Fatal trap NUM: page fault in destroy_indir
2 views
Skip to first unread message
syzbot
Jul 2, 2025, 8:59:30 PM7/2/25
to syzkaller-f...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 604d34c23f77 net: ether_gen_addr: fix address generation
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=1669848c580000
dashboard link: https://syzkaller.appspot.com/bug?extid=a0ff73f664de8757cfaa
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a0ff73...@syzkaller.appspotmail.com
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80b0c758
stack pointer = 0x0:0xfffffe0056d16070
frame pointer = 0x0:0xfffffe0056d160b0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 813 (syz-executor)
rdi: 0000000000000000 rsi: 0000000000007427 rdx: 0000000000007426
rcx: fffffe0002bf1850 r8: 0000000000000000 r9: 0000000000000027
rax: fffffe0002bf1850 rbx: 0000000000000000 rbp: fffffe0056d160b0
r10: 33e2fd513472f3f7 r11: 0000000000000000 r12: fffffe006e4c9058
r13: fffffe006e4c9040 r14: 0000000000000000 r15: 0000000000000010
trap number = 12
panic: page fault
cpuid = 1
time = 1751504306
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056d15890
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056d159f0
vpanic() at vpanic+0x257/frame 0xfffffe0056d15bb0
panic() at panic+0xb5/frame 0xfffffe0056d15c70
trap_pfault() at trap_pfault+0xaec/frame 0xfffffe0056d15db0
trap() at trap+0x78e/frame 0xfffffe0056d15fa0
calltrap() at calltrap+0x8/frame 0xfffffe0056d15fa0
--- trap 0xc, rip = 0xffffffff80b0c758, rsp = 0xfffffe0056d16070, rbp = 0xfffffe0056d160b0 ---
destroy_indir() at destroy_indir+0x48/frame 0xfffffe0056d160b0
mddestroy() at mddestroy+0x358/frame 0xfffffe0056d16190
mdctlioctl() at mdctlioctl+0x1680/frame 0xfffffe0056d162f0
devfs_ioctl() at devfs_ioctl+0x266/frame 0xfffffe0056d163e0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x87/frame 0xfffffe0056d16410
vn_ioctl() at vn_ioctl+0x3c7/frame 0xfffffe0056d16620
devfs_ioctl_f() at devfs_ioctl_f+0x69/frame 0xfffffe0056d16670
kern_ioctl() at kern_ioctl+0x4ca/frame 0xfffffe0056d16750
sys_ioctl() at sys_ioctl+0x36e/frame 0xfffffe0056d168d0
freebsd32_ioctl() at freebsd32_ioctl+0x607/frame 0xfffffe0056d16d10
ia32_syscall() at ia32_syscall+0x4d2/frame 0xfffffe0056d16f30
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xdfffcf98
KDB: enter: panic
[ thread pid 813 tid 100125 ]
Stopped at kdb_enter+0x6e: movq $0,0x25b9147(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0xfffffe006ea00000
rdx 0x7ffff
rbx 0xffffffff827bcf60 .str.27
rsp 0xfffffe0056d159d0
rbp 0xfffffe0056d159f0
rsi 0x80001
rdi 0xffffffff8161a6c9 printf+0x149
r8 0
r9 0xffffffff
r10 0
r11 0x17
r12 0xfffffe00540f9000
r13 0xfffffffffffffffd
r14 0xffffffff827bcf60 .str.27
r15 0
rip 0xffffffff8160424e kdb_enter+0x6e
rflags 0x46
kdb_enter+0x6e: movq $0,0x25b9147(%rip)
db> show proc
Process 813 (syz-executor) at 0xfffffe00540e85c0:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 765 at 0xfffffe00540d2ae0
ABI: FreeBSD ELF32
flag: 0x10000080 flag2: 0
arguments: ./syz-executor exec
reaper: 0xfffffe0007809040 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe000780f490
(map 0xfffffe000780f490)
(map.pmap 0xfffffe000780f530)
(pmap 0xfffffe000780f5a0)
threads: 2
100112 RunQ syz-executor
100125 Run CPU 1 syz-executor
db> ps
pid ppid pgrp uid state wmesg wchan cmd
816 767 767 0 R CPU 0 syz-executor
814 807 424 0 R dhclient
813 765 765 0 R (threaded) syz-executor
100112 RunQ syz-executor
100125 Run CPU 1 syz-executor
812 766 766 0 R (threaded) syz-executor
100117 RunQ syz-executor
100126 RunQ syz-executor
811 764 764 0 R (threaded) syz-executor
100118 RunQ syz-executor
100124 S sigsusp 0xfffffe00540d4110 syz-executor
100128 S uwait 0xfffffe006dcf6100 syz-executor
807 787 424 0 S select 0xfffffe00584ec640 dhclient
787 424 424 0 S wait 0xfffffe00540e8060 sh
767 763 767 0 R syz-executor
766 763 766 0 S nanslp 0xffffffff83b9e580 syz-executor
765 763 765 0 S nanslp 0xffffffff83b9e580 syz-executor
764 763 764 0 S nanslp 0xffffffff83b9e580 syz-executor
763 761 761 0 S select 0xfffffe006dcf68c0 syz-executor
761 759 761 0 Ss sigsusp 0xfffffe00540e5b70 csh
759 682 759 0 Ss select 0xfffffe006dcf69c0 sshd
748 1 748 0 Ss+ ttyin 0xfffffe0058287cb0 getty
747 1 747 0 Ss+ ttyin 0xfffffe00593f50b0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00593f54b0 getty
745 1 745 0 Ss+ ttyin 0xfffffe00593f58b0 getty
744 1 744 0 Ss+ ttyin 0xfffffe00593f5cb0 getty
743 1 743 0 Ss+ ttyin 0xfffffe00593f60b0 getty
742 1 742 0 Ss+ ttyin 0xfffffe00593f64b0 getty
741 1 741 0 Ss+ ttyin 0xfffffe00593f68b0 getty
740 1 740 0 Ss+ ttyin 0xfffffe00593f6cb0 getty
738 1 18 0 S+ piperd 0xfffffe006b421b80 logger
737 736 18 0 S+ nanslp 0xffffffff83b9e580 sleep
736 1 18 0 S+ wait 0xfffffe00540d2020 sh
686 1 686 0 Ss nanslp 0xffffffff83b9e581 cron
682 1 682 0 Ss select 0xfffffe006dcf73c0 sshd
495 1 495 0 Ss select 0xfffffe006dcf74c0 syslogd
424 1 424 0 Ss wait 0xfffffe00540d3040 devd
423 1 423 65 Ss select 0xfffffe0057d75c40 dhclient
338 1 338 0 Ss select 0xfffffe005824ef40 dhclient
335 1 335 0 Ss select 0xfffffe006dcf7440 dhclient
17 0 0 0 DL syncer 0xffffffff83cbbfa0 [syncer]
16 0 0 0 DL vlruwt 0xfffffe0007828040 [vnlru]
15 0 0 0 DL (threaded) [bufdaemon]
100080 D psleep 0xffffffff83cba560 [bufdaemon]
100083 D - 0xffffffff83001ec0 [bufspacedaemon-0]
100094 D sdflush 0xfffffe00596c9ce8 [/ worker]
9 0 0 0 DL psleep 0xffffffff83d05400 [vmdaemon]
8 0 0 0 DL (threaded) [pagedaemon]
100078 D psleep 0xffffffff83ceb4c8 [dom0]
100081 D launds 0xffffffff83ceb4d4 [laundry: dom0]
100082 D umarcl 0xffffffff81dda750 [uma]
7 0 0 0 DL - 0xffffffff8391bcd0 [rand_harvestq]
6 0 0 0 DL pftm 0xffffffff847bb980 [pf purge]
5 0 0 0 DL waiting 0xffffffff844e5700 [sctp_iterator]
4 0 0 0 DL (threaded) [cam]
100046 D - 0xffffffff838e6340 [doneq0]
100047 D - 0xffffffff838e62c0 [async]
100076 D - 0xffffffff838e6140 [scanner]
3 0 0 0 DL (threaded) [crypto]
100043 D crypto_ 0xffffffff83ce6d80 [crypto]
100044 D crypto_ 0xfffffe0007a72d30 [crypto returns 0]
100045 D crypto_ 0xfffffe0007a72d80 [crypto returns 1]
14 0 0 0 DL seqstat 0xfffffe0057cba488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100037 D - 0xffffffff83b46f20 [g_event]
100038 D - 0xffffffff83b46f40 [g_up]
100039 D - 0xffffffff83b46f60 [g_down]
2 0 0 0 WL (threaded) [clock]
100031 I [clock (0)]
100032 I [clock (1)]
12 0 0 0 WL (threaded) [intr]
100013 I [swi6: task queue]
100014 I [swi6: Giant taskq]
100016 I [swi5: fast taskq]
100033 I [swi1: netisr 0]
100034 I [swi1: hpts]
100035 I [swi1: hpts]
100048 I [irq24: virtio_pci0]
100049 I [irq25: virtio_pci0]
100050 I [irq26: virtio_pci0]
100051 I [irq27: virtio_pci0]
100052 I [irq28: virtio_pci1]
100053 I [irq29: virtio_pci1]
100054 I [irq30: virtio_pci1]
100055 I [irq31: virtio_pci1]
100056 I [irq32: virtio_pci1]
100061 I [irq10: virtio_pci2]
100063 I [irq1: atkbd0]
100064 I [irq12: psm0]
100065 I [swi0: uart uart++]
100069 I [swi1: pf send]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffffe0007809040 [init]
10 0 0 0 DL audit_w 0xffffffff83ce7820 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D parked 0xffffffff84c36ff0 [swapper]
100005 D - 0xfffffe0053ea0100 [softirq_0]
100006 D - 0xfffffe0053ea0000 [softirq_1]
100007 D - 0xfffffe0053e9fe00 [if_io_tqg_0]
100008 D - 0xfffffe0053e9fd00 [if_io_tqg_1]
100009 D - 0xfffffe0053e9fc00 [if_config_tqg_0]
100010 D - 0xfffffe0007764900 [kqueue_ctx taskq]
100011 D - 0xfffffe0007764800 [jail_remove taskq]
100012 D - 0xfffffe0007764700 [bus taskq]
100015 D - 0xfffffe0007764200 [thread taskq]
100017 D - 0xfffffe0007763e00 [aiod_kick taskq]
100018 D - 0xfffffe0007763d00 [deferred_unmount ta]
100019 D - 0xfffffe0007763c00 [inm_free taskq]
100020 D - 0xfffffe0007763b00 [in6m_free taskq]
100021 D - 0xfffffe0007763a00 [linuxkpi_irq_wq]
100022 D - 0xfffffe0007763900 [linuxkpi_short_wq_0]
100023 D - 0xfffffe0007763900 [linuxkpi_short_wq_1]
100024 D - 0xfffffe0007763900 [linuxkpi_short_wq_2]
100025 D - 0xfffffe0007763900 [linuxkpi_short_wq_3]
100026 D - 0xfffffe0007763800 [linuxkpi_long_wq_0]
100027 D - 0xfffffe0007763800 [linuxkpi_long_wq_1]
100028 D - 0xfffffe0007763800 [linuxkpi_long_wq_2]
100029 D - 0xfffffe0007763800 [linuxkpi_long_wq_3]
100036 D - 0xfffffe0007763300 [firmware taskq]
100041 D - 0xfffffe0007763200 [crypto_0]
100042 D - 0xfffffe0007763200 [crypto_1]
100057 D - 0xfffffe005812c000 [vtnet0 rxq 0]
100058 D - 0xfffffe005812be00 [vtnet0 txq 0]
100059 D - 0xfffffe005812bd00 [vtnet0 rxq 1]
100060 D - 0xfffffe005812bc00 [vtnet0 txq 1]
100062 D vtbslp 0xfffffe0058250f00 [virtio_balloon]
100066 D - 0xffffffff827c2300 [deadlkres]
100070 D - 0xfffffe00593da400 [acpi_task_0]
100071 D - 0xfffffe00593da400 [acpi_task_1]
100072 D - 0xfffffe00593da400 [acpi_task_2]
100074 D - 0xfffffe0007766800 [mca taskq]
100075 D - 0xfffffe0007763100 [CAM taskq]
100077 D - 0xfffffe005812b500 [ipsec_offload]
db> show all locks
Process 816 (syz-executor) thread 0xfffffe005411b780 (100127)
shared sx vm map (user) (vm map (user)) r = 0 (0xfffffe00540d0980) locked @ /syzkaller/managers/i386/kernel/sys/vm/vm_map.c:4998
Process 813 (syz-executor) thread 0xfffffe00540f9000 (100125)
exclusive sx MD config lock (MD config lock) r = 0 (0xffffffff83911400) locked @ /syzkaller/managers/i386/kernel/sys/dev/md/md.c:1796
db> show malloc
Type InUse MemUse Requests
pf_hash 6 12804K 6
linker 376 5071K 486
tcp_hpts 7 4801K 7
devbuf 4188 4324K 4213
sysctloid 34891 2055K 34966
vtbuf 24 1968K 46
kobj 331 1324K 495
newblk 325 1105K 343
vfscache 3 1025K 3
pcb 23 669K 52
inodedep 68 538K 91
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
subproc 118 230K 884
vnet_data 2 224K 2
acpitask 1 224K 1
KTRACE 100 200K 100
acpica 1674 184K 54426
vmem 5 143K 5
tidhash 3 141K 3
pagedep 22 134K 29
tfo_ccache 1 128K 1
IP reass 1 128K 1
filedesc 16 121K 75
DEVFS1 109 109K 126
sem 4 106K 4
gtaskqueue 18 98K 18
bus 997 82K 5063
mtx_pool 3 74K 3
syncache 1 68K 1
NFSD srvcache 3 68K 3
module 521 66K 521
ddb_capture 1 64K 1
temp 35 37K 1821
kdtrace 176 35K 946
umtx 272 34K 272
hostcache 1 32K 1
shm 1 32K 1
DEVFS3 128 32K 138
msg 4 30K 4
kbdmux 6 28K 6
DEVFS_RULE 56 20K 56
ifaddr 66 19K 68
BPF 14 19K 14
ufs_mount 4 17K 5
proc 3 17K 3
LRO 16 17K 16
tty 16 16K 16
routetbl 124 16K 395
ithread 90 15K 90
bus-sc 34 15K 1647
eventhandler 163 14K 163
lltable 43 14K 43
ifnet 7 13K 7
ether_multi 152 13K 162
kenv 95 12K 95
GEOM 61 11K 477
CAM queue 5 11K 1528
rman 82 10K 437
rpc 8 9K 8
plimit 23 9K 332
in6_multi 65 9K 65
bmsafemap 3 9K 58
devstat 4 9K 4
UART 12 9K 12
ksem 1 8K 1
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 239 8K 301
taskqueue 69 8K 69
sglist 6 7K 6
CAM DEV 3 6K 510
cred 23 6K 180
pfs_nodes 22 6K 22
dirrem 20 5K 40
ufs_dirhash 24 5K 24
UMA 266 5K 266
pf_ifnet 10 5K 19
vt 11 5K 11
memdesc 1 4K 1
MCA 32 4K 32
md_disk 1 4K 1
evdev 4 4K 4
diradd 31 4K 54
acpisem 28 4K 28
kqueue 51 4K 819
pwddesc 51 4K 818
terminal 11 3K 11
DEVFSP 44 3K 47
selfd 43 3K 5773
mkdir 20 3K 38
indirdep 10 3K 10
session 20 3K 31
acpidev 20 3K 20
proc-args 79 3K 1854
hhook 8 3K 10
clone 9 3K 9
uidinfo 3 3K 6
kcovinfo 36 3K 36
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 13
Unitno 32 2K 52
sctp_ifa 13 2K 14
CAM XPT 22 2K 543
lockf 15 2K 22
newdirblk 12 2K 19
in_multi 6 2K 8
tun 4 2K 4
toponodes 6 2K 6
ipsecpolicy 2 2K 2
msi 9 2K 9
netlink 2 2K 70
select 9 2K 25
softdep 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
nhops 6 1K 8
vnodemarker 2 1K 8
NFSD session 1 1K 1
CAM periph 4 1K 271
ipsec 3 1K 3
sctp_ifn 6 1K 14
mld 6 1K 6
igmp 6 1K 6
pfil 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
crypto 4 1K 4
encap_export_host 12 1K 12
osd 9 1K 22
CC Mem 4 1K 6
ioctlops 1 1K 97
cdev 2 1K 2
lkpikmalloc 8 1K 9
counter_rate 14 1K 14
freefile 3 1K 12
chacha20random 1 1K 1
biobuf 1 1K 1
inpcbpolicy 11 1K 153
vnodes 1 1K 1
procdesc 2 1K 7
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
CAM SIM 2 1K 2
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 5
prison 6 1K 6
cryptodev 2 1K 35
nexusdev 8 1K 8
apmdev 1 1K 1
atkbddev 2 1K 2
pmchooks 1 1K 1
CAM path 4 1K 1034
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
soname 4 1K 3305
filecaps 4 1K 66
sctp_vrf 1 1K 1
vnet 1 1K 1
pmc 1 1K 1
entropy 2 1K 32
acpiintr 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
freework 1 1K 29
p1003.1b 1 1K 1
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_krule_item 0 0K 0
pf_temp 0 0K 0
ipcomp 0 0K 0
esp 0 0K 0
ah 0 0K 0
tcp_pcm_rack 0 0K 0
tcp_do_rack 0 0K 0
tcp_fsb_rack 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
sctp_iter 0 0K 11
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 1
sctp_atky 0 0K 1
sctp_atcl 0 0K 1
sctp_a_it 0 0K 11
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
filemon 0 0K 0
mqdata 0 0K 0
madt_table 0 0K 2
smartpqi 0 0K 0
ixl 0 0K 0
ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
iavf 0 0K 0
axgbe 0 0K 0
fpukern_ctx 0 0K 0
xen_intr 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
NMI handlers 0 0K 0
bounce 0 0K 0
busdma 0 0K 0
qpidrv 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
amdiommu_dom 0 0K 0
amdiommu_ctx 0 0K 0
isci 0 0K 0
iommu_dmamap 0 0K 0
hyperv_socket 0 0K 0
bxe_ilt 0 0K 0
aesni_data 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 15
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 2
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freeblks 0 0K 28
freefrag 0 0K 2
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
ktls_ocf 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS_RX 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EN 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5DUMP 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
simple_attr 0 0K 0
seq_file 0 0K 0
lkpiskb 0 0K 0
radix 0 0K 0
idr 0 0K 0
lkpindev 0 0K 0
lkpimhi 0 0K 0
lkpifw 0 0K 0
lkpi80211 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
tcp_hwpace 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 19
fadvise 0 0K 0
VN POLL 0 0K 0
statfs 0 0K 181
namei_tracker 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 1
aio 0 0K 0
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 0
ktls 0 0K 0
accf 0 0K 0
pts 0 0K 0
timerfd 0 0K 0
iov 0 0K 13452
eventfd 0 0K 0
Witness 0 0K 0
stack 0 0K 0
sbuf 0 0K 288
firmware 0 0K 0
compressor 0 0K 0
SWAP 0 0K 0
sysctltmp 0 0K 647
sysctl 0 0K 3
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
cache 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
boottrace 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
tmpfs dir 0 0K 0
tmpfs name 0 0K 0
tmpfs mount 0 0K 0
tmpfs extattr 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroff 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
xnb 0 0K 0
xen_acpi 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
pvscsi 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
twsbuf 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
SIIS driver 0 0K 0
PUC 0 0K 0
ppbusdev 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
mpi3mrbuf 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
malodev 0 0K 0
LED 0 0K 0
ix_sriov 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
ciss_data 0 0K 0
BACKLIGHT 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
acpipwr 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
aacraidcam 0 0K 0
aacraid_buf 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
XZ_DEC 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
scsi_pass 0 0K 0
scsi_da 0 0K 70
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
nvme_da 0 0K 0
CAM CCB 0 0K 523
CAM ccb queue 0 0K 0
db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree
mbuf_jumbo_page 4096 8320 1078 10950 0 254 38494208 0
mbuf 256 8606 1056 12695 0 254 2473472 0
BUF TRIE 152 201 11603 378 0 62 1794208 0
malloc-384 384 4173 27 4522 0 30 1612800 0
malloc-4096 4096 383 1 1315 0 2 1572864 0
malloc-128 128 11488 106 11531 0 126 1484032 0
UMA Slabs 0 112 10895 7 10895 0 126 1221024 0
tcp_log 416 331 2216 2656 0 254 1059552 0
mbuf_cluster 2048 508 0 508 0 254 1040384 0
RADIX NODE 152 5822 153 25716 0 62 908200 0
vmem btag 56 15928 95 15928 0 254 897288 0
malloc-65536 65536 9 1 12 0 1 655360 0
FFS inode 1168 531 22 543 0 8 645904 0
pbuf 2624 0 202 0 0 2 530048 0
lkpicurr 168 2 3118 2 0 62 524160 0
socket 1024 22 486 1338 0 254 520192 0
malloc-65536 65536 4 2 172 0 1 393216 0
sctp_ep 1152 0 259 1 0 254 298368 0
VM OBJECT 248 1078 106 13269 0 62 293632 0
malloc-64 64 4100 247 5419 0 254 278208 0
VNODE 440 567 36 581 0 30 265320 0
256 Bucket 2048 120 8 942 0 8 262144 0
THREAD 1860 124 12 128 0 8 252960 0
malloc-16 16 14418 82 14499 0 254 232000 0
malloc-2048 2048 7 105 621 0 8 229376 0
malloc-2048 2048 107 5 107 0 8 229376 0
DEVCTL 1024 20 200 147 0 0 225280 0
UMA Zones 768 238 1 238 0 16 183552 0
malloc-32 32 5393 277 7038 0 254 181440 0
malloc-16384 16384 8 3 37 0 1 180224 0
malloc-128 128 1205 190 25343 0 126 178560 0
lkpimm 56 1 3095 1 0 254 173376 0
unpcb 320 10 506 1159 0 254 165120 0
FFS2 dinode 256 531 99 543 0 62 161280 0
malloc-256 256 587 43 941 0 62 161280 0
malloc-1024 1024 125 19 1313 0 16 147456 0
MAP ENTRY 96 1214 172 41131 0 126 133056 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-65536 65536 0 2 8 0 1 131072 0
malloc-32768 32768 3 1 123 0 1 131072 0
mbuf_packet 256 0 508 124 0 254 130048 0
S VFS Cache 104 993 177 1033 0 126 121680 0
FPU_save_area 832 126 18 139 0 16 119808 0
ksiginfo 112 43 1001 58 0 126 116928 0
malloc-128 128 738 161 1786 0 126 115072 0
malloc-128 128 562 213 3913 0 126 99200 0
PROC 1376 50 16 816 0 8 90816 0
UMA Kegs 384 225 8 225 0 30 89472 0
128 Bucket 1024 40 43 241 0 16 84992 0
filedesc0 1072 51 19 818 0 8 75040 0
g_bio 408 0 180 4751 0 30 73440 0
malloc-64 64 659 412 3220 0 254 68544 0
malloc-32768 32768 2 0 2 0 1 65536 0
malloc-16384 16384 4 0 194 0 1 65536 0
malloc-4096 4096 13 3 65 0 2 65536 0
malloc-4096 4096 12 4 20 0 2 65536 0
malloc-2048 2048 7 25 722 0 8 65536 0
malloc-8192 8192 6 1 113 0 1 57344 0
malloc-64 64 526 293 766 0 254 52416 0
udp_inpcb 408 6 120 142 0 30 51408 0
malloc-256 256 134 61 153 0 62 49920 0
malloc-256 256 103 92 809 0 62 49920 0
32 Bucket 256 54 141 647 0 62 49920 0
DIRHASH 1024 34 14 34 0 16 49152 0
NAMEI 1024 0 48 12577 0 16 49152 0
malloc-8192 8192 6 0 7 0 1 49152 0
malloc-1024 1024 14 34 541 0 16 49152 0
64 Bucket 512 65 31 1577 0 30 49152 0
syncache 168 0 264 3 0 254 44352 0
malloc-8192 8192 5 0 5 0 1 40960 0
malloc-8192 8192 3 2 5 0 1 40960 0
pcpu-8 8 4694 426 4850 0 254 40960 0
malloc-64 64 7 560 13192 0 254 36288 0
malloc-64 64 161 406 163 0 254 36288 0
malloc-64 64 105 462 5865 0 254 36288 0
malloc-64 64 20 547 294 0 254 36288 0
malloc-64 64 9 558 32 0 254 36288 0
malloc-128 128 81 198 89 0 126 35712 0
malloc-128 128 68 211 73 0 126 35712 0
malloc-128 128 25 254 283 0 126 35712 0
malloc-128 128 15 264 276 0 126 35712 0
routing nhops 256 26 109 33 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
malloc-384 384 68 22 94 0 30 34560 0
malloc-384 384 86 4 111 0 30 34560 0
malloc-384 384 53 37 362 0 30 34560 0
malloc-256 256 10 125 415 0 62 34560 0
malloc-256 256 93 42 133 0 62 34560 0
malloc-256 256 27 108 65 0 62 34560 0
malloc-256 256 25 110 258 0 62 34560 0
malloc-256 256 15 120 526 0 62 34560 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-32768 32768 0 1 11 0 1 32768 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 2 0 2 0 1 32768 0
malloc-4096 4096 5 3 564 0 2 32768 0
malloc-4096 4096 6 2 9 0 2 32768 0
malloc-2048 2048 4 12 27 0 8 32768 0
malloc-2048 2048 3 13 3 0 8 32768 0
malloc-2048 2048 9 7 9 0 8 32768 0
malloc-1024 1024 2 30 11 0 16 32768 0
malloc-1024 1024 6 26 6 0 16 32768 0
malloc-1024 1024 16 16 19 0 16 32768 0
malloc-1024 1024 9 23 9 0 16 32768 0
malloc-512 512 3 61 23 0 30 32768 0
malloc-512 512 12 52 18 0 30 32768 0
malloc-512 512 3 61 174 0 30 32768 0
malloc-512 512 2 62 3 0 30 32768 0
pcpu-64 64 497 15 497 0 254 32768 0
ttyinq 160 135 65 300 0 62 32000 0
PGRP 120 24 240 35 0 126 31680 0
VMSPACE 584 34 15 801 0 16 28616 0
sctp_laddr 48 0 588 12 0 254 28224 0
malloc-32 32 350 532 421 0 254 28224 0
16 Bucket 144 47 149 226 0 62 28224 0
4 Bucket 48 5 583 6 0 254 28224 0
da_ccb 544 0 49 1280 0 16 26656 0
TURNSTILE 136 137 52 137 0 62 25704 0
cpuset 200 7 121 7 0 62 25600 0
malloc-8192 8192 3 0 3 0 1 24576 0
malloc-8192 8192 2 1 21 0 1 24576 0
malloc-4096 4096 4 2 4 0 2 24576 0
pipe 736 19 14 287 0 16 24288 0
ertt_txseginfo 40 0 606 138 0 254 24240 0
PWD 40 18 588 102 0 254 24240 0
rtentry 168 29 115 33 0 62 24192 0
Files 80 151 149 6729 0 126 24000 0
8 Bucket 80 51 249 341 0 126 24000 0
tcp_inpcb 1304 4 14 6 0 8 23472 0
malloc-384 384 8 52 9 0 30 23040 0
ripcb 376 1 59 4 0 30 22560 0
Mountpoints 2816 2 6 2 0 4 22528 0
SLEEPQUEUE 88 137 119 137 0 126 22528 0
clpbuf 2624 0 8 11 0 4 20992 0
hostcache 64 1 314 1 0 254 20160 0
ertt 72 4 276 6 0 126 20160 0
malloc-32 32 65 565 227 0 254 20160 0
malloc-32 32 31 599 67 0 254 20160 0
malloc-32 32 24 606 2685 0 254 20160 0
malloc-32 32 35 595 191 0 254 20160 0
malloc-32 32 17 613 31 0 254 20160 0
2 Bucket 32 50 580 318 0 254 20160 0
vmem 1856 2 7 2 0 8 16704 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-4096 4096 0 4 181 0 2 16384 0
malloc-4096 4096 0 4 2 0 2 16384 0
malloc-2048 2048 5 3 22 0 8 16384 0
malloc-2048 2048 0 8 2 0 8 16384 0
malloc-1024 1024 1 15 1 0 16 16384 0
malloc-1024 1024 3 13 3 0 16 16384 0
malloc-512 512 1 31 1 0 30 16384 0
malloc-512 512 2 30 7 0 30 16384 0
SMR CPU 32 8 503 8 0 254 16352 0
malloc-16 16 504 496 3420 0 254 16000 0
kenv 258 17 43 1066 0 30 15480 0
mqnode 416 3 33 3 0 30 14976 0
udplite_inpcb 408 0 36 1 0 30 14688 0
SMR SHARED 24 8 503 8 0 254 12264 0
malloc-32 32 152 226 928 0 254 12096 0
KNOTE 160 0 75 8 0 62 12000 0
malloc-16 16 1 749 103 0 254 12000 0
malloc-16 16 12 738 12 0 254 12000 0
malloc-16 16 16 734 57 0 254 12000 0
malloc-16 16 44 706 24847 0 254 12000 0
malloc-16 16 44 706 1462 0 254 12000 0
malloc-384 384 1 29 1 0 30 11520 0
malloc-384 384 27 3 38 0 30 11520 0
malloc-384 384 1 29 1 0 30 11520 0
pcpu-16 16 8 504 8 0 254 8192 0
vtnet_tx_hdr 24 0 334 781 0 254 8016 0
malloc-16 16 3 497 4 0 254 8000 0
UMA Slabs 1 176 9 13 9 0 62 3872 0
KMAP ENTRY 96 12 27 14 0 0 3744 0
FFS1 dinode 128 0 0 0 0 126 0 0
ada_ccb 272 0 0 0 0 30 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 152 0 0 0 0 62 0 0
cdg_qdiffsample 16 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf fragment node 72 0 0 0 0 126 0 0
pf frags 232 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 254 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf UDP mappings 104 0 0 0 0 126 0 0
pf source nodes 152 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 384 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 184 0 0 0 0 62 0 0
tcp_bbr_pcb 896 0 0 0 0 16 0 0
tcp_bbr_map 128 0 0 0 0 126 0 0
tcp_rack_pcb 1088 0 0 0 0 8 0 0
tcp_rack_map 128 0 0 0 0 126 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
sctp_stream_msg_out 112 0 0 0 0 254 0 0
sctp_readq 152 0 0 0 0 254 0 0
sctp_chunk 152 0 0 0 0 254 0 0
sctp_raddr 736 0 0 0 0 254 0 0
sctp_asoc 2256 0 0 0 0 254 0 0
tcp_log_id_node 120 0 0 0 0 126 0 0
tcp_log_id_bucket 176 0 0 0 0 62 0 0
tcpreass 48 0 0 0 0 254 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 272 0 0 0 0 30 0 0
AIOCB 552 0 0 0 0 16 0 0
AIO 208 0 0 0 0 62 0 0
mqnotifier 216 0 0 0 0 62 0 0
mvdata 64 0 0 0 0 254 0 0
mqueue 248 0 0 0 0 62 0 0
TMPFS node 240 0 0 0 0 62 0 0
NCLNODE 608 0 0 0 0 16 0 0
LTS VFS Cache 360 0 0 0 0 30 0 0
L VFS Cache 320 0 0 0 0 30 0 0
STS VFS Cache 144 0 0 0 0 62 0 0
cryptop 280 0 0 0 0 30 0 0
linux_dma_object 32 0 0 0 0 254 0 0
linux_dma_pctrie 152 0 0 0 0 62 0 0
IOMMU_MAP_ENTRY 112 0 0 0 0 126 0 0
skbuff 1808 0 0 0 0 8 0 0
mbuf_jumbo_16k 16384 0 0 0 0 254 0 0
mbuf_jumbo_9k 9216 0 0 0 0 254 0 0
audit_record 1280 0 0 0 0 8 0 0
domainset 40 0 0 0 0 254 0 0
MAC labels 40 0 0 0 0 254 0 0
vnpbuf 2624 0 0 0 0 16 0 0
nfspbuf 2624 0 0 0 0 4 0 0
swwbuf 2624 0 0 0 0 2 0 0
swrbuf 2624 0 0 0 0 4 0 0
umtx_shm 88 0 0 0 0 126 0 0
umtx pi 96 0 0 0 0 126 0 0
rangeset pctrie nodes 152 0 0 0 0 62 0 0
rl_entry 48 0 0 0 0 254 0 0
malloc-65536 65536 0 0 0 0 1 0 0
malloc-65536 65536 0 0 0 0 1 0 0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 604d34c23f77 net: ether_gen_addr: fix address generation
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=1669848c580000
dashboard link: https://syzkaller.appspot.com/bug?extid=a0ff73f664de8757cfaa
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a0ff73...@syzkaller.appspotmail.com
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80b0c758
stack pointer = 0x0:0xfffffe0056d16070
frame pointer = 0x0:0xfffffe0056d160b0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 813 (syz-executor)
rdi: 0000000000000000 rsi: 0000000000007427 rdx: 0000000000007426
rcx: fffffe0002bf1850 r8: 0000000000000000 r9: 0000000000000027
rax: fffffe0002bf1850 rbx: 0000000000000000 rbp: fffffe0056d160b0
r10: 33e2fd513472f3f7 r11: 0000000000000000 r12: fffffe006e4c9058
r13: fffffe006e4c9040 r14: 0000000000000000 r15: 0000000000000010
trap number = 12
panic: page fault
cpuid = 1
time = 1751504306
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056d15890
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056d159f0
vpanic() at vpanic+0x257/frame 0xfffffe0056d15bb0
panic() at panic+0xb5/frame 0xfffffe0056d15c70
trap_pfault() at trap_pfault+0xaec/frame 0xfffffe0056d15db0
trap() at trap+0x78e/frame 0xfffffe0056d15fa0
calltrap() at calltrap+0x8/frame 0xfffffe0056d15fa0
--- trap 0xc, rip = 0xffffffff80b0c758, rsp = 0xfffffe0056d16070, rbp = 0xfffffe0056d160b0 ---
destroy_indir() at destroy_indir+0x48/frame 0xfffffe0056d160b0
mddestroy() at mddestroy+0x358/frame 0xfffffe0056d16190
mdctlioctl() at mdctlioctl+0x1680/frame 0xfffffe0056d162f0
devfs_ioctl() at devfs_ioctl+0x266/frame 0xfffffe0056d163e0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x87/frame 0xfffffe0056d16410
vn_ioctl() at vn_ioctl+0x3c7/frame 0xfffffe0056d16620
devfs_ioctl_f() at devfs_ioctl_f+0x69/frame 0xfffffe0056d16670
kern_ioctl() at kern_ioctl+0x4ca/frame 0xfffffe0056d16750
sys_ioctl() at sys_ioctl+0x36e/frame 0xfffffe0056d168d0
freebsd32_ioctl() at freebsd32_ioctl+0x607/frame 0xfffffe0056d16d10
ia32_syscall() at ia32_syscall+0x4d2/frame 0xfffffe0056d16f30
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xdfffcf98
KDB: enter: panic
[ thread pid 813 tid 100125 ]
Stopped at kdb_enter+0x6e: movq $0,0x25b9147(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0xfffffe006ea00000
rdx 0x7ffff
rbx 0xffffffff827bcf60 .str.27
rsp 0xfffffe0056d159d0
rbp 0xfffffe0056d159f0
rsi 0x80001
rdi 0xffffffff8161a6c9 printf+0x149
r8 0
r9 0xffffffff
r10 0
r11 0x17
r12 0xfffffe00540f9000
r13 0xfffffffffffffffd
r14 0xffffffff827bcf60 .str.27
r15 0
rip 0xffffffff8160424e kdb_enter+0x6e
rflags 0x46
kdb_enter+0x6e: movq $0,0x25b9147(%rip)
db> show proc
Process 813 (syz-executor) at 0xfffffe00540e85c0:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 765 at 0xfffffe00540d2ae0
ABI: FreeBSD ELF32
flag: 0x10000080 flag2: 0
arguments: ./syz-executor exec
reaper: 0xfffffe0007809040 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe000780f490
(map 0xfffffe000780f490)
(map.pmap 0xfffffe000780f530)
(pmap 0xfffffe000780f5a0)
threads: 2
100112 RunQ syz-executor
100125 Run CPU 1 syz-executor
db> ps
pid ppid pgrp uid state wmesg wchan cmd
816 767 767 0 R CPU 0 syz-executor
814 807 424 0 R dhclient
813 765 765 0 R (threaded) syz-executor
100112 RunQ syz-executor
100125 Run CPU 1 syz-executor
812 766 766 0 R (threaded) syz-executor
100117 RunQ syz-executor
100126 RunQ syz-executor
811 764 764 0 R (threaded) syz-executor
100118 RunQ syz-executor
100124 S sigsusp 0xfffffe00540d4110 syz-executor
100128 S uwait 0xfffffe006dcf6100 syz-executor
807 787 424 0 S select 0xfffffe00584ec640 dhclient
787 424 424 0 S wait 0xfffffe00540e8060 sh
767 763 767 0 R syz-executor
766 763 766 0 S nanslp 0xffffffff83b9e580 syz-executor
765 763 765 0 S nanslp 0xffffffff83b9e580 syz-executor
764 763 764 0 S nanslp 0xffffffff83b9e580 syz-executor
763 761 761 0 S select 0xfffffe006dcf68c0 syz-executor
761 759 761 0 Ss sigsusp 0xfffffe00540e5b70 csh
759 682 759 0 Ss select 0xfffffe006dcf69c0 sshd
748 1 748 0 Ss+ ttyin 0xfffffe0058287cb0 getty
747 1 747 0 Ss+ ttyin 0xfffffe00593f50b0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00593f54b0 getty
745 1 745 0 Ss+ ttyin 0xfffffe00593f58b0 getty
744 1 744 0 Ss+ ttyin 0xfffffe00593f5cb0 getty
743 1 743 0 Ss+ ttyin 0xfffffe00593f60b0 getty
742 1 742 0 Ss+ ttyin 0xfffffe00593f64b0 getty
741 1 741 0 Ss+ ttyin 0xfffffe00593f68b0 getty
740 1 740 0 Ss+ ttyin 0xfffffe00593f6cb0 getty
738 1 18 0 S+ piperd 0xfffffe006b421b80 logger
737 736 18 0 S+ nanslp 0xffffffff83b9e580 sleep
736 1 18 0 S+ wait 0xfffffe00540d2020 sh
686 1 686 0 Ss nanslp 0xffffffff83b9e581 cron
682 1 682 0 Ss select 0xfffffe006dcf73c0 sshd
495 1 495 0 Ss select 0xfffffe006dcf74c0 syslogd
424 1 424 0 Ss wait 0xfffffe00540d3040 devd
423 1 423 65 Ss select 0xfffffe0057d75c40 dhclient
338 1 338 0 Ss select 0xfffffe005824ef40 dhclient
335 1 335 0 Ss select 0xfffffe006dcf7440 dhclient
17 0 0 0 DL syncer 0xffffffff83cbbfa0 [syncer]
16 0 0 0 DL vlruwt 0xfffffe0007828040 [vnlru]
15 0 0 0 DL (threaded) [bufdaemon]
100080 D psleep 0xffffffff83cba560 [bufdaemon]
100083 D - 0xffffffff83001ec0 [bufspacedaemon-0]
100094 D sdflush 0xfffffe00596c9ce8 [/ worker]
9 0 0 0 DL psleep 0xffffffff83d05400 [vmdaemon]
8 0 0 0 DL (threaded) [pagedaemon]
100078 D psleep 0xffffffff83ceb4c8 [dom0]
100081 D launds 0xffffffff83ceb4d4 [laundry: dom0]
100082 D umarcl 0xffffffff81dda750 [uma]
7 0 0 0 DL - 0xffffffff8391bcd0 [rand_harvestq]
6 0 0 0 DL pftm 0xffffffff847bb980 [pf purge]
5 0 0 0 DL waiting 0xffffffff844e5700 [sctp_iterator]
4 0 0 0 DL (threaded) [cam]
100046 D - 0xffffffff838e6340 [doneq0]
100047 D - 0xffffffff838e62c0 [async]
100076 D - 0xffffffff838e6140 [scanner]
3 0 0 0 DL (threaded) [crypto]
100043 D crypto_ 0xffffffff83ce6d80 [crypto]
100044 D crypto_ 0xfffffe0007a72d30 [crypto returns 0]
100045 D crypto_ 0xfffffe0007a72d80 [crypto returns 1]
14 0 0 0 DL seqstat 0xfffffe0057cba488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100037 D - 0xffffffff83b46f20 [g_event]
100038 D - 0xffffffff83b46f40 [g_up]
100039 D - 0xffffffff83b46f60 [g_down]
2 0 0 0 WL (threaded) [clock]
100031 I [clock (0)]
100032 I [clock (1)]
12 0 0 0 WL (threaded) [intr]
100013 I [swi6: task queue]
100014 I [swi6: Giant taskq]
100016 I [swi5: fast taskq]
100033 I [swi1: netisr 0]
100034 I [swi1: hpts]
100035 I [swi1: hpts]
100048 I [irq24: virtio_pci0]
100049 I [irq25: virtio_pci0]
100050 I [irq26: virtio_pci0]
100051 I [irq27: virtio_pci0]
100052 I [irq28: virtio_pci1]
100053 I [irq29: virtio_pci1]
100054 I [irq30: virtio_pci1]
100055 I [irq31: virtio_pci1]
100056 I [irq32: virtio_pci1]
100061 I [irq10: virtio_pci2]
100063 I [irq1: atkbd0]
100064 I [irq12: psm0]
100065 I [swi0: uart uart++]
100069 I [swi1: pf send]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffffe0007809040 [init]
10 0 0 0 DL audit_w 0xffffffff83ce7820 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D parked 0xffffffff84c36ff0 [swapper]
100005 D - 0xfffffe0053ea0100 [softirq_0]
100006 D - 0xfffffe0053ea0000 [softirq_1]
100007 D - 0xfffffe0053e9fe00 [if_io_tqg_0]
100008 D - 0xfffffe0053e9fd00 [if_io_tqg_1]
100009 D - 0xfffffe0053e9fc00 [if_config_tqg_0]
100010 D - 0xfffffe0007764900 [kqueue_ctx taskq]
100011 D - 0xfffffe0007764800 [jail_remove taskq]
100012 D - 0xfffffe0007764700 [bus taskq]
100015 D - 0xfffffe0007764200 [thread taskq]
100017 D - 0xfffffe0007763e00 [aiod_kick taskq]
100018 D - 0xfffffe0007763d00 [deferred_unmount ta]
100019 D - 0xfffffe0007763c00 [inm_free taskq]
100020 D - 0xfffffe0007763b00 [in6m_free taskq]
100021 D - 0xfffffe0007763a00 [linuxkpi_irq_wq]
100022 D - 0xfffffe0007763900 [linuxkpi_short_wq_0]
100023 D - 0xfffffe0007763900 [linuxkpi_short_wq_1]
100024 D - 0xfffffe0007763900 [linuxkpi_short_wq_2]
100025 D - 0xfffffe0007763900 [linuxkpi_short_wq_3]
100026 D - 0xfffffe0007763800 [linuxkpi_long_wq_0]
100027 D - 0xfffffe0007763800 [linuxkpi_long_wq_1]
100028 D - 0xfffffe0007763800 [linuxkpi_long_wq_2]
100029 D - 0xfffffe0007763800 [linuxkpi_long_wq_3]
100036 D - 0xfffffe0007763300 [firmware taskq]
100041 D - 0xfffffe0007763200 [crypto_0]
100042 D - 0xfffffe0007763200 [crypto_1]
100057 D - 0xfffffe005812c000 [vtnet0 rxq 0]
100058 D - 0xfffffe005812be00 [vtnet0 txq 0]
100059 D - 0xfffffe005812bd00 [vtnet0 rxq 1]
100060 D - 0xfffffe005812bc00 [vtnet0 txq 1]
100062 D vtbslp 0xfffffe0058250f00 [virtio_balloon]
100066 D - 0xffffffff827c2300 [deadlkres]
100070 D - 0xfffffe00593da400 [acpi_task_0]
100071 D - 0xfffffe00593da400 [acpi_task_1]
100072 D - 0xfffffe00593da400 [acpi_task_2]
100074 D - 0xfffffe0007766800 [mca taskq]
100075 D - 0xfffffe0007763100 [CAM taskq]
100077 D - 0xfffffe005812b500 [ipsec_offload]
db> show all locks
Process 816 (syz-executor) thread 0xfffffe005411b780 (100127)
shared sx vm map (user) (vm map (user)) r = 0 (0xfffffe00540d0980) locked @ /syzkaller/managers/i386/kernel/sys/vm/vm_map.c:4998
Process 813 (syz-executor) thread 0xfffffe00540f9000 (100125)
exclusive sx MD config lock (MD config lock) r = 0 (0xffffffff83911400) locked @ /syzkaller/managers/i386/kernel/sys/dev/md/md.c:1796
db> show malloc
Type InUse MemUse Requests
pf_hash 6 12804K 6
linker 376 5071K 486
tcp_hpts 7 4801K 7
devbuf 4188 4324K 4213
sysctloid 34891 2055K 34966
vtbuf 24 1968K 46
kobj 331 1324K 495
newblk 325 1105K 343
vfscache 3 1025K 3
pcb 23 669K 52
inodedep 68 538K 91
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
subproc 118 230K 884
vnet_data 2 224K 2
acpitask 1 224K 1
KTRACE 100 200K 100
acpica 1674 184K 54426
vmem 5 143K 5
tidhash 3 141K 3
pagedep 22 134K 29
tfo_ccache 1 128K 1
IP reass 1 128K 1
filedesc 16 121K 75
DEVFS1 109 109K 126
sem 4 106K 4
gtaskqueue 18 98K 18
bus 997 82K 5063
mtx_pool 3 74K 3
syncache 1 68K 1
NFSD srvcache 3 68K 3
module 521 66K 521
ddb_capture 1 64K 1
temp 35 37K 1821
kdtrace 176 35K 946
umtx 272 34K 272
hostcache 1 32K 1
shm 1 32K 1
DEVFS3 128 32K 138
msg 4 30K 4
kbdmux 6 28K 6
DEVFS_RULE 56 20K 56
ifaddr 66 19K 68
BPF 14 19K 14
ufs_mount 4 17K 5
proc 3 17K 3
LRO 16 17K 16
tty 16 16K 16
routetbl 124 16K 395
ithread 90 15K 90
bus-sc 34 15K 1647
eventhandler 163 14K 163
lltable 43 14K 43
ifnet 7 13K 7
ether_multi 152 13K 162
kenv 95 12K 95
GEOM 61 11K 477
CAM queue 5 11K 1528
rman 82 10K 437
rpc 8 9K 8
plimit 23 9K 332
in6_multi 65 9K 65
bmsafemap 3 9K 58
devstat 4 9K 4
UART 12 9K 12
ksem 1 8K 1
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 239 8K 301
taskqueue 69 8K 69
sglist 6 7K 6
CAM DEV 3 6K 510
cred 23 6K 180
pfs_nodes 22 6K 22
dirrem 20 5K 40
ufs_dirhash 24 5K 24
UMA 266 5K 266
pf_ifnet 10 5K 19
vt 11 5K 11
memdesc 1 4K 1
MCA 32 4K 32
md_disk 1 4K 1
evdev 4 4K 4
diradd 31 4K 54
acpisem 28 4K 28
kqueue 51 4K 819
pwddesc 51 4K 818
terminal 11 3K 11
DEVFSP 44 3K 47
selfd 43 3K 5773
mkdir 20 3K 38
indirdep 10 3K 10
session 20 3K 31
acpidev 20 3K 20
proc-args 79 3K 1854
hhook 8 3K 10
clone 9 3K 9
uidinfo 3 3K 6
kcovinfo 36 3K 36
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 13
Unitno 32 2K 52
sctp_ifa 13 2K 14
CAM XPT 22 2K 543
lockf 15 2K 22
newdirblk 12 2K 19
in_multi 6 2K 8
tun 4 2K 4
toponodes 6 2K 6
ipsecpolicy 2 2K 2
msi 9 2K 9
netlink 2 2K 70
select 9 2K 25
softdep 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
nhops 6 1K 8
vnodemarker 2 1K 8
NFSD session 1 1K 1
CAM periph 4 1K 271
ipsec 3 1K 3
sctp_ifn 6 1K 14
mld 6 1K 6
igmp 6 1K 6
pfil 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
crypto 4 1K 4
encap_export_host 12 1K 12
osd 9 1K 22
CC Mem 4 1K 6
ioctlops 1 1K 97
cdev 2 1K 2
lkpikmalloc 8 1K 9
counter_rate 14 1K 14
freefile 3 1K 12
chacha20random 1 1K 1
biobuf 1 1K 1
inpcbpolicy 11 1K 153
vnodes 1 1K 1
procdesc 2 1K 7
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
CAM SIM 2 1K 2
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 5
prison 6 1K 6
cryptodev 2 1K 35
nexusdev 8 1K 8
apmdev 1 1K 1
atkbddev 2 1K 2
pmchooks 1 1K 1
CAM path 4 1K 1034
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
soname 4 1K 3305
filecaps 4 1K 66
sctp_vrf 1 1K 1
vnet 1 1K 1
pmc 1 1K 1
entropy 2 1K 32
acpiintr 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
freework 1 1K 29
p1003.1b 1 1K 1
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_krule_item 0 0K 0
pf_temp 0 0K 0
ipcomp 0 0K 0
esp 0 0K 0
ah 0 0K 0
tcp_pcm_rack 0 0K 0
tcp_do_rack 0 0K 0
tcp_fsb_rack 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
sctp_iter 0 0K 11
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 1
sctp_atky 0 0K 1
sctp_atcl 0 0K 1
sctp_a_it 0 0K 11
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
filemon 0 0K 0
mqdata 0 0K 0
madt_table 0 0K 2
smartpqi 0 0K 0
ixl 0 0K 0
ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
iavf 0 0K 0
axgbe 0 0K 0
fpukern_ctx 0 0K 0
xen_intr 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
NMI handlers 0 0K 0
bounce 0 0K 0
busdma 0 0K 0
qpidrv 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
amdiommu_dom 0 0K 0
amdiommu_ctx 0 0K 0
isci 0 0K 0
iommu_dmamap 0 0K 0
hyperv_socket 0 0K 0
bxe_ilt 0 0K 0
aesni_data 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 15
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 2
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freeblks 0 0K 28
freefrag 0 0K 2
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
ktls_ocf 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS_RX 0 0K 0
MLX5EEPROM 0 0K 0
MLX5E_TLS 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EN 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5DUMP 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
MLX5EEPROM 0 0K 0
simple_attr 0 0K 0
seq_file 0 0K 0
lkpiskb 0 0K 0
radix 0 0K 0
idr 0 0K 0
lkpindev 0 0K 0
lkpimhi 0 0K 0
lkpifw 0 0K 0
lkpi80211 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
tcp_hwpace 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 19
fadvise 0 0K 0
VN POLL 0 0K 0
statfs 0 0K 181
namei_tracker 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 1
aio 0 0K 0
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 0
ktls 0 0K 0
accf 0 0K 0
pts 0 0K 0
timerfd 0 0K 0
iov 0 0K 13452
eventfd 0 0K 0
Witness 0 0K 0
stack 0 0K 0
sbuf 0 0K 288
firmware 0 0K 0
compressor 0 0K 0
SWAP 0 0K 0
sysctltmp 0 0K 647
sysctl 0 0K 3
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
cache 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
boottrace 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
tmpfs dir 0 0K 0
tmpfs name 0 0K 0
tmpfs mount 0 0K 0
tmpfs extattr 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroff 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
xnb 0 0K 0
xen_acpi 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
pvscsi 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
twsbuf 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
SIIS driver 0 0K 0
PUC 0 0K 0
ppbusdev 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
mpi3mrbuf 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
malodev 0 0K 0
LED 0 0K 0
ix_sriov 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
ciss_data 0 0K 0
BACKLIGHT 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
acpipwr 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
aacraidcam 0 0K 0
aacraid_buf 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
XZ_DEC 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
scsi_pass 0 0K 0
scsi_da 0 0K 70
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
nvme_da 0 0K 0
CAM CCB 0 0K 523
CAM ccb queue 0 0K 0
db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree
mbuf_jumbo_page 4096 8320 1078 10950 0 254 38494208 0
mbuf 256 8606 1056 12695 0 254 2473472 0
BUF TRIE 152 201 11603 378 0 62 1794208 0
malloc-384 384 4173 27 4522 0 30 1612800 0
malloc-4096 4096 383 1 1315 0 2 1572864 0
malloc-128 128 11488 106 11531 0 126 1484032 0
UMA Slabs 0 112 10895 7 10895 0 126 1221024 0
tcp_log 416 331 2216 2656 0 254 1059552 0
mbuf_cluster 2048 508 0 508 0 254 1040384 0
RADIX NODE 152 5822 153 25716 0 62 908200 0
vmem btag 56 15928 95 15928 0 254 897288 0
malloc-65536 65536 9 1 12 0 1 655360 0
FFS inode 1168 531 22 543 0 8 645904 0
pbuf 2624 0 202 0 0 2 530048 0
lkpicurr 168 2 3118 2 0 62 524160 0
socket 1024 22 486 1338 0 254 520192 0
malloc-65536 65536 4 2 172 0 1 393216 0
sctp_ep 1152 0 259 1 0 254 298368 0
VM OBJECT 248 1078 106 13269 0 62 293632 0
malloc-64 64 4100 247 5419 0 254 278208 0
VNODE 440 567 36 581 0 30 265320 0
256 Bucket 2048 120 8 942 0 8 262144 0
THREAD 1860 124 12 128 0 8 252960 0
malloc-16 16 14418 82 14499 0 254 232000 0
malloc-2048 2048 7 105 621 0 8 229376 0
malloc-2048 2048 107 5 107 0 8 229376 0
DEVCTL 1024 20 200 147 0 0 225280 0
UMA Zones 768 238 1 238 0 16 183552 0
malloc-32 32 5393 277 7038 0 254 181440 0
malloc-16384 16384 8 3 37 0 1 180224 0
malloc-128 128 1205 190 25343 0 126 178560 0
lkpimm 56 1 3095 1 0 254 173376 0
unpcb 320 10 506 1159 0 254 165120 0
FFS2 dinode 256 531 99 543 0 62 161280 0
malloc-256 256 587 43 941 0 62 161280 0
malloc-1024 1024 125 19 1313 0 16 147456 0
MAP ENTRY 96 1214 172 41131 0 126 133056 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-65536 65536 0 2 8 0 1 131072 0
malloc-32768 32768 3 1 123 0 1 131072 0
mbuf_packet 256 0 508 124 0 254 130048 0
S VFS Cache 104 993 177 1033 0 126 121680 0
FPU_save_area 832 126 18 139 0 16 119808 0
ksiginfo 112 43 1001 58 0 126 116928 0
malloc-128 128 738 161 1786 0 126 115072 0
malloc-128 128 562 213 3913 0 126 99200 0
PROC 1376 50 16 816 0 8 90816 0
UMA Kegs 384 225 8 225 0 30 89472 0
128 Bucket 1024 40 43 241 0 16 84992 0
filedesc0 1072 51 19 818 0 8 75040 0
g_bio 408 0 180 4751 0 30 73440 0
malloc-64 64 659 412 3220 0 254 68544 0
malloc-32768 32768 2 0 2 0 1 65536 0
malloc-16384 16384 4 0 194 0 1 65536 0
malloc-4096 4096 13 3 65 0 2 65536 0
malloc-4096 4096 12 4 20 0 2 65536 0
malloc-2048 2048 7 25 722 0 8 65536 0
malloc-8192 8192 6 1 113 0 1 57344 0
malloc-64 64 526 293 766 0 254 52416 0
udp_inpcb 408 6 120 142 0 30 51408 0
malloc-256 256 134 61 153 0 62 49920 0
malloc-256 256 103 92 809 0 62 49920 0
32 Bucket 256 54 141 647 0 62 49920 0
DIRHASH 1024 34 14 34 0 16 49152 0
NAMEI 1024 0 48 12577 0 16 49152 0
malloc-8192 8192 6 0 7 0 1 49152 0
malloc-1024 1024 14 34 541 0 16 49152 0
64 Bucket 512 65 31 1577 0 30 49152 0
syncache 168 0 264 3 0 254 44352 0
malloc-8192 8192 5 0 5 0 1 40960 0
malloc-8192 8192 3 2 5 0 1 40960 0
pcpu-8 8 4694 426 4850 0 254 40960 0
malloc-64 64 7 560 13192 0 254 36288 0
malloc-64 64 161 406 163 0 254 36288 0
malloc-64 64 105 462 5865 0 254 36288 0
malloc-64 64 20 547 294 0 254 36288 0
malloc-64 64 9 558 32 0 254 36288 0
malloc-128 128 81 198 89 0 126 35712 0
malloc-128 128 68 211 73 0 126 35712 0
malloc-128 128 25 254 283 0 126 35712 0
malloc-128 128 15 264 276 0 126 35712 0
routing nhops 256 26 109 33 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
malloc-384 384 68 22 94 0 30 34560 0
malloc-384 384 86 4 111 0 30 34560 0
malloc-384 384 53 37 362 0 30 34560 0
malloc-256 256 10 125 415 0 62 34560 0
malloc-256 256 93 42 133 0 62 34560 0
malloc-256 256 27 108 65 0 62 34560 0
malloc-256 256 25 110 258 0 62 34560 0
malloc-256 256 15 120 526 0 62 34560 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-32768 32768 0 1 11 0 1 32768 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 2 0 2 0 1 32768 0
malloc-4096 4096 5 3 564 0 2 32768 0
malloc-4096 4096 6 2 9 0 2 32768 0
malloc-2048 2048 4 12 27 0 8 32768 0
malloc-2048 2048 3 13 3 0 8 32768 0
malloc-2048 2048 9 7 9 0 8 32768 0
malloc-1024 1024 2 30 11 0 16 32768 0
malloc-1024 1024 6 26 6 0 16 32768 0
malloc-1024 1024 16 16 19 0 16 32768 0
malloc-1024 1024 9 23 9 0 16 32768 0
malloc-512 512 3 61 23 0 30 32768 0
malloc-512 512 12 52 18 0 30 32768 0
malloc-512 512 3 61 174 0 30 32768 0
malloc-512 512 2 62 3 0 30 32768 0
pcpu-64 64 497 15 497 0 254 32768 0
ttyinq 160 135 65 300 0 62 32000 0
PGRP 120 24 240 35 0 126 31680 0
VMSPACE 584 34 15 801 0 16 28616 0
sctp_laddr 48 0 588 12 0 254 28224 0
malloc-32 32 350 532 421 0 254 28224 0
16 Bucket 144 47 149 226 0 62 28224 0
4 Bucket 48 5 583 6 0 254 28224 0
da_ccb 544 0 49 1280 0 16 26656 0
TURNSTILE 136 137 52 137 0 62 25704 0
cpuset 200 7 121 7 0 62 25600 0
malloc-8192 8192 3 0 3 0 1 24576 0
malloc-8192 8192 2 1 21 0 1 24576 0
malloc-4096 4096 4 2 4 0 2 24576 0
pipe 736 19 14 287 0 16 24288 0
ertt_txseginfo 40 0 606 138 0 254 24240 0
PWD 40 18 588 102 0 254 24240 0
rtentry 168 29 115 33 0 62 24192 0
Files 80 151 149 6729 0 126 24000 0
8 Bucket 80 51 249 341 0 126 24000 0
tcp_inpcb 1304 4 14 6 0 8 23472 0
malloc-384 384 8 52 9 0 30 23040 0
ripcb 376 1 59 4 0 30 22560 0
Mountpoints 2816 2 6 2 0 4 22528 0
SLEEPQUEUE 88 137 119 137 0 126 22528 0
clpbuf 2624 0 8 11 0 4 20992 0
hostcache 64 1 314 1 0 254 20160 0
ertt 72 4 276 6 0 126 20160 0
malloc-32 32 65 565 227 0 254 20160 0
malloc-32 32 31 599 67 0 254 20160 0
malloc-32 32 24 606 2685 0 254 20160 0
malloc-32 32 35 595 191 0 254 20160 0
malloc-32 32 17 613 31 0 254 20160 0
2 Bucket 32 50 580 318 0 254 20160 0
vmem 1856 2 7 2 0 8 16704 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-4096 4096 0 4 181 0 2 16384 0
malloc-4096 4096 0 4 2 0 2 16384 0
malloc-2048 2048 5 3 22 0 8 16384 0
malloc-2048 2048 0 8 2 0 8 16384 0
malloc-1024 1024 1 15 1 0 16 16384 0
malloc-1024 1024 3 13 3 0 16 16384 0
malloc-512 512 1 31 1 0 30 16384 0
malloc-512 512 2 30 7 0 30 16384 0
SMR CPU 32 8 503 8 0 254 16352 0
malloc-16 16 504 496 3420 0 254 16000 0
kenv 258 17 43 1066 0 30 15480 0
mqnode 416 3 33 3 0 30 14976 0
udplite_inpcb 408 0 36 1 0 30 14688 0
SMR SHARED 24 8 503 8 0 254 12264 0
malloc-32 32 152 226 928 0 254 12096 0
KNOTE 160 0 75 8 0 62 12000 0
malloc-16 16 1 749 103 0 254 12000 0
malloc-16 16 12 738 12 0 254 12000 0
malloc-16 16 16 734 57 0 254 12000 0
malloc-16 16 44 706 24847 0 254 12000 0
malloc-16 16 44 706 1462 0 254 12000 0
malloc-384 384 1 29 1 0 30 11520 0
malloc-384 384 27 3 38 0 30 11520 0
malloc-384 384 1 29 1 0 30 11520 0
pcpu-16 16 8 504 8 0 254 8192 0
vtnet_tx_hdr 24 0 334 781 0 254 8016 0
malloc-16 16 3 497 4 0 254 8000 0
UMA Slabs 1 176 9 13 9 0 62 3872 0
KMAP ENTRY 96 12 27 14 0 0 3744 0
FFS1 dinode 128 0 0 0 0 126 0 0
ada_ccb 272 0 0 0 0 30 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 152 0 0 0 0 62 0 0
cdg_qdiffsample 16 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf fragment node 72 0 0 0 0 126 0 0
pf frags 232 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 254 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf UDP mappings 104 0 0 0 0 126 0 0
pf source nodes 152 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 384 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 184 0 0 0 0 62 0 0
tcp_bbr_pcb 896 0 0 0 0 16 0 0
tcp_bbr_map 128 0 0 0 0 126 0 0
tcp_rack_pcb 1088 0 0 0 0 8 0 0
tcp_rack_map 128 0 0 0 0 126 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
sctp_stream_msg_out 112 0 0 0 0 254 0 0
sctp_readq 152 0 0 0 0 254 0 0
sctp_chunk 152 0 0 0 0 254 0 0
sctp_raddr 736 0 0 0 0 254 0 0
sctp_asoc 2256 0 0 0 0 254 0 0
tcp_log_id_node 120 0 0 0 0 126 0 0
tcp_log_id_bucket 176 0 0 0 0 62 0 0
tcpreass 48 0 0 0 0 254 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 272 0 0 0 0 30 0 0
AIOCB 552 0 0 0 0 16 0 0
AIO 208 0 0 0 0 62 0 0
mqnotifier 216 0 0 0 0 62 0 0
mvdata 64 0 0 0 0 254 0 0
mqueue 248 0 0 0 0 62 0 0
TMPFS node 240 0 0 0 0 62 0 0
NCLNODE 608 0 0 0 0 16 0 0
LTS VFS Cache 360 0 0 0 0 30 0 0
L VFS Cache 320 0 0 0 0 30 0 0
STS VFS Cache 144 0 0 0 0 62 0 0
cryptop 280 0 0 0 0 30 0 0
linux_dma_object 32 0 0 0 0 254 0 0
linux_dma_pctrie 152 0 0 0 0 62 0 0
IOMMU_MAP_ENTRY 112 0 0 0 0 126 0 0
skbuff 1808 0 0 0 0 8 0 0
mbuf_jumbo_16k 16384 0 0 0 0 254 0 0
mbuf_jumbo_9k 9216 0 0 0 0 254 0 0
audit_record 1280 0 0 0 0 8 0 0
domainset 40 0 0 0 0 254 0 0
MAC labels 40 0 0 0 0 254 0 0
vnpbuf 2624 0 0 0 0 16 0 0
nfspbuf 2624 0 0 0 0 4 0 0
swwbuf 2624 0 0 0 0 2 0 0
swrbuf 2624 0 0 0 0 4 0 0
umtx_shm 88 0 0 0 0 126 0 0
umtx pi 96 0 0 0 0 126 0 0
rangeset pctrie nodes 152 0 0 0 0 62 0 0
rl_entry 48 0 0 0 0 254 0 0
malloc-65536 65536 0 0 0 0 1 0 0
malloc-65536 65536 0 0 0 0 1 0 0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 3, 2025, 12:47:27 AM7/3/25
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 604d34c23f77 net: ether_gen_addr: fix address generation
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=17bd148c580000
dashboard link: https://syzkaller.appspot.com/bug?extid=a0ff73f664de8757cfaa
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1199f982580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16c6b770580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a0ff73...@syzkaller.appspotmail.com
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80b0c758
stack pointer = 0x28:0xfffffe0056d2b4b0
frame pointer = 0x28:0xfffffe0056d2b4f0
rdi: 0000000000000000 rsi: 0000000000000000 rdx: 0000000000000001
rcx: fffffe0002bf1850 r8: 0000000000000000 r9: 000000000000002c
rax: fffffe0002bf1850 rbx: 0000000000000000 rbp: fffffe0056d2b4f0
r10: 0aed2ec20241790f r11: 0000000000000085 r12: fffffe005853c058
r13: fffffe005853c040 r14: 0000000000000000 r15: 0000000000000010
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056d2acd0
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056d2ae30
vpanic() at vpanic+0x257/frame 0xfffffe0056d2aff0
panic() at panic+0xb5/frame 0xfffffe0056d2b0b0
trap_pfault() at trap_pfault+0xaec/frame 0xfffffe0056d2b1f0
trap() at trap+0x78e/frame 0xfffffe0056d2b3e0
calltrap() at calltrap+0x8/frame 0xfffffe0056d2b3e0
--- trap 0xc, rip = 0xffffffff80b0c758, rsp = 0xfffffe0056d2b4b0, rbp = 0xfffffe0056d2b4f0 ---
destroy_indir() at destroy_indir+0x48/frame 0xfffffe0056d2b4f0
mddestroy() at mddestroy+0x358/frame 0xfffffe0056d2b5d0
mdctlioctl() at mdctlioctl+0x1680/frame 0xfffffe0056d2b730
devfs_ioctl() at devfs_ioctl+0x266/frame 0xfffffe0056d2b820
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x87/frame 0xfffffe0056d2b850
vn_ioctl() at vn_ioctl+0x3c7/frame 0xfffffe0056d2ba60
devfs_ioctl_f() at devfs_ioctl_f+0x69/frame 0xfffffe0056d2bab0
kern_ioctl() at kern_ioctl+0x4ca/frame 0xfffffe0056d2bb90
sys_ioctl() at sys_ioctl+0x36e/frame 0xfffffe0056d2bd10
amd64_syscall() at amd64_syscall+0x4e2/frame 0xfffffe0056d2bf30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0056d2bf30
--- syscall (198, FreeBSD ELF64, __syscall), rip = 0x3a197a, rsp = 0x820cfaa28, rbp = 0x820cfaaa0 ---
KDB: enter: panic
[ thread pid 833 tid 100137 ]
rax 0x12
rcx 0xfffffe0002bf1850
rdx 0xdffff7c000000000
rbx 0xffffffff827bcf60 .str.27
rsp 0xfffffe0056d2ae10
rbp 0xfffffe0056d2ae30
rsi 0
rdi 0xffffffff830004d8 panicstr
ABI: FreeBSD ELF64
flag: 0x10000000 flag2: 0
(map 0xfffffe005410adb0)
(map.pmap 0xfffffe005410ae50)
(pmap 0xfffffe005410aec0)
threads: 1
100137 Run CPU 1 syz-executor
826 774 826 0 R syz-executor
817 1 817 0 Ss select 0xfffffe006dcd5dc0 dhclient
812 796 424 0 S nanslp 0xffffffff83b9e580 dhclient
796 424 424 0 S wait 0xfffffe00540e2560 sh
774 773 771 0 S select 0xfffffe006dcd6140 syz-executor
773 771 771 0 S (threaded) syz-execprog
100096 S uwait 0xfffffe005824e580 syz-execprog
100114 S uwait 0xfffffe0057d75600 syz-execprog
100115 S uwait 0xfffffe006dcd6200 syz-execprog
100116 S uwait 0xfffffe006dcd6300 syz-execprog
100117 S uwait 0xfffffe006dcd6400 syz-execprog
100118 S uwait 0xfffffe00584ed100 syz-execprog
100119 S uwait 0xfffffe00584ed200 syz-execprog
100120 S kqread 0xfffffe00593da100 syz-execprog
771 769 771 0 Ss sigsusp 0xfffffe00540ca0d0 csh
769 682 769 0 Ss select 0xfffffe006dcd69c0 sshd
748 1 748 0 Rs+ CPU 0 getty
747 1 747 0 Ss+ ttyin 0xfffffe00593f58b0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00593f5cb0 getty
745 1 745 0 Ss+ ttyin 0xfffffe00593f60b0 getty
744 1 744 0 Ss+ ttyin 0xfffffe00582868b0 getty
743 1 743 0 Ss+ ttyin 0xfffffe00593f64b0 getty
742 1 742 0 Ss+ ttyin 0xfffffe0058286cb0 getty
737 736 18 0 S+ nanslp 0xffffffff83b9e581 sleep
736 1 18 0 S+ wait 0xfffffe0054009060 sh
686 1 686 0 Ss nanslp 0xffffffff83b9e580 cron
682 1 682 0 Ss select 0xfffffe006dcd7140 sshd
495 1 495 0 Ss select 0xfffffe006dcd6ec0 syslogd
424 1 424 0 Ss wait 0xfffffe00540cb040 devd
423 1 423 65 Ss select 0xfffffe00584ecec0 dhclient
338 1 338 0 Ss select 0xfffffe006dcd6f40 dhclient
335 1 335 0 Ss select 0xfffffe005824e940 dhclient
5 0 0 0 DL waiting 0xffffffff8455e700 [sctp_iterator]
100066 D - 0xffffffff827c2301 [deadlkres]
exclusive sx MD config lock (MD config lock) r = 0 (0xffffffff83911400) locked @ /syzkaller/managers/main/kernel/sys/dev/md/md.c:1796
Process 748 (getty) thread 0xfffffe00540d3000 (100112)
exclusive sleep mutex ttymtx (ttymtx) r = 0 (0xfffffe0058287c08) locked @ /syzkaller/managers/main/kernel/sys/kern/tty.c:216
kobj 331 1324K 495
vfscache 3 1025K 3
pcb 23 669K 46
inodedep 82 543K 105
tidhash 3 141K 3
pagedep 40 138K 47
filedesc 5 37K 81
kdtrace 172 35K 974
kenv 95 12K 95
routetbl 79 12K 309
diradd 52 7K 68
ifnet 4 7K 5
sglist 6 7K 6
LRO 6 7K 8
lltable 19 6K 27
kqueue 49 6K 840
pfs_nodes 22 6K 22
ether_multi 68 6K 106
dirrem 20 5K 33
ufs_dirhash 24 5K 24
in6_multi 35 5K 45
UMA 266 5K 266
vt 11 5K 11
pf_ifnet 9 4K 16
acpisem 28 4K 28
pwddesc 46 3K 835
proc-args 73 3K 1874
terminal 11 3K 11
session 21 3K 44
acpidev 20 3K 20
selfd 33 3K 29129
Unitno 28 2K 48
msi 9 2K 9
netlink 2 2K 60
softdep 1 1K 1
indirdep 4 1K 4
sctp_ifa 7 1K 10
in_multi 3 1K 6
nhops 6 1K 6
ioctlops 1 1K 93
sctp_ifn 3 1K 10
freefile 3 1K 12
mld 3 1K 4
igmp 3 1K 4
tun 1 1K 2
freework 2 1K 29
freeblks 1 1K 28
vnodes 1 1K 1
procdesc 2 1K 8
prison 6 1K 6
cryptodev 2 1K 49
filecaps 4 1K 70
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 9
freefrag 0 0K 28
ipsec-misc 0 0K 2
statfs 0 0K 196
mbuf_jumbo_page 4096 8320 1078 25085 0 254 38494208 0
mbuf 256 8581 1081 33674 0 254 2473472 0
tcp_log 416 606 4731 9252 0 254 2220192 0
BUF TRIE 152 292 11512 1043 0 62 1794208 0
malloc-384 384 4170 30 4515 0 30 1612800 0
malloc-4096 4096 377 5 1330 0 2 1564672 0
malloc-128 128 11509 85 11545 0 126 1484032 0
UMA Slabs 0 112 10896 6 10896 0 126 1221024 0
RADIX NODE 152 4396 773 27220 0 62 785688 0
FFS inode 1168 546 28 558 0 8 670432 0
pbuf 2624 0 198 0 0 2 519552 0
malloc-65536 65536 4 2 166 0 1 393216 0
256 Bucket 2048 133 11 966 0 8 294912 0
malloc-64 64 4095 252 5478 0 254 278208 0
VM OBJECT 248 1035 85 13648 0 62 277760 0
VNODE 440 580 50 595 0 30 277200 0
THREAD 1860 125 11 138 0 8 252960 0
malloc-16 16 14418 332 14499 0 254 236000 0
malloc-2048 2048 104 8 105 0 8 229376 0
DEVCTL 1024 14 206 141 0 0 225280 0
malloc-2048 2048 8 96 615 0 8 212992 0
malloc-32 32 5388 534 7006 0 254 189504 0
FFS2 dinode 256 546 84 558 0 62 161280 0
malloc-1024 1024 122 22 1303 0 16 147456 0
S VFS Cache 104 1018 269 1062 0 126 133848 0
MAP ENTRY 96 1048 338 42549 0 126 133056 0
FPU_save_area 832 127 17 4280 0 16 119808 0
ksiginfo 112 41 1003 4162 0 126 116928 0
malloc-128 128 757 142 1812 0 126 115072 0
malloc-16384 16384 3 4 42 0 1 114688 0
malloc-128 128 559 216 3918 0 126 99200 0
PROC 1376 45 21 834 0 8 90816 0
filedesc0 1072 46 24 835 0 8 75040 0
g_bio 408 0 180 5083 0 30 73440 0
malloc-64 64 613 458 3245 0 254 68544 0
malloc-65536 65536 0 1 8 0 1 65536 0
malloc-2048 2048 7 25 721 0 8 65536 0
64 Bucket 512 82 46 1978 0 30 65536 0
malloc-256 256 133 62 158 0 62 49920 0
malloc-256 256 104 91 825 0 62 49920 0
32 Bucket 256 51 144 425 0 62 49920 0
syncache 168 0 264 6 0 254 44352 0
pipe 736 10 45 332 0 16 40480 0
pcpu-8 8 4435 173 4641 0 254 36864 0
udp_inpcb 408 6 84 148 0 30 36720 0
malloc-64 64 6 561 14872 0 254 36288 0
malloc-64 64 156 411 168 0 254 36288 0
malloc-64 64 62 505 29199 0 254 36288 0
malloc-64 64 20 547 290 0 254 36288 0
malloc-64 64 6 561 44 0 254 36288 0
malloc-128 128 83 196 102 0 126 35712 0
malloc-128 128 32 247 49 0 126 35712 0
malloc-128 128 61 218 334 0 126 35712 0
malloc-128 128 12 267 274 0 126 35712 0
routing nhops 256 14 121 25 0 62 34560 0
malloc-256 256 9 126 440 0 62 34560 0
malloc-256 256 62 73 114 0 62 34560 0
malloc-256 256 15 120 57 0 62 34560 0
malloc-256 256 29 106 355 0 62 34560 0
malloc-256 256 12 123 524 0 62 34560 0
malloc-2048 2048 6 10 23 0 8 32768 0
clpbuf 2624 0 12 70 0 4 31488 0
sctp_laddr 48 0 588 10 0 254 28224 0
malloc-32 32 309 573 384 0 254 28224 0
16 Bucket 144 49 147 332 0 62 28224 0
4 Bucket 48 5 583 10 0 254 28224 0
da_ccb 544 0 49 1498 0 16 26656 0
PWD 40 13 593 127 0 254 24240 0
rtentry 168 17 127 25 0 62 24192 0
Files 80 97 203 7018 0 126 24000 0
8 Bucket 80 53 247 558 0 126 24000 0
tcp_inpcb 1304 6 12 13 0 8 23472 0
malloc-384 384 38 22 446 0 30 23040 0
malloc-384 384 8 52 8 0 30 23040 0
malloc-384 384 27 33 38 0 30 23040 0
malloc-32 32 45 585 223 0 254 20160 0
malloc-32 32 16 614 57 0 254 20160 0
malloc-32 32 24 606 2680 0 254 20160 0
malloc-32 32 32 598 226 0 254 20160 0
malloc-32 32 17 613 36 0 254 20160 0
2 Bucket 32 46 584 314 0 254 20160 0
malloc-4096 4096 4 0 4 0 2 16384 0
malloc-16 16 1 749 143 0 254 12000 0
malloc-16 16 9 741 10 0 254 12000 0
malloc-16 16 13 737 55 0 254 12000 0
malloc-16 16 46 704 24851 0 254 12000 0
malloc-16 16 34 716 1473 0 254 12000 0
malloc-4096 4096 0 2 2 0 2 8192 0
vtnet_tx_hdr 24 0 334 7025 0 254 8016 0
malloc-16 16 3 497 5 0 254 8000 0
pcpu-16 16 4 252 4 0 254 4096 0
UMA Slabs 1 176 8 14 8 0 62 3872 0
malloc-32768 32768 0 0 0 0 1 0 0
malloc-32768 32768 0 0 0 0 1 0 0
malloc-32768 32768 0 0 0 0 1
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 604d34c23f77 net: ether_gen_addr: fix address generation
git tree: freebsd-src
dashboard link: https://syzkaller.appspot.com/bug?extid=a0ff73f664de8757cfaa
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1199f982580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16c6b770580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a0ff73...@syzkaller.appspotmail.com
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80b0c758
frame pointer = 0x28:0xfffffe0056d2b4f0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 833 (syz-executor)
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
rdi: 0000000000000000 rsi: 0000000000000000 rdx: 0000000000000001
rcx: fffffe0002bf1850 r8: 0000000000000000 r9: 000000000000002c
rax: fffffe0002bf1850 rbx: 0000000000000000 rbp: fffffe0056d2b4f0
r10: 0aed2ec20241790f r11: 0000000000000085 r12: fffffe005853c058
r13: fffffe005853c040 r14: 0000000000000000 r15: 0000000000000010
trap number = 12
panic: page fault
cpuid = 1
time = 1751517991
panic: page fault
cpuid = 1
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056d2acd0
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056d2ae30
vpanic() at vpanic+0x257/frame 0xfffffe0056d2aff0
panic() at panic+0xb5/frame 0xfffffe0056d2b0b0
trap_pfault() at trap_pfault+0xaec/frame 0xfffffe0056d2b1f0
trap() at trap+0x78e/frame 0xfffffe0056d2b3e0
calltrap() at calltrap+0x8/frame 0xfffffe0056d2b3e0
--- trap 0xc, rip = 0xffffffff80b0c758, rsp = 0xfffffe0056d2b4b0, rbp = 0xfffffe0056d2b4f0 ---
destroy_indir() at destroy_indir+0x48/frame 0xfffffe0056d2b4f0
mddestroy() at mddestroy+0x358/frame 0xfffffe0056d2b5d0
mdctlioctl() at mdctlioctl+0x1680/frame 0xfffffe0056d2b730
devfs_ioctl() at devfs_ioctl+0x266/frame 0xfffffe0056d2b820
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x87/frame 0xfffffe0056d2b850
vn_ioctl() at vn_ioctl+0x3c7/frame 0xfffffe0056d2ba60
devfs_ioctl_f() at devfs_ioctl_f+0x69/frame 0xfffffe0056d2bab0
kern_ioctl() at kern_ioctl+0x4ca/frame 0xfffffe0056d2bb90
sys_ioctl() at sys_ioctl+0x36e/frame 0xfffffe0056d2bd10
amd64_syscall() at amd64_syscall+0x4e2/frame 0xfffffe0056d2bf30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0056d2bf30
--- syscall (198, FreeBSD ELF64, __syscall), rip = 0x3a197a, rsp = 0x820cfaa28, rbp = 0x820cfaaa0 ---
KDB: enter: panic
[ thread pid 833 tid 100137 ]
Stopped at kdb_enter+0x6e: movq $0,0x25b9147(%rip)
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0x28
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
rax 0x12
rcx 0xfffffe0002bf1850
rdx 0xdffff7c000000000
rbx 0xffffffff827bcf60 .str.27
rsp 0xfffffe0056d2ae10
rbp 0xfffffe0056d2ae30
rsi 0
rdi 0xffffffff830004d8 panicstr
r8 0
r9 0xffffffff
r10 0
r11 0x17
r12 0xfffffe0054111780
r9 0xffffffff
r10 0
r11 0x17
r13 0xfffffffffffffffd
r14 0xffffffff827bcf60 .str.27
r15 0
rip 0xffffffff8160424e kdb_enter+0x6e
rflags 0x46
kdb_enter+0x6e: movq $0,0x25b9147(%rip)
db> show proc
Process 833 (syz-executor) at 0xfffffe00540cc060:
r14 0xffffffff827bcf60 .str.27
r15 0
rip 0xffffffff8160424e kdb_enter+0x6e
rflags 0x46
kdb_enter+0x6e: movq $0,0x25b9147(%rip)
db> show proc
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 826 at 0xfffffe00540e2ac0
uid: 0 gids: 0, 0, 5
ABI: FreeBSD ELF64
flag: 0x10000000 flag2: 0
arguments: ./syz-executor exec
reaper: 0xfffffe0007809040 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe005410adb0
reaper: 0xfffffe0007809040 reapsubtree: 1
sigparent: 20
(map 0xfffffe005410adb0)
(map.pmap 0xfffffe005410ae50)
(pmap 0xfffffe005410aec0)
threads: 1
100137 Run CPU 1 syz-executor
db> ps
pid ppid pgrp uid state wmesg wchan cmd
833 826 826 0 R CPU 1 syz-executor
pid ppid pgrp uid state wmesg wchan cmd
826 774 826 0 R syz-executor
817 1 817 0 Ss select 0xfffffe006dcd5dc0 dhclient
812 796 424 0 S nanslp 0xffffffff83b9e580 dhclient
796 424 424 0 S wait 0xfffffe00540e2560 sh
774 773 771 0 S select 0xfffffe006dcd6140 syz-executor
773 771 771 0 S (threaded) syz-execprog
100096 S uwait 0xfffffe005824e580 syz-execprog
100114 S uwait 0xfffffe0057d75600 syz-execprog
100115 S uwait 0xfffffe006dcd6200 syz-execprog
100116 S uwait 0xfffffe006dcd6300 syz-execprog
100117 S uwait 0xfffffe006dcd6400 syz-execprog
100118 S uwait 0xfffffe00584ed100 syz-execprog
100119 S uwait 0xfffffe00584ed200 syz-execprog
100120 S kqread 0xfffffe00593da100 syz-execprog
771 769 771 0 Ss sigsusp 0xfffffe00540ca0d0 csh
769 682 769 0 Ss select 0xfffffe006dcd69c0 sshd
748 1 748 0 Rs+ CPU 0 getty
747 1 747 0 Ss+ ttyin 0xfffffe00593f58b0 getty
746 1 746 0 Ss+ ttyin 0xfffffe00593f5cb0 getty
745 1 745 0 Ss+ ttyin 0xfffffe00593f60b0 getty
744 1 744 0 Ss+ ttyin 0xfffffe00582868b0 getty
743 1 743 0 Ss+ ttyin 0xfffffe00593f64b0 getty
742 1 742 0 Ss+ ttyin 0xfffffe0058286cb0 getty
741 1 741 0 Ss+ ttyin 0xfffffe00593f68b0 getty
740 1 740 0 Ss+ ttyin 0xfffffe00593f6cb0 getty
738 1 18 0 S+ piperd 0xfffffe005980c000 logger
740 1 740 0 Ss+ ttyin 0xfffffe00593f6cb0 getty
737 736 18 0 S+ nanslp 0xffffffff83b9e581 sleep
736 1 18 0 S+ wait 0xfffffe0054009060 sh
686 1 686 0 Ss nanslp 0xffffffff83b9e580 cron
682 1 682 0 Ss select 0xfffffe006dcd7140 sshd
495 1 495 0 Ss select 0xfffffe006dcd6ec0 syslogd
424 1 424 0 Ss wait 0xfffffe00540cb040 devd
423 1 423 65 Ss select 0xfffffe00584ecec0 dhclient
338 1 338 0 Ss select 0xfffffe006dcd6f40 dhclient
335 1 335 0 Ss select 0xfffffe005824e940 dhclient
17 0 0 0 DL syncer 0xffffffff83cbbfa0 [syncer]
16 0 0 0 DL vlruwt 0xfffffe0007829060 [vnlru]
15 0 0 0 DL (threaded) [bufdaemon]
100080 D psleep 0xffffffff83cba560 [bufdaemon]
100083 D - 0xffffffff83001ec0 [bufspacedaemon-0]
100094 D sdflush 0xfffffe00596bc4e8 [/ worker]
100080 D psleep 0xffffffff83cba560 [bufdaemon]
100083 D - 0xffffffff83001ec0 [bufspacedaemon-0]
9 0 0 0 DL psleep 0xffffffff83d05400 [vmdaemon]
8 0 0 0 DL (threaded) [pagedaemon]
100078 D psleep 0xffffffff83ceb4c8 [dom0]
100081 D launds 0xffffffff83ceb4d4 [laundry: dom0]
100082 D umarcl 0xffffffff81dda750 [uma]
7 0 0 0 DL - 0xffffffff8391bcd0 [rand_harvestq]
6 0 0 0 DL pftm 0xffffffff8485f980 [pf purge]
8 0 0 0 DL (threaded) [pagedaemon]
100078 D psleep 0xffffffff83ceb4c8 [dom0]
100081 D launds 0xffffffff83ceb4d4 [laundry: dom0]
100082 D umarcl 0xffffffff81dda750 [uma]
7 0 0 0 DL - 0xffffffff8391bcd0 [rand_harvestq]
5 0 0 0 DL waiting 0xffffffff8455e700 [sctp_iterator]
100070 D - 0xfffffe00593da400 [acpi_task_0]
100071 D - 0xfffffe00593da400 [acpi_task_1]
100072 D - 0xfffffe00593da400 [acpi_task_2]
100074 D - 0xfffffe0007766500 [mca taskq]
100071 D - 0xfffffe00593da400 [acpi_task_1]
100072 D - 0xfffffe00593da400 [acpi_task_2]
100075 D - 0xfffffe0007763100 [CAM taskq]
100077 D - 0xfffffe005812b500 [ipsec_offload]
db> show all locks
Process 833 (syz-executor) thread 0xfffffe0054111780 (100137)
100077 D - 0xfffffe005812b500 [ipsec_offload]
db> show all locks
exclusive sx MD config lock (MD config lock) r = 0 (0xffffffff83911400) locked @ /syzkaller/managers/main/kernel/sys/dev/md/md.c:1796
Process 748 (getty) thread 0xfffffe00540d3000 (100112)
exclusive sleep mutex ttymtx (ttymtx) r = 0 (0xfffffe0058287c08) locked @ /syzkaller/managers/main/kernel/sys/kern/tty.c:216
db> show malloc
Type InUse MemUse Requests
pf_hash 6 12804K 6
linker 376 5071K 486
tcp_hpts 7 4801K 7
devbuf 4188 4324K 4213
sysctloid 34891 2055K 34966
vtbuf 24 1968K 46
newblk 1853 1487K 1896
Type InUse MemUse Requests
pf_hash 6 12804K 6
linker 376 5071K 486
tcp_hpts 7 4801K 7
devbuf 4188 4324K 4213
sysctloid 34891 2055K 34966
vtbuf 24 1968K 46
kobj 331 1324K 495
vfscache 3 1025K 3
pcb 23 669K 46
inodedep 82 543K 105
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
vnet_data 2 224K 2
acpitask 1 224K 1
subproc 113 210K 902
acpitask 1 224K 1
KTRACE 100 200K 100
acpica 1674 184K 54426
vmem 5 144K 7
acpica 1674 184K 54426
tidhash 3 141K 3
pagedep 40 138K 47
tfo_ccache 1 128K 1
IP reass 1 128K 1
DEVFS1 107 107K 120
IP reass 1 128K 1
sem 4 106K 4
gtaskqueue 18 98K 18
bus 997 82K 5063
mtx_pool 3 74K 3
syncache 1 68K 1
NFSD srvcache 3 68K 3
module 521 66K 521
ddb_capture 1 64K 1
temp 23 37K 1783
gtaskqueue 18 98K 18
bus 997 82K 5063
mtx_pool 3 74K 3
syncache 1 68K 1
NFSD srvcache 3 68K 3
module 521 66K 521
ddb_capture 1 64K 1
filedesc 5 37K 81
kdtrace 172 35K 974
umtx 272 34K 272
hostcache 1 32K 1
shm 1 32K 1
DEVFS3 125 32K 136
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
kbdmux 6 28K 6
DEVFS_RULE 56 20K 56
BPF 11 18K 12
kbdmux 6 28K 6
DEVFS_RULE 56 20K 56
ufs_mount 4 17K 5
proc 3 17K 3
tty 16 16K 16
proc 3 17K 3
ithread 90 15K 90
bus-sc 34 15K 1647
eventhandler 163 14K 163
ifaddr 39 13K 50
bus-sc 34 15K 1647
eventhandler 163 14K 163
kenv 95 12K 95
routetbl 79 12K 309
GEOM 61 11K 477
CAM queue 5 11K 1528
rman 82 10K 437
rpc 8 9K 8
bmsafemap 4 9K 72
CAM queue 5 11K 1528
rman 82 10K 437
rpc 8 9K 8
devstat 4 9K 4
UART 12 9K 12
ksem 1 8K 1
shmfd 1 8K 1
pfs_vncache 1 8K 1
plimit 20 8K 424
UART 12 9K 12
ksem 1 8K 1
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 239 8K 301
taskqueue 69 8K 69
mkdir 56 7K 74
taskqueue 69 8K 69
diradd 52 7K 68
ifnet 4 7K 5
sglist 6 7K 6
LRO 6 7K 8
CAM DEV 3 6K 510
cred 23 6K 277
lltable 19 6K 27
kqueue 49 6K 840
pfs_nodes 22 6K 22
ether_multi 68 6K 106
dirrem 20 5K 33
ufs_dirhash 24 5K 24
in6_multi 35 5K 45
UMA 266 5K 266
vt 11 5K 11
pf_ifnet 9 4K 16
memdesc 1 4K 1
MCA 32 4K 32
md_disk 1 4K 1
evdev 4 4K 4
newdirblk 30 4K 37
MCA 32 4K 32
md_disk 1 4K 1
evdev 4 4K 4
acpisem 28 4K 28
pwddesc 46 3K 835
proc-args 73 3K 1874
terminal 11 3K 11
session 21 3K 44
acpidev 20 3K 20
hhook 8 3K 10
clone 9 3K 9
uidinfo 3 3K 9
clone 9 3K 9
selfd 33 3K 29129
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
lockf 18 2K 25
io_apic 1 2K 1
ipsec-saq 2 2K 2
Unitno 28 2K 48
CAM XPT 22 2K 543
toponodes 6 2K 6
ipsecpolicy 2 2K 2
select 10 2K 34
ipsecpolicy 2 2K 2
msi 9 2K 9
netlink 2 2K 60
softdep 1 1K 1
indirdep 4 1K 4
sahead 1 1K 1
secasvar 1 1K 1
secasvar 1 1K 1
vnodemarker 2 1K 8
NFSD session 1 1K 1
ip6ndp 6 1K 9
NFSD session 1 1K 1
sctp_ifa 7 1K 10
CAM periph 4 1K 271
ipsec 3 1K 3
CC Mem 6 1K 13
ipsec 3 1K 3
in_multi 3 1K 6
nhops 6 1K 6
pfil 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
crypto 4 1K 4
encap_export_host 12 1K 12
osd 11 1K 29
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
crypto 4 1K 4
encap_export_host 12 1K 12
ioctlops 1 1K 93
cdev 2 1K 2
lkpikmalloc 8 1K 9
counter_rate 14 1K 14
inpcbpolicy 13 1K 165
lkpikmalloc 8 1K 9
counter_rate 14 1K 14
sctp_ifn 3 1K 10
freefile 3 1K 12
mld 3 1K 4
igmp 3 1K 4
tun 1 1K 2
chacha20random 1 1K 1
biobuf 1 1K 1
DEVFSP 5 1K 34
biobuf 1 1K 1
freework 2 1K 29
freeblks 1 1K 28
vnodes 1 1K 1
procdesc 2 1K 8
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
CAM SIM 2 1K 2
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 7
NFSD V4client 1 1K 1
DEVFS 9 1K 10
CAM SIM 2 1K 2
feeder 7 1K 7
tcpfunc 3 1K 3
prison 6 1K 6
cryptodev 2 1K 49
nexusdev 8 1K 8
apmdev 1 1K 1
atkbddev 2 1K 2
pmchooks 1 1K 1
CAM path 4 1K 1034
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
soname 4 1K 3354
apmdev 1 1K 1
atkbddev 2 1K 2
pmchooks 1 1K 1
CAM path 4 1K 1034
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
filecaps 4 1K 70
sctp_vrf 1 1K 1
vnet 1 1K 1
pmc 1 1K 1
entropy 2 1K 52
vnet 1 1K 1
pmc 1 1K 1
acpiintr 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_krule_item 0 0K 0
pf_temp 0 0K 0
pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_krule_item 0 0K 0
pf_temp 0 0K 0
tcp_pcm_rack 0 0K 0
tcp_do_rack 0 0K 0
tcp_fsb_rack 0 0K 0
filemon 0 0K 0
tcp_do_rack 0 0K 0
tcp_fsb_rack 0 0K 0
ipcomp 0 0K 0
esp 0 0K 0
ah 0 0K 0
esp 0 0K 0
ah 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
sctp_iter 0 0K 9
sctp_socko 0 0K 0
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 9
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
namei_tracker 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 29
export_host 0 0K 0
aio 0 0K 0
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 0
ktls 0 0K 0
accf 0 0K 0
pts 0 0K 0
timerfd 0 0K 0
iov 0 0K 15184
lio 0 0K 0
acl 0 0K 0
mbuf_tag 0 0K 0
ktls 0 0K 0
accf 0 0K 0
pts 0 0K 0
timerfd 0 0K 0
eventfd 0 0K 0
Witness 0 0K 0
stack 0 0K 0
sbuf 0 0K 288
firmware 0 0K 0
compressor 0 0K 0
SWAP 0 0K 0
sysctltmp 0 0K 669
Witness 0 0K 0
stack 0 0K 0
sbuf 0 0K 288
firmware 0 0K 0
compressor 0 0K 0
SWAP 0 0K 0
sysctl 0 0K 3
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
cache 0 0K 0
kcovinfo 0 0K 23
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
cache 0 0K 0
mbuf 256 8581 1081 33674 0 254 2473472 0
tcp_log 416 606 4731 9252 0 254 2220192 0
BUF TRIE 152 292 11512 1043 0 62 1794208 0
malloc-384 384 4170 30 4515 0 30 1612800 0
malloc-4096 4096 377 5 1330 0 2 1564672 0
malloc-128 128 11509 85 11545 0 126 1484032 0
UMA Slabs 0 112 10896 6 10896 0 126 1221024 0
mbuf_cluster 2048 508 0 508 0 254 1040384 0
vmem btag 56 16280 31 16280 0 254 913416 0
RADIX NODE 152 4396 773 27220 0 62 785688 0
FFS inode 1168 546 28 558 0 8 670432 0
malloc-65536 65536 9 1 12 0 1 655360 0
malloc-256 256 2131 44 2524 0 62 556800 0
lkpicurr 168 2 3118 2 0 62 524160 0
socket 1024 25 483 1363 0 254 520192 0
pbuf 2624 0 198 0 0 2 519552 0
malloc-65536 65536 4 2 166 0 1 393216 0
256 Bucket 2048 133 11 966 0 8 294912 0
malloc-64 64 4095 252 5478 0 254 278208 0
VM OBJECT 248 1035 85 13648 0 62 277760 0
VNODE 440 580 50 595 0 30 277200 0
THREAD 1860 125 11 138 0 8 252960 0
malloc-16 16 14418 332 14499 0 254 236000 0
malloc-2048 2048 104 8 105 0 8 229376 0
DEVCTL 1024 14 206 141 0 0 225280 0
malloc-2048 2048 8 96 615 0 8 212992 0
malloc-32 32 5388 534 7006 0 254 189504 0
UMA Zones 768 238 1 238 0 16 183552 0
malloc-128 128 1200 195 25343 0 126 178560 0
lkpimm 56 1 3095 1 0 254 173376 0
unpcb 320 11 505 1177 0 254 165120 0
FFS2 dinode 256 546 84 558 0 62 161280 0
malloc-1024 1024 122 22 1303 0 16 147456 0
S VFS Cache 104 1018 269 1062 0 126 133848 0
MAP ENTRY 96 1048 338 42549 0 126 133056 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-65536 65536 2 0 2 0 1 131072 0
malloc-32768 32768 3 1 123 0 1 131072 0
mbuf_packet 256 0 508 161 0 254 130048 0
FPU_save_area 832 127 17 4280 0 16 119808 0
ksiginfo 112 41 1003 4162 0 126 116928 0
malloc-128 128 757 142 1812 0 126 115072 0
malloc-16384 16384 3 4 42 0 1 114688 0
malloc-128 128 559 216 3918 0 126 99200 0
PROC 1376 45 21 834 0 8 90816 0
UMA Kegs 384 225 8 225 0 30 89472 0
128 Bucket 1024 45 38 270 0 16 84992 0
filedesc0 1072 46 24 835 0 8 75040 0
g_bio 408 0 180 5083 0 30 73440 0
malloc-64 64 613 458 3245 0 254 68544 0
malloc-65536 65536 0 1 8 0 1 65536 0
malloc-32768 32768 2 0 2 0 1 65536 0
malloc-16384 16384 4 0 194 0 1 65536 0
malloc-4096 4096 13 3 61 0 2 65536 0
malloc-16384 16384 4 0 194 0 1 65536 0
malloc-2048 2048 7 25 721 0 8 65536 0
64 Bucket 512 82 46 1978 0 30 65536 0
malloc-8192 8192 6 1 113 0 1 57344 0
malloc-64 64 487 332 747 0 254 52416 0
malloc-256 256 133 62 158 0 62 49920 0
malloc-256 256 104 91 825 0 62 49920 0
32 Bucket 256 51 144 425 0 62 49920 0
DIRHASH 1024 34 14 34 0 16 49152 0
NAMEI 1024 0 48 12898 0 16 49152 0
malloc-8192 8192 6 0 7 0 1 49152 0
malloc-4096 4096 11 1 16 0 2 49152 0
malloc-1024 1024 14 34 541 0 16 49152 0
malloc-384 384 91 29 119 0 30 46080 0
syncache 168 0 264 6 0 254 44352 0
malloc-8192 8192 5 0 5 0 1 40960 0
VMSPACE 584 29 41 818 0 16 40880 0
pipe 736 10 45 332 0 16 40480 0
pcpu-8 8 4435 173 4641 0 254 36864 0
udp_inpcb 408 6 84 148 0 30 36720 0
malloc-64 64 6 561 14872 0 254 36288 0
malloc-64 64 156 411 168 0 254 36288 0
malloc-64 64 62 505 29199 0 254 36288 0
malloc-64 64 20 547 290 0 254 36288 0
malloc-64 64 6 561 44 0 254 36288 0
malloc-128 128 83 196 102 0 126 35712 0
malloc-128 128 32 247 49 0 126 35712 0
malloc-128 128 61 218 334 0 126 35712 0
malloc-128 128 12 267 274 0 126 35712 0
routing nhops 256 14 121 25 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
malloc-384 384 68 22 92 0 30 34560 0
malloc-256 256 9 126 440 0 62 34560 0
malloc-256 256 62 73 114 0 62 34560 0
malloc-256 256 15 120 57 0 62 34560 0
malloc-256 256 29 106 355 0 62 34560 0
malloc-256 256 12 123 524 0 62 34560 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-32768 32768 0 1 11 0 1 32768 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 2 0 2 0 1 32768 0
malloc-8192 8192 3 1 5 0 1 32768 0
malloc-32768 32768 0 1 11 0 1 32768 0
malloc-32768 32768 1 0 1 0 1 32768 0
malloc-16384 16384 2 0 2 0 1 32768 0
malloc-4096 4096 5 3 564 0 2 32768 0
malloc-4096 4096 6 2 9 0 2 32768 0
malloc-2048 2048 5 11 26 0 8 32768 0
malloc-4096 4096 6 2 9 0 2 32768 0
malloc-2048 2048 3 13 3 0 8 32768 0
malloc-2048 2048 4 12 5 0 8 32768 0
malloc-2048 2048 6 10 23 0 8 32768 0
malloc-1024 1024 2 30 11 0 16 32768 0
malloc-1024 1024 6 26 6 0 16 32768 0
malloc-1024 1024 16 16 19 0 16 32768 0
malloc-1024 1024 9 23 9 0 16 32768 0
malloc-512 512 2 62 18 0 30 32768 0
malloc-1024 1024 6 26 6 0 16 32768 0
malloc-1024 1024 16 16 19 0 16 32768 0
malloc-1024 1024 9 23 9 0 16 32768 0
malloc-512 512 12 52 18 0 30 32768 0
malloc-512 512 3 61 175 0 30 32768 0
malloc-512 512 2 62 3 0 30 32768 0
pcpu-64 64 497 15 497 0 254 32768 0
ttyinq 160 135 65 300 0 62 32000 0
PGRP 120 22 242 58 0 126 31680 0
pcpu-64 64 497 15 497 0 254 32768 0
ttyinq 160 135 65 300 0 62 32000 0
clpbuf 2624 0 12 70 0 4 31488 0
sctp_laddr 48 0 588 10 0 254 28224 0
malloc-32 32 309 573 384 0 254 28224 0
16 Bucket 144 49 147 332 0 62 28224 0
4 Bucket 48 5 583 10 0 254 28224 0
da_ccb 544 0 49 1498 0 16 26656 0
TURNSTILE 136 137 52 137 0 62 25704 0
cpuset 200 7 121 7 0 62 25600 0
malloc-8192 8192 3 0 3 0 1 24576 0
malloc-8192 8192 2 1 21 0 1 24576 0
ertt_txseginfo 40 0 606 623 0 254 24240 0
cpuset 200 7 121 7 0 62 25600 0
malloc-8192 8192 3 0 3 0 1 24576 0
malloc-8192 8192 2 1 21 0 1 24576 0
PWD 40 13 593 127 0 254 24240 0
rtentry 168 17 127 25 0 62 24192 0
Files 80 97 203 7018 0 126 24000 0
8 Bucket 80 53 247 558 0 126 24000 0
tcp_inpcb 1304 6 12 13 0 8 23472 0
malloc-384 384 38 22 446 0 30 23040 0
malloc-384 384 8 52 8 0 30 23040 0
malloc-384 384 27 33 38 0 30 23040 0
ripcb 376 1 59 4 0 30 22560 0
SLEEPQUEUE 88 137 119 137 0 126 22528 0
hostcache 64 1 314 1 0 254 20160 0
ertt 72 6 274 13 0 126 20160 0
malloc-32 32 45 585 223 0 254 20160 0
malloc-32 32 16 614 57 0 254 20160 0
malloc-32 32 24 606 2680 0 254 20160 0
malloc-32 32 32 598 226 0 254 20160 0
malloc-32 32 17 613 36 0 254 20160 0
2 Bucket 32 46 584 314 0 254 20160 0
vmem 1856 2 7 2 0 8 16704 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-4096 4096 0 4 196 0 2 16384 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
malloc-16384 16384 1 0 1 0 1 16384 0
malloc-4096 4096 4 0 4 0 2 16384 0
malloc-2048 2048 0 8 2 0 8 16384 0
malloc-1024 1024 1 15 1 0 16 16384 0
malloc-1024 1024 3 13 3 0 16 16384 0
malloc-512 512 1 31 1 0 30 16384 0
malloc-512 512 3 29 8 0 30 16384 0
malloc-1024 1024 1 15 1 0 16 16384 0
malloc-1024 1024 3 13 3 0 16 16384 0
malloc-512 512 1 31 1 0 30 16384 0
SMR CPU 32 8 503 8 0 254 16352 0
malloc-16 16 492 508 3411 0 254 16000 0
kenv 258 17 43 1066 0 30 15480 0
mqnode 416 3 33 3 0 30 14976 0
mqnode 416 3 33 3 0 30 14976 0
SMR SHARED 24 8 503 8 0 254 12264 0
malloc-32 32 152 226 928 0 254 12096 0
KNOTE 160 6 69 108 0 62 12000 0
malloc-32 32 152 226 928 0 254 12096 0
malloc-16 16 1 749 143 0 254 12000 0
malloc-16 16 9 741 10 0 254 12000 0
malloc-16 16 13 737 55 0 254 12000 0
malloc-16 16 46 704 24851 0 254 12000 0
malloc-16 16 34 716 1473 0 254 12000 0
malloc-384 384 1 29 1 0 30 11520 0
malloc-384 384 1 29 1 0 30 11520 0
Mountpoints 2816 2 2 2 0 4 11264 0
malloc-384 384 1 29 1 0 30 11520 0
malloc-4096 4096 0 2 2 0 2 8192 0
vtnet_tx_hdr 24 0 334 7025 0 254 8016 0
malloc-16 16 3 497 5 0 254 8000 0
pcpu-16 16 4 252 4 0 254 4096 0
UMA Slabs 1 176 8 14 8 0 62 3872 0
KMAP ENTRY 96 12 27 14 0 0 3744 0
FFS1 dinode 128 0 0 0 0 126 0 0
ada_ccb 272 0 0 0 0 30 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 152 0 0 0 0 62 0 0
cdg_qdiffsample 16 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf fragment node 72 0 0 0 0 126 0 0
pf frags 232 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 254 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf UDP mappings 104 0 0 0 0 126 0 0
pf source nodes 152 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 384 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 184 0 0 0 0 62 0 0
FFS1 dinode 128 0 0 0 0 126 0 0
ada_ccb 272 0 0 0 0 30 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 152 0 0 0 0 62 0 0
cdg_qdiffsample 16 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf fragment node 72 0 0 0 0 126 0 0
pf frags 232 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 254 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf UDP mappings 104 0 0 0 0 126 0 0
pf source nodes 152 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 384 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0
pf mtags 184 0 0 0 0 62 0 0
tcp_rack_pcb 1088 0 0 0 0 8 0 0
tcp_rack_map 128 0 0 0 0 126 0 0
tcp_bbr_pcb 896 0 0 0 0 16 0 0
tcp_bbr_map 128 0 0 0 0 126 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
sctp_stream_msg_out 112 0 0 0 0 254 0 0
sctp_readq 152 0 0 0 0 254 0 0
sctp_chunk 152 0 0 0 0 254 0 0
sctp_raddr 736 0 0 0 0 254 0 0
sctp_asoc 2256 0 0 0 0 254 0 0
sctp_ep 1152 0 0 0 0 254 0 0
tcp_rack_map 128 0 0 0 0 126 0 0
tcp_bbr_pcb 896 0 0 0 0 16 0 0
tcp_bbr_map 128 0 0 0 0 126 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
tfo 4 0 0 0 0 254 0 0
sackhole 32 0 0 0 0 254 0 0
ipq 56 0 0 0 0 254 0 0
sctp_asconf_ack 48 0 0 0 0 254 0 0
sctp_asconf 40 0 0 0 0 254 0 0
sctp_stream_msg_out 112 0 0 0 0 254 0 0
sctp_readq 152 0 0 0 0 254 0 0
sctp_chunk 152 0 0 0 0 254 0 0
sctp_raddr 736 0 0 0 0 254 0 0
sctp_asoc 2256 0 0 0 0 254 0 0
tcp_log_id_node 120 0 0 0 0 126 0 0
tcp_log_id_bucket 176 0 0 0 0 62 0 0
tcpreass 48 0 0 0 0 254 0 0
udplite_inpcb 408 0 0 0 0 30 0 0
tcp_log_id_bucket 176 0 0 0 0 62 0 0
tcpreass 48 0 0 0 0 254 0 0
malloc-32768 32768 0 0 0 0 1 0 0
malloc-32768 32768 0 0 0 0 1
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages