Fatal trap NUM: page fault while in kernel mode (4)
3 views
Skip to first unread message
syzbot
Mar 29, 2022, 12:49:20 AM3/29/22
to syzkaller-f...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 8601fca7895c sysent: regen for syscallarg_t
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=167f67b3700000
dashboard link: https://syzkaller.appspot.com/bug?extid=c8ad26b104be036c81e8
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c8ad26...@syzkaller.appspotmail.com
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff84ac6164
stack pointer = 0x28:0xfffffe0092b4e220
frame pointer = 0x28:0xfffffe0092b4e260
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 7553 (syz-executor.1)
trap number = 12
panic: page fault
cpuid = 1
time = 1648529311
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc7/frame 0xfffffe0092b4da30
04:48:31 executing program 2:
r0 = socket(0x2, 0x1, 0x0)
bind(0xffffffffffffffff, &(0x7f0000000000)=@in={0x10, 0x2, 0x3, @loopback}, 0x10)
sendto(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)=@in={0x10, 0x2, 0x3, @loopback}, 0x10)
setsockopt$inet_tcp_TCP_FUNCTION_BLK(r0, 0x6, 0x2000, &(0x7f00000005c0)={'bbr\x00'}, 0x24)
04:48:31 executing program 2:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
connect(r0, &(0x7f0000000040)=@in={0x10, 0x2, 0x1, @rand_addr}, 0x10)
04:48:31 executing program 2:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
connect(r0, &(0x7f0000000040)=@in={0x10, 0x2, 0x1, @rand_addr}, 0x10)
kdb_backtrace() at kdb_backtrace+0xd3/frame 0xfffffe0092b4db90
vpanic() at vpanic+0x2b8/frame 0xfffffe0092b4dc70
panic() at panic+0xb5/frame 0xfffffe0092b4dd30
trap_fatal() at trap_fatal+0x6a4/frame 0xfffffe0092b4de30
trap_pfault() at trap_pfault+0x186/frame 0xfffffe0092b4df70
trap() at trap+0x5ad/frame 0xfffffe0092b4e150
calltrap() at calltrap+0x8/frame 0xfffffe0092b4e150
--- trap 0xc, rip = 0xffffffff84ac6164, rsp = 0xfffffe0092b4e220, rbp = 0xfffffe0092b4e260 ---
pf_krule_global_RB_INSERT() at pf_krule_global_RB_INSERT+0x24/frame 0xfffffe0092b4e260
pf_ioctl_addrule() at pf_ioctl_addrule+0xe06/frame 0xfffffe0092b4e2f0
pfioctl() at pfioctl+0x553d/frame 0xfffffe0092b4f610
devfs_ioctl() at devfs_ioctl+0x22a/frame 0xfffffe0092b4f6f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0xb0/frame 0xfffffe0092b4f730
vn_ioctl() at vn_ioctl+0x215/frame 0xfffffe0092b4fa80
devfs_ioctl_f() at devfs_ioctl_f+0x71/frame 0xfffffe0092b4fad0
kern_ioctl() at kern_ioctl+0x631/frame 0xfffffe0092b4fbd0
sys_ioctl() at sys_ioctl+0x31f/frame 0xfffffe0092b4fd30
amd64_syscall() at amd64_syscall+0x40c/frame 0xfffffe0092b4ff30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0092b4ff30
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x28a42a, rsp = 0x82f9cbf08, rbp = 0x82f9cbf70 ---
KDB: enter: panic
[ thread pid 7553 tid 107268 ]
Stopped at kdb_enter+0x6b: movq $0,0x270a69a(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0x28
rax 0x12
rcx 0x88fdb92ae843e706
rdx 0x3ffff
rbx 0
rsp 0xfffffe0092b4db70
rbp 0xfffffe0092b4db90
rsi 0x40001
rdi 0xffffffff8177a5ea vprintf+0x35a
r8 0
r9 0xffffffff
r10 0
r11 0
r12 0xfffffe0092e62ac0
r13 0xfffffe0092b4db01
r14 0xffffffff82bb9d20 .str.26
r15 0xffffffff82bb9d20 .str.26
rip 0xffffffff8176db7b kdb_enter+0x6b
rflags 0x46
kdb_enter+0x6b: movq $0,0x270a69a(%rip)
db> show proc
Process 7553 (syz-executor.1) at 0xfffffe0092f04000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 784 at 0xfffffe0058bf9a90
ABI: FreeBSD ELF64
flag: 0x10000080 flag2: 0
arguments: /root/syz-executor.1 exec
reaper: 0xfffffe0053dde000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe0092eb69f8
(map 0xfffffe0092eb69f8)
(map.pmap 0xfffffe0092eb6ab8)
(pmap 0xfffffe0092eb6b20)
threads: 2
107057 RunQ syz-executor.1
107268 Run CPU 1 syz-executor.1
db> ps
pid ppid pgrp uid state wmesg wchan cmd
7559 7556 4954 0 R CPU 0 arp
7558 785 785 0 R syz-executor.2
7556 4954 4954 0 S wait 0xfffffe0092f05000 sh
7554 783 783 0 R (threaded) syz-executor.0
106921 RunQ syz-executor.0
107270 S uwait 0xfffffe0058a0ad00 syz-executor.0
7553 784 784 0 R (threaded) syz-executor.1
107057 RunQ syz-executor.1
107268 Run CPU 1 syz-executor.1
7551 787 787 0 R (threaded) syz-executor.3
107264 RunQ syz-executor.3
107266 S uwait 0xfffffe0092eff580 syz-executor.3
4954 4930 4954 0 Ss wait 0xfffffe0092ec5a90 dhclient
4940 1 4940 0 Ss select 0xfffffe0099b50040 dhclient
4930 4902 430 65 S piperd 0xfffffe0058b78d00 dhclient
4902 430 430 0 S wait 0xfffffe0058d50548 sh
4869 1 4869 65 Ss select 0xfffffe0099bb8240 dhclient
3882 1 3882 0 Ss select 0xfffffe0099b50740 dhclient
3879 1 3879 0 Ss select 0xfffffe00999302c0 dhclient
3860 1 3860 65 Ss select 0xfffffe0099882440 dhclient
1046 1 1046 0 Ss select 0xfffffe009235f440 dhclient
1043 1 1043 0 Ss select 0xfffffe009235f340 dhclient
787 774 787 0 Rs syz-executor.3
785 774 785 0 Rs syz-executor.2
784 774 784 0 Rs syz-executor.1
783 774 783 0 Rs syz-executor.0
774 772 772 0 S (threaded) syz-fuzzer
100114 S uwait 0xfffffe0058a0a700 syz-fuzzer
100115 S uwait 0xfffffe00588e7980 syz-fuzzer
100116 S uwait 0xfffffe00588e7a80 syz-fuzzer
100117 S uwait 0xfffffe00588e7b80 syz-fuzzer
100118 S uwait 0xfffffe0058a0a800 syz-fuzzer
100119 S uwait 0xfffffe0058a0a900 syz-fuzzer
100120 S kqread 0xfffffe000817e300 syz-fuzzer
100121 S uwait 0xfffffe0058a0aa00 syz-fuzzer
100669 S uwait 0xfffffe00588ea780 syz-fuzzer
772 770 772 0 Ss pause 0xfffffe0058d500b0 csh
770 688 770 0 Ss select 0xfffffe0058a0a0c0 sshd
754 1 754 0 Ss+ ttyin 0xfffffe00574d7cb0 getty
753 1 753 0 Ss+ ttyin 0xfffffe00586c08b0 getty
752 1 752 0 Ss+ ttyin 0xfffffe00574d54b0 getty
751 1 751 0 Ss+ ttyin 0xfffffe00574d58b0 getty
750 1 750 0 Ss+ ttyin 0xfffffe00586c0cb0 getty
749 1 749 0 Ss+ ttyin 0xfffffe00574d5cb0 getty
748 1 748 0 Ss+ ttyin 0xfffffe00574d60b0 getty
747 1 747 0 Ss+ ttyin 0xfffffe00574d64b0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00574d68b0 getty
692 1 692 0 Ss nanslp 0xffffffff83e458c0 cron
688 1 688 0 Ss select 0xfffffe0058a0ae40 sshd
501 1 501 0 Ds bo_wwai 0xfffffe00926aca28 syslogd
430 1 430 0 Ss wait 0xfffffe0058bf8000 devd
429 1 429 65 Ss select 0xfffffe0058a0b840 dhclient
344 1 344 0 Ss select 0xfffffe0058a0b040 dhclient
341 1 341 0 Ss select 0xfffffe0058a0b940 dhclient
17 0 0 0 DL syncer 0xffffffff83f6b0e0 [syncer]
16 0 0 0 DL vlruwt 0xfffffe005886da90 [vnlru]
15 0 0 0 DL (threaded) [bufdaemon]
100080 D psleep 0xffffffff83f696e0 [bufdaemon]
100083 D - 0xffffffff83211f80 [bufspacedaemon-0]
100095 D sdflush 0xfffffe00586328e8 [/ worker]
9 0 0 0 DL psleep 0xffffffff83f9d180 [vmdaemon]
8 0 0 0 DL (threaded) [pagedaemon]
100078 D psleep 0xffffffff83f91038 [dom0]
100081 D launds 0xffffffff83f91044 [laundry: dom0]
100082 D umarcl 0xffffffff81ea4540 [uma]
7 0 0 0 DL - 0xffffffff83c01688 [rand_harvestq]
6 0 0 0 DL pftm 0xffffffff84a85530 [pf purge]
5 0 0 0 DL waiting 0xffffffff848605a0 [sctp_iterator]
4 0 0 0 RL (threaded) [cam]
100045 RunQ [doneq0]
100046 D - 0xffffffff83aa3540 [async]
100077 D - 0xffffffff83aa33c0 [scanner]
14 0 0 0 DL seqstat 0xfffffe0056ec5488 [sequencer 00]
3 0 0 0 DL (threaded) [crypto]
100041 D crypto_ 0xffffffff83f8c840 [crypto]
100042 D crypto_ 0xfffffe0053ed6c30 [crypto returns 0]
100043 D crypto_ 0xfffffe0053ed6c80 [crypto returns 1]
13 0 0 0 DL (threaded) [geom]
100036 D - 0xffffffff83e1ae80 [g_event]
100037 D - 0xffffffff83e1aea0 [g_up]
100038 D - 0xffffffff83e1aec0 [g_down]
2 0 0 0 WL (threaded) [clock]
100030 I [clock (0)]
100031 I [clock (1)]
12 0 0 0 WL (threaded) [intr]
100010 I [swi6: Giant taskq]
100017 I [swi5: fast taskq]
100020 I [swi6: task queue]
100029 I [swi1: netisr 0]
100032 I [swi3: busdma]
100033 I [swi1: hpts]
100034 I [swi1: hpts]
100047 I [irq24: virtio_pci0]
100048 I [irq25: virtio_pci0]
100049 I [irq26: virtio_pci0]
100050 I [irq27: virtio_pci0]
100051 I [irq28: virtio_pci1]
100052 I [irq29: virtio_pci1]
100053 I [irq30: virtio_pci1]
100054 I [irq31: virtio_pci1]
100055 I [irq32: virtio_pci1]
100060 I [irq33: virtio_pci2]
100061 I [irq34: virtio_pci2]
100062 I [irq35: virtio_pci2]
100064 I [irq1: atkbd0]
100065 I [irq12: psm0]
100066 I [swi0: uart uart++]
100070 I [swi1: pf send]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffffe0053dde000 [init]
10 0 0 0 DL audit_w 0xffffffff83f8d340 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff83e1b8c0 [swapper]
100005 D - 0xfffffe0053c95b00 [softirq_0]
100006 D - 0xfffffe0053c95900 [softirq_1]
100007 D - 0xfffffe0053c95700 [if_io_tqg_0]
100008 D - 0xfffffe0053c95500 [if_io_tqg_1]
100009 D - 0xfffffe0053c95300 [if_config_tqg_0]
100011 D - 0xfffffe0008181c00 [aiod_kick taskq]
100012 D - 0xfffffe0008181b00 [inm_free taskq]
100013 D - 0xfffffe0008181a00 [linuxkpi_irq_wq]
100014 D - 0xfffffe0008181900 [in6m_free taskq]
100015 D - 0xfffffe0008181800 [deferred_unmount ta]
100016 D - 0xfffffe0008181700 [thread taskq]
100018 D - 0xfffffe0008181500 [kqueue_ctx taskq]
100019 D - 0xfffffe0008181400 [pci_hp taskq]
100021 D - 0xfffffe0008181200 [linuxkpi_short_wq_0]
100022 D - 0xfffffe0008181200 [linuxkpi_short_wq_1]
100023 D - 0xfffffe0008181200 [linuxkpi_short_wq_2]
100024 D - 0xfffffe0008181200 [linuxkpi_short_wq_3]
100025 D - 0xfffffe0008181100 [linuxkpi_long_wq_0]
100026 D - 0xfffffe0008181100 [linuxkpi_long_wq_1]
100027 D - 0xfffffe0008181100 [linuxkpi_long_wq_2]
100028 D - 0xfffffe0008181100 [linuxkpi_long_wq_3]
100035 D - 0xfffffe0053f33300 [firmware taskq]
100039 D - 0xfffffe0053f33200 [crypto_0]
100040 D - 0xfffffe0053f33200 [crypto_1]
100056 D - 0xfffffe0053f32d00 [vtnet0 rxq 0]
100057 D - 0xfffffe0053f32c00 [vtnet0 txq 0]
100058 D - 0xfffffe0053f32b00 [vtnet0 rxq 1]
100059 D - 0xfffffe0053f32a00 [vtnet0 txq 1]
100063 D vtbslp 0xfffffe0056fa1480 [virtio_balloon]
100067 D - 0xffffffff82bbfba0 [deadlkres]
100071 D - 0xfffffe0008182100 [mca taskq]
100073 D - 0xfffffe0053f32500 [acpi_task_0]
100074 D - 0xfffffe0053f32500 [acpi_task_1]
100075 D - 0xfffffe0053f32500 [acpi_task_2]
100076 D - 0xfffffe0053f32e00 [CAM taskq]
db> show all locks
Process 7559 (arp) thread 0xfffffe0092e63900 (107081)
exclusive rw vm object (vm object) r = 0 (0xfffffe0092e0d528) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_fault.c:1495
shared sx vm map (user) (vm map (user)) r = 0 (0xfffffe0092e42a58) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_map.c:4934
Process 7554 (syz-executor.0) thread 0xfffffe00928321e0 (106921)
shared rw vm object (vm object) r = 0 (0xfffffe0092526528) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_fault.c:1495
shared sx vm map (user) (vm map (user)) r = 0 (0xfffffe0092e1d450) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_map.c:4934
Process 7553 (syz-executor.1) thread 0xfffffe0092e62ac0 (107268)
exclusive sx pf config (pf config) r = 0 (0xffffffff84b3d2c0) locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:2114
Process 501 (syslogd) thread 0xfffffe0058bfe740 (100100)
exclusive lockmgr ufs (ufs) r = 0 (0xfffffe00926ac930) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_syscalls.c:3561
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
tcp_hpts 6 4801K 6
devbuf 4217 4323K 4245
sysctloid 35306 2080K 35377
vtbuf 24 1968K 46
pcb 920 1547K 6770
kobj 327 1308K 488
newblk 9 1026K 14301
vfscache 3 1025K 3
inodedep 390 658K 7141
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
sctp_stro 449 449K 1233
sctp_atcl 898 337K 4587
vmem 3 274K 6
subproc 130 256K 7633
acpica 1674 184K 56014
vnet_data 1 168K 1
tidhash 3 141K 3
filedesc 18 137K 13241
linker 358 134K 386
pagedep 10 131K 6628
tfo_ccache 1 128K 1
DEVFS1 109 109K 126
sem 4 106K 4
dirrem 380 95K 6942
bus 991 81K 5140
mtx_pool 2 72K 2
BPF 38 71K 75
syncache 1 68K 1
module 512 64K 512
acpitask 1 64K 1
ddb_capture 1 64K 1
sctp_atky 1347 57K 5997
freefile 380 48K 6940
umtx 352 44K 352
kdtrace 210 42K 14833
temp 34 33K 2215
DEVFS3 128 32K 138
hostcache 1 32K 1
shm 1 32K 8
msg 4 30K 4
gtaskqueue 18 26K 18
kbdmux 6 22K 6
DEVFS_RULE 56 20K 56
ifaddr 69 20K 71
ufs_mount 4 17K 5
proc 3 17K 3
tty 16 16K 16
ithread 100 16K 100
routetbl 130 16K 410
bus-sc 34 15K 1651
sctp_athm 898 15K 4587
sctp_map 898 15K 2466
lltable 42 13K 54
KTRACE 100 13K 100
ifnet 7 13K 7
ether_multi 152 13K 162
kenv 95 12K 95
eventhandler 134 12K 134
rman 88 11K 429
GEOM 61 11K 490
CAM queue 5 11K 1528
sctp_timw 37 10K 37
in6_multi 65 9K 65
bmsafemap 2 9K 7145
UART 12 9K 12
devstat 4 9K 4
ksem 1 8K 1
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
pfs_nodes 20 8K 20
audit_evclass 237 8K 296
taskqueue 63 7K 63
cred 25 7K 240
sglist 5 7K 5
CAM DEV 3 6K 510
kqueue 59 6K 7624
plimit 23 6K 411
ufs_dirhash 24 5K 24
pf_ifnet 11 5K 23
UMA 272 5K 272
DEVFSP 66 5K 616
vt 11 5K 11
memdesc 1 4K 1
MCA 32 4K 32
ioctlops 1 4K 175
evdev 4 4K 4
session 31 4K 50
pwddesc 57 4K 7560
acpisem 28 4K 28
proc-args 92 4K 8836
hhook 15 4K 17
kcovinfo 52 4K 52
lockf 29 4K 74
terminal 11 3K 11
selfd 37 3K 120405
uidinfo 3 3K 13
pf_rule 1 2K 1
local_apic 1 2K 1
io_apic 1 2K 1
fpukern_ctx 2 2K 2
ipsec-saq 2 2K 2
select 16 2K 69
ip6ndp 12 2K 14
Unitno 30 2K 1313
sctp_ifa 13 2K 14
CAM XPT 22 2K 543
msi 12 2K 12
in_multi 6 2K 8
freework 5 2K 9817
ipsecpolicy 2 2K 2
acpidev 20 2K 20
clone 9 2K 9
tun 7 2K 7
softdep 1 1K 1
mkdir 8 1K 13222
freeblks 4 1K 6970
sahead 1 1K 1
secasvar 1 1K 1
nhops 6 1K 8
vnodemarker 2 1K 30
NFSD session 1 1K 1
CAM periph 4 1K 271
sctp_ifn 6 1K 14
ipsec 3 1K 3
mld 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
diradd 5 1K 6980
crypto 4 1K 4
encap_export_host 12 1K 12
newdirblk 4 1K 6611
pfil 4 1K 4
procdesc 4 1K 16
cdev 2 1K 2
inpcbpolicy 15 1K 3041
osd 9 1K 2711
chacha20random 1 1K 1
CC Mem 5 1K 2700
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
vnodes 1 1K 1
CAM SIM 2 1K 2
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 6
prison 6 1K 6
lkpikmalloc 5 1K 6
aesni_data 2 1K 2
cryptodev 2 1K 603
nexusdev 8 1K 8
apmdev 1 1K 1
atkbddev 2 1K 2
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
CAM path 4 1K 1034
pmchooks 1 1K 1
soname 4 1K 10812
sctp_vrf 1 1K 1
ip_msource 1 1K 1
vnet 1 1K 1
entropy 2 1K 42
pmc 1 1K 1
acpiintr 1 1K 1
filecaps 4 1K 108
sigio 1 1K 2
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_table 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
filemon 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 1199
sctp_iter 0 0K 11
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 11
sctp_aadr 0 0K 0
sctp_stri 0 0K 0
ipcomp 0 0K 0
esp 0 0K 0
ah 0 0K 0
tcp_do 0 0K 0
tcp_fsb 0 0K 590
mqdata 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
madt_table 0 0K 2
smartpqi 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
ixl 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
iavf 0 0K 0
axgbe 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
xen_intr 0 0K 0
NFSD srvcache 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
bounce 0 0K 0
busdma 0 0K 0
qpidrv 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
msdosfs_node 0 0K 0
isci 0 0K 0
iommu_dmamap 0 0K 0
hyperv_socket 0 0K 0
bxe_ilt 0 0K 0
DEVFS4 0 0K 0
xenbus 0 0K 0
DEVFS2 0 0K 0
vm_fictitious 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
UMAHash 0 0K 0
vtfont 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 7849
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 13
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 1
allocindir 0 0K 0
indirdep 0 0K 4087
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
BACKLIGHT 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
pvscsi 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
ktls_ocf 0 0K 0
AHCI driver 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS_RX 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EN 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5DUMP 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
seq_file 0 0K 0
lkpiskb 0 0K 0
radix 0 0K 0
idr 0 0K 0
lkpindev 0 0K 0
lkpifw 0 0K 0
lkpi80211 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 6
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
tcp_hwpace 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
LRO 0 0K 0
ip_moptions 0 0K 1
in_mfilter 0 0K 2
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
VN POLL 0 0K 0
agp 0 0K 0
statfs 0 0K 6793
namei_tracker 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 2
nvme_da 0 0K 0
acpipwr 0 0K 0
acpi_perf 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
CAM CCB 0 0K 523
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 107
ktls 0 0K 0
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
accf 0 0K 0
pts 0 0K 0
iov 0 0K 21007
eventfd 0 0K 0
Witness 0 0K 0
stack 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
mps 0 0K 0
sbuf 0 0K 288
mpr_user 0 0K 0
firmware 0 0K 0
compressor 0 0K 0
MPRSAS 0 0K 0
SWAP 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
sysctltmp 0 0K 754
sysctl 0 0K 3
md_sectors 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
md_disk 0 0K 0
malodev 0 0K 0
LED 0 0K 0
ix_sriov 0 0K 0
cache 0 0K 0
aacraidcam 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
aacraid_buf 0 0K 0
aaccam 0 0K 0
boottrace 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
XZ_DEC 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
tmpfs dir 0 0K 0
tmpfs name 0 0K 0
tmpfs mount 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree
mbuf_jumbo_page 4096 8320 1078 1579194 0 254 38494208 0
mbuf 256 8960 703 2475806 0 254 2473728 0
RADIX NODE 144 14889 338 202086 0 63 2192688 0
pbuf 2624 0 794 0 0 2 2083456 0
malloc-128 128 12834 1550 19467 0 126 1841152 0
BUF TRIE 144 192 11596 6732 0 62 1697472 0
malloc-384 384 4155 45 4156 0 30 1612800 0
mbuf_cluster 2048 762 0 762 0 254 1560576 0
malloc-4096 4096 328 4 491 0 2 1359872 0
UMA Slabs 0 112 11152 2 11152 0 126 1249248 0
sctp_asoc 2288 449 61 1233 0 254 1166880 0
vmem btag 56 18336 63 18336 0 254 1030344 0
malloc-2048 2048 451 13 3380 0 8 950272 0
sctp_ep 1208 449 321 3354 0 254 930160 0
malloc-384 384 389 1381 7141 0 30 679680 0
FFS inode 1160 514 32 7455 0 8 633360 0
malloc-256 256 838 1457 20172 0 62 587520 0
VM OBJECT 264 2122 68 169494 0 30 578160 0
tcpcb 1104 5 506 2700 0 254 564144 0
malloc-256 256 164 1891 8385 0 62 526080 0
malloc-1024 1024 453 27 1390 0 16 491520 0
socket 960 37 471 7750 0 254 487680 0
256 Bucket 2048 189 19 4641 0 8 425984 0
lkpimm 168 1 2327 1 0 62 391104 0
lkpicurr 168 2 2326 2 0 62 391104 0
sctp_raddr 736 449 68 1233 0 254 380512 0
malloc-384 384 920 40 4611 0 30 368640 0
MAP ENTRY 96 2798 520 429310 0 127 318528 0
THREAD 1808 152 24 7272 0 8 318208 0
VNODE 448 553 113 7496 0 30 298368 0
malloc-64 64 3885 714 124286 0 254 294336 0
malloc-65536 65536 4 0 4 0 1 262144 0
malloc-65536 65536 1 3 137 0 1 262144 0
malloc-32768 32768 1 7 3858 0 1 262144 0
malloc-4096 4096 58 2 7565 0 2 245760 0
malloc-16 16 14627 373 17422 0 254 240000 0
DEVCTL 1024 13 207 153 0 0 225280 0
tcp_log 416 0 513 2859 0 254 213408 0
malloc-16384 16384 9 4 6779 0 1 212992 0
malloc-65536 65536 0 3 130 0 1 196608 0
malloc-65536 65536 3 0 3 0 1 196608 0
mbuf_packet 256 16 746 8129 0 254 195072 0
malloc-32 32 5317 605 9435 0 254 189504 0
UMA Zones 768 244 0 244 0 16 187392 0
ertt_txseginfo 40 0 4646 50759 0 254 185840 0
malloc-128 128 1132 263 26333 0 126 178560 0
malloc-256 256 31 659 14921 0 62 176640 0
FPU_save_area 832 154 44 17192 0 16 164736 0
FFS2 dinode 256 514 116 7454 0 62 161280 0
malloc-4096 4096 35 3 53 0 2 155648 0
malloc-1024 1024 123 21 141 0 16 147456 0
S VFS Cache 104 1021 383 8109 0 126 146016 0
unpcb 256 17 493 1320 0 254 130560 0
VMSPACE 2552 40 8 7544 0 4 122496 0
ksiginfo 112 63 981 10204 0 126 116928 0
64 Bucket 512 130 70 6796 0 30 102400 0
128 Bucket 1024 78 21 1892 0 16 101376 0
tcp_bbr_map 128 0 775 5516 0 126 99200 0
PROC 1352 56 16 7559 0 8 97344 0
malloc-256 256 244 131 14445 0 62 96000 0
UMA Kegs 384 230 3 230 0 30 89472 0
syncache 168 0 528 4 0 254 88704 0
pipe 744 22 93 467 0 16 85560 0
filedesc0 1072 57 20 7560 0 8 82544 0
malloc-2048 2048 7 33 584 0 8 81920 0
32 Bucket 256 122 193 7090 0 62 80640 0
sctp_chunk 152 262 258 262 0 254 79040 0
sctp_laddr 48 1308 288 2844 0 254 76608 0
g_bio 408 4 176 60948 0 30 73440 0
malloc-64 64 580 491 15789 0 254 68544 0
malloc-64 64 519 552 4367 0 254 68544 0
malloc-128 128 296 231 951 0 126 67456 0
malloc-65536 65536 1 0 1 0 1 65536 0
malloc-65536 65536 0 1 8 0 1 65536 0
malloc-32768 32768 0 2 120 0 1 65536 0
sctp_stream_msg_out 112 209 331 274 0 254 60480 0
malloc-8192 8192 6 1 34 0 1 57344 0
malloc-8192 8192 5 2 8 0 1 57344 0
malloc-8192 8192 4 3 105 0 1 57344 0
tcp_inpcb 424 5 121 2700 0 30 53424 0
malloc-64 64 392 427 16735 0 254 52416 0
malloc-64 64 513 306 1614 0 254 52416 0
malloc-128 128 134 269 27046 0 126 51584 0
malloc-128 128 179 224 615 0 126 51584 0
malloc-256 256 101 94 14412 0 62 49920 0
DIRHASH 1024 34 14 34 0 16 49152 0
NAMEI 1024 0 48 43973 0 16 49152 0
malloc-16384 16384 3 0 3 0 1 49152 0
malloc-8192 8192 5 1 6 0 1 49152 0
malloc-2048 2048 13 11 13 0 8 49152 0
malloc-2048 2048 2 22 575 0 8 49152 0
malloc-1024 1024 5 43 1680 0 16 49152 0
malloc-1024 1024 16 32 20 0 16 49152 0
malloc-384 384 94 26 94 0 30 46080 0
malloc-32 32 984 402 6405 0 254 44352 0
Files 80 210 340 23234 0 126 44000 0
clpbuf 2624 0 16 27 0 16 41984 0
pcpu-8 8 4707 413 5121 0 254 40960 0
malloc-16 16 2104 396 15524 0 254 40000 0
Mountpoints 2752 2 12 2 0 4 38528 0
ripcb 424 4 86 84 0 30 38160 0
udp_inpcb 424 6 84 255 0 30 38160 0
da_ccb 544 1 69 15353 0 16 38080 0
hostcache 64 2 565 2 0 254 36288 0
malloc-64 64 8 559 557 0 254 36288 0
malloc-64 64 227 340 8272 0 254 36288 0
malloc-64 64 8 559 65 0 254 36288 0
16 Bucket 144 85 167 857 0 62 36288 0
malloc-128 128 55 224 123 0 126 35712 0
malloc-128 128 84 195 3499 0 126 35712 0
malloc-128 128 152 127 965 0 126 35712 0
routing nhops 256 27 108 34 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
malloc-384 384 52 38 392 0 30 34560 0
malloc-256 256 73 62 887 0 62 34560 0
malloc-256 256 95 40 513 0 62 34560 0
malloc-256 256 7 128 591 0 62 34560 0
TURNSTILE 136 177 75 177 0 62 34272 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 2 0 17 0 1 32768 0
malloc-4096 4096 5 3 629 0 2 32768 0
malloc-4096 4096 3 5 6796 0 2 32768 0
malloc-2048 2048 1 15 13 0 8 32768 0
malloc-2048 2048 2 14 2 0 8 32768 0
malloc-2048 2048 1 15 244 0 8 32768 0
malloc-1024 1024 4 28 44 0 16 32768 0
malloc-1024 1024 2 30 22 0 16 32768 0
malloc-1024 1024 17 15 17 0 16 32768 0
malloc-1024 1024 1 31 9 0 16 32768 0
malloc-512 512 2 62 120 0 30 32768 0
malloc-512 512 9 55 39 0 30 32768 0
malloc-512 512 0 64 23 0 30 32768 0
malloc-512 512 2 62 51 0 30 32768 0
malloc-512 512 2 62 31 0 30 32768 0
malloc-512 512 9 55 20 0 30 32768 0
pcpu-64 64 492 20 492 0 254 32768 0
tcp_rack_pcb 896 0 36 590 0 16 32256 0
KNOTE 160 28 172 89776 0 62 32000 0
ttyinq 160 135 65 300 0 62 32000 0
tcp_rack_map 120 0 264 958 0 126 31680 0
tcp_bbr_pcb 832 0 36 916 0 16 29952 0
cpuset 104 7 272 2529 0 126 29016 0
tcp_inpcb ports 32 2 880 1604 0 254 28224 0
PWD 32 20 862 6700 0 254 28224 0
malloc-32 32 337 545 932 0 254 28224 0
4 Bucket 48 7 581 195 0 254 28224 0
2 Bucket 32 60 822 1519 0 254 28224 0
rtentry 176 30 108 34 0 62 24288 0
PGRP 88 31 245 50 0 126 24288 0
rl_entry 40 76 530 76 0 254 24240 0
8 Bucket 80 47 253 1954 0 126 24000 0
malloc-384 384 19 41 31 0 30 23040 0
malloc-384 384 3 57 24 0 30 23040 0
malloc-384 384 1 59 35 0 30 23040 0
domainset 40 0 567 1889 0 254 22680 0
SLEEPQUEUE 88 177 79 177 0 126 22528 0
udpcb 32 6 624 257 0 254 20160 0
udp_inpcb ports 32 3 627 33 0 254 20160 0
ertt 72 5 275 2700 0 126 20160 0
malloc-32 32 128 502 1190 0 254 20160 0
malloc-32 32 52 578 7369 0 254 20160 0
malloc-32 32 100 530 140 0 254 20160 0
malloc-32 32 43 587 2808 0 254 20160 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-8192 8192 2 0 2 0 1 16384 0
malloc-4096 4096 2 2 4 0 2 16384 0
malloc-4096 4096 1 3 5 0 2 16384 0
malloc-2048 2048 8 0 8 0 8 16384 0
SMR CPU 32 7 504 7 0 254 16352 0
ipq 56 0 288 1 0 254 16128 0
vtnet_tx_hdr 24 0 668 813570 0 254 16032 0
kenv 258 15 45 1036 0 30 15480 0
udplite_inpcb 424 0 36 2 0 30 15264 0
mqnode 416 3 33 3 0 30 14976 0
vmem 1856 1 7 1 0 8 14848 0
SMR SHARED 24 7 504 7 0 254 12264 0
malloc-32 32 4 374 77 0 254 12096 0
malloc-16 16 11 739 773 0 254 12000 0
malloc-16 16 51 699 11364 0 254 12000 0
malloc-16 16 58 692 227 0 254 12000 0
malloc-16 16 199 551 3075 0 254 12000 0
malloc-16 16 25 725 25473 0 254 12000 0
malloc-8192 8192 1 0 1 0 1 8192 0
malloc-8192 8192 1 0 1 0 1 8192 0
malloc-8192 8192 1 0 1 0 1 8192 0
pcpu-16 16 14 498 14 0 254 8192 0
malloc-16 16 8 492 8 0 254 8000 0
UMA Slabs 1 176 9 13 9 0 62 3872 0
KMAP ENTRY 96 12 27 14 0 0 3744 0
FFS1 dinode 128 0 0 0 0 126 0 0
ada_ccb 272 0 0 0 0 30 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
cdg_qdiffsample 16 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 248 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 62 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 312 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 56 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
tcptw 72 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
sctp_readq 152 0 0 0 0 254 0 0
tcp_log_node 120 0 0 0 0 126 0 0
tcp_log_bucket 176 0 0 0 0 62 0 0
tcpreass 48 0 0 0 0 254 0 0
ripcb ports 32 0 0 0 0 254 0 0
udplite_inpcb ports 32 0 0 0 0 254 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 272 0 0 0 0 30 0 0
AIOCB 552 0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 8601fca7895c sysent: regen for syscallarg_t
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=167f67b3700000
dashboard link: https://syzkaller.appspot.com/bug?extid=c8ad26b104be036c81e8
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c8ad26...@syzkaller.appspotmail.com
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff84ac6164
stack pointer = 0x28:0xfffffe0092b4e220
frame pointer = 0x28:0xfffffe0092b4e260
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 7553 (syz-executor.1)
trap number = 12
panic: page fault
cpuid = 1
time = 1648529311
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc7/frame 0xfffffe0092b4da30
04:48:31 executing program 2:
r0 = socket(0x2, 0x1, 0x0)
bind(0xffffffffffffffff, &(0x7f0000000000)=@in={0x10, 0x2, 0x3, @loopback}, 0x10)
sendto(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)=@in={0x10, 0x2, 0x3, @loopback}, 0x10)
setsockopt$inet_tcp_TCP_FUNCTION_BLK(r0, 0x6, 0x2000, &(0x7f00000005c0)={'bbr\x00'}, 0x24)
04:48:31 executing program 2:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
connect(r0, &(0x7f0000000040)=@in={0x10, 0x2, 0x1, @rand_addr}, 0x10)
04:48:31 executing program 2:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
connect(r0, &(0x7f0000000040)=@in={0x10, 0x2, 0x1, @rand_addr}, 0x10)
kdb_backtrace() at kdb_backtrace+0xd3/frame 0xfffffe0092b4db90
vpanic() at vpanic+0x2b8/frame 0xfffffe0092b4dc70
panic() at panic+0xb5/frame 0xfffffe0092b4dd30
trap_fatal() at trap_fatal+0x6a4/frame 0xfffffe0092b4de30
trap_pfault() at trap_pfault+0x186/frame 0xfffffe0092b4df70
trap() at trap+0x5ad/frame 0xfffffe0092b4e150
calltrap() at calltrap+0x8/frame 0xfffffe0092b4e150
--- trap 0xc, rip = 0xffffffff84ac6164, rsp = 0xfffffe0092b4e220, rbp = 0xfffffe0092b4e260 ---
pf_krule_global_RB_INSERT() at pf_krule_global_RB_INSERT+0x24/frame 0xfffffe0092b4e260
pf_ioctl_addrule() at pf_ioctl_addrule+0xe06/frame 0xfffffe0092b4e2f0
pfioctl() at pfioctl+0x553d/frame 0xfffffe0092b4f610
devfs_ioctl() at devfs_ioctl+0x22a/frame 0xfffffe0092b4f6f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0xb0/frame 0xfffffe0092b4f730
vn_ioctl() at vn_ioctl+0x215/frame 0xfffffe0092b4fa80
devfs_ioctl_f() at devfs_ioctl_f+0x71/frame 0xfffffe0092b4fad0
kern_ioctl() at kern_ioctl+0x631/frame 0xfffffe0092b4fbd0
sys_ioctl() at sys_ioctl+0x31f/frame 0xfffffe0092b4fd30
amd64_syscall() at amd64_syscall+0x40c/frame 0xfffffe0092b4ff30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0092b4ff30
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x28a42a, rsp = 0x82f9cbf08, rbp = 0x82f9cbf70 ---
KDB: enter: panic
[ thread pid 7553 tid 107268 ]
Stopped at kdb_enter+0x6b: movq $0,0x270a69a(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0x28
rax 0x12
rcx 0x88fdb92ae843e706
rdx 0x3ffff
rbx 0
rsp 0xfffffe0092b4db70
rbp 0xfffffe0092b4db90
rsi 0x40001
rdi 0xffffffff8177a5ea vprintf+0x35a
r8 0
r9 0xffffffff
r10 0
r11 0
r12 0xfffffe0092e62ac0
r13 0xfffffe0092b4db01
r14 0xffffffff82bb9d20 .str.26
r15 0xffffffff82bb9d20 .str.26
rip 0xffffffff8176db7b kdb_enter+0x6b
rflags 0x46
kdb_enter+0x6b: movq $0,0x270a69a(%rip)
db> show proc
Process 7553 (syz-executor.1) at 0xfffffe0092f04000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 784 at 0xfffffe0058bf9a90
ABI: FreeBSD ELF64
flag: 0x10000080 flag2: 0
arguments: /root/syz-executor.1 exec
reaper: 0xfffffe0053dde000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe0092eb69f8
(map 0xfffffe0092eb69f8)
(map.pmap 0xfffffe0092eb6ab8)
(pmap 0xfffffe0092eb6b20)
threads: 2
107057 RunQ syz-executor.1
107268 Run CPU 1 syz-executor.1
db> ps
pid ppid pgrp uid state wmesg wchan cmd
7559 7556 4954 0 R CPU 0 arp
7558 785 785 0 R syz-executor.2
7556 4954 4954 0 S wait 0xfffffe0092f05000 sh
7554 783 783 0 R (threaded) syz-executor.0
106921 RunQ syz-executor.0
107270 S uwait 0xfffffe0058a0ad00 syz-executor.0
7553 784 784 0 R (threaded) syz-executor.1
107057 RunQ syz-executor.1
107268 Run CPU 1 syz-executor.1
7551 787 787 0 R (threaded) syz-executor.3
107264 RunQ syz-executor.3
107266 S uwait 0xfffffe0092eff580 syz-executor.3
4954 4930 4954 0 Ss wait 0xfffffe0092ec5a90 dhclient
4940 1 4940 0 Ss select 0xfffffe0099b50040 dhclient
4930 4902 430 65 S piperd 0xfffffe0058b78d00 dhclient
4902 430 430 0 S wait 0xfffffe0058d50548 sh
4869 1 4869 65 Ss select 0xfffffe0099bb8240 dhclient
3882 1 3882 0 Ss select 0xfffffe0099b50740 dhclient
3879 1 3879 0 Ss select 0xfffffe00999302c0 dhclient
3860 1 3860 65 Ss select 0xfffffe0099882440 dhclient
1046 1 1046 0 Ss select 0xfffffe009235f440 dhclient
1043 1 1043 0 Ss select 0xfffffe009235f340 dhclient
787 774 787 0 Rs syz-executor.3
785 774 785 0 Rs syz-executor.2
784 774 784 0 Rs syz-executor.1
783 774 783 0 Rs syz-executor.0
774 772 772 0 S (threaded) syz-fuzzer
100114 S uwait 0xfffffe0058a0a700 syz-fuzzer
100115 S uwait 0xfffffe00588e7980 syz-fuzzer
100116 S uwait 0xfffffe00588e7a80 syz-fuzzer
100117 S uwait 0xfffffe00588e7b80 syz-fuzzer
100118 S uwait 0xfffffe0058a0a800 syz-fuzzer
100119 S uwait 0xfffffe0058a0a900 syz-fuzzer
100120 S kqread 0xfffffe000817e300 syz-fuzzer
100121 S uwait 0xfffffe0058a0aa00 syz-fuzzer
100669 S uwait 0xfffffe00588ea780 syz-fuzzer
772 770 772 0 Ss pause 0xfffffe0058d500b0 csh
770 688 770 0 Ss select 0xfffffe0058a0a0c0 sshd
754 1 754 0 Ss+ ttyin 0xfffffe00574d7cb0 getty
753 1 753 0 Ss+ ttyin 0xfffffe00586c08b0 getty
752 1 752 0 Ss+ ttyin 0xfffffe00574d54b0 getty
751 1 751 0 Ss+ ttyin 0xfffffe00574d58b0 getty
750 1 750 0 Ss+ ttyin 0xfffffe00586c0cb0 getty
749 1 749 0 Ss+ ttyin 0xfffffe00574d5cb0 getty
748 1 748 0 Ss+ ttyin 0xfffffe00574d60b0 getty
747 1 747 0 Ss+ ttyin 0xfffffe00574d64b0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00574d68b0 getty
692 1 692 0 Ss nanslp 0xffffffff83e458c0 cron
688 1 688 0 Ss select 0xfffffe0058a0ae40 sshd
501 1 501 0 Ds bo_wwai 0xfffffe00926aca28 syslogd
430 1 430 0 Ss wait 0xfffffe0058bf8000 devd
429 1 429 65 Ss select 0xfffffe0058a0b840 dhclient
344 1 344 0 Ss select 0xfffffe0058a0b040 dhclient
341 1 341 0 Ss select 0xfffffe0058a0b940 dhclient
17 0 0 0 DL syncer 0xffffffff83f6b0e0 [syncer]
16 0 0 0 DL vlruwt 0xfffffe005886da90 [vnlru]
15 0 0 0 DL (threaded) [bufdaemon]
100080 D psleep 0xffffffff83f696e0 [bufdaemon]
100083 D - 0xffffffff83211f80 [bufspacedaemon-0]
100095 D sdflush 0xfffffe00586328e8 [/ worker]
9 0 0 0 DL psleep 0xffffffff83f9d180 [vmdaemon]
8 0 0 0 DL (threaded) [pagedaemon]
100078 D psleep 0xffffffff83f91038 [dom0]
100081 D launds 0xffffffff83f91044 [laundry: dom0]
100082 D umarcl 0xffffffff81ea4540 [uma]
7 0 0 0 DL - 0xffffffff83c01688 [rand_harvestq]
6 0 0 0 DL pftm 0xffffffff84a85530 [pf purge]
5 0 0 0 DL waiting 0xffffffff848605a0 [sctp_iterator]
4 0 0 0 RL (threaded) [cam]
100045 RunQ [doneq0]
100046 D - 0xffffffff83aa3540 [async]
100077 D - 0xffffffff83aa33c0 [scanner]
14 0 0 0 DL seqstat 0xfffffe0056ec5488 [sequencer 00]
3 0 0 0 DL (threaded) [crypto]
100041 D crypto_ 0xffffffff83f8c840 [crypto]
100042 D crypto_ 0xfffffe0053ed6c30 [crypto returns 0]
100043 D crypto_ 0xfffffe0053ed6c80 [crypto returns 1]
13 0 0 0 DL (threaded) [geom]
100036 D - 0xffffffff83e1ae80 [g_event]
100037 D - 0xffffffff83e1aea0 [g_up]
100038 D - 0xffffffff83e1aec0 [g_down]
2 0 0 0 WL (threaded) [clock]
100030 I [clock (0)]
100031 I [clock (1)]
12 0 0 0 WL (threaded) [intr]
100010 I [swi6: Giant taskq]
100017 I [swi5: fast taskq]
100020 I [swi6: task queue]
100029 I [swi1: netisr 0]
100032 I [swi3: busdma]
100033 I [swi1: hpts]
100034 I [swi1: hpts]
100047 I [irq24: virtio_pci0]
100048 I [irq25: virtio_pci0]
100049 I [irq26: virtio_pci0]
100050 I [irq27: virtio_pci0]
100051 I [irq28: virtio_pci1]
100052 I [irq29: virtio_pci1]
100053 I [irq30: virtio_pci1]
100054 I [irq31: virtio_pci1]
100055 I [irq32: virtio_pci1]
100060 I [irq33: virtio_pci2]
100061 I [irq34: virtio_pci2]
100062 I [irq35: virtio_pci2]
100064 I [irq1: atkbd0]
100065 I [irq12: psm0]
100066 I [swi0: uart uart++]
100070 I [swi1: pf send]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffffe0053dde000 [init]
10 0 0 0 DL audit_w 0xffffffff83f8d340 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff83e1b8c0 [swapper]
100005 D - 0xfffffe0053c95b00 [softirq_0]
100006 D - 0xfffffe0053c95900 [softirq_1]
100007 D - 0xfffffe0053c95700 [if_io_tqg_0]
100008 D - 0xfffffe0053c95500 [if_io_tqg_1]
100009 D - 0xfffffe0053c95300 [if_config_tqg_0]
100011 D - 0xfffffe0008181c00 [aiod_kick taskq]
100012 D - 0xfffffe0008181b00 [inm_free taskq]
100013 D - 0xfffffe0008181a00 [linuxkpi_irq_wq]
100014 D - 0xfffffe0008181900 [in6m_free taskq]
100015 D - 0xfffffe0008181800 [deferred_unmount ta]
100016 D - 0xfffffe0008181700 [thread taskq]
100018 D - 0xfffffe0008181500 [kqueue_ctx taskq]
100019 D - 0xfffffe0008181400 [pci_hp taskq]
100021 D - 0xfffffe0008181200 [linuxkpi_short_wq_0]
100022 D - 0xfffffe0008181200 [linuxkpi_short_wq_1]
100023 D - 0xfffffe0008181200 [linuxkpi_short_wq_2]
100024 D - 0xfffffe0008181200 [linuxkpi_short_wq_3]
100025 D - 0xfffffe0008181100 [linuxkpi_long_wq_0]
100026 D - 0xfffffe0008181100 [linuxkpi_long_wq_1]
100027 D - 0xfffffe0008181100 [linuxkpi_long_wq_2]
100028 D - 0xfffffe0008181100 [linuxkpi_long_wq_3]
100035 D - 0xfffffe0053f33300 [firmware taskq]
100039 D - 0xfffffe0053f33200 [crypto_0]
100040 D - 0xfffffe0053f33200 [crypto_1]
100056 D - 0xfffffe0053f32d00 [vtnet0 rxq 0]
100057 D - 0xfffffe0053f32c00 [vtnet0 txq 0]
100058 D - 0xfffffe0053f32b00 [vtnet0 rxq 1]
100059 D - 0xfffffe0053f32a00 [vtnet0 txq 1]
100063 D vtbslp 0xfffffe0056fa1480 [virtio_balloon]
100067 D - 0xffffffff82bbfba0 [deadlkres]
100071 D - 0xfffffe0008182100 [mca taskq]
100073 D - 0xfffffe0053f32500 [acpi_task_0]
100074 D - 0xfffffe0053f32500 [acpi_task_1]
100075 D - 0xfffffe0053f32500 [acpi_task_2]
100076 D - 0xfffffe0053f32e00 [CAM taskq]
db> show all locks
Process 7559 (arp) thread 0xfffffe0092e63900 (107081)
exclusive rw vm object (vm object) r = 0 (0xfffffe0092e0d528) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_fault.c:1495
shared sx vm map (user) (vm map (user)) r = 0 (0xfffffe0092e42a58) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_map.c:4934
Process 7554 (syz-executor.0) thread 0xfffffe00928321e0 (106921)
shared rw vm object (vm object) r = 0 (0xfffffe0092526528) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_fault.c:1495
shared sx vm map (user) (vm map (user)) r = 0 (0xfffffe0092e1d450) locked @ /syzkaller/managers/main/kernel/sys/vm/vm_map.c:4934
Process 7553 (syz-executor.1) thread 0xfffffe0092e62ac0 (107268)
exclusive sx pf config (pf config) r = 0 (0xffffffff84b3d2c0) locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:2114
Process 501 (syslogd) thread 0xfffffe0058bfe740 (100100)
exclusive lockmgr ufs (ufs) r = 0 (0xfffffe00926ac930) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_syscalls.c:3561
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
tcp_hpts 6 4801K 6
devbuf 4217 4323K 4245
sysctloid 35306 2080K 35377
vtbuf 24 1968K 46
pcb 920 1547K 6770
kobj 327 1308K 488
newblk 9 1026K 14301
vfscache 3 1025K 3
inodedep 390 658K 7141
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
sctp_stro 449 449K 1233
sctp_atcl 898 337K 4587
vmem 3 274K 6
subproc 130 256K 7633
acpica 1674 184K 56014
vnet_data 1 168K 1
tidhash 3 141K 3
filedesc 18 137K 13241
linker 358 134K 386
pagedep 10 131K 6628
tfo_ccache 1 128K 1
DEVFS1 109 109K 126
sem 4 106K 4
dirrem 380 95K 6942
bus 991 81K 5140
mtx_pool 2 72K 2
BPF 38 71K 75
syncache 1 68K 1
module 512 64K 512
acpitask 1 64K 1
ddb_capture 1 64K 1
sctp_atky 1347 57K 5997
freefile 380 48K 6940
umtx 352 44K 352
kdtrace 210 42K 14833
temp 34 33K 2215
DEVFS3 128 32K 138
hostcache 1 32K 1
shm 1 32K 8
msg 4 30K 4
gtaskqueue 18 26K 18
kbdmux 6 22K 6
DEVFS_RULE 56 20K 56
ifaddr 69 20K 71
ufs_mount 4 17K 5
proc 3 17K 3
tty 16 16K 16
ithread 100 16K 100
routetbl 130 16K 410
bus-sc 34 15K 1651
sctp_athm 898 15K 4587
sctp_map 898 15K 2466
lltable 42 13K 54
KTRACE 100 13K 100
ifnet 7 13K 7
ether_multi 152 13K 162
kenv 95 12K 95
eventhandler 134 12K 134
rman 88 11K 429
GEOM 61 11K 490
CAM queue 5 11K 1528
sctp_timw 37 10K 37
in6_multi 65 9K 65
bmsafemap 2 9K 7145
UART 12 9K 12
devstat 4 9K 4
ksem 1 8K 1
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
pfs_nodes 20 8K 20
audit_evclass 237 8K 296
taskqueue 63 7K 63
cred 25 7K 240
sglist 5 7K 5
CAM DEV 3 6K 510
kqueue 59 6K 7624
plimit 23 6K 411
ufs_dirhash 24 5K 24
pf_ifnet 11 5K 23
UMA 272 5K 272
DEVFSP 66 5K 616
vt 11 5K 11
memdesc 1 4K 1
MCA 32 4K 32
ioctlops 1 4K 175
evdev 4 4K 4
session 31 4K 50
pwddesc 57 4K 7560
acpisem 28 4K 28
proc-args 92 4K 8836
hhook 15 4K 17
kcovinfo 52 4K 52
lockf 29 4K 74
terminal 11 3K 11
selfd 37 3K 120405
uidinfo 3 3K 13
pf_rule 1 2K 1
local_apic 1 2K 1
io_apic 1 2K 1
fpukern_ctx 2 2K 2
ipsec-saq 2 2K 2
select 16 2K 69
ip6ndp 12 2K 14
Unitno 30 2K 1313
sctp_ifa 13 2K 14
CAM XPT 22 2K 543
msi 12 2K 12
in_multi 6 2K 8
freework 5 2K 9817
ipsecpolicy 2 2K 2
acpidev 20 2K 20
clone 9 2K 9
tun 7 2K 7
softdep 1 1K 1
mkdir 8 1K 13222
freeblks 4 1K 6970
sahead 1 1K 1
secasvar 1 1K 1
nhops 6 1K 8
vnodemarker 2 1K 30
NFSD session 1 1K 1
CAM periph 4 1K 271
sctp_ifn 6 1K 14
ipsec 3 1K 3
mld 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
diradd 5 1K 6980
crypto 4 1K 4
encap_export_host 12 1K 12
newdirblk 4 1K 6611
pfil 4 1K 4
procdesc 4 1K 16
cdev 2 1K 2
inpcbpolicy 15 1K 3041
osd 9 1K 2711
chacha20random 1 1K 1
CC Mem 5 1K 2700
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
vnodes 1 1K 1
CAM SIM 2 1K 2
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 6
prison 6 1K 6
lkpikmalloc 5 1K 6
aesni_data 2 1K 2
cryptodev 2 1K 603
nexusdev 8 1K 8
apmdev 1 1K 1
atkbddev 2 1K 2
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
CAM path 4 1K 1034
pmchooks 1 1K 1
soname 4 1K 10812
sctp_vrf 1 1K 1
ip_msource 1 1K 1
vnet 1 1K 1
entropy 2 1K 42
pmc 1 1K 1
acpiintr 1 1K 1
filecaps 4 1K 108
sigio 1 1K 2
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_table 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
filemon 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 1199
sctp_iter 0 0K 11
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 11
sctp_aadr 0 0K 0
sctp_stri 0 0K 0
ipcomp 0 0K 0
esp 0 0K 0
ah 0 0K 0
tcp_do 0 0K 0
tcp_fsb 0 0K 590
mqdata 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
madt_table 0 0K 2
smartpqi 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
ixl 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
iavf 0 0K 0
axgbe 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
xen_intr 0 0K 0
NFSD srvcache 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
bounce 0 0K 0
busdma 0 0K 0
qpidrv 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
msdosfs_node 0 0K 0
isci 0 0K 0
iommu_dmamap 0 0K 0
hyperv_socket 0 0K 0
bxe_ilt 0 0K 0
DEVFS4 0 0K 0
xenbus 0 0K 0
DEVFS2 0 0K 0
vm_fictitious 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
UMAHash 0 0K 0
vtfont 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 7849
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 13
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 1
allocindir 0 0K 0
indirdep 0 0K 4087
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
BACKLIGHT 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
pvscsi 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
ktls_ocf 0 0K 0
AHCI driver 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS_RX 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EN 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5DUMP 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
seq_file 0 0K 0
lkpiskb 0 0K 0
radix 0 0K 0
idr 0 0K 0
lkpindev 0 0K 0
lkpifw 0 0K 0
lkpi80211 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 6
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
tcp_hwpace 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
LRO 0 0K 0
ip_moptions 0 0K 1
in_mfilter 0 0K 2
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
VN POLL 0 0K 0
agp 0 0K 0
statfs 0 0K 6793
namei_tracker 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 2
nvme_da 0 0K 0
acpipwr 0 0K 0
acpi_perf 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
CAM CCB 0 0K 523
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 107
ktls 0 0K 0
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
accf 0 0K 0
pts 0 0K 0
iov 0 0K 21007
eventfd 0 0K 0
Witness 0 0K 0
stack 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
mps 0 0K 0
sbuf 0 0K 288
mpr_user 0 0K 0
firmware 0 0K 0
compressor 0 0K 0
MPRSAS 0 0K 0
SWAP 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
sysctltmp 0 0K 754
sysctl 0 0K 3
md_sectors 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
md_disk 0 0K 0
malodev 0 0K 0
LED 0 0K 0
ix_sriov 0 0K 0
cache 0 0K 0
aacraidcam 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
aacraid_buf 0 0K 0
aaccam 0 0K 0
boottrace 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
XZ_DEC 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
tmpfs dir 0 0K 0
tmpfs name 0 0K 0
tmpfs mount 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree
mbuf_jumbo_page 4096 8320 1078 1579194 0 254 38494208 0
mbuf 256 8960 703 2475806 0 254 2473728 0
RADIX NODE 144 14889 338 202086 0 63 2192688 0
pbuf 2624 0 794 0 0 2 2083456 0
malloc-128 128 12834 1550 19467 0 126 1841152 0
BUF TRIE 144 192 11596 6732 0 62 1697472 0
malloc-384 384 4155 45 4156 0 30 1612800 0
mbuf_cluster 2048 762 0 762 0 254 1560576 0
malloc-4096 4096 328 4 491 0 2 1359872 0
UMA Slabs 0 112 11152 2 11152 0 126 1249248 0
sctp_asoc 2288 449 61 1233 0 254 1166880 0
vmem btag 56 18336 63 18336 0 254 1030344 0
malloc-2048 2048 451 13 3380 0 8 950272 0
sctp_ep 1208 449 321 3354 0 254 930160 0
malloc-384 384 389 1381 7141 0 30 679680 0
FFS inode 1160 514 32 7455 0 8 633360 0
malloc-256 256 838 1457 20172 0 62 587520 0
VM OBJECT 264 2122 68 169494 0 30 578160 0
tcpcb 1104 5 506 2700 0 254 564144 0
malloc-256 256 164 1891 8385 0 62 526080 0
malloc-1024 1024 453 27 1390 0 16 491520 0
socket 960 37 471 7750 0 254 487680 0
256 Bucket 2048 189 19 4641 0 8 425984 0
lkpimm 168 1 2327 1 0 62 391104 0
lkpicurr 168 2 2326 2 0 62 391104 0
sctp_raddr 736 449 68 1233 0 254 380512 0
malloc-384 384 920 40 4611 0 30 368640 0
MAP ENTRY 96 2798 520 429310 0 127 318528 0
THREAD 1808 152 24 7272 0 8 318208 0
VNODE 448 553 113 7496 0 30 298368 0
malloc-64 64 3885 714 124286 0 254 294336 0
malloc-65536 65536 4 0 4 0 1 262144 0
malloc-65536 65536 1 3 137 0 1 262144 0
malloc-32768 32768 1 7 3858 0 1 262144 0
malloc-4096 4096 58 2 7565 0 2 245760 0
malloc-16 16 14627 373 17422 0 254 240000 0
DEVCTL 1024 13 207 153 0 0 225280 0
tcp_log 416 0 513 2859 0 254 213408 0
malloc-16384 16384 9 4 6779 0 1 212992 0
malloc-65536 65536 0 3 130 0 1 196608 0
malloc-65536 65536 3 0 3 0 1 196608 0
mbuf_packet 256 16 746 8129 0 254 195072 0
malloc-32 32 5317 605 9435 0 254 189504 0
UMA Zones 768 244 0 244 0 16 187392 0
ertt_txseginfo 40 0 4646 50759 0 254 185840 0
malloc-128 128 1132 263 26333 0 126 178560 0
malloc-256 256 31 659 14921 0 62 176640 0
FPU_save_area 832 154 44 17192 0 16 164736 0
FFS2 dinode 256 514 116 7454 0 62 161280 0
malloc-4096 4096 35 3 53 0 2 155648 0
malloc-1024 1024 123 21 141 0 16 147456 0
S VFS Cache 104 1021 383 8109 0 126 146016 0
unpcb 256 17 493 1320 0 254 130560 0
VMSPACE 2552 40 8 7544 0 4 122496 0
ksiginfo 112 63 981 10204 0 126 116928 0
64 Bucket 512 130 70 6796 0 30 102400 0
128 Bucket 1024 78 21 1892 0 16 101376 0
tcp_bbr_map 128 0 775 5516 0 126 99200 0
PROC 1352 56 16 7559 0 8 97344 0
malloc-256 256 244 131 14445 0 62 96000 0
UMA Kegs 384 230 3 230 0 30 89472 0
syncache 168 0 528 4 0 254 88704 0
pipe 744 22 93 467 0 16 85560 0
filedesc0 1072 57 20 7560 0 8 82544 0
malloc-2048 2048 7 33 584 0 8 81920 0
32 Bucket 256 122 193 7090 0 62 80640 0
sctp_chunk 152 262 258 262 0 254 79040 0
sctp_laddr 48 1308 288 2844 0 254 76608 0
g_bio 408 4 176 60948 0 30 73440 0
malloc-64 64 580 491 15789 0 254 68544 0
malloc-64 64 519 552 4367 0 254 68544 0
malloc-128 128 296 231 951 0 126 67456 0
malloc-65536 65536 1 0 1 0 1 65536 0
malloc-65536 65536 0 1 8 0 1 65536 0
malloc-32768 32768 0 2 120 0 1 65536 0
sctp_stream_msg_out 112 209 331 274 0 254 60480 0
malloc-8192 8192 6 1 34 0 1 57344 0
malloc-8192 8192 5 2 8 0 1 57344 0
malloc-8192 8192 4 3 105 0 1 57344 0
tcp_inpcb 424 5 121 2700 0 30 53424 0
malloc-64 64 392 427 16735 0 254 52416 0
malloc-64 64 513 306 1614 0 254 52416 0
malloc-128 128 134 269 27046 0 126 51584 0
malloc-128 128 179 224 615 0 126 51584 0
malloc-256 256 101 94 14412 0 62 49920 0
DIRHASH 1024 34 14 34 0 16 49152 0
NAMEI 1024 0 48 43973 0 16 49152 0
malloc-16384 16384 3 0 3 0 1 49152 0
malloc-8192 8192 5 1 6 0 1 49152 0
malloc-2048 2048 13 11 13 0 8 49152 0
malloc-2048 2048 2 22 575 0 8 49152 0
malloc-1024 1024 5 43 1680 0 16 49152 0
malloc-1024 1024 16 32 20 0 16 49152 0
malloc-384 384 94 26 94 0 30 46080 0
malloc-32 32 984 402 6405 0 254 44352 0
Files 80 210 340 23234 0 126 44000 0
clpbuf 2624 0 16 27 0 16 41984 0
pcpu-8 8 4707 413 5121 0 254 40960 0
malloc-16 16 2104 396 15524 0 254 40000 0
Mountpoints 2752 2 12 2 0 4 38528 0
ripcb 424 4 86 84 0 30 38160 0
udp_inpcb 424 6 84 255 0 30 38160 0
da_ccb 544 1 69 15353 0 16 38080 0
hostcache 64 2 565 2 0 254 36288 0
malloc-64 64 8 559 557 0 254 36288 0
malloc-64 64 227 340 8272 0 254 36288 0
malloc-64 64 8 559 65 0 254 36288 0
16 Bucket 144 85 167 857 0 62 36288 0
malloc-128 128 55 224 123 0 126 35712 0
malloc-128 128 84 195 3499 0 126 35712 0
malloc-128 128 152 127 965 0 126 35712 0
routing nhops 256 27 108 34 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
malloc-384 384 52 38 392 0 30 34560 0
malloc-256 256 73 62 887 0 62 34560 0
malloc-256 256 95 40 513 0 62 34560 0
malloc-256 256 7 128 591 0 62 34560 0
TURNSTILE 136 177 75 177 0 62 34272 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 2 0 17 0 1 32768 0
malloc-4096 4096 5 3 629 0 2 32768 0
malloc-4096 4096 3 5 6796 0 2 32768 0
malloc-2048 2048 1 15 13 0 8 32768 0
malloc-2048 2048 2 14 2 0 8 32768 0
malloc-2048 2048 1 15 244 0 8 32768 0
malloc-1024 1024 4 28 44 0 16 32768 0
malloc-1024 1024 2 30 22 0 16 32768 0
malloc-1024 1024 17 15 17 0 16 32768 0
malloc-1024 1024 1 31 9 0 16 32768 0
malloc-512 512 2 62 120 0 30 32768 0
malloc-512 512 9 55 39 0 30 32768 0
malloc-512 512 0 64 23 0 30 32768 0
malloc-512 512 2 62 51 0 30 32768 0
malloc-512 512 2 62 31 0 30 32768 0
malloc-512 512 9 55 20 0 30 32768 0
pcpu-64 64 492 20 492 0 254 32768 0
tcp_rack_pcb 896 0 36 590 0 16 32256 0
KNOTE 160 28 172 89776 0 62 32000 0
ttyinq 160 135 65 300 0 62 32000 0
tcp_rack_map 120 0 264 958 0 126 31680 0
tcp_bbr_pcb 832 0 36 916 0 16 29952 0
cpuset 104 7 272 2529 0 126 29016 0
tcp_inpcb ports 32 2 880 1604 0 254 28224 0
PWD 32 20 862 6700 0 254 28224 0
malloc-32 32 337 545 932 0 254 28224 0
4 Bucket 48 7 581 195 0 254 28224 0
2 Bucket 32 60 822 1519 0 254 28224 0
rtentry 176 30 108 34 0 62 24288 0
PGRP 88 31 245 50 0 126 24288 0
rl_entry 40 76 530 76 0 254 24240 0
8 Bucket 80 47 253 1954 0 126 24000 0
malloc-384 384 19 41 31 0 30 23040 0
malloc-384 384 3 57 24 0 30 23040 0
malloc-384 384 1 59 35 0 30 23040 0
domainset 40 0 567 1889 0 254 22680 0
SLEEPQUEUE 88 177 79 177 0 126 22528 0
udpcb 32 6 624 257 0 254 20160 0
udp_inpcb ports 32 3 627 33 0 254 20160 0
ertt 72 5 275 2700 0 126 20160 0
malloc-32 32 128 502 1190 0 254 20160 0
malloc-32 32 52 578 7369 0 254 20160 0
malloc-32 32 100 530 140 0 254 20160 0
malloc-32 32 43 587 2808 0 254 20160 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-8192 8192 2 0 2 0 1 16384 0
malloc-4096 4096 2 2 4 0 2 16384 0
malloc-4096 4096 1 3 5 0 2 16384 0
malloc-2048 2048 8 0 8 0 8 16384 0
SMR CPU 32 7 504 7 0 254 16352 0
ipq 56 0 288 1 0 254 16128 0
vtnet_tx_hdr 24 0 668 813570 0 254 16032 0
kenv 258 15 45 1036 0 30 15480 0
udplite_inpcb 424 0 36 2 0 30 15264 0
mqnode 416 3 33 3 0 30 14976 0
vmem 1856 1 7 1 0 8 14848 0
SMR SHARED 24 7 504 7 0 254 12264 0
malloc-32 32 4 374 77 0 254 12096 0
malloc-16 16 11 739 773 0 254 12000 0
malloc-16 16 51 699 11364 0 254 12000 0
malloc-16 16 58 692 227 0 254 12000 0
malloc-16 16 199 551 3075 0 254 12000 0
malloc-16 16 25 725 25473 0 254 12000 0
malloc-8192 8192 1 0 1 0 1 8192 0
malloc-8192 8192 1 0 1 0 1 8192 0
malloc-8192 8192 1 0 1 0 1 8192 0
pcpu-16 16 14 498 14 0 254 8192 0
malloc-16 16 8 492 8 0 254 8000 0
UMA Slabs 1 176 9 13 9 0 62 3872 0
KMAP ENTRY 96 12 27 14 0 0 3744 0
FFS1 dinode 128 0 0 0 0 126 0 0
ada_ccb 272 0 0 0 0 30 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
cdg_qdiffsample 16 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 248 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 62 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 312 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 56 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
tcptw 72 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
sctp_readq 152 0 0 0 0 254 0 0
tcp_log_node 120 0 0 0 0 126 0 0
tcp_log_bucket 176 0 0 0 0 62 0 0
tcpreass 48 0 0 0 0 254 0 0
ripcb ports 32 0 0 0 0 254 0 0
udplite_inpcb ports 32 0 0 0 0 254 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 272 0 0 0 0 30 0 0
AIOCB 552 0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Aug 12, 2022, 1:01:21 AM8/12/22
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 693f88c9da8d iconv_std: complete the //IGNORE support
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=113dd587080000
dashboard link: https://syzkaller.appspot.com/bug?extid=c8ad26b104be036c81e8
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=170d66c3080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1085e525080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c8ad26...@syzkaller.appspotmail.com
Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0x45e03616
stack pointer = 0x0:0xfffffe008fcc6b80
frame pointer = 0x0:0xfffffe008fcc6bb0
trap number = 12
HEAD commit: 693f88c9da8d iconv_std: complete the //IGNORE support
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=113dd587080000
dashboard link: https://syzkaller.appspot.com/bug?extid=c8ad26b104be036c81e8
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=170d66c3080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1085e525080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c8ad26...@syzkaller.appspotmail.com
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x45e03616
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff81bd47b6
stack pointer = 0x0:0xfffffe008fcc6b80
frame pointer = 0x0:0xfffffe008fcc6bb0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 779 (syz-executor1626677)
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
trap number = 12
Reply all
Reply to author
Forward
0 new messages