe0025a4a360
trap_fatal() at trap_fatal+0x4ca/frame 0xfffffe0025a4a3e0
trap() at trap+0xda/frame 0xfffffe0025a4a500
calltrap() at calltrap+0x8/frame 0xfffffe0025a4a500
--- trap 0x9, rip = 0xffffffff8133b775, rsp = 0xfffffe0025a4a5d0, rbp = 0xfffffe0025a4a7a0 ---
sctp_lower_sosend() at sctp_lower_sosend+0x32e5/frame 0xfffffe0025a4a7a0
sctp_sosend() at sctp_sosend+0x501/frame 0xfffffe0025a4a8d0
sosend() at sosend+0xc6/frame 0xfffffe0025a4a940
kern_sendit() at kern_sendit+0x33d/frame 0xfffffe0025a4a9f0
sendit() at sendit+0x224/frame 0xfffffe0025a4aa50
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe0025a4aab0
ia32_syscall() at ia32_syscall+0x24e/frame 0xfffffe0025a4abf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbffcf78
KDB: enter: panic
[ thread pid 937 tid 100460 ]
Stopped at kdb_enter+0x67: movq $0,0x14a5626(%rip)
rcx 0x80 ll+0x5f
rdx 0xffffffff8195e8a8
rbx 0
rsp 0xfffffe0025a4a280
rbp 0xfffffe0025a4a2a0
rsi 0x1
rdi 0
r12 0xffffffff82068f70 ddb_dbbe
r13 0
r14 0xffffffff819a9130
r15 0xffffffff819a9130
rip 0xffffffff810b45c7 kdb_enter+0x67
rflags 0x200082 kernphys+0x82
kdb_enter+0x67: movq $0,0x14a5626(%rip)
db> show proc
Process 937 (syz-executor.2) at 0xfffff80003c30000:
ABI: FreeBSD ELF32
arguments: /root/syz-executor.2
reaper: 0xfffff80003318000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe002584d000
(map 0xfffffe002584d000)
(map.pmap 0xfffffe002584d0c0)
(pmap 0xfffffe002584d120)
threads: 4
100090 S nanslp 0xffffffff8252f1f1 syz-executor.2
100460 Run CPU 0 syz-executor.2
100462 S uwait 0xfffff800037c1b00 syz-executor.2
100464 S uwait 0xfffff800037c1c00 syz-executor.2
100077 S nanslp 0xffffffff8252f1f1 syz-executor.3
100461 S sbwait 0xfffffe00239afb8c syz-executor.3
100463 S sbwait 0xfffffe00239afb8c syz-executor.3
100465 S uwait 0xfffff80016a04d00 syz-executor.3
937 778 778 0 R (threaded) syz-executor.2
100090 S nanslp 0xffffffff8252f1f1 syz-executor.2
100460 Run CPU 0 syz-executor.2
100462 S uwait 0xfffff800037c1b00 syz-executor.2
100464 S uwait 0xfffff800037c1c00 syz-executor.2
936 775 775 0 R (threaded) syz-executor.0
100119 RunQ syz-executor.0
100456 S sbwait 0xfffffe00239e465c syz-executor.0
100458 S sbwait 0xfffffe00239e465c syz-executor.0
100459 S uwait 0xfffff800030f9180 syz-executor.0
935 777 777 0 R (threaded) syz-executor.1
100120 Run CPU 1 syz-executor.1
100452 S sbwait 0xfffffe00239e547c syz-executor.1
100455 S sbwait 0xfffffe00239e547c syz-executor.1
100457 S uwait 0xfffff80016a04c00 syz-executor.1
828 818 828 0 Ss select 0xfffff80015aee6c0 dhclient
825 1 825 0 Ss select 0xfffff8001613c340 dhclient
818 803 424 65 S select 0xfffff80003bf98c0 dhclient
803 424 424 0 S wait 0xfffff8001658a000 sh
790 773 790 0 Rs syz-executor.3
778 773 778 0 Ss nanslp 0xffffffff8252f1f1 syz-executor.2
777 773 777 0 Ss nanslp 0xffffffff8252f1f1 syz-executor.1
775 773 775 0 Ss nanslp 0xffffffff8252f1f1 syz-executor.0
773 771 771 0 S (threaded) syz-execprog
100107 S uwait 0xfffff800039f6d80 syz-execprog
100108 S uwait 0xfffff800037c2200 syz-execprog
100109 S uwait 0xfffff800037c2300 syz-execprog
100110 S uwait 0xfffff800037c2480 syz-execprog
100111 S uwait 0xfffff800037c2580 syz-execprog
100112 S kqread 0xfffff80003345700 syz-execprog
100114 S uwait 0xfffff800037c0d80 syz-execprog
100115 S uwait 0xfffff800037c0b80 syz-execprog
100116 S uwait 0xfffff800037c1d80 syz-execprog
771 769 771 0 Ss pause 0xfffff800165895c8 csh
769 682 769 0 Ss select 0xfffff80003d151c0 sshd
750 1 750 0 Ss+ ttyin 0xfffff800037b98b0 getty
749 1 749 0 Ss+ ttyin 0xfffff80003b35cb0 getty
748 1 748 0 Ss+ ttyin 0xfffff80003b384b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b38cb0 getty
746 1 746 0 Ss+ ttyin 0xfffff800033c44b0 getty
745 1 745 0 Ss+ ttyin 0xfffff800033c4cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff800033c34b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800033c3cb0 getty
742 1 742 0 Ss+ ttyin 0xfffff800033c64b0 getty
740 1 24 0 S+ piperd 0xfffff80003c61000 logger
739 738 24 0 S+ nanslp 0xffffffff8252f1f1 sleep
738 1 24 0 S+ wait 0xfffff80003c74000 sh
686 1 686 0 Ss nanslp 0xffffffff8252f1f1 cron
682 1 682 0 Ss select 0xfffff80003d152c0 sshd
4
HEAD commit: 58a1a1f8 if_vtnet: let vtnet_rx_vq_intr() and vtnet_rxq_tq..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1670e599100000
dashboard link: https://syzkaller.appspot.com/bug?extid=bc02585076c3cc977f9b
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17a92849100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bc0258...@syzkaller.appspotmail.com
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
stack pointer = 0x0:0xfffffe0025a4a5d0
frame pointer = 0x0:0xfffffe0025a4a7a0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 937 (syz-executor.2)
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
trap number = 9
panic: general protection fault
cpuid = 0
time = 1592262339
panic: general protection fault
cpuid = 0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025a4a2a0
vpanic() at vpanic+0x1c7/frame 0xfffffe0025a4a300
panic() at panic+0x43/frame 0xfffffe0025a4a360
trap_fatal() at trap_fatal+0x4ca/frame 0xfffffe0025a4a3e0
trap() at trap+0xda/frame 0xfffffe0025a4a500
calltrap() at calltrap+0x8/frame 0xfffffe0025a4a500
--- trap 0x9, rip = 0xffffffff8133b775, rsp = 0xfffffe0025a4a5d0, rbp = 0xfffffe0025a4a7a0 ---
sctp_lower_sosend() at sctp_lower_sosend+0x32e5/frame 0xfffffe0025a4a7a0
sctp_sosend() at sctp_sosend+0x501/frame 0xfffffe0025a4a8d0
sosend() at sosend+0xc6/frame 0xfffffe0025a4a940
kern_sendit() at kern_sendit+0x33d/frame 0xfffffe0025a4a9f0
sendit() at sendit+0x224/frame 0xfffffe0025a4aa50
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe0025a4aab0
ia32_syscall() at ia32_syscall+0x24e/frame 0xfffffe0025a4abf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbffcf78
KDB: enter: panic
[ thread pid 937 tid 100460 ]
Stopped at kdb_enter+0x67: movq $0,0x14a5626(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rcx 0x80 ll+0x5f
rdx 0xffffffff8195e8a8
rbx 0
rsp 0xfffffe0025a4a280
rbp 0xfffffe0025a4a2a0
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe0025c26f10
r9 0xffffffff
r10 0
r12 0xffffffff82068f70 ddb_dbbe
r13 0
r14 0xffffffff819a9130
r15 0xffffffff819a9130
rip 0xffffffff810b45c7 kdb_enter+0x67
rflags 0x200082 kernphys+0x82
kdb_enter+0x67: movq $0,0x14a5626(%rip)
db> show proc
Process 937 (syz-executor.2) at 0xfffff80003c30000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 778 at 0xfffff8001658e000
uid: 0 gids: 0, 0, 5
ABI: FreeBSD ELF32
arguments: /root/syz-executor.2
reaper: 0xfffff80003318000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe002584d000
(map 0xfffffe002584d000)
(map.pmap 0xfffffe002584d0c0)
(pmap 0xfffffe002584d120)
threads: 4
100090 S nanslp 0xffffffff8252f1f1 syz-executor.2
100460 Run CPU 0 syz-executor.2
100462 S uwait 0xfffff800037c1b00 syz-executor.2
100464 S uwait 0xfffff800037c1c00 syz-executor.2
db> ps
pid ppid pgrp uid state wmesg wchan cmd
938 790 790 0 S (threaded) syz-executor.3
pid ppid pgrp uid state wmesg wchan cmd
100077 S nanslp 0xffffffff8252f1f1 syz-executor.3
100461 S sbwait 0xfffffe00239afb8c syz-executor.3
100463 S sbwait 0xfffffe00239afb8c syz-executor.3
100465 S uwait 0xfffff80016a04d00 syz-executor.3
937 778 778 0 R (threaded) syz-executor.2
100090 S nanslp 0xffffffff8252f1f1 syz-executor.2
100460 Run CPU 0 syz-executor.2
100462 S uwait 0xfffff800037c1b00 syz-executor.2
100464 S uwait 0xfffff800037c1c00 syz-executor.2
936 775 775 0 R (threaded) syz-executor.0
100119 RunQ syz-executor.0
100456 S sbwait 0xfffffe00239e465c syz-executor.0
100458 S sbwait 0xfffffe00239e465c syz-executor.0
100459 S uwait 0xfffff800030f9180 syz-executor.0
935 777 777 0 R (threaded) syz-executor.1
100120 Run CPU 1 syz-executor.1
100452 S sbwait 0xfffffe00239e547c syz-executor.1
100455 S sbwait 0xfffffe00239e547c syz-executor.1
100457 S uwait 0xfffff80016a04c00 syz-executor.1
828 818 828 0 Ss select 0xfffff80015aee6c0 dhclient
825 1 825 0 Ss select 0xfffff8001613c340 dhclient
818 803 424 65 S select 0xfffff80003bf98c0 dhclient
803 424 424 0 S wait 0xfffff8001658a000 sh
790 773 790 0 Rs syz-executor.3
778 773 778 0 Ss nanslp 0xffffffff8252f1f1 syz-executor.2
777 773 777 0 Ss nanslp 0xffffffff8252f1f1 syz-executor.1
775 773 775 0 Ss nanslp 0xffffffff8252f1f1 syz-executor.0
773 771 771 0 S (threaded) syz-execprog
100107 S uwait 0xfffff800039f6d80 syz-execprog
100108 S uwait 0xfffff800037c2200 syz-execprog
100109 S uwait 0xfffff800037c2300 syz-execprog
100110 S uwait 0xfffff800037c2480 syz-execprog
100111 S uwait 0xfffff800037c2580 syz-execprog
100112 S kqread 0xfffff80003345700 syz-execprog
100114 S uwait 0xfffff800037c0d80 syz-execprog
100115 S uwait 0xfffff800037c0b80 syz-execprog
100116 S uwait 0xfffff800037c1d80 syz-execprog
771 769 771 0 Ss pause 0xfffff800165895c8 csh
769 682 769 0 Ss select 0xfffff80003d151c0 sshd
750 1 750 0 Ss+ ttyin 0xfffff800037b98b0 getty
749 1 749 0 Ss+ ttyin 0xfffff80003b35cb0 getty
748 1 748 0 Ss+ ttyin 0xfffff80003b384b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b38cb0 getty
746 1 746 0 Ss+ ttyin 0xfffff800033c44b0 getty
745 1 745 0 Ss+ ttyin 0xfffff800033c4cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff800033c34b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800033c3cb0 getty
742 1 742 0 Ss+ ttyin 0xfffff800033c64b0 getty
740 1 24 0 S+ piperd 0xfffff80003c61000 logger
739 738 24 0 S+ nanslp 0xffffffff8252f1f1 sleep
738 1 24 0 S+ wait 0xfffff80003c74000 sh
686 1 686 0 Ss nanslp 0xffffffff8252f1f1 cron
682 1 682 0 Ss select 0xfffff80003d152c0 sshd
4
syzbot
Jun 19, 2020, 11:36:14 PM6/19/20
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 6328f172 Allocate an fs_summary_info structure when creati..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=153a23d1100000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=170aefae100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108aefae100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bc0258...@syzkaller.appspotmail.com
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff8133c0b5
stack pointer = 0x0:0xfffffe00255f85d0
frame pointer = 0x0:0xfffffe00255f87a0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00255f82a0
vpanic() at vpanic+0x1c7/frame 0xfffffe00255f8300
panic() at panic+0x43/frame 0xfffffe00255f8360
trap_fatal() at trap_fatal+0x4ca/frame 0xfffffe00255f83e0
trap() at trap+0xda/frame 0xfffffe00255f8500
calltrap() at calltrap+0x8/frame 0xfffffe00255f8500
--- trap 0x9, rip = 0xffffffff8133c0b5, rsp = 0xfffffe00255f85d0, rbp = 0xfffffe00255f87a0 ---
sctp_lower_sosend() at sctp_lower_sosend+0x32e5/frame 0xfffffe00255f87a0
sctp_sosend() at sctp_sosend+0x501/frame 0xfffffe00255f88d0
sosend() at sosend+0xc6/frame 0xfffffe00255f8940
kern_sendit() at kern_sendit+0x33d/frame 0xfffffe00255f89f0
sendit() at sendit+0x224/frame 0xfffffe00255f8a50
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe00255f8ab0
ia32_syscall() at ia32_syscall+0x24e/frame 0xfffffe00255f8bf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbffcf7c
KDB: enter: panic
[ thread pid 1062 tid 101078 ]
Stopped at kdb_enter+0x67: movq $0,0x14a50d6(%rip)
rbx 0
rsp 0xfffffe00255f8280
rbp 0xfffffe00255f82a0
rsi 0x1
rdi 0
r15 0xffffffff819a9141
rip 0xffffffff810b4b17 kdb_enter+0x67
rflags 0x200082 kernphys+0x82
kdb_enter+0x67: movq $0,0x14a50d6(%rip)
db> show proc
Process 1062 (syz-executor7210921) at 0xfffff8001687c000:
ABI: FreeBSD ELF32
arguments: ./syz-executor721092150
reaper: 0xfffff8000331a000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe000498a9e8
(map 0xfffffe000498a9e8)
(map.pmap 0xfffffe000498aaa8)
(pmap 0xfffffe000498ab08)
threads: 2
100104 s syz-executor7210921
101078 Run CPU 0 syz-executor7210921
100103 S nanslp 0xffffffff8252f201 syz-executor7210921
101086 S sbwait 0xfffffe00239e29e4 syz-executor7210921
101087 S sbwait 0xfffffe00239e29e4 syz-executor7210921
1064 782 776 0 R (threaded) syz-executor7210921
100448 RunQ syz-executor7210921
101084 S sbwait 0xfffffe00239e30f4 syz-executor7210921
101085 S sbwait 0xfffffe00239e30f4 syz-executor7210921
101090 S uwait 0xfffff80003a02500 syz-executor7210921
101091 S uwait 0xfffff800030fbc00 syz-executor7210921
1063 780 776 0 S (threaded) syz-executor7210921
100102 S nanslp 0xffffffff8252f201 syz-executor7210921
101082 S sbwait 0xfffffe00239e5804 syz-executor7210921
101083 S sbwait 0xfffffe00239e5804 syz-executor7210921
101088 S uwait 0xfffff800037c4700 syz-executor7210921
101089 S uwait 0xfffff800037c4200 syz-executor7210921
1062 783 776 0 T (threaded) syz-executor7210921
100104 s syz-executor7210921
101078 Run CPU 0 syz-executor7210921
783 778 776 0 S nanslp 0xffffffff8252f201 syz-executor7210921
782 778 776 0 S nanslp 0xffffffff8252f201 syz-executor7210921
780 778 776 0 S nanslp 0xffffffff8252f201 syz-executor7210921
779 778 776 0 S nanslp 0xffffffff8252f201 syz-executor7210921
778 776 776 0 S nanslp 0xffffffff8252f200 syz-executor7210921
776 774 776 0 Ss pause 0xfffff80003cf30a8 csh
774 682 774 0 Ss select 0xfffff800039ee040 sshd
748 1 748 0 Ss+ ttyin 0xfffff800037bd8b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b41cb0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b444b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b44cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff800033c54b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800033c5cb0 getty
742 1 742 0 Ss+ ttyin 0xfffff800033ca4b0 getty
741 1 741 0 Ss+ ttyin 0xfffff800033cacb0 getty
740 1 740 0 Ss+ ttyin 0xfffff800033c94b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252f200 cron
682 1 682 0 Ss select 0xfffff800039ee540 sshd
495 1 495 0 Ss select 0xfffff80003c11440 syslogd
424 1 424 0 Ss select 0xfffff80003c12c40 devd
423 1 423 65 Ss select 0xfffff80003c12dc0 dhclient
338 1 338 0 Ss select 0xfffff800039ef640 dhclient
335 1 335 0 Ss select 0xfffff80003c113c0 dhclient
23 0 0 0 DL vlruwt 0xfffff800033fa520 [vnlru]
22 0 0 0 DL syncer 0xffffffff8261a458 [syncer]
20 0 0 0 DL psleep 0xffffffff82640788 [vmdaemon]
100074 D launds 0xffffffff82634c24 [laundry: dom0]
100075 D umarcl 0xffffffff8154fa70 [uma]
18 0 0 0 DL - 0xffffffff82362e58 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82c583a0 [pf purge]
16 0 0 0 DL waiting 0xffffffff8261cbd0 [sctp_iterator]
15 0 0 0 DL - 0xffffffff82618dac [soaiod4]
9 0 0 0 DL - 0xffffffff82618dac [soaiod3]
8 0 0 0 DL - 0xffffffff82618dac [soaiod2]
7 0 0 0 DL - 0xffffffff82618dac [soaiod1]
100066 D - 0xffffffff8223aa90 [scanner]
5 0 0 0 DL crypto_ 0xfffff8000334d690 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff8000334d630 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff82632400 [crypto]
14 0 0 0 DL seqstat 0xfffff800030e2488 [sequencer 00]
100025 D - 0xffffffff8250e188 [g_up]
100026 D - 0xffffffff8250e190 [g_down]
100018 D - 0xfffff800030f9c40 [thr_1]
100013 I [swi6: task queue]
100014 I [swi6: Giant taskq]
100019 I [swi4: clock (0)]
100020 I [swi4: clock (1)]
100021 I [swi3: vm]
10 0 0 0 DL audit_w 0xffffffff826328d8 [audit]
100005 D - 0xfffff80003217e00 [if_config_tqg_0]
100006 D - 0xfffff80003217d00 [softirq_0]
100007 D - 0xfffff80003217c00 [softirq_1]
100008 D - 0xfffff80003217b00 [if_io_tqg_0]
100009 D - 0xfffff80003217a00 [if_io_tqg_1]
100011 D - 0xfffff80003350000 [kqueue_ctx taskq]
100012 D - 0xfffff8000334de00 [aiod_kick taskq]
100015 D - 0xfffff8000334db00 [in6m_free taskq]
100016 D - 0xfffff8000334da00 [thread taskq]
100023 D - 0xfffff8000334d900 [firmware taskq]
100028 D - 0xfffff8000334d700 [crypto_0]
100029 D - 0xfffff8000334d700 [crypto_1]
100043 D - 0xfffff8000334d400 [vtnet0 rxq 0]
100044 D - 0xfffff8000334d300 [vtnet0 txq 0]
100045 D - 0xfffff8000334d200 [vtnet0 rxq 1]
100046 D - 0xfffff8000334d100 [vtnet0 txq 1]
100048 D vtbslp 0xfffff80003524580 [virtio_balloon]
100052 D - 0xfffff8000334d000 [mca taskq]
100057 D - 0xffffffff81d4e870 [deadlkres]
100061 D - 0xfffff80003b32300 [acpi_task_0]
100062 D - 0xfffff80003b32300 [acpi_task_1]
100063 D - 0xfffff80003b32300 [acpi_task_2]
100065 D - 0xfffff8000334d500 [CAM taskq]
db> show all locks
Process 1062 (syz-executor7210921) thread 0xfffffe002599ea00 (101078)
exclusive sleep mutex sctp-send-tcb (tcbs) r = 0 (0xfffffe00259621c0) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_output.c:13197
kobj 334 1336K 493
newblk 102 1050K 484
vfscache 4 1025K 4
pcb 35 553K 1205
inodedep 2 513K 71
subproc 118 238K 1133
acpica 1674 185K 55859
vnet_data 1 168K 1
pagedep 2 129K 19
linker 239 96K 268
bus 972 79K 3360
mtx_pool 2 72K 2
umtx 288 36K 288
temp 18 33K 1559
kdtrace 167 33K 3171
DEVFS3 120 30K 130
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18
vmem 3 22K 4
kbdmux 6 22K 6
BPF 10 18K 10
ufs_mount 5 17K 6
ifaddr 32 13K 32
KTRACE 100 13K 100
sctp_timw 49 13K 49
kenv 92 12K 92
eventhandler 132 12K 132
pfs_nodes 20 10K 20
GEOM 60 10K 488
rman 82 10K 423
audit_evclass 233 8K 291
taskqueue 45 5K 45
ufs_dirhash 24 5K 24
ifnet 3 5K 3
UMA 249 5K 249
plimit 16 4K 353
evdev 4 4K 4
filedesc 1 4K 1
lltable 11 4K 11
routetbl 14 4K 14
hhook 13 4K 13
kqueue 51 4K 1068
ether_multi 40 4K 45
pf_ifnet 5 3K 6
in6_multi 25 3K 25
pgrp 19 3K 33
uidinfo 3 3K 9
select 17 3K 17
sctp_stri 4 2K 566
lockf 16 2K 26
Unitno 25 2K 37
vnodemarker 2 1K 18
sctp_ifa 5 1K 5
crypto 3 1K 3
in_multi 2 1K 3
indirdep 1 1K 3
mld 2 1K 2
sctp_ifn 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1
feeder 7 1K 7
inpcbpolicy 6 1K 131
loginclass 3 1K 7
soname 8 1K 7489
tcpfunc 2 1K 2
sctp_map 8 1K 1072
tun 3 1K 3
nexusdev 5 1K 5
entropy 2 1K 35
freework 1 1K 26
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
tcp_log_dev 0 0K 0
ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
mixer 0 0K 0
hdacc 0 0K 0
hyperv_socket 0 0K 0
dirrem 0 0K 28
mkdir 0 0K 16
freefile 0 0K 26
freeblks 0 0K 25
freefrag 0 0K 7
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_aadr 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 3
mbuf_cluster 2048 9272 126 9272 0 254 19247104 0
mbuf_jumbo_page 4096 3200 1372 262885 0 254 18726912 0
mbuf_packet 256 8197 947 26387 0 254 2340864 0
512 512 4180 52 4181 0 30 2166784 0
mbuf 256 5894 1987 799765 0 254 2017536 0
BUF TRIE 144 159 13337 528 0 62 1943424 0
4096 4096 391 3 2014 0 2 1613824 0
UMA Slabs 0 112 10691 31 10691 0 126 1200864 0
128 128 9285 46 14990 0 126 1194368 0
sctp_asoc 2288 4 506 536 0 254 1166880 0
pbuf 832 0 969 0 0 2 806208 0
sctp_ep 1280 7 503 565 0 254 652800 0
socket 904 21 492 1730 0 254 463752 0
65536 65536 6 0 6 0 1 393216 0
sctp_raddr 736 4 513 536 0 254 380512 0
256 Bucket 2048 156 28 2846 0 8 376832 0
RADIX NODE 144 2281 208 41378 0 62 358416 0
VNODE 488 515 61 544 0 30 281088 0
tcpcb 1040 3 261 7 0 254 274560 0
VM OBJECT 264 920 70 16360 0 30 261360 0
THREAD 1792 117 27 1091 0 8 258048 0
ripcb 488 1 511 4 0 254 249856 0
udp_inpcb 488 2 510 120 0 254 249856 0
64 64 2759 328 4021 0 254 197568 0
65536 65536 1 2 54 0 1 196608 0
16 16 11754 496 13096 0 254 196000 0
128 128 1271 124 25581 0 126 178560 0
UMA Zones 768 223 3 223 0 16 173568 0
32 32 4443 471 5767 0 254 157248 0
1024 1024 129 15 139 0 16 147456 0
FFS2 dinode 256 486 84 512 0 62 145920 0
tcp_inpcb 488 3 253 7 0 254 124928 0
MAP ENTRY 96 877 383 42907 0 126 120960 0
sctp_chunk 152 44 736 16697 0 254 118560 0
ksiginfo 112 37 1007 57 0 126 116928 0
vmem btag 56 1915 160 1915 0 254 116200 0
256 256 103 332 503 0 62 111360 0
128 128 559 216 1486 0 126 99200 0
2048 2048 7 41 2658 0 8 98304 0
256 256 256 119 2334 0 62 96000 0
FFS inode 160 486 89 513 0 62 92000 0
VMSPACE 2536 28 8 1045 0 4 91296 0
PROC 1312 50 16 1065 0 8 86592 0
filedesc0 1088 51 26 1066 0 8 83776 0
UMA Kegs 384 209 6 209 0 30 82560 0
S VFS Cache 108 589 167 1113 0 126 81648 0
sctp_readq 152 4 516 283 0 254 79040 0
4096 4096 15 3 28 0 2 73728 0
g_bio 408 0 180 5202 0 30 73440 0
1024 1024 10 58 281 0 16 69632 0
128 Bucket 1024 39 28 209 0 16 68608 0
64 64 607 464 14342 0 254 68544 0
128 128 308 219 394 0 126 67456 0
65536 65536 0 1 112 0 1 65536 0
32768 32768 2 0 2 0 1 65536 0
16384 16384 4 0 4 0 1 65536 0
256 256 120 135 1273 0 62 65280 0
512 512 23 97 210 0 30 61440 0
sctp_stream_msg_out 112 3 537 289 0 254 60480 0
8192 8192 6 1 8 0 1 57344 0
64 Bucket 512 60 44 760 0 30 53248 0
64 64 284 535 1346 0 254 52416 0
64 64 445 374 679 0 254 52416 0
128 128 325 78 389 0 126 51584 0
256 256 52 143 189 0 62 49920 0
32 Bucket 256 41 154 453 0 62 49920 0
DIRHASH 1024 34 14 34 0 16 49152 0
NAMEI 1024 0 48 11575 0 16 49152 0
16384 16384 3 0 4 0 1 49152 0
2048 2048 8 16 566 0 8 49152 0
1024 1024 10 38 542 0 16 49152 0
512 512 71 25 392 0 30 49152 0
512 512 21 75 2460 0 30 49152 0
syncache 168 0 264 5 0 254 44352 0
8192 8192 4 1 32 0 1 40960 0
4096 4096 8 2 12 0 2 40960 0
clpbuf 832 0 48 113 0 16 39936 0
selfd 64 37 530 5982 0 254 36288 0
64 64 12 555 26 0 254 36288 0
64 64 12 555 36 0 254 36288 0
64 64 33 534 65 0 254 36288 0
64 64 36 531 1169 0 254 36288 0
128 128 19 260 77 0 126 35712 0
128 128 13 266 14 0 126 35712 0
128 128 62 217 67 0 126 35712 0
routing nhops 256 8 127 18 0 62 34560 0
256 256 22 113 683 0 62 34560 0
256 256 64 71 156 0 62 34560 0
256 256 7 128 1275 0 62 34560 0
2048 2048 5 11 6 0 8 32768 0
2048 2048 3 13 194 0 8 32768 0
1024 1024 2 30 31 0 16 32768 0
1024 1024 9 23 879 0 16 32768 0
1024 1024 4 28 22 0 16 32768 0
512 512 4 60 39 0 30 32768 0
512 512 19 45 20 0 30 32768 0
mt_stats_zone 64 443 69 443 0 254 32768 0
64 pcpu 8 3397 699 3399 0 254 32768 0
4 Bucket 48 11 577 7078 0 254 28224 0
pipe 760 6 29 284 0 16 26600 0
TURNSTILE 136 145 44 145 0 62 25704 0
rl_entry 40 26 580 26 0 254 24240 0
8 Bucket 80 41 259 7609 0 126 24000 0
Mountpoints 2816 2 6 2 0 4 22528 0
SLEEPQUEUE 88 145 111 145 0 126 22528 0
udpcb 32 2 628 120 0 254 20160 0
PWD 32 10 620 101 0 254 20160 0
Files 72 72 208 6933 0 126 20160 0
32 32 21 609 42 0 254 20160 0
32 32 42 588 1135 0 254 20160 0
32 32 36 594 131 0 254 20160 0
32 32 34 596 793 0 254 20160 0
32 32 42 588 2883 0 254 20160 0
32 32 39 591 1907 0 254 20160 0
16 Bucket 144 42 98 146 0 62 20160 0
2 Bucket 32 44 586 9000 0 254 20160 0
procdesc 136 1 144 6 0 62 19720 0
4096 4096 2 2 2 0 2 16384 0
2048 2048 7 1 7 0 8 16384 0
1024 1024 1 15 1 0 16 16384 0
1024 1024 1 15 1 0 16 16384 0
512 512 11 21 11 0 30 16384 0
512 512 1 31 4 0 30 16384 0
vtnet_tx_hdr 24 0 668 1414 0 254 16032 0
mt_zone 24 443 225 443 0 254 16032 0
kenv 258 3 57 1109 0 30 15480 0
16 16 11 739 45 0 254 12000 0
16 16 28 722 67 0 254 12000 0
16 16 259 491 416 0 254 12000 0
16 16 24 726 1110 0 254 12000 0
16 16 29 721 25987 0 254 12000 0
16 16 28 722 1942 0 254 12000 0
8192 8192 1 0 1 0 1 8192 0
8192 8192 1 0 1 0 1 8192 0
4096 4096 1 1 1 0 2 8192 0
4096 4096 1 1 1 0 2 8192 0
UMA Slabs 1 176 8 14 8 0 62 3872 0
int pcpu 4 34 478 34 0 254 2048 0
pf table entry counters 64 0 0 0 0 254 0 0
tcp_bbr_map 128 0 0 0 0 126 0 0
tcp_log_bucket 184 0 0 0 0 62 0 0
tcp_log 416 0 0 0 0 254 0 0
2048 2048 0 0 0 0 8 0 0
HEAD commit: 6328f172 Allocate an fs_summary_info structure when creati..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=153a23d1100000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=170aefae100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108aefae100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bc0258...@syzkaller.appspotmail.com
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
stack pointer = 0x0:0xfffffe00255f85d0
frame pointer = 0x0:0xfffffe00255f87a0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 1062 (syz-executor7210921)
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
trap number = 9
panic: general protection fault
cpuid = 0
time = 1592623945
panic: general protection fault
cpuid = 0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00255f82a0
vpanic() at vpanic+0x1c7/frame 0xfffffe00255f8300
panic() at panic+0x43/frame 0xfffffe00255f8360
trap_fatal() at trap_fatal+0x4ca/frame 0xfffffe00255f83e0
trap() at trap+0xda/frame 0xfffffe00255f8500
calltrap() at calltrap+0x8/frame 0xfffffe00255f8500
--- trap 0x9, rip = 0xffffffff8133c0b5, rsp = 0xfffffe00255f85d0, rbp = 0xfffffe00255f87a0 ---
sctp_lower_sosend() at sctp_lower_sosend+0x32e5/frame 0xfffffe00255f87a0
sctp_sosend() at sctp_sosend+0x501/frame 0xfffffe00255f88d0
sosend() at sosend+0xc6/frame 0xfffffe00255f8940
kern_sendit() at kern_sendit+0x33d/frame 0xfffffe00255f89f0
sendit() at sendit+0x224/frame 0xfffffe00255f8a50
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe00255f8ab0
ia32_syscall() at ia32_syscall+0x24e/frame 0xfffffe00255f8bf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbffcf7c
KDB: enter: panic
[ thread pid 1062 tid 101078 ]
Stopped at kdb_enter+0x67: movq $0,0x14a50d6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0x80 ll+0x5f
rdx 0xffffffff8195e8e0
rax 0x12
rcx 0x80 ll+0x5f
rbx 0
rsp 0xfffffe00255f8280
rbp 0xfffffe00255f82a0
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe002599ef10
r9 0xffffffff
r10 0
r12 0xffffffff82068f70 ddb_dbbe
r13 0
r14 0xffffffff819a9141
r13 0
r15 0xffffffff819a9141
rip 0xffffffff810b4b17 kdb_enter+0x67
rflags 0x200082 kernphys+0x82
kdb_enter+0x67: movq $0,0x14a50d6(%rip)
db> show proc
Process 1062 (syz-executor7210921) at 0xfffff8001687c000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 783 at 0xfffff80003cf3520
uid: 0 gids: 0, 0, 5
ABI: FreeBSD ELF32
arguments: ./syz-executor721092150
reaper: 0xfffff8000331a000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe000498a9e8
(map 0xfffffe000498a9e8)
(map.pmap 0xfffffe000498aaa8)
(pmap 0xfffffe000498ab08)
threads: 2
100104 s syz-executor7210921
101078 Run CPU 0 syz-executor7210921
db> ps
pid ppid pgrp uid state wmesg wchan cmd
1065 779 776 0 S (threaded) syz-executor7210921
pid ppid pgrp uid state wmesg wchan cmd
100103 S nanslp 0xffffffff8252f201 syz-executor7210921
101086 S sbwait 0xfffffe00239e29e4 syz-executor7210921
101087 S sbwait 0xfffffe00239e29e4 syz-executor7210921
1064 782 776 0 R (threaded) syz-executor7210921
100448 RunQ syz-executor7210921
101084 S sbwait 0xfffffe00239e30f4 syz-executor7210921
101085 S sbwait 0xfffffe00239e30f4 syz-executor7210921
101090 S uwait 0xfffff80003a02500 syz-executor7210921
101091 S uwait 0xfffff800030fbc00 syz-executor7210921
1063 780 776 0 S (threaded) syz-executor7210921
100102 S nanslp 0xffffffff8252f201 syz-executor7210921
101082 S sbwait 0xfffffe00239e5804 syz-executor7210921
101083 S sbwait 0xfffffe00239e5804 syz-executor7210921
101088 S uwait 0xfffff800037c4700 syz-executor7210921
101089 S uwait 0xfffff800037c4200 syz-executor7210921
1062 783 776 0 T (threaded) syz-executor7210921
100104 s syz-executor7210921
101078 Run CPU 0 syz-executor7210921
783 778 776 0 S nanslp 0xffffffff8252f201 syz-executor7210921
782 778 776 0 S nanslp 0xffffffff8252f201 syz-executor7210921
780 778 776 0 S nanslp 0xffffffff8252f201 syz-executor7210921
779 778 776 0 S nanslp 0xffffffff8252f201 syz-executor7210921
778 776 776 0 S nanslp 0xffffffff8252f200 syz-executor7210921
776 774 776 0 Ss pause 0xfffff80003cf30a8 csh
774 682 774 0 Ss select 0xfffff800039ee040 sshd
748 1 748 0 Ss+ ttyin 0xfffff800037bd8b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b41cb0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b444b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b44cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff800033c54b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800033c5cb0 getty
742 1 742 0 Ss+ ttyin 0xfffff800033ca4b0 getty
741 1 741 0 Ss+ ttyin 0xfffff800033cacb0 getty
740 1 740 0 Ss+ ttyin 0xfffff800033c94b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252f200 cron
682 1 682 0 Ss select 0xfffff800039ee540 sshd
495 1 495 0 Ss select 0xfffff80003c11440 syslogd
424 1 424 0 Ss select 0xfffff80003c12c40 devd
423 1 423 65 Ss select 0xfffff80003c12dc0 dhclient
338 1 338 0 Ss select 0xfffff800039ef640 dhclient
335 1 335 0 Ss select 0xfffff80003c113c0 dhclient
23 0 0 0 DL vlruwt 0xfffff800033fa520 [vnlru]
22 0 0 0 DL syncer 0xffffffff8261a458 [syncer]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff826197a0 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100087 D sdflush 0xfffff80003cf9ce8 [/ worker]
20 0 0 0 DL psleep 0xffffffff82640788 [vmdaemon]
19 0 0 0 DL (threaded) [pagedaemon]
100067 D psleep 0xffffffff82634c18 [dom0]
100074 D launds 0xffffffff82634c24 [laundry: dom0]
100075 D umarcl 0xffffffff8154fa70 [uma]
18 0 0 0 DL - 0xffffffff82362e58 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82c583a0 [pf purge]
16 0 0 0 DL waiting 0xffffffff8261cbd0 [sctp_iterator]
15 0 0 0 DL - 0xffffffff82618dac [soaiod4]
9 0 0 0 DL - 0xffffffff82618dac [soaiod3]
8 0 0 0 DL - 0xffffffff82618dac [soaiod2]
7 0 0 0 DL - 0xffffffff82618dac [soaiod1]
6 0 0 0 DL (threaded) [cam]
100033 D - 0xffffffff8223abc0 [doneq0]
100066 D - 0xffffffff8223aa90 [scanner]
5 0 0 0 DL crypto_ 0xfffff8000334d690 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff8000334d630 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff82632400 [crypto]
14 0 0 0 DL seqstat 0xfffff800030e2488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100024 D - 0xffffffff8250e180 [g_event]
100025 D - 0xffffffff8250e188 [g_up]
100026 D - 0xffffffff8250e190 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100017 D - 0xfffff800030f9c00 [thr_0]
100018 D - 0xfffff800030f9c40 [thr_1]
12 0 0 0 WL (threaded) [intr]
100010 I [swi5: fast taskq]
100013 I [swi6: task queue]
100014 I [swi6: Giant taskq]
100019 I [swi4: clock (0)]
100020 I [swi4: clock (1)]
100021 I [swi3: vm]
100022 I [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 Run CPU 1 [idle: cpu1]
1 0 1 0 SLs wait 0xfffff8000331a000 [init]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 Run CPU 1 [idle: cpu1]
10 0 0 0 DL audit_w 0xffffffff826328d8 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8250e710 [swapper]
100005 D - 0xfffff80003217e00 [if_config_tqg_0]
100006 D - 0xfffff80003217d00 [softirq_0]
100007 D - 0xfffff80003217c00 [softirq_1]
100008 D - 0xfffff80003217b00 [if_io_tqg_0]
100009 D - 0xfffff80003217a00 [if_io_tqg_1]
100011 D - 0xfffff80003350000 [kqueue_ctx taskq]
100012 D - 0xfffff8000334de00 [aiod_kick taskq]
100015 D - 0xfffff8000334db00 [in6m_free taskq]
100016 D - 0xfffff8000334da00 [thread taskq]
100023 D - 0xfffff8000334d900 [firmware taskq]
100028 D - 0xfffff8000334d700 [crypto_0]
100029 D - 0xfffff8000334d700 [crypto_1]
100043 D - 0xfffff8000334d400 [vtnet0 rxq 0]
100044 D - 0xfffff8000334d300 [vtnet0 txq 0]
100045 D - 0xfffff8000334d200 [vtnet0 rxq 1]
100046 D - 0xfffff8000334d100 [vtnet0 txq 1]
100048 D vtbslp 0xfffff80003524580 [virtio_balloon]
100052 D - 0xfffff8000334d000 [mca taskq]
100057 D - 0xffffffff81d4e870 [deadlkres]
100061 D - 0xfffff80003b32300 [acpi_task_0]
100062 D - 0xfffff80003b32300 [acpi_task_1]
100063 D - 0xfffff80003b32300 [acpi_task_2]
100065 D - 0xfffff8000334d500 [CAM taskq]
db> show all locks
Process 1062 (syz-executor7210921) thread 0xfffffe002599ea00 (101078)
exclusive sleep mutex sctp-send-tcb (tcbs) r = 0 (0xfffffe00259621c0) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_output.c:13197
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4212 4850K 4240
Type InUse MemUse Requests
pf_hash 5 11524K 5
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 27951 1631K 28015
vtbuf 24 1968K 46
kobj 334 1336K 493
newblk 102 1050K 484
vfscache 4 1025K 4
pcb 35 553K 1205
inodedep 2 513K 71
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
vfs_hash 1 512K 1
callout 2 512K 2
subproc 118 238K 1133
acpica 1674 185K 55859
vnet_data 1 168K 1
pagedep 2 129K 19
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 101 101K 110
sem 4 106K 4
linker 239 96K 268
bus 972 79K 3360
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 501 63K 501
acpitask 1 64K 1
ddb_capture 1 64K 1
umtx 288 36K 288
temp 18 33K 1559
kdtrace 167 33K 3171
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
shm 1 32K 1
DEVFS3 120 30K 130
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18
vmem 3 22K 4
kbdmux 6 22K 6
BPF 10 18K 10
ufs_mount 5 17K 6
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
bus-sc 30 14K 1439
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
ifaddr 32 13K 32
KTRACE 100 13K 100
sctp_timw 49 13K 49
kenv 92 12K 92
eventhandler 132 12K 132
pfs_nodes 20 10K 20
GEOM 60 10K 488
rman 82 10K 423
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
bmsafemap 1 8K 39
devstat 4 9K 4
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
sctp_atcl 15 8K 1384
pfs_vncache 1 8K 1
audit_evclass 233 8K 291
CAM DEV 3 6K 510
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
cred 20 5K 252
CAM queue 5 6K 1528
taskqueue 45 5K 45
ufs_dirhash 24 5K 24
ifnet 3 5K 3
UMA 249 5K 249
memdesc 1 4K 1
MCA 32 4K 32
sctp_stro 4 4K 536
MCA 32 4K 32
plimit 16 4K 353
evdev 4 4K 4
filedesc 1 4K 1
lltable 11 4K 11
routetbl 14 4K 14
hhook 13 4K 13
kqueue 51 4K 1068
ether_multi 40 4K 45
pf_ifnet 5 3K 6
in6_multi 25 3K 25
acpisem 22 3K 22
terminal 11 3K 11
session 19 3K 33
terminal 11 3K 11
pgrp 19 3K 33
uidinfo 3 3K 9
select 17 3K 17
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
io_apic 1 2K 1
sctp_stri 4 2K 566
lockf 16 2K 26
CAM XPT 22 2K 543
proc-args 36 2K 481
Unitno 25 2K 37
acpidev 20 2K 20
msi 9 2K 9
msi 9 2K 9
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
vnodemarker 2 1K 18
NFSD session 1 1K 1
CAM periph 4 1K 271
sctp_atky 19 1K 2203
CAM periph 4 1K 271
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
ip6ndp 4 1K 5
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
sctp_ifa 5 1K 5
crypto 3 1K 3
in_multi 2 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
osd 3 1K 9
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
indirdep 1 1K 3
mld 2 1K 2
sctp_ifn 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
sctp_athm 15 1K 1667
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
inpcbpolicy 6 1K 131
loginclass 3 1K 7
soname 8 1K 7489
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
diradd 1 1K 36
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
tcpfunc 2 1K 2
sctp_map 8 1K 1072
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
DEVFSP 2 1K 2
pmchooks 1 1K 1
prison 4 1K 4
tun 3 1K 3
nexusdev 5 1K 5
entropy 2 1K 35
freework 1 1K 26
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
iov 3 1K 13597
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
filecaps 1 1K 66
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
fpukern_ctx 0 0K 0
midi buffers 0 0K 0
xen_intr 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
ac97 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdac 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
isci 0 0K 0
acpi_perf 0 0K 0
hyperv_socket 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
acpicmbat 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 1887
vm_fictitious 0 0K 0
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 13
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 6
jfsync 0 0K 0
jtrunc 0 0K 0
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
newdirblk 0 0K 8
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
dirrem 0 0K 28
mkdir 0 0K 16
freefile 0 0K 26
freeblks 0 0K 25
freefrag 0 0K 7
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 565
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 3
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_aadr 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 200
export_host 0 0K 0
cl_savebuf 0 0K 3
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 25
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
accf 0 0K 0
pts 0 0K 0
ioctlops 0 0K 86
pts 0 0K 0
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
firmware 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 576
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
kcovinfo 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
Fail Points 0 0K 0
mbuf_jumbo_page 4096 3200 1372 262885 0 254 18726912 0
mbuf_packet 256 8197 947 26387 0 254 2340864 0
512 512 4180 52 4181 0 30 2166784 0
mbuf 256 5894 1987 799765 0 254 2017536 0
BUF TRIE 144 159 13337 528 0 62 1943424 0
4096 4096 391 3 2014 0 2 1613824 0
UMA Slabs 0 112 10691 31 10691 0 126 1200864 0
128 128 9285 46 14990 0 126 1194368 0
sctp_asoc 2288 4 506 536 0 254 1166880 0
pbuf 832 0 969 0 0 2 806208 0
sctp_ep 1280 7 503 565 0 254 652800 0
socket 904 21 492 1730 0 254 463752 0
65536 65536 6 0 6 0 1 393216 0
sctp_raddr 736 4 513 536 0 254 380512 0
256 Bucket 2048 156 28 2846 0 8 376832 0
RADIX NODE 144 2281 208 41378 0 62 358416 0
VNODE 488 515 61 544 0 30 281088 0
tcpcb 1040 3 261 7 0 254 274560 0
VM OBJECT 264 920 70 16360 0 30 261360 0
THREAD 1792 117 27 1091 0 8 258048 0
ripcb 488 1 511 4 0 254 249856 0
udp_inpcb 488 2 510 120 0 254 249856 0
64 64 2759 328 4021 0 254 197568 0
65536 65536 1 2 54 0 1 196608 0
16 16 11754 496 13096 0 254 196000 0
128 128 1271 124 25581 0 126 178560 0
UMA Zones 768 223 3 223 0 16 173568 0
32 32 4443 471 5767 0 254 157248 0
1024 1024 129 15 139 0 16 147456 0
FFS2 dinode 256 486 84 512 0 62 145920 0
65536 65536 2 0 2 0 1 131072 0
unpcb 256 7 503 1017 0 254 130560 0
tcp_inpcb 488 3 253 7 0 254 124928 0
MAP ENTRY 96 877 383 42907 0 126 120960 0
sctp_chunk 152 44 736 16697 0 254 118560 0
ksiginfo 112 37 1007 57 0 126 116928 0
vmem btag 56 1915 160 1915 0 254 116200 0
256 256 103 332 503 0 62 111360 0
128 128 559 216 1486 0 126 99200 0
2048 2048 7 41 2658 0 8 98304 0
256 256 256 119 2334 0 62 96000 0
FFS inode 160 486 89 513 0 62 92000 0
VMSPACE 2536 28 8 1045 0 4 91296 0
PROC 1312 50 16 1065 0 8 86592 0
filedesc0 1088 51 26 1066 0 8 83776 0
UMA Kegs 384 209 6 209 0 30 82560 0
S VFS Cache 108 589 167 1113 0 126 81648 0
sctp_readq 152 4 516 283 0 254 79040 0
4096 4096 15 3 28 0 2 73728 0
g_bio 408 0 180 5202 0 30 73440 0
1024 1024 10 58 281 0 16 69632 0
128 Bucket 1024 39 28 209 0 16 68608 0
64 64 607 464 14342 0 254 68544 0
128 128 308 219 394 0 126 67456 0
65536 65536 0 1 112 0 1 65536 0
32768 32768 2 0 2 0 1 65536 0
16384 16384 4 0 4 0 1 65536 0
256 256 120 135 1273 0 62 65280 0
512 512 23 97 210 0 30 61440 0
sctp_stream_msg_out 112 3 537 289 0 254 60480 0
8192 8192 6 1 8 0 1 57344 0
64 Bucket 512 60 44 760 0 30 53248 0
64 64 284 535 1346 0 254 52416 0
64 64 445 374 679 0 254 52416 0
128 128 325 78 389 0 126 51584 0
256 256 52 143 189 0 62 49920 0
32 Bucket 256 41 154 453 0 62 49920 0
DIRHASH 1024 34 14 34 0 16 49152 0
NAMEI 1024 0 48 11575 0 16 49152 0
16384 16384 3 0 4 0 1 49152 0
2048 2048 8 16 566 0 8 49152 0
1024 1024 10 38 542 0 16 49152 0
512 512 71 25 392 0 30 49152 0
512 512 21 75 2460 0 30 49152 0
syncache 168 0 264 5 0 254 44352 0
8192 8192 4 1 32 0 1 40960 0
4096 4096 8 2 12 0 2 40960 0
clpbuf 832 0 48 113 0 16 39936 0
selfd 64 37 530 5982 0 254 36288 0
64 64 12 555 26 0 254 36288 0
64 64 12 555 36 0 254 36288 0
64 64 33 534 65 0 254 36288 0
64 64 36 531 1169 0 254 36288 0
128 128 19 260 77 0 126 35712 0
128 128 13 266 14 0 126 35712 0
128 128 62 217 67 0 126 35712 0
routing nhops 256 8 127 18 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
256 256 32 103 376 0 62 34560 0
256 256 22 113 683 0 62 34560 0
256 256 64 71 156 0 62 34560 0
256 256 7 128 1275 0 62 34560 0
32768 32768 1 0 1 0 1 32768 0
32768 32768 0 1 112 0 1 32768 0
2048 2048 4 12 16 0 8 32768 0
32768 32768 0 1 112 0 1 32768 0
2048 2048 5 11 6 0 8 32768 0
2048 2048 3 13 194 0 8 32768 0
1024 1024 2 30 31 0 16 32768 0
1024 1024 9 23 879 0 16 32768 0
1024 1024 4 28 22 0 16 32768 0
512 512 4 60 39 0 30 32768 0
512 512 19 45 20 0 30 32768 0
mt_stats_zone 64 443 69 443 0 254 32768 0
64 pcpu 8 3397 699 3399 0 254 32768 0
ttyinq 160 135 65 300 0 62 32000 0
cpuset 104 7 272 7 0 126 29016 0
sctp_laddr 48 0 588 4 0 254 28224 0
hostcache 96 1 293 1 0 254 28224 0
32 32 312 570 372 0 254 28224 0
4 Bucket 48 11 577 7078 0 254 28224 0
KMAP ENTRY 96 12 279 12 0 126 27936 0
rtentry 208 14 119 18 0 62 27664 0
pipe 760 6 29 284 0 16 26600 0
TURNSTILE 136 145 44 145 0 62 25704 0
8192 8192 3 0 3 0 1 24576 0
4096 4096 2 4 202 0 2 24576 0
rl_entry 40 26 580 26 0 254 24240 0
8 Bucket 80 41 259 7609 0 126 24000 0
Mountpoints 2816 2 6 2 0 4 22528 0
SLEEPQUEUE 88 145 111 145 0 126 22528 0
udpcb 32 2 628 120 0 254 20160 0
PWD 32 10 620 101 0 254 20160 0
Files 72 72 208 6933 0 126 20160 0
32 32 21 609 42 0 254 20160 0
32 32 42 588 1135 0 254 20160 0
32 32 36 594 131 0 254 20160 0
32 32 34 596 793 0 254 20160 0
32 32 42 588 2883 0 254 20160 0
32 32 39 591 1907 0 254 20160 0
16 Bucket 144 42 98 146 0 62 20160 0
2 Bucket 32 44 586 9000 0 254 20160 0
procdesc 136 1 144 6 0 62 19720 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
16384 16384 1 0 1 0 1 16384 0
16384 16384 0 1 136 0 1 16384 0
16384 16384 1 0 1 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0
8192 8192 1 1 82 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0
4096 4096 0 4 3 0 2 16384 0
4096 4096 2 2 2 0 2 16384 0
2048 2048 7 1 7 0 8 16384 0
1024 1024 1 15 1 0 16 16384 0
1024 1024 1 15 1 0 16 16384 0
512 512 11 21 11 0 30 16384 0
512 512 1 31 4 0 30 16384 0
vtnet_tx_hdr 24 0 668 1414 0 254 16032 0
mt_zone 24 443 225 443 0 254 16032 0
kenv 258 3 57 1109 0 30 15480 0
MAP 216 2 69 2 0 62 15336 0
FPU_save_area 832 1 17 1 0 16 14976 0
vmem 1856 1 7 1 0 8 14848 0
KNOTE 160 0 75 8 0 62 12000 0
16 16 11 739 45 0 254 12000 0
16 16 28 722 67 0 254 12000 0
16 16 259 491 416 0 254 12000 0
16 16 24 726 1110 0 254 12000 0
16 16 29 721 25987 0 254 12000 0
16 16 28 722 1942 0 254 12000 0
8192 8192 1 0 1 0 1 8192 0
8192 8192 1 0 1 0 1 8192 0
4096 4096 1 1 1 0 2 8192 0
4096 4096 1 1 1 0 2 8192 0
SMR CPU 32 1 254 1 0 254 8160 0
16 16 185 315 1239 0 254 8000 0
SMR SHARED 24 1 254 1 0 254 6120 0
2048 2048 0 2 32 0 8 4096 0
UMA Slabs 1 176 8 14 8 0 62 3872 0
int pcpu 4 34 478 34 0 254 2048 0
FFS1 dinode 128 0 0 0 0 126 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 256 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 62 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 256 0 0 0 0 62 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 296 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 48 0 0 0 0 254 0 0
tcp_bbr_pcb 832 0 0 0 0 16 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 296 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 48 0 0 0 0 254 0 0
tcp_bbr_map 128 0 0 0 0 126 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
udplite_inpcb 488 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
tcp_log_node 120 0 0 0 0 126 0 0
sctp_asconf 40 0 0 0 0 254 0 0
tcp_log_bucket 184 0 0 0 0 62 0 0
tcp_log 416 0 0 0 0 254 0 0
tcpreass 48 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
tcptw 88 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 280 0 0 0 0 30 0 0
AIOCB 752 0 0 0 0 16 0 0
AIOP 32 0 0 0 0 254 0 0
AIO 208 0 0 0 0 62 0 0
NCLNODE 592 0 0 0 0 16 0 0
rentr 24 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
tcptw 88 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 280 0 0 0 0 30 0 0
AIOCB 752 0 0 0 0 16 0 0
AIOP 32 0 0 0 0 254 0 0
AIO 208 0 0 0 0 62 0 0
NCLNODE 592 0 0 0 0 16 0 0
LTS VFS Cache 368 0 0 0 0 30 0 0
L VFS Cache 328 0 0 0 0 30 0 0
STS VFS Cache 148 0 0 0 0 62 0 0
VNODEPOLL 120 0 0 0 0 126 0 0
crypto_session 72 0 0 0 0 126 0 0
cryptop 272 0 0 0 0 30 0 0
nvme_request 128 0 0 0 0 126 0 0
Reply all
Reply to author
Forward
0 new messages