UBSan: Undefined Behavior in ip_ctloutput

4 views

Skip to first unread message

syzbot

unread,

Oct 28, 2022, 9:21:40 AM10/28/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=148a6cb6880000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=2e8b6f8af2d83f29f68a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8813f5f371a8/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e5d1760d89e4/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2e8b6f...@syzkaller.appspotmail.com

[ 347.9252164] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/ip_output.c:1091:13, member access within null pointer of type 'struct in4pcb'

[ 347.9447505] cpu0: Begin traceback...
[ 347.9751950] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 348.0751944] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 348.1651959] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 348.2351945] ip_ctloutput() at netbsd:ip_ctloutput+0x15ae sys/netinet/ip_output.c:1091
[ 348.3051956] tcp_ctloutput() at netbsd:tcp_ctloutput+0x2e7 sys/netinet/tcp_usrreq.c:278
[ 348.3851946] tcp_ctloutput_wrapper() at netbsd:tcp_ctloutput_wrapper+-0xdbecb
[ 348.4651938] sosetopt() at netbsd:sosetopt+0x195 sys/kern/uipc_socket.c:1902
[ 348.5351924] sys_setsockopt() at netbsd:sys_setsockopt+0x1a7 sys/kern/uipc_syscalls.c:1202
[ 348.6051925] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 348.6051925] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 348.6851922] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 348.6851922] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 348.6851922] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 348.6951927] --- syscall (number 105 via SYS_syscall) ---
[ 348.7251916] netbsd:syscall+0x2da:
[ 348.7251916] cpu0: End traceback...
[ 348.7251916] fatal breakpoint trap in supervisor mode
[ 348.7364584] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x7885f3964789 ilevel 0x4 rsp 0xffffc20248e996b0
[ 348.7494656] curlwp 0xffffafff69082680 pid 9541.9322 lowest kstack 0xffffc20248e952c0
Stopped in pid 9541.9322 (syz-executor.1) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
ip_ctloutput() at netbsd:ip_ctloutput+0x15ae sys/netinet/ip_output.c:1091
tcp_ctloutput() at netbsd:tcp_ctloutput+0x2e7 sys/netinet/tcp_usrreq.c:278
tcp_ctloutput_wrapper() at netbsd:tcp_ctloutput_wrapper+-0xdbecb
sosetopt() at netbsd:sosetopt+0x195 sys/kern/uipc_socket.c:1902
sys_setsockopt() at netbsd:sys_setsockopt+0x1a7 sys/kern/uipc_syscalls.c:1202
sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 105 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/ip_output.c:1091:13, member access within null pointer of type 'struct in4pcb'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
12473 10924 3 0 180 ffffafff69a6bb40 syz-executor.4 parked
12473 12473 2 0 10000000 ffffafff7de41180 syz-executor.4
9541 >9322 7 0 100 ffffafff69082680 syz-executor.1
9541 9541 2 1 10000000 ffffafff7e65c1c0 syz-executor.1
9830 9661 2 0 40000 ffffafff6b106340 syz-executor.0
9830 9830 2 1 10040000 ffffafff6507b280 syz-executor.0
8419 8419 2 1 140 ffffafff5eacc4c0 syz-executor.1
8843 8843 3 0 180 ffffafff740b4480 syz-executor.0 nanoslp
10304 10304 2 1 140 ffffafff759764c0 syz-executor.4
10657 10657 2 0 140 ffffafff7ad3a500 syz-executor.2
8183 8183 2 1 40 ffffafff5e313500 syz-executor.3
9049 9049 3 0 180 ffffafff672e85c0 syz-executor.2 parked
11190 11190 3 0 180 ffffafff6b106bc0 syz-executor.3 parked
7787 7787 3 0 180 ffffafff67344600 syz-executor.2 parked
9016 9016 3 0 180 ffffafff6a396300 syz-executor.2 parked
10697 10697 3 1 1c0 ffffafff5eacc900 syz-executor.5 pipe_rd
7579 7579 3 1 180 ffffafff5818f580 syz-executor.2 parked
7407 7407 3 0 180 ffffafff68a05640 syz-executor.3 parked
8414 8414 3 1 180 ffffafff5818f140 syz-executor.3 parked
7576 7576 3 0 180 ffffafff65537b40 syz-executor.3 parked
9152 9152 3 0 180 ffffafff6b106780 syz-executor.3 parked
8019 8019 3 1 180 ffffafff6ae866c0 syz-executor.5 parked
7060 7060 3 0 180 ffffafff6543cbc0 syz-executor.5 parked
6722 6722 3 0 180 ffffafff69a6b700 syz-executor.1 parked
10088 10088 3 0 180 ffffafff67344a40 syz-executor.1 parked
9651 9651 3 0 180 ffffafff58d06600 syz-executor.2 parked
7356 7356 3 0 180 ffffafff673441c0 syz-executor.3 parked
3733 3733 3 0 180 ffffafff65ee39c0 syz-executor.5 parked
6359 6359 3 0 180 ffffafff579148c0 syz-executor.5 parked
4713 4713 3 0 180 ffffafff65ee3140 syz-executor.5 parked
4487 4487 3 0 180 ffffafff580f4500 syz-executor.5 parked
3972 3972 3 0 180 ffffafff577b1b80 syz-executor.3 parked
6492 6492 3 0 180 ffffafff672e8180 syz-executor.3 parked
4054 4054 3 1 180 ffffafff69082ac0 syz-executor.1 parked
6655 6655 3 0 180 ffffafff6ae86b00 syz-executor.1 parked
2854 2854 3 1 180 ffffafff57f744c0 syz-executor.3 parked
4442 4442 3 0 180 ffffafff68a05a80 syz-executor.3 parked
6192 6192 3 0 180 ffffafff654e6300 syz-executor.3 parked
5941 5941 3 0 180 ffffafff5e3130c0 syz-executor.3 parked
3401 3401 3 0 180 ffffafff6507b6c0 syz-executor.0 parked
3021 3021 3 1 180 ffffafff6543c340 syz-executor.5 parked
2743 2743 3 0 180 ffffafff6543c780 syz-executor.5 parked
1868 1868 3 0 180 ffffafff65822480 syz-executor.5 parked
2731 2731 3 1 180 ffffafff5eacc080 syz-executor.5 parked
1233 1324 3 1 180 ffffafff5c495680 syz-fuzzer wait
1233 1073 3 1 180 ffffafff5733a700 syz-fuzzer wait
1233 1240 3 1 1c0 ffffafff580f4940 syz-fuzzer wait
1233 1202 3 1 1c0 ffffafff5c495240 syz-fuzzer wait
1233 1236 3 0 1c0 ffffafff577b1300 syz-fuzzer parked
1233 449 3 0 180 ffffafff581b4980 syz-fuzzer kqueue
1233 1241 3 1 1c0 ffffafff58c26180 syz-fuzzer wait
1233 942 3 1 180 ffffafff571b36c0 syz-fuzzer parked
1233 829 3 1 180 ffffafff59477a80 syz-fuzzer parked
1233 1242 3 1 180 ffffafff571b3b00 syz-fuzzer parked
1233 1120 3 0 180 ffffafff56e5f200 syz-fuzzer wait
1233 1224 3 0 180 ffffafff58d06a40 syz-fuzzer parked
1233 1226 3 1 180 ffffafff59477200 syz-fuzzer parked
1233 1233 3 0 180 ffffafff59477640 syz-fuzzer parked
1235 1235 3 1 180 ffffafff571b3280 sshd select
1255 1255 3 0 180 ffffafff581b4100 getty nanoslp
1184 1184 3 0 180 ffffafff58c26a00 getty nanoslp
1223 1223 3 0 180 ffffafff58c265c0 getty nanoslp
1004 1004 3 1 1c0 ffffafff56e9dac0 getty ttyraw
1103 1103 3 1 180 ffffafff58d061c0 sshd select
1094 1094 3 0 180 ffffafff5818f9c0 powerd kqueue
702 702 3 0 180 ffffafff57914040 syslogd kqueue
747 747 3 0 180 ffffafff57f74080 dhcpcd poll
742 742 3 1 180 ffffafff577b1740 dhcpcd poll
466 466 3 1 180 ffffafff5733ab40 dhcpcd poll
598 598 3 1 180 ffffafff57914480 dhcpcd poll
292 292 3 1 180 ffffafff577cfbc0 dhcpcd poll
485 485 3 1 180 ffffafff577cf340 dhcpcd poll
291 291 3 1 180 ffffafff577cf780 dhcpcd poll
1 1 3 1 180 ffffafff4ec4b980 init wait
0 9609 5 0 200 ffffafff68a05200 (zombie)
0 10806 3 0 200 ffffafff654e6740 acctwatch actwat
0 8242 3 0 200 ffffafff65c36980 ktrace ktrwait
0 7210 3 0 200 ffffafff580f40c0 ktrace ktrwait
0 6488 3 1 200 ffffafff65ee3580 ktrace ktrwait
0 3720 3 1 200 ffffafff65c36100 ktrace ktrwait
0 655 3 1 200 ffffafff581b4540 ktrace ktrwait
0 2081 3 0 200 ffffafff5733a2c0 ktrace ktrwait
0 1976 3 1 200 ffffafff65537700 ktrace ktrwait
0 987 3 1 200 ffffafff56e5f640 physiod physiod
0 196 3 0 200 ffffafff56e9d680 pooldrain pooldrain
0 195 3 0 200 ffffafff56e9d240 ioflush syncer
0 194 3 1 200 ffffafff56e5fa80 pgdaemon pgdaemon
0 170 3 0 200 ffffafff54d9fa40 usb7 usbevt
0 169 3 1 200 ffffafff54d9f600 usb6 usbevt
0 168 3 0 200 ffffafff54d9f1c0 usb5 usbevt
0 167 3 1 200 ffffafff51d32a00 usb4 usbevt
0 166 3 1 200 ffffafff51d325c0 usb3 usbevt
0 165 3 0 200 ffffafff51d32180 usb2 usbevt
0 31 3 0 200 ffffafff4ecad9c0 usb1 usbevt
0 > 63 7 1 240 ffffafff4ecad580 usb0
0 126 3 1 200 ffffafff4eae0740 usbtask-dr usbtsk
0 125 3 1 200 ffffafff4eae0b80 usbtask-hc usbtsk
0 124 3 0 200 ffffafff4d0a1b00 swwreboot swwreboot
0 123 3 0 200 ffffafff4ecad140 npfgc0 npfgcw
0 122 3 1 200 ffffafff4ec4b540 rt_free rt_free
0 121 3 0 200 ffffafff4ec4b100 unpgc unpgc
0 120 3 0 200 ffffafff4ec46940 key_timehandler key_timehandler
0 119 3 1 200 ffffafff4ec46500 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffafff4ec460c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffffafff4ec29900 nd6_timer nd6_timer
0 116 3 1 200 ffffafff4ec294c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffafff4ec29080 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffafff4ec1c8c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffafff4ec1c480 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffafff4ec1c040 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffafff4ebd7bc0 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffffafff4ebd7340 rt_timer rt_timer
0 109 3 0 200 ffffafff4ebd7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffffafff4eae0300 entbutler entropy
0 99 3 1 200 ffffafff4e550b40 viomb balloon
0 98 3 1 200 ffffafff4e550700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffafff4e5502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffffafff4d0a16c0 scsibus0 sccomp
0 29 3 0 200 ffffafff4d0a1280 pms0 pmsreset
0 28 3 1 200 ffffafff4cfb4ac0 xcall/1 xcall
0 27 1 1 200 ffffafff4cfb4680 softser/1
0 26 1 1 200 ffffafff4cfb4240 softclk/1
0 25 1 1 200 ffffafff4cf87a80 softbio/1
0 24 1 1 200 ffffafff4cf87640 softnet/1
0 23 1 1 201 ffffafff4cf87200 idle/1
0 22 3 1 200 ffffb0007b32da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffffb0007b32d600 lnxubdwq lnxubdwq
0 20 3 1 200 ffffb0007b32d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffffb0007b334a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffb0007b3345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffffb0007b334180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffb0007b3539c0 sysmon smtaskq
0 15 3 1 200 ffffb0007b353580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffb0007b353140 pmfevent pmfevent
0 13 3 1 200 ffffb0007b35e980 sopendfree sopendfr
0 12 3 0 200 ffffb0007b35e540 ifwdog ifwdog
0 11 3 0 200 ffffb0007b35e100 iflnkst iflnkst
0 10 3 1 200 ffffb0007c393940 nfssilly nfssilly
0 9 3 0 200 ffffb0007c393500 vdrain vdrain
0 8 3 1 200 ffffb0007c3930c0 modunload mod_unld
0 7 3 0 200 ffffb0007c3bc900 xcall/0 xcall
0 6 1 0 200 ffffb0007c3bc4c0 softser/0
0 5 1 0 200 ffffb0007c3bc080 softclk/0
0 4 1 0 200 ffffb0007c3e98c0 softbio/0
0 3 1 0 200 ffffb0007c3e9480 softnet/0
0 2 1 0 201 ffffb0007c3e9040 idle/0
0 0 3 0 200 ffffffff8673e8c0 swapper uvm
[Locks tracked through LWPs]

****** LWP 12473.12473 (syz-executor.4) @ 0xffffafff7de41180, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)
lock address : ffffafff7048ad00
type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffafff7de41180 last held: 0xffffafff7de41180
last locked* : netbsd:uvm_fault_internal+0x75d
unlocked : netbsd:uvm_fault_lower_enter+0x86d
owner/count : 0xffffafff7de41180 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 9541.9322 (syz-executor.1) @ 0xffffafff69082680, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)
lock address : ffffb0007c869080
type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffafff69082680 last held: 0xffffafff69082680
last locked* : netbsd:sosetopt+0x34b
unlocked : netbsd:softint_dispatch+0x3b7
owner field : 0xffffafff69082680 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 9830.9661 (syz-executor.0) @ 0xffffafff6b106340, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:vhci_attach+0x2b2 sys/dev/usb/vhci.c:1283)
lock address : ffffc2000f9846f0
type : sleep/adaptive
initialized : netbsd:vhci_attach+0x2b2
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 0 last held: 0
relevant lwp : 0xffffafff6b106340 last held: 000000000000000000
last locked : netbsd:vhci_fd_read+0x194
unlocked* : netbsd:vhci_fd_read+0x652
owner field : 0xffffafff6b106340 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 10657.10657 (syz-executor.2) @ 0xffffafff7ad3a500, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:vcache_alloc+0xba sys/kern/vfs_vnode.c:1391)
lock address : ffffafff7c28cc00
type : sleep/adaptive
initialized : netbsd:vcache_alloc+0xba
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffafff7ad3a500 last held: 0xffffafff7ad3a500
last locked* : netbsd:genfs_lock+0x220
unlocked : netbsd:genfs_unlock+0x50
owner/count : 0xffffafff7ad3a500 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 8183.8183 (syz-executor.3) @ 0xffffafff5e313500, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 uvm_map_setup sys/uvm/uvm_map.c:4772 [inline])
* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 uvmspace_init sys/uvm/uvm_map.c:4115 [inline])
* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 sys/uvm/uvm_map.c:4094)
lock address : ffffafff4ec765c0
type : sleep/adaptive
initialized : netbsd:uvmspace_alloc+0x339
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffafff5e313500 last held: 0xffffafff5e313500
last locked* : netbsd:vm_map_lock+0x146
unlocked : netbsd:uvm_fault_upper_enter+0x473
owner/count : 0xffffafff5e313500 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 11190.11190 (syz-executor.3) @ 0xffffafff6b106bc0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffafff6b106bc0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 742.742 (dhcpcd) @ 0xffffafff577b1740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffafff577b1740 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 466.466 (dhcpcd) @ 0xffffafff5733ab40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffafff5733ab40 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xffffafff577cf340, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffafff577cf340 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xffffafff577cf780, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffafff577cf780 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffb0007b35e100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffb0007b35e100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffb0007c3bc080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffb0007c3bc080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff8673e8c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff8673e8c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at netbsd:main+0x106 sys/kern/init_main.c:303)
lock address : netbsd:kernel_lock
type : spin
initialized : netbsd:main+0x106
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffafff69082680 last held: 0xffffafff69082680
last locked* : ffffffff82949d6a
unlocked : netbsd:ipintr+0x768
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at netbsd:kprintf_init+0x72 sys/kern/subr_prf.c:155)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x72
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffafff69082680 last held: 0xffffafff69082680
last locked* : netbsd:kprintf_lock+0x50
unlocked : netbsd:kprintf_unlock+0x70
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffffc20000007180 0045 00000000 0x0 0x0
0xffffc20000007200 0045 00000000 0x0 0x0
0xffffc20000007280 0045 00000000 0x0 0x0
0xffffc20000007300 0045 00000000 0x0 0x0
0xffffc20000007380 0045 00000000 0x0 0x0
0xffffc20000007400 0045 00000000 0x0 0x0
0xffffc20000007480 0045 00000000 0x0 0x0
0xffffc20000007500 0045 00000000 0x0 0x0
0xffffc20000007580 0045 00000000 0x0 0x0
0xffffc20000007600 0045 00000000 0x0 0x0
0xffffc20000007680 0045 00000000 0x0 0x0
0xffffc20000007700 0041 00000000 0x0 0x0
0xffffc20000007780 0041 00000000 0x0 0x0
0xffffc20000007800 0041 00000000 0x0 0x0
0xffffc20000007880 0041 00000000 0x0 0x0
0xffffc20000007900 0045 00000000 0x0 0x0
0xffffc20000007980 0041 00000000 0x0 0x0
0xffffc20000007a00 0041 00000000 0x0 0x0
0xffffc20000007a80 0041 00000000 0x0 0x0
0xffffc20000007b00 0041 00000000 0x0 0x0
0xffffc20000007b80 0041 00000000 0x0 0x0
0xffffc20000007c00 0041 00000000 0x0 0x0
0xffffc20000007c80 0041 00000000 0x0 0x0
0xffffc20000007d00 0041 00000000 0x0 0x0
0xffffc20000007d80 0041 00000000 0x0 0x0
0xffffc20000007e00 0041 00000000 0x0 0x0
0xffffc20000007e80 0041 00000000 0x0 0x0
0xffffc20000007f00 0041 00000000 0x0 0x0
0xffffc20000007f80 0041 00000000 0x0 0x0
0xffffc20000008000 0041 00000000 0x0 0x0
0xffffc20000008080 0041 00000000 0x0 0x0
0xffffc20000008100 0041 00000000 0x0 0x0
0xffffc20000008180 0041 00000000 0x0 0x0
0xffffc20000008200 0041 00000000 0x0 0x0
0xffffc20000008280 0041 00000000 0x0 0x0
0xffffc20000008300 0041 00000000 0x0 0x0
0xffffc20000008380 0041 00000000 0x0 0x0
0xffffc20000008400 0041 00000000 0x0 0x0
0xffffc20000008480 0041 00000000 0x0 0x0
0xffffc20000008500 0041 00000000 0x0 0x0
0xffffc20000008580 0041 00000000 0x0 0x0
0xffffc20000008600 0045 00000000 0x0 0x0
0xffffc20000008680 0041 00000000 0x0 0x0
0xffffc20000008700 0041 00000000 0x0 0x0
0xffffc20000008780 0041 00000000 0x0 0x0
0xffffc20000008800 0045 00000000 0x0 0x0
0xffffc20000008880 0041 00000000 0x0 0x0
0xffffc20000008900 0041 00000000 0x0 0x0
0xffffc20000008980 0041 00000000 0x0 0x0
0xffffc20000008a00 0041 00000000 0x0 0x0
0xffffc20000008a80 0041 00000000 0x0 0x0
0xffffc20000008b00 0041 00000000 0x0 0x0
0xffffc20000008b80 0041 00000000 0x0 0x0
0xffffc20000008c00 0041 00000000 0x0 0x0
0xffffc20000008c80 0041 00000000 0x0 0x0
0xffffc20000008d00 0041 00000000 0x0 0x0
0xffffc20000008d80 0041 00000000 0x0 0x0
0xffffc20000008e00 0041 00000000 0x0 0x0
0xffffc20000008e80 0041 00000000 0x0 0x0
0xffffc20000008f00 0041 00000000 0x0 0x0
0xffffc20000008f80 0041 00000000 0x0 0x0
0xffffc20000009000 0041 00000000 0x0 0x0
0xffffc20000009080 0045 00000000 0x0 0x0
0xffffc20000009100 0041 00000000 0x0 0x0
0xffffc20000009180 0041 00000000 0x0 0x0
0xffffc20000009200 0041 00000000 0x0 0x0
0xffffc20000009280 0041 00000000 0x0 0x0
0xffffc20000009300 0041 00000000 0x0 0x0
0xffffc20000009380 0041 00000000 0x0 0x0
0xffffc20000009400 0041 00000000 0x0 0x0
0xffffc20000009480 0041 00000000 0x0 0x0
0xffffc20000009500 0041 00000000 0x0 0x0
0xffffc20000009580 0041 00000000 0x0 0x0
0xffffc20000009600 0041 00000000 0x0 0x0
0xffffc20000009680 0041 00000000 0x0 0x0
0xffffc20000009700 0041 00000000 0x0 0x0
0xffffc20000009780 0041 00000000 0x0 0x0
0xffffc20000009800 0041 00000000 0x0 0x0
0xffffc20000009880 0041 00000000 0x0 0x0
0xffffc20000009900 0041 00000000 0x0 0x0
0xffffc20000009980 0041 00000000 0x0 0x0
0xffffc20000009a00 0041 00000000 0x0 0x0
0xffffc20000009a80 0041 00000000 0x0 0x0
0xffffc20000009b00 0041 00000000 0x0 0x0
0xffffc20000009b80 0041 00000000 0x0 0x0
0xffffc20000009c00 0041 00000000 0x0 0x0
0xffffc20000009c80 0041 00000000 0x0 0x0
0xffffc20000009d00 0041 00000000 0x0 0x0
0xffffc20000009d80 0041 00000000 0x0 0x0
0xffffc20000009e00 0041 00000000 0x0 0x0
0xffffc20000009e80 0045 00000000 0x0 0x0
0xffffc20000009f00 0041 00000000 0x0 0x0
0xffffc20000009f80 0041 00000000 0x0 0x0
0xffffc2000000a000 0041 00000000 0x0 0x0
0xffffc2000000a080 0041 00000000 0x0 0x0
0xffffc2000000a100 0041 00000000 0x0 0x0
0xffffc2000000a180 0041 00000000 0x0 0x0
0xffffc2000000a200 0041 00000000 0x0 0x0
0xffffc2000000a280 0041 00000000 0x0 0x0
0xffffc2000000a300 0041 00000000 0x0 0x0
0xffffc2000000a380 0041 00000000 0x0 0x0
0xffffc2000000a400 0041 00000000 0x0 0x0
0xffffc2000000a480 0041 00000000 0x0 0x0
0xffffc2000000a500 0041 00000000 0x0 0x0
0xffffc2000000a580 0041 00000000 0x0 0x0
0xffffc2000000a600 0041 00000000 0x0 0x0
0xffffc2000000a680 0041 00000000 0x0 0x0
0xffffc2000000a700 0041 00000000 0x0 0x0
0xffffc2000000a780 0041 00000000 0x0 0x0
0xffffc2000000a800 0041 00000000 0x0 0x0
0xffffc2000000a880 0041 00000000 0x0 0x0
0xffffc2000000a900 0041 00000000 0x0 0x0
0xffffc2000000a980 0041 00000000 0x0 0x0
0xffffc2000000aa00 0041 00000000 0x0 0x0
0xffffc2000000aa80 0041 00000000 0x0 0x0
0xffffc2000000ab00 0041 00000000 0x0 0x0
0xffffc2000000ab80 0041 00000000 0x0 0x0
0xffffc2000000ac00 0041 00000000 0x0 0x0
0xffffc2000000ac80 0041 00000000 0x0 0x0
0xffffc2000000ad00 0041 00000000 0x0 0x0
0xffffc2000000ad80 0041 00000000 0x0 0x0
0xffffc2000000ae00 0041 00000000 0x0 0x0
0xffffc2000000ae80 0041 00000000 0x0 0x0
0xffffc2000000af00 0045 00000000 0x0 0x0
0xffffc2000000af80 0045 00000000 0x0 0x0
0xffffc2000000b000 0041 00000000 0x0 0x0
0xffffc2000000b080 0041 00000000 0x0 0x0
0xffffc2000000b100 0041 00000000 0x0 0x0
0xffffc2000000b180 0045 00000000 0x0 0x0
0xffffc2000000b200 0041 00000000 0x0 0x0
0xffffc2000000b280 0045 00000000 0x0 0x0
0xffffc2000000b300 0045 00000000 0x0 0x0
0xffffc2000000b380 0045 00000000 0x0 0x0
0xffffc2000000b400 0041 00000000 0x0 0x0
0xffffc2000000b480 0041 00000000 0x0 0x0
0xffffc2000000b500 0045 00000000 0x0 0x0
0xffffc2000000b580 0045 00000000 0x0 0x0
0xffffc2000000b600 0045 00000000 0x0 0x0
0xffffc2000000b680 0045 00000000 0x0 0x0
0xffffc2000000b700 0045 00000000 0x0 0x0
0xffffc2000000b780 0045 00000000 0x0 0x0
0xffffc2000000b800 0045 00000000 0x0 0x0
0xffffc2000000b880 0041 00000000 0x0 0x0
0xffffc2000000b900 0045 00000000 0x0 0x0
0xffffc2000000b980 0045 00000000 0x0 0x0
0xffffc2000000ba00 0045 00000000 0x0 0x0
0xffffc2000000ba80 0045 00000000 0x0 0x0
0xffffc2000000bb00 0045 00000000 0x0 0x0
0xffffc2000000bb80 0045 00000000 0x0 0x0
0xffffc2000000bc00 0045 00000000 0x0 0x0
0xffffc2000000bc80 0041 00000000 0x0 0x0
0xffffc2000000bd00 0045 00000000 0x0 0x0
0xffffc2000000bd80 0045 00000000 0x0 0x0
0xffffc2000000be00 0045 00000000 0x0 0x0
0xffffc2000000be80 0045 00000000 0x0 0x0
0xffffc2000000bf00 0045 00000000 0x0 0x0
0xffffc2000000bf80 0045 00000000 0x0 0x0
0xffffc2000000c000 0045 00000000 0x0 0x0
0xffffc2000000c080 0045 00000000 0x0 0x0
0xffffc2000000c100 0045 00000000 0x0 0x0
0xffffc2000000c180 0045 00000000 0x0 0x0
0xffffc2000000c200 0045 00000000 0x0 0x0
0xffffc2000000c280 0045 00000000 0x0 0x0
0xffffc2000000c300 0045 00000000 0x0 0x0
0xffffc2000000c380 0045 00000000 0x0 0x0
0xffffc2000000c400 0045 00000000 0x0 0x0
0xffffc2000000c480 0045 00000000 0x0 0x0
0xffffc2000000c500 0045 00000000 0x0 0x0
0xffffc2000000c580 0045 00000000 0x0 0x0
0xffffc2000000c600 0045 00000000 0x0 0x0
0xffffc2000000c680 0045 00000000 0x0 0x0
0xffffc2000000c700 0041 00000000 0x0 0x0
0xffffc2000000c780 0041 00000000 0x0 0x0
0xffffc2000000c800 0045 00000000 0x0 0x0
0xffffc2000000c880 0045 00000000 0x0 0x0
0xffffc2000000c900 0045 00000000 0x0 0x0
0xffffc2000000c980 0045 00000000 0x0 0x0
0xffffc2000000ca00 0045 00000000 0x0 0x0
0xffffc2000000ca80 0045 00000000 0x0 0x0
0xffffc2000000cb00 0041 00000000 0x0 0x0
0xffffc2000000cb80 0041 00000000 0x0 0x0
0xffffc2000000cc00 0045 00000000 0x0 0x0
0xffffc2000000cc80 0045 00000000 0x0 0x0
0xffffc2000000cd00 0045 00000000 0x0 0x0
0xffffc2000000cd80 0041 00000000 0x0 0x0
0xffffc2000000ce00 0045 00000000 0x0 0x0
0xffffc2000000ce80 0041 00000000 0x0 0x0
0xffffc2000000cf00 0041 00000000 0x0 0x0
0xffffc2000000cf80 0041 00000000 0x0 0x0
0xffffc2000000d000 0041 00000000 0x0 0x0
0xffffc2000000d080 0045 00000000 0x0 0x0
0xffffc2000000d100 0041 00000000 0x0 0x0
0xffffc2000000d180 0041 00000000 0x0 0x0
0xffffc2000000d200 0041 00000000 0x0 0x0
0xffffc2000000d280 0041 00000000 0x0 0x0
0xffffc2000000d300 0045 00000000 0x0 0x0
0xffffc2000000d380 0041 00000000 0x0 0x0
0xffffc2000000d400 0041 00000000 0x0 0x0
0xffffc2000000d480 0045 00000000 0x0 0x0
0xffffc2000000d500 0041 00000000 0x0 0x0
0xffffc2000000d580 0041 00000000 0x0 0x0
0xffffc2000000d600 0041 00000000 0x0 0x0
0xffffc2000000d680 0041 00000000 0x0 0x0
0xffffc2000000d700 0041 00000000 0x0 0x0
0xffffc2000000d780 0045 00000000 0x0 0x0
0xffffc2000000d800 0041 00000000 0x0 0x0
0xffffc2000000d880 0041 00000000 0x0 0x0
0xffffc2000000d900 0041 00000000 0x0 0x0
0xffffc2000000d980 0041 00000000 0x0 0x0
0xffffc2000000da00 0041 00000000 0x0 0x0
0xffffc2000000da80 0045 00000000 0x0 0x0
0xffffc2000000db00 0045 00000000 0x0 0x0
0xffffc2000000db80 0045 00000000 0x0 0x0
0xffffc2000000dc00 0041 00000000 0x0 0x0
0xffffc2000000dc80 0041 00000000 0x0 0x0
0xffffc2000000dd00 0041 00000000 0x0 0x0
0xffffc2000000dd80 0041 00000000 0x0 0x0
0xffffc2000000de00 0041 00000000 0x0 0x0
0xffffc2000000de80 0041 00000000 0x0 0x0
0xffffc2000000df00 0045 00000000 0x0 0x0
0xffffc2000000df80 0045 00000000 0x0 0x0
0xffffc2000000e000 0045 00000000 0x0 0x0
0xffffc2000000e080 0041 00000000 0x0 0x0
0xffffc2000000e100 0041 00000000 0x0 0x0
0xffffc2000000e180 0045 00000000 0x0 0x0
0xffffc2000000e200 0041 00000000 0x0 0x0
0xffffc2000000e280 0041 00000000 0x0 0x0
0xffffc2000000e300 0045 00000000 0x0 0x0
0xffffc2000000e380 0041 00000000 0x0 0x0
0xffffc2000000e400 0045 00000000 0x0 0x0
0xffffc2000000e480 0041 00000000 0x0 0x0
0xffffc2000000e500 0045 00000000 0x0 0x0
0xffffc2000000e580 0041 00000000 0x0 0x0
0xffffc2000000e600 0045 00000000 0x0 0x0
0xffffc2000000e680 0045 00000000 0x0 0x0
0xffffc2000000e700 0041 00000000 0x0 0x0
0xffffc2000000e780 0041 00000000 0x0 0x0
0xffffc2000000e800 0045 00000000 0x0 0x0
0xffffc2000000e880 0045 00000000 0x0 0x0
0xffffc2000000e900 0041 00000000 0x0 0x0
0xffffc2000000e980 0041 00000000 0x0 0x0
0xffffc2000000ea00 0041 00000000 0x0 0x0
0xffffc2000000ea80 0041 00000000 0x0 0x0
0xffffc2000000eb00 0041 00000000 0x0 0x0
0xffffc2000000eb80 0045 00000000 0x0 0x0
0xffffc2000000ec00 0041 00000000 0x0 0x0
0xffffc2000000ec80 0041 00000000 0x0 0x0
0xffffc2000000ed00 0041 00000000 0x0 0x0
0xffffc2000000ed80 0041 00000000 0x0 0x0
0xffffc2000000ee00 0041 00000000 0x0 0x0
0xffffc2000000ee80 0045 00000000 0x0 0x0
0xffffc2000000ef00 0041 00000000 0x0 0x0
0xffffc2000000ef80 0041 00000000 0x0 0x0
0xffffc2000000f000 0041 00000000 0x0 0x0
0xffffc2000000f080 0045 00000000 0x0 0x0
0xffffc2000000f100 0041 00000000 0x0 0x0
0xffffc2000000f180 0041 00000000 0x0 0x0
0xffffc2000000f200 0041 00000000 0x0 0x0
0xffffc2000000f280 0041 00000000 0x0 0x0
0xffffc2000000f300 0041 00000000 0x0 0x0
0xffffc2000000f380 0041 00000000 0x0 0x0
0xffffc2000000f400 0045 00000000 0x0 0x0
0xffffc2000000f480 0041 00000000 0x0 0x0
0xffffc2000000f500 0041 00000000 0x0 0x0
0xffffc2000000f580 0041 00000000 0x0 0x0
0xffffc2000000f600 0041 00000000 0x0 0x0
0xffffc2000000f680 0045 00000000 0x0 0x0
0xffffc2000000f700 0041 00000000 0x0 0x0
0xffffc2000000f780 0041 00000000 0x0 0x0
0xffffc2000000f800 0041 00000000 0x0 0x0
0xffffc2000000f880 0045 00000000 0x0 0x0
0xffffc2000000f900 0041 00000000 0x0 0x0
0xffffc2000000f980 0045 00000000 0x0 0x0
0xffffc2000000fa00 0041 00000000 0x0 0x0
0xffffc2000000fa80 0041 00000000 0x0 0x0
0xffffc2000000fb00 0041 00000000 0x0 0x0
0xffffc2000000fb80 0041 00000000 0x0 0x0
0xffffc2000000fc00 0045 00000000 0x0 0x0
0xffffc2000000fc80 0041 00000000 0x0 0x0
0xffffc2000000fd00 0045 00000000 0x0 0x0
0xffffc2000000fd80 0041 00000000 0x0 0x0
0xffffc2000000fe00 0041 00000000 0x0 0x0
0xffffc2000000fe80 0041 00000000 0x0 0x0
0xffffc2000000ff00 0041 00000000 0x0 0x0
0xffffc2000000ff80 0041 00000000 0x0 0x0
0xffffc20000010000 0041 00000000 0x0 0x0
0xffffc20000010080 0041 00000000 0x0 0x0
0xffffc20000010100 0041 00000000 0x0 0x0
0xffffc20000010180 0045 00000000 0x0 0x0
0xffffc20000010200 0045 00000000 0x0 0x0
0xffffc20000010280 0041 00000000 0x0 0x0
0xffffc20000010300 0041 00000000 0x0 0x0
0xffffc20000010380 0041 00000000 0x0 0x0
0xffffc20000010400 0041 00000000 0x0 0x0
0xffffc20000010480 0045 00000000 0x0 0x0
0xffffc20000010500 0045 00000000 0x0 0x0
0xffffc20000010580 0041 00000000 0x0 0x0
0xffffc20000010600 0041 00000000 0x0 0x0
0xffffc20000010680 0041 00000000 0x0 0x0
0xffffc20000010700 0041 00000000 0x0 0x0
0xffffc20000010780 0041 00000000 0x0 0x0
0xffffc20000010800 0041 00000000 0x0 0x0
0xffffc20000010880 0041 00000000 0x0 0x0
0xffffc20000010900 0041 00000000 0x0 0x0
0xffffc20000010980 0045 00000000 0x0 0x0
0xffffc20000010a00 0045 00000000 0x0 0x0
0xffffc20000010a80 0045 00000000 0x0 0x0
0xffffc20000010b00 0041 00000000 0x0 0x0
0xffffc20000010b80 0041 00000000 0x0 0x0
0xffffc20000010c00 0041 00000000 0x0 0x0
0xffffc20000010c80 0045 00000000 0x0 0x0
0xffffc20000010d00 0041 00000000 0x0 0x0
0xffffc20000010d80 0041 00000000 0x0 0x0
0xffffc20000010e00 0041 00000000 0x0 0x0
0xffffc20000010e80 0041 00000000 0x0 0x0
0xffffc20000010f00 0041 00000000 0x0 0x0
0xffffc20000010f80 0041 00000000 0x0 0x0
0xffffc20000011000 0041 00000000 0x0 0x0
0xffffc20000011080 0041 00000000 0x0 0x0
0xffffc20000011100 0041 00000000 0x0 0x0
0xffffc20000011180 0041 00000000 0x0 0x0
0xffffc20000011200 0045 00000000 0x0 0x0
0xffffc20000011280 0045 00000000 0x0 0x0
0xffffc20000011300 0041 00000000 0x0 0x0
0xffffc20000011380 0041 00000000 0x0 0x0
0xffffc20000011400 0041 00000000 0x0 0x0
0xffffc20000011480 0041 00000000 0x0 0x0
0xffffc20000011500 0045 00000000 0x0 0x0
0xffffc20000011580 0041 00000000 0x0 0x0
0xffffc20000011600 0041 00000000 0x0 0x0
0xffffc20000011680 0041 00000000 0x0 0x0
0xffffc20000011700 0045 00000000 0x0 0x0
0xffffc20000011780 0045 00000000 0x0 0x0
0xffffc20000011800 0041 00000000 0x0 0x0
0xffffc20000011880 0041 00000000 0x0 0x0
0xffffc20000011900 0041 00000000 0x0 0x0
0xffffc20000011980 0041 00000000 0x0 0x0
0xffffc20000011a00 0041 00000000 0x0 0x0
0xffffc20000011a80 0041 00000000 0x0 0x0
0xffffc20000011b00 0041 00000000 0x0 0x0
0xffffc20000011b80 0041 00000000 0x0 0x0
0xffffc20000011c00 0041 00000000 0x0 0x0
0xffffc20000011c80 0041 00000000 0x0 0x0
0xffffc20000011d00 0041 00000000 0x0 0x0
0xffffc20000011d80 0041 00000000 0x0 0x0
0xffffc20000011e00 0045 00000000 0x0 0x0
0xffffc20000011e80 0041 00000000 0x0 0x0
0xffffc20000011f00 0041 00000000 0x0 0x0
0xffffc20000011f80 0041 00000000 0x0 0x0
0xffffc20000012000 0041 00000000 0x0 0x0
0xffffc20000012080 0041 00000000 0x0 0x0
0xffffc20000012100 0045 00000000 0x0 0x0
0xffffc20000012180 0045 00000000 0x0 0x0
0xffffc20000012200 0041 00000000 0x0 0x0
0xffffc20000012280 0041 00000000 0x0 0x0
0xffffc20000012300 0041 00000000 0x0 0x0
0xffffc20000012380 0041 00000000 0x0 0x0
0xffffc20000012400 0041 00000000 0x0 0x0
0xffffc20000012480 0041 00000000 0x0 0x0
0xffffc20000012500 0041 00000000 0x0 0x0
0xffffc20000012580 0041 00000000 0x0 0x0
0xffffc20000012600 0041 00000000 0x0 0x0
0xffffc20000012680 0045 00000000 0x0 0x0
0xffffc20000012700 0041 00000000 0x0 0x0
0xffffc20000012780 0041 00000000 0x0 0x0
0xffffc20000012800 0041 00000000 0x0 0x0
0xffffc20000012880 0045 00000000 0x0 0x0
0xffffc20000012900 0001 00000000 0x0 0x0
0xffffc20000012980 0001 00000000 0x0 0x0
0xffffc20000012a00 0001 00000000 0x0 0x0
0xffffc20000012a80 0001 00000000 0x0 0x0
0xffffc20000012b00 0001 00000000 0x0 0x0
0xffffc20000012b80 0001 00000000 0x0 0x0
0xffffc20000012c00 0001 00000000 0x0 0x0
0xffffc20000012c80 0001 00000000 0x0 0x0
0xffffc20000012d00 0001 00000000 0x0 0x0
0xffffc20000012d80 0001 00000000 0x0 0x0
0xffffc20000012e00 0001 00000000 0x0 0x0
0xffffc20000012e80 0001 00000000 0x0 0x0
0xffffc20000012f00 0001 00000000 0x0 0x0
0xffffc20000012f80 0001 00000000 0x0 0x0
0xffffc20000013000 0001 00000000 0x0 0x0
0xffffc20000013080 0001 00000000 0x0 0x0
0xffffc20000013100 0001 00000000 0x0 0x0
0xffffc20000013180 0001 00000000 0x0 0x0
0xffffc20000013200 0001 00000000 0x0 0x0
0xffffc20000013280 0001 00000000 0x0 0x0
0xffffc20000013300 0001 00000000 0x0 0x0
0xffffc20000013380 0001 00000000 0x0 0x0
0xffffc20000013400 0001 00000000 0x0 0x0
0xffffc20000013480 0001 00000000 0x0 0x0
0xffffc20000013500 0001 00000000 0x0 0x0
0xffffc20000013580 0001 00000000 0x0 0x0
0xffffc20000013600 0001 00000000 0x0 0x0
0xffffc20000013680 0001 00000000 0x0 0x0
0xffffc20000013700 0001 00000000 0x0 0x0
0xffffc20000013780 0001 00000000 0x0 0x0
0xffffc20000013800 0001 00000000 0x0 0x0
0xffffc20000013880 0001 00000000 0x0 0x0
0xffffc20000013900 0001 00000000 0x0 0x0
0xffffc20000013980 0001 00000000 0x0 0x0
0xffffc20000013a00 0001 00000000 0x0 0x0
0xffffc20000013a80 0001 00000000 0x0 0x0
0xffffc20000013b00 0001 00000000 0x0 0x0
0xffffc20000013b80 0001 00000000 0x0 0x0
0xffffc20000013c00 0001 00000000 0x0 0x0
0xffffc20000013c80 0001 00000000 0x0 0x0
0xffffc20000013d00 0001 00000000 0x0 0x0
0xffffc20000013d80 0001 00000000 0x0 0x0
0xffffc20000013e00 0001 00000000 0x0 0x0
0xffffc20000013e80 0001 00000000 0x0 0x0
0xffffc20000013f00 0001 00000000 0x0 0x0
0xffffc20000013f80 0001 00000000 0x0 0x0
0xffffc20000014000 0001 00000000 0x0 0x0
0xffffc20000014080 0001 00000000 0x0 0x0
0xffffc20000014100 0001 00000000 0x0 0x0
0xffffc20000014180 0001 00000000 0x0 0x0
0xffffc20000014200 0001 00000000 0x0 0x0
0xffffc20000014280 0001 00000000 0x0 0x0
0xffffc20000014300 0001 00000000 0x0 0x0
0xffffc20000014380 0001 00000000 0x0 0x0
0xffffc20000014400 0041 00000000 0x0 0x0
0xffffc20000014480 0041 00000000 0x0 0x0
0xffffc20000014500 0041 00000000 0x0 0x0
0xffffc20000014580 0041 00000000 0x0 0x0
0xffffc20000014600 0041 00000000 0x0 0x0
0xffffc20000014680 0041 00000000 0x0 0x0
0xffffc20000014700 0041 00000000 0x0 0x0
0xffffc20000014780 0041 00000000 0x0 0x0
0xffffc20000014800 0041 00000000 0x0 0x0
0xffffc20000014880 0041 00000000 0x0 0x0
0xffffc20000014900 0041 00000000 0x0 0x0
0xffffc20000014980 0041 00000000 0x0 0x0
0xffffc20000014a00 0041 00000000 0x0 0x0
0xffffc20000014a80 0041 00000000 0x0 0x0
0xffffc20000014b00 0041 00000000 0x0 0x0
0xffffc20000014b80 0041 00000000 0x0 0x0
0xffffc20000014c00 0041 00000000 0x0 0x0
0xffffc20000014c80 0041 00000000 0x0 0x0
0xffffc20000014d00 0041 00000000 0x0 0x0
0xffffc20000014d80 0041 00000000 0x0 0x0
0xffffc20000014e00 0041 00000000 0x0 0x0
0xffffc20000014e80 0041 00000000 0x0 0x0
0xffffc20000014f00 0041 00000000 0x0 0x0
0xffffc20000014f80 0041 00000000 0x0 0x0
0xffffc20000015000 0041 00000000 0x0 0x0
0xffffc20000015080 0041 00000000 0x0 0x0
0xffffc20000015100 0041 00000000 0x0 0x0
0xffffc20000015180 0041 00000000 0x0 0x0
0xffffc20000015200 0041 00000000 0x0 0x0
0xffffc20000015280 0041 00000000 0x0 0x0
0xffffc20000015300 0041 00000000 0x0 0x0
0xffffc20000015380 0041 00000000 0x0 0x0
0xffffc20000015400 0041 00000000 0x0 0x0
0xffffc20000015480 0041 00000000 0x0 0x0
0xffffc20000015500 0041 00000000 0x0 0x0
0xffffc20000015580 0041 00000000 0x0 0x0
0xffffc20000015600 0041 00000000 0x0 0x0
0xffffc20000015680 0041 00000000 0x0 0x0
0xffffc20000015700 0041 00000000 0x0 0x0
0xffffc20000015780 0041 00000000 0x0 0x0
0xffffc20000015800 0041 00000000 0x0 0x0
0xffffc20000015880 0041 00000000 0x0 0x0
0xffffc20000015900 0041 00000000 0x0 0x0
0xffffc20000015980 0041 00000000 0x0 0x0
0xffffc20000015a00 0041 00000000 0x0 0x0
0xffffc20000015a80 0041 00000000 0x0 0x0
0xffffc20000015b00 0001 00000000 0x0 0x0
0xffffc20000015b80 0001 00000000 0x0 0x0
0xffffc20000015c00 0001 00000000 0x0 0x0
0xffffc20000015c80 0001 00000000 0x0 0x0
0xffffc20000015d00 0001 00000000 0x0 0x0
0xffffc20000015d80 0001 00000000 0x0 0x0
0xffffc20000015e00 0001 00000000 0x0 0x0
0xffffc20000015e80 0001 00000000 0x0 0x0
0xffffc20000015f00 0001 00000000 0x0 0x0
0xffffc20000015f80 0001 00000000 0x0 0x0
0xffffc20000016000 0001 00000000 0x0 0x0
0xffffc20000016080 0001 00000000 0x0 0x0
0xffffc20000016100 0001 00000000 0x0 0x0
0xffffc20000016180 0001 00000000 0x0 0x0
0xffffc20000016200 0001 00000000 0x0 0x0
0xffffc20000016280 0001 00000000 0x0 0x0
0xffffc20000016300 0001 00000000 0x0 0x0
0xffffc20000016380 0001 00000000 0x0 0x0
0xffffc20000016400 0001 00000000 0x0 0x0
0xffffc20000016480 0001 00000000 0x0 0x0
0xffffc20000016500 0001 00000000 0x0 0x0
0xffffc20000016580 0001 00000000 0x0 0x0
0xffffc20000016600 0001 00000000 0x0 0x0
0xffffc20000016680 0001 00000000 0x0 0x0
0xffffc20000016700 0001 00000000 0x0 0x0
0xffffc20000016780 0001 00000000 0x0 0x0
0xffffc20000016800 0001 00000000 0x0 0x0
0xffffc20000016880 0001 00000000 0x0 0x0
0xffffc20000016900 0001 00000000 0x0 0x0
0xffffc20000016980 0001 00000000 0x0 0x0
0xffffc20000016a00 0001 00000000 0x0 0x0
0xffffc20000016a80 0001 00000000 0x0 0x0
0xffffc20000016b00 0001 00000000 0x0 0x0
0xffffc20000016b80 0001 00000000 0x0 0x0
0xffffc20000016c00 0001 00000000 0x0 0x0
0xffffc20000016c80 0001 00000000 0x0 0x0
0xffffc20000016d00 0001 00000000 0x0 0x0
0xffffc20000016d80 0001 00000000 0x0 0x0
0xffffc20000016e00 0001 00000000 0x0 0x0
0xffffc20000016e80 0001 00000000 0x0 0x0
0xffffc20000016f00 0001 00000000 0x0 0x0
0xffffc20000016f80 0001 00000000 0x0 0x0
0xffffc20000017000 0001 00000000 0x0 0x0
0xffffc20000017080 0001 00000000 0x0 0x0
0xffffc20000017100 0001 00000000 0x0 0x0
0xffffc20000017180 0001 00000000 0x0 0x0
0xffffc20000017200 0001 00000000 0x0 0x0
0xffffc20000017280 0001 00000000 0x0 0x0
0xffffc20000017300 0001 00000000 0x0 0x0
0xffffc20000017380 0001 00000000 0x0 0x0
0xffffc20000017400 0001 00000000 0x0 0x0
0xffffc20000017480 0001 00000000 0x0 0x0
0xffffc20000017500 0001 00000000 0x0 0x0
0xffffc20000017580 0001 00000000 0x0 0x0
0xffffc20000017600 0041 00000000 0x0 0x0
0xffffc20000017680 0041 00000000 0x0 0x0
0xffffc20000017700 0041 00000000 0x0 0x0
0xffffc20000017780 0041 00000000 0x0 0x0
0xffffc20000017800 0041 00000000 0x0 0x0
0xffffc20000017880 0041 00000000 0x0 0x0
0xffffc20000017900 0041 00000000 0x0 0x0
0xffffc20000017980 0041 00000000 0x0 0x0
0xffffc20000017a00 0041 00000000 0x0 0x0
0xffffc20000017a80 0041 00000000 0x0 0x0
0xffffc20000017b00 0041 00000000 0x0 0x0
0xffffc20000017b80 0041 00000000 0x0 0x0
0xffffc20000017c00 0041 00000000 0x0 0x0
0xffffc20000017c80 0041 00000000 0x0 0x0
0xffffc20000017d00 0041 00000000 0x0 0x0
0xffffc20000017d80 0041 00000000 0x0 0x0
0xffffc20000017e00 0041 00000000 0x0 0x0
0xffffc20000017e80 0041 00000000 0x0 0x0
0xffffc20000017f00 0041 00000000 0x0 0x0
0xffffc20000017f80 0041 00000000 0x0 0x0
0xffffc20000018000 0041 00000000 0x0 0x0
0xffffc20000018080 0041 00000000 0x0 0x0
0xffffc20000018100 0041 00000000 0x0 0x0
0xffffc20000018180 0041 00000000 0x0 0x0
0xffffc20000018200 0041 00000000 0x0 0x0
0xffffc20000018280 0041 00000000 0x0 0x0
0xffffc20000018300 0041 00000000 0x0 0x0
0xffffc20000018380 0041 00000000 0x0 0x0
0xffffc20000018400 0041 00000000 0x0 0x0
0xffffc20000018480 0041 00000000 0x0 0x0
0xffffc20000018500 0041 00000000 0x0 0x0
0xffffc20000018580 0041 00000000 0x0 0x0
0xffffc20000018600 0041 00000000 0x0 0x0
0xffffc20000018680 0041 00000000 0x0 0x0
0xffffc20000018700 0041 00000000 0x0 0x0
0xffffc20000018780 0041 00000000 0x0 0x0
0xffffc20000018800 0041 00000000 0x0 0x0
0xffffc20000018880 0041 00000000 0x0 0x0
0xffffc20000018900 0041 00000000 0x0 0x0
0xffffc20000018980 0041 00000000 0x0 0x0
0xffffc20000018a00 0041 00000000 0x0 0x0
0xffffc20000018a80 0041 00000000 0x0 0x0
0xffffc20000018b00 0041 00000000 0x0 0x0
0xffffc20000018b80 0041 00000000 0x0 0x0
0xffffc20000018c00 0041 00000000 0x0 0x0
0xffffc20000018c80 0041 00000000 0x0 0x0
0xffffc20000018d00 0001 00000000 0x0 0x0
0xffffc20000018d80 0001 00000000 0x0 0x0
0xffffc20000018e00 0001 00000000 0x0 0x0
0xffffc20000018e80 0001 00000000 0x0 0x0
0xffffc20000018f00 0001 00000000 0x0 0x0
0xffffc20000018f80 0001 00000000 0x0 0x0
0xffffc20000019000 0001 00000000 0x0 0x0
0xffffc20000019080 0001 00000000 0x0 0x0
0xffffc20000019100 0001 00000000 0x0 0x0
0xffffc20000019180 0001 00000000 0x0 0x0
0xffffc20000019200 0001 000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Oct 28, 2022, 10:00:41 AM10/28/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=11136bf2880000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=2e8b6f8af2d83f29f68a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a0b3f2880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17d41b5a880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8813f5f371a8/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e5d1760d89e4/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2e8b6f...@syzkaller.appspotmail.com

[ 36.1797345] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/ip_output.c:1091:13, member access within null pointer of type 'struct in4pcb'

[ 36.1797345] cpu0: Begin traceback...
[ 36.1997152] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 36.2697159] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 36.3297169] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 36.3797148] ip_ctloutput() at netbsd:ip_ctloutput+0x15ae sys/netinet/ip_output.c:1091
[ 36.4297155] tcp_ctloutput() at netbsd:tcp_ctloutput+0x2e7 sys/netinet/tcp_usrreq.c:278
[ 36.4797159] tcp_ctloutput_wrapper() at netbsd:tcp_ctloutput_wrapper+-0xdbecb
[ 36.5397154] sosetopt() at netbsd:sosetopt+0x195 sys/kern/uipc_socket.c:1902
[ 36.5897129] sys_setsockopt() at netbsd:sys_setsockopt+0x1a7 sys/kern/uipc_syscalls.c:1202
[ 36.6397155] sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 36.6397155] sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 36.6897148] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 36.6897148] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 36.6897148] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 36.6997120] --- syscall (number 105 via SYS_syscall) ---
[ 36.7197129] netbsd:syscall+0x2da:
[ 36.7197129] cpu0: End traceback...
[ 36.7313764] fatal breakpoint trap in supervisor mode
[ 36.7313764] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x20000040 ilevel 0x4 rsp 0xffff92824838d6b0
[ 36.7470884] curlwp 0xffff91256d3faa40 pid 1120.1120 lowest kstack 0xffff9282483892c0
Stopped in pid 1120.1120 (syz-executor1656) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
ip_ctloutput() at netbsd:ip_ctloutput+0x15ae sys/netinet/ip_output.c:1091
tcp_ctloutput() at netbsd:tcp_ctloutput+0x2e7 sys/netinet/tcp_usrreq.c:278
tcp_ctloutput_wrapper() at netbsd:tcp_ctloutput_wrapper+-0xdbecb
sosetopt() at netbsd:sosetopt+0x195 sys/kern/uipc_socket.c:1902
sys_setsockopt() at netbsd:sys_setsockopt+0x1a7 sys/kern/uipc_syscalls.c:1202

sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 105 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/ip_output.c:1091:13, member access within null pointer of type 'struct in4pcb'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1198 1198 2 0 0 ffff91256c176140 syz-executor1656
929 929 3 0 180 ffff91256e2c7640 syz-executor1656 socket
1259 1259 2 1 0 ffff91256c86e180 syz-executor1656
1239 1239 2 0 0 ffff91256c1769c0 syz-executor1656
1004 1004 3 0 180 ffff91256adc26c0 syz-executor1656 nanoslp
1120 >1120 7 0 100 ffff91256d3faa40 syz-executor1656
985 985 2 1 140 ffff91256adc2280 syz-executor1656
990 990 3 0 180 ffff91256c86e5c0 syz-executor1656 nanoslp
815 815 3 1 40 ffff91256c86ea00 syz-executor1656 tstile
449 449 2 1 140 ffff91256adc2b00 syz-executor1656
941 941 3 0 180 ffff91256d3fa600 syz-executor1656 nanoslp
1233 1233 2 1 100 ffff91256d3fa1c0 sshd
1222 1222 3 0 180 ffff91256af062c0 getty nanoslp
1184 1184 3 0 180 ffff91256c298540 getty nanoslp
1083 1083 3 1 180 ffff91256aa6f200 getty nanoslp
1195 1195 3 1 1c0 ffff91256aa8dac0 getty ttyraw
1098 1098 3 1 180 ffff91256c176580 sshd select
1095 1095 3 0 180 ffff91256bf1f940 powerd kqueue
698 698 3 0 180 ffff91256c298100 syslogd kqueue
745 745 3 0 180 ffff91256bde9480 dhcpcd poll
742 742 3 0 180 ffff91256aee7300 dhcpcd poll
466 466 3 0 180 ffff91256c4b0900 dhcpcd poll
603 603 3 1 180 ffff91256b53fbc0 dhcpcd poll
292 292 3 0 180 ffff91256af06b40 dhcpcd poll
485 485 3 0 180 ffff91256af06700 dhcpcd poll
291 291 3 0 180 ffff91256b53f340 dhcpcd poll
1 1 3 0 180 ffff91256286b100 init wait
0 732 3 0 200 ffff91256aa6f640 physiod physiod
0 196 3 1 200 ffff91256aa8d680 pooldrain pooldrain
0 195 3 0 200 ffff91256aa8d240 ioflush syncer
0 194 3 0 200 ffff91256aa6fa80 pgdaemon pgdaemon
0 170 3 1 200 ffff9125689afa40 usb7 usbevt
0 169 3 1 200 ffff9125689af600 usb6 usbevt
0 168 3 1 200 ffff9125689af1c0 usb5 usbevt
0 167 3 1 200 ffff91256592aa00 usb4 usbevt
0 166 3 1 200 ffff91256592a5c0 usb3 usbevt
0 165 3 1 200 ffff91256592a180 usb2 usbevt
0 31 3 1 200 ffff9125638fd9c0 usb1 usbevt
0 63 3 1 200 ffff9125638fd580 usb0 usbevt
0 126 3 1 200 ffff9125638fd140 usbtask-dr usbtsk
0 125 3 0 200 ffff91256286b980 usbtask-hc usbtsk
0 124 3 1 200 ffff91256286b540 swwreboot swwreboot
0 123 3 0 200 ffff912560ca1b00 npfgc0 npfgcw
0 122 3 1 200 ffff9125626de940 rt_free rt_free
0 121 3 1 200 ffff9125626de500 unpgc unpgc
0 120 3 0 200 ffff9125626de0c0 key_timehandler key_timehandler
0 119 3 1 200 ffff912562848900 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffff9125628484c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffff912562848080 nd6_timer nd6_timer
0 116 3 1 200 ffff9125628348c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffff912562834480 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffff912562834040 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffff9125627d7bc0 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffff9125626e0740 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffff9125626e0b80 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffff9125627d7340 rt_timer rt_timer
0 109 3 0 200 ffff9125627d7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffff9125626e0300 entbutler entropy
0 99 3 0 200 ffff912562150b40 viomb balloon
0 98 3 1 200 ffff912562150700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffff9125621502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffff912560ca16c0 scsibus0 sccomp
0 29 3 0 200 ffff912560ca1280 pms0 pmsreset
0 28 3 1 200 ffff912560bb4ac0 xcall/1 xcall
0 27 1 1 200 ffff912560bb4680 softser/1
0 > 26 7 1 200 ffff912560bb4240 softclk/1
0 25 1 1 200 ffff912560b87a80 softbio/1
0 24 1 1 200 ffff912560b87640 softnet/1
0 23 1 1 201 ffff912560b87200 idle/1
0 22 3 1 200 ffff91268ef2da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffff91268ef2d600 lnxubdwq lnxubdwq
0 20 3 1 200 ffff91268ef2d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffff91268ef34a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffff91268ef345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffff91268ef34180 lnxrcugc lnxrcugc
0 16 3 0 200 ffff91268ef539c0 sysmon smtaskq
0 15 3 1 200 ffff91268ef53580 pmfsuspend pmfsuspend
0 14 3 0 200 ffff91268ef53140 pmfevent pmfevent
0 13 3 1 200 ffff91268ef5e980 sopendfree sopendfr
0 12 3 0 200 ffff91268ef5e540 ifwdog ifwdog
0 11 3 0 200 ffff91268ef5e100 iflnkst iflnkst
0 10 3 1 200 ffff91268ff93940 nfssilly nfssilly
0 9 3 0 200 ffff91268ff93500 vdrain vdrain
0 8 3 1 200 ffff91268ff930c0 modunload mod_unld
0 7 3 0 200 ffff91268ffbc900 xcall/0 xcall
0 6 1 0 200 ffff91268ffbc4c0 softser/0
0 5 1 0 200 ffff91268ffbc080 softclk/0
0 4 1 0 200 ffff91268ffe98c0 softbio/0
0 3 1 0 200 ffff91268ffe9480 softnet/0
0 2 1 0 201 ffff91268ffe9040 idle/0
0 > 0 7 1 240 ffffffff8673e8c0 swapper
[Locks tracked through LWPs]

****** LWP 1198.1198 (syz-executor1656) @ 0xffff91256c176140, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)

lock address : ffff91256ada65c0

type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffff91256c176140 last held: 0xffff91256c176140
last locked* : netbsd:uvm_fault_internal+0x75d
unlocked : netbsd:amap_wipeout+0x365
owner/count : 0xffff91256c176140 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 1 waiting writers: 0xffff91256c86ea00

* Lock 1 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffff91256baf5580
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffff91256c176140 last held: 0xffff91256c176140
last locked* : netbsd:pmap_enter_ma+0x3c0
unlocked : netbsd:pmap_enter_ma+0xb24
owner field : 0xffff91256c176140 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

* Lock 2 (initialized at netbsd:pmap_ctor+0x9b sys/arch/x86/x86/pmap.c:2861)
lock address : ffff91256baf5588
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x9b

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffff91256c176140 last held: 0xffff91256c176140
last locked* : netbsd:pmap_get_ptp+0x25e
unlocked : netbsd:pmap_get_ptp+0x6dc
owner/count : 0xffff91256c176140 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1259.1259 (syz-executor1656) @ 0xffff91256c86e180, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffff91256baf5f80
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1

relevant lwp : 0xffff91256c86e180 last held: 0xffff91256c86e180
last locked* : netbsd:pmap_enter_ma+0x3c0
unlocked : netbsd:pmap_extract+0x2c8

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1120.1120 (syz-executor1656) @ 0xffff91256d3faa40, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)

lock address : ffff912690469080

type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffff91256d3faa40 last held: 0xffff91256d3faa40

last locked* : netbsd:sosetopt+0x34b
unlocked : netbsd:softint_dispatch+0x3b7

owner field : 0xffff91256d3faa40 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 742.742 (dhcpcd) @ 0xffff91256aee7300, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffff91256aee7300 last held: 000000000000000000