UBSan: Undefined Behavior in tcp_recvoob_wrapper

4 views

Skip to first unread message

syzbot

unread,

Oct 28, 2022, 9:06:43 AM10/28/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16bbc5ce880000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=1ea5b8ef3e323b39073a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8813f5f371a8/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e5d1760d89e4/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1ea5b8...@syzkaller.appspotmail.com

[ 539.5282904] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:937:5, member access within null pointer of type 'struct inpcb'

[ 539.5382796] cpu1: Begin traceback...
[ 539.5582860] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 539.6182847] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 539.6582829] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 539.6982828] tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x2fe tcp_recvoob sys/netinet/tcp_usrreq.c:937 [inline]
[ 539.6982828] tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x2fe sys/netinet/tcp_usrreq.c:2296
[ 539.7482860] soreceive() at netbsd:soreceive+0x776 sys/kern/uipc_socket.c:1184
[ 539.7882862] do_sys_recvmsg_so() at netbsd:do_sys_recvmsg_so+0x518 sys/kern/uipc_syscalls.c:978
[ 539.8282801] sys_recvmsg() at netbsd:sys_recvmsg+0x129 do_sys_recvmsg sys/kern/uipc_syscalls.c:1017 [inline]
[ 539.8282801] sys_recvmsg() at netbsd:sys_recvmsg+0x129 sys/kern/uipc_syscalls.c:740
[ 539.8582820] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 539.8582820] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 539.9082826] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 539.9082826] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 539.9082826] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 539.9182877] --- syscall (number 27 via SYS_syscall) ---
[ 539.9282807] netbsd:syscall+0x2da:
[ 539.9282807] cpu1: End traceback...
[ 539.9382841] fatal breakpoint trap in supervisor mode
[ 539.9382841] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x6250a0 ilevel 0 rsp 0xffff958251590640
[ 539.9482752] curlwp 0xffff94b8c345e280 pid 17716.16887 lowest kstack 0xffff95825158c2c0
Stopped in pid 17716.16887 (syz-executor.3) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x2fe tcp_recvoob sys/netinet/tcp_usrreq.c:937 [inline]
tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x2fe sys/netinet/tcp_usrreq.c:2296
soreceive() at netbsd:soreceive+0x776 sys/kern/uipc_socket.c:1184
do_sys_recvmsg_so() at netbsd:do_sys_recvmsg_so+0x518 sys/kern/uipc_syscalls.c:978
sys_recvmsg() at netbsd:sys_recvmsg+0x129 do_sys_recvmsg sys/kern/uipc_syscalls.c:1017 [inline]
sys_recvmsg() at netbsd:sys_recvmsg+0x129 sys/kern/uipc_syscalls.c:740
sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 27 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:937:5, member access within null pointer of type 'struct inpcb'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
15763 16796 3 1 180 ffff94b8bfe7d9c0 syz-executor.5 parked
15763 15763 2 1 10000000 ffff94b8c1cdca40 syz-executor.5
19382 18738 2 1 100 ffff94b8ccabe700 syz-executor.1
19382 19382 2 1 10040000 ffff94b8bae24640 syz-executor.1
16779 17888 3 1 180 ffff94b8c1cdc1c0 syz-executor.2 parked
16779 16779 2 1 10040000 ffff94b8c345eb00 syz-executor.2
17716>16887 7 1 100 ffff94b8c345e280 syz-executor.3
17716 17716 2 1 10040000 ffff94b8ccabe2c0 syz-executor.3
17477 17046 3 1 180 ffff94b8c0a0aa00 syz-executor.4 parked
17477 17477 2 1 10040000 ffff94b8bf99e080 syz-executor.4
17151 19674 2 1 100 ffff94b8b3cada40 syz-executor.0
17151 17151 2 1 10040000 ffff94b8c1d54640 syz-executor.0
16866 16866 2 1 40140 ffff94b8bb64fa40 syz-executor.2
16291 16291 3 1 1c0 ffff94b8ada7dac0 getty ttyraw
14813 14813 2 1 140 ffff94b8bf40d340 syz-executor.0
15855 15855 2 1 140 ffff94b8c0a0a5c0 syz-executor.1
13650 13650 2 1 140 ffff94b8bf99e4c0 syz-executor.4
12678 12678 2 1 140 ffff94b8b9076780 syz-executor.3
11415 11415 2 1 140 ffff94b8c1d54200 syz-executor.5
10279 10279 3 1 180 ffff94b8bb9192c0 syz-executor.0 parked
9284 9284 3 1 180 ffff94b8c1cdc600 syz-executor.2 parked
9000 9000 3 1 180 ffff94b8bf40dbc0 syz-executor.2 parked
9822 9822 3 1 180 ffff94b8c0a0a180 syz-executor.0 parked
9375 9375 3 1 180 ffff94b8c24f9680 syz-executor.4 parked
9027 9027 3 1 180 ffff94b8c1d54a80 syz-executor.0 parked
11449 11449 3 1 180 ffff94b8bb3c5500 syz-executor.4 parked
9115 9115 3 1 180 ffff94b8bfe7d140 syz-executor.0 parked
9802 9802 3 1 180 ffff94b8c10d0980 syz-executor.0 parked
9098 9098 3 1 180 ffff94b8bf40d780 syz-executor.5 parked
8073 8073 3 1 180 ffff94b8b9076bc0 syz-executor.0 parked
9090 9090 3 1 180 ffff94b8bb3e6b00 syz-executor.5 parked
8948 8948 3 1 180 ffff94b8bfe7d580 syz-executor.5 parked
9025 9025 3 1 180 ffff94b8bf99e900 syz-executor.0 parked
7131 7131 3 1 180 ffff94b8bfed4500 syz-executor.2 parked
8383 8383 3 1 180 ffff94b8c10d0100 syz-executor.4 parked
8336 8336 3 1 180 ffff94b8c10d0540 syz-executor.1 parked
8189 8189 3 1 180 ffff94b8bfed4940 syz-executor.1 parked
10043 10043 3 1 180 ffff94b8bab84280 syz-executor.2 parked
8555 8555 3 1 180 ffff94b8bb6db980 syz-executor.1 parked
8082 8082 3 1 180 ffff94b8bfed40c0 syz-executor.4 parked
9813 9813 3 1 180 ffff94b8bb6db540 syz-executor.4 parked
10547 10547 3 1 180 ffff94b8b7dd08c0 syz-executor.2 parked
7261 7261 3 1 180 ffff94b8b7dd0480 syz-executor.3 parked
4545 4545 3 1 180 ffff94b8bab846c0 syz-executor.3 parked
6396 6396 3 1 180 ffff94b8c00e0300 syz-executor.3 parked
8911 8911 3 1 180 ffff94b8b8881300 syz-executor.3 parked
8935 8935 3 1 180 ffff94b8bb3c50c0 syz-executor.3 parked
8280 8280 3 1 180 ffff94b8bb64f600 syz-executor.3 parked
6142 6142 3 1 180 ffff94b8ae15f740 syz-executor.0 parked
6134 6134 3 1 180 ffff94b8ade8eb40 syz-executor.0 parked
7007 7007 3 1 180 ffff94b8b8bfd200 syz-executor.3 parked
7632 7632 3 1 180 ffff94b8aee19900 syz-executor.0 parked
8271 8271 3 1 180 ffff94b8ae15fb80 syz-executor.0 parked
6072 6072 3 1 180 ffff94b8c00e0b80 syz-executor.3 parked
1611 1611 3 1 180 ffff94b8bb647900 syz-executor.4 parked
2359 2359 3 1 180 ffff94b8b9076340 syz-executor.4 parked
2362 2362 3 1 180 ffff94b8b8881b80 syz-executor.4 parked
2513 2513 3 1 180 ffff94b8bab84b00 syz-executor.1 parked
2005 2005 3 1 180 ffff94b8bae1b8c0 syz-executor.1 parked
2357 2357 3 1 180 ffff94b8bb36b2c0 syz-executor.1 parked
1230 2608 3 1 180 ffff94b8bb647080 syz-fuzzer parked
1230 1204 3 1 180 ffff94b8b8bfd640 syz-fuzzer wait
1230 1199 3 1 1c0 ffff94b8afb62a00 syz-fuzzer wait
1230 1386 3 1 1c0 ffff94b8aec97500 syz-fuzzer wait
1230 1239 2 1 140 ffff94b8aec97940 syz-fuzzer
1230 813 3 1 1c0 ffff94b8ae15f300 syz-fuzzer wait
1230 1241 3 1 180 ffff94b8aec970c0 syz-fuzzer wait
1230 1120 3 1 180 ffff94b8afb625c0 syz-fuzzer parked
1230 929 3 1 180 ffff94b8afb81100 syz-fuzzer parked
1230 1080 3 1 180 ffff94b8adde2280 syz-fuzzer parked
1230 980 3 1 180 ffff94b8aee194c0 syz-fuzzer parked
1230 1225 3 1 180 ffff94b8af78d9c0 syz-fuzzer wait
1230 1226 2 1 140 ffff94b8adde26c0 syz-fuzzer
1230 1230 3 1 180 ffff94b8afb62180 syz-fuzzer parked
1229 1229 3 1 180 ffff94b8adde2b00 sshd select
1184 1184 3 1 180 ffff94b8af78d140 getty nanoslp
1195 1195 3 1 180 ffff94b8afb81540 getty nanoslp
1223 1223 3 1 180 ffff94b8ada67200 getty nanoslp
1107 1107 3 1 180 ffff94b8af78d580 sshd select
1094 1094 3 1 180 ffff94b8afb81980 powerd kqueue
702 702 3 1 180 ffff94b8ae3ae040 syslogd kqueue
747 747 3 1 180 ffff94b8ade8e700 dhcpcd poll
742 742 3 1 180 ffff94b8ae237340 dhcpcd poll
466 466 3 1 180 ffff94b8ae3ae8c0 dhcpcd poll
598 598 3 1 180 ffff94b8ae3ae480 dhcpcd poll
292 292 3 1 180 ffff94b8ae237bc0 dhcpcd poll
485 485 3 1 180 ffff94b8ae237780 dhcpcd poll
291 291 3 1 180 ffff94b8ade8e2c0 dhcpcd poll
1 1 3 1 180 ffff94b8a5880140 init wait
0 17368 5 1 200 ffff94b8bb3b6140 (zombie)
0 14209 3 1 200 ffff94b8b7dd0040 ktrace ktrwait
0 6543 3 1 200 ffff94b8b8bfda80 ktrace ktrwait
0 4992 3 1 200 ffff94b8bb3b69c0 ktrace ktrwait
0 7099 3 1 200 ffff94b8bb3e66c0 ktrace ktrwait
0 7272 3 1 200 ffff94b8bb36bb40 ktrace ktrwait
0 7404 3 1 200 ffff94b8aee19080 ktrace ktrwait
0 5460 3 1 200 ffff94b8bb919700 ktrace ktrwait
0 3551 3 1 200 ffff94b8b3cad1c0 ktrace ktrwait
0 968 3 1 200 ffff94b8ada67640 physiod physiod
0 196 3 1 200 ffff94b8ada7d680 pooldrain pooldrain
0 195 3 1 200 ffff94b8ada7d240 ioflush syncer
0 194 3 1 200 ffff94b8ada67a80 pgdaemon pgdaemon
0 170 3 1 200 ffff94b8ab9a7a40 usb7 usbevt
0 169 3 1 200 ffff94b8ab9a7600 usb6 usbevt
0 168 3 1 200 ffff94b8ab9a71c0 usb5 usbevt
0 167 3 1 200 ffff94b8a893aa00 usb4 usbevt
0 166 3 1 200 ffff94b8a893a5c0 usb3 usbevt
0 165 3 1 200 ffff94b8a893a180 usb2 usbevt
0 31 3 1 200 ffff94b8a58809c0 usb1 usbevt
0 63 3 1 200 ffff94b8a56e0740 usb0 usbevt
0 126 3 1 200 ffff94b8a56e0b80 usbtask-dr usbtsk
0 125 3 1 200 ffff94b8a57d7340 usbtask-hc usbtsk
0 124 3 1 200 ffff94b8a3ca1b00 swwreboot swwreboot
0 123 3 1 200 ffff94b8a5880580 npfgc0 npfgcw
0 122 3 1 200 ffff94b8a585b980 rt_free rt_free
0 121 3 1 200 ffff94b8a585b540 unpgc unpgc
0 120 3 1 200 ffff94b8a585b100 key_timehandler key_timehandler
0 119 3 1 200 ffff94b8a583e940 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffff94b8a583e500 icmp6_wqinput/0 icmp6_wqinput
0 117 3 1 200 ffff94b8a583e0c0 nd6_timer nd6_timer
0 116 3 1 200 ffff94b8a582a900 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffff94b8a582a4c0 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffff94b8a582a080 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffff94b8a580c8c0 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffff94b8a580c480 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffff94b8a580c040 icmp_wqinput/0 icmp_wqinput
0 110 3 1 200 ffff94b8a57d7bc0 rt_timer rt_timer
0 109 3 1 200 ffff94b8a57d7780 vmem_rehash vmem_rehash
0 100 3 1 200 ffff94b8a56e0300 entbutler entropy
0 99 3 1 200 ffff94b8a5150b40 viomb balloon
0 98 3 1 200 ffff94b8a5150700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffff94b8a51502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffff94b8a3ca16c0 scsibus0 sccomp
0 29 3 1 200 ffff94b8a3ca1280 pms0 pmsreset
0 28 3 1 200 ffff94b8a3bb4ac0 xcall/1 xcall
0 27 1 1 200 ffff94b8a3bb4680 softser/1
0 26 1 1 200 ffff94b8a3bb4240 softclk/1
0 25 1 1 200 ffff94b8a3b87a80 softbio/1
0 24 1 1 200 ffff94b8a3b87640 softnet/1
0 23 1 1 201 ffff94b8a3b87200 idle/1
0 22 3 1 200 ffff94b9d1f2da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffff94b9d1f2d600 lnxubdwq lnxubdwq
0 20 3 1 200 ffff94b9d1f2d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffff94b9d1f34a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffff94b9d1f345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffff94b9d1f34180 lnxrcugc lnxrcugc
0 16 3 1 200 ffff94b9d1f539c0 sysmon smtaskq
0 15 3 1 200 ffff94b9d1f53580 pmfsuspend pmfsuspend
0 14 3 1 200 ffff94b9d1f53140 pmfevent pmfevent
0 13 3 1 200 ffff94b9d1f5e980 sopendfree sopendfr
0 12 3 1 200 ffff94b9d1f5e540 ifwdog ifwdog
0 11 3 1 200 ffff94b9d1f5e100 iflnkst iflnkst
0 10 3 1 200 ffff94b9d2f93940 nfssilly nfssilly
0 9 3 1 200 ffff94b9d2f93500 vdrain vdrain
0 8 3 1 200 ffff94b9d2f930c0 modunload mod_unld
0 7 3 0 200 ffff94b9d2fbc900 xcall/0 xcall
0 6 1 0 200 ffff94b9d2fbc4c0 softser/0
0 5 3 0 200 ffff94b9d2fbc080 softclk/0 tstile
0 4 1 0 200 ffff94b9d2fe98c0 softbio/0
0 3 1 0 200 ffff94b9d2fe9480 softnet/0
0 > 2 1 0 201 ffff94b9d2fe9040 idle/0
0 0 3 1 200 ffffffff8673e8c0 swapper uvm
[Locks tracked through LWPs]

****** LWP 17716.16887 (syz-executor.3) @ 0xffff94b8c345e280, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)
lock address : ffff94b9d3469080
type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff94b8c345e280 last held: 0xffff94b8c345e280
last locked* : netbsd:soreceive+0x6bf
unlocked : netbsd:pffasttimo+0xc6
owner field : 0xffff94b8c345e280 wait/spin: 1/0
Turnstile:
=> 0 waiting readers:
=> 1 waiting writers: 0xffff94b9d2fbc080

*** Locks wanted: none

****** LWP 742.742 (dhcpcd) @ 0xffff94b8ae237340, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff94b8ae237340 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 466.466 (dhcpcd) @ 0xffff94b8ae3ae8c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff94b8ae3ae8c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xffff94b8ae237780, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff94b8ae237780 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xffff94b8ade8e2c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff94b8ade8e2c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffff94b9d1f5e100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff94b9d1f5e100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffff94b9d2fbc080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff94b9d2fbc080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff8673e8c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffffff8673e8c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu1:

* Lock 0 (initialized at netbsd:main+0x106 sys/kern/init_main.c:303)
lock address : netbsd:kernel_lock
type : spin
initialized : netbsd:main+0x106
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff94b8c345e280 last held: 0xffff94b8c345e280
last locked* : netbsd:tcp_recvoob_wrapper+0x29
unlocked : netbsd:hci_attach_wrapper+0xd3
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at netbsd:kprintf_init+0x72 sys/kern/subr_prf.c:155)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x72
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff94b8c345e280 last held: 0xffff94b8c345e280
last locked* : netbsd:kprintf_lock+0x50
unlocked : netbsd:kprintf_unlock+0x70
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffff958000007180 0045 00000000 0x0 0x0
0xffff958000007200 0045 00000000 0x0 0x0
0xffff958000007280 0045 00000000 0x0 0x0
0xffff958000007300 0045 00000000 0x0 0x0
0xffff958000007380 0045 00000000 0x0 0x0
0xffff958000007400 0045 00000000 0x0 0x0
0xffff958000007480 0045 00000000 0x0 0x0
0xffff958000007500 0045 00000000 0x0 0x0
0xffff958000007580 0045 00000000 0x0 0x0
0xffff958000007600 0045 00000000 0x0 0x0
0xffff958000007680 0045 00000000 0x0 0x0
0xffff958000007700 0041 00000000 0x0 0x0
0xffff958000007780 0041 00000000 0x0 0x0
0xffff958000007800 0041 00000000 0x0 0x0
0xffff958000007880 0041 00000000 0x0 0x0
0xffff958000007900 0045 00000000 0x0 0x0
0xffff958000007980 0041 00000000 0x0 0x0
0xffff958000007a00 0041 00000000 0x0 0x0
0xffff958000007a80 0041 00000000 0x0 0x0
0xffff958000007b00 0041 00000000 0x0 0x0
0xffff958000007b80 0041 00000000 0x0 0x0
0xffff958000007c00 0041 00000000 0x0 0x0
0xffff958000007c80 0041 00000000 0x0 0x0
0xffff958000007d00 0041 00000000 0x0 0x0
0xffff958000007d80 0041 00000000 0x0 0x0
0xffff958000007e00 0041 00000000 0x0 0x0
0xffff958000007e80 0041 00000000 0x0 0x0
0xffff958000007f00 0041 00000000 0x0 0x0
0xffff958000007f80 0041 00000000 0x0 0x0
0xffff958000008000 0041 00000000 0x0 0x0
0xffff958000008080 0041 00000000 0x0 0x0
0xffff958000008100 0041 00000000 0x0 0x0
0xffff958000008180 0041 00000000 0x0 0x0
0xffff958000008200 0041 00000000 0x0 0x0
0xffff958000008280 0041 00000000 0x0 0x0
0xffff958000008300 0041 00000000 0x0 0x0
0xffff958000008380 0041 00000000 0x0 0x0
0xffff958000008400 0041 00000000 0x0 0x0
0xffff958000008480 0041 00000000 0x0 0x0
0xffff958000008500 0041 00000000 0x0 0x0
0xffff958000008580 0041 00000000 0x0 0x0
0xffff958000008600 0045 00000000 0x0 0x0
0xffff958000008680 0041 00000000 0x0 0x0
0xffff958000008700 0041 00000000 0x0 0x0
0xffff958000008780 0041 00000000 0x0 0x0
0xffff958000008800 0045 00000000 0x0 0x0
0xffff958000008880 0041 00000000 0x0 0x0
0xffff958000008900 0041 00000000 0x0 0x0
0xffff958000008980 0041 00000000 0x0 0x0
0xffff958000008a00 0041 00000000 0x0 0x0
0xffff958000008a80 0041 00000000 0x0 0x0
0xffff958000008b00 0041 00000000 0x0 0x0
0xffff958000008b80 0041 00000000 0x0 0x0
0xffff958000008c00 0041 00000000 0x0 0x0
0xffff958000008c80 0041 00000000 0x0 0x0
0xffff958000008d00 0041 00000000 0x0 0x0
0xffff958000008d80 0041 00000000 0x0 0x0
0xffff958000008e00 0041 00000000 0x0 0x0
0xffff958000008e80 0041 00000000 0x0 0x0
0xffff958000008f00 0041 00000000 0x0 0x0
0xffff958000008f80 0041 00000000 0x0 0x0
0xffff958000009000 0041 00000000 0x0 0x0
0xffff958000009080 0045 00000000 0x0 0x0
0xffff958000009100 0041 00000000 0x0 0x0
0xffff958000009180 0041 00000000 0x0 0x0
0xffff958000009200 0041 00000000 0x0 0x0
0xffff958000009280 0041 00000000 0x0 0x0
0xffff958000009300 0041 00000000 0x0 0x0
0xffff958000009380 0041 00000000 0x0 0x0
0xffff958000009400 0041 00000000 0x0 0x0
0xffff958000009480 0041 00000000 0x0 0x0
0xffff958000009500 0041 00000000 0x0 0x0
0xffff958000009580 0041 00000000 0x0 0x0
0xffff958000009600 0041 00000000 0x0 0x0
0xffff958000009680 0041 00000000 0x0 0x0
0xffff958000009700 0041 00000000 0x0 0x0
0xffff958000009780 0041 00000000 0x0 0x0
0xffff958000009800 0041 00000000 0x0 0x0
0xffff958000009880 0041 00000000 0x0 0x0
0xffff958000009900 0041 00000000 0x0 0x0
0xffff958000009980 0041 00000000 0x0 0x0
0xffff958000009a00 0041 00000000 0x0 0x0
0xffff958000009a80 0041 00000000 0x0 0x0
0xffff958000009b00 0041 00000000 0x0 0x0
0xffff958000009b80 0041 00000000 0x0 0x0
0xffff958000009c00 0041 00000000 0x0 0x0
0xffff958000009c80 0041 00000000 0x0 0x0
0xffff958000009d00 0041 00000000 0x0 0x0
0xffff958000009d80 0041 00000000 0x0 0x0
0xffff958000009e00 0041 00000000 0x0 0x0
0xffff958000009e80 0045 00000000 0x0 0x0
0xffff958000009f00 0041 00000000 0x0 0x0
0xffff958000009f80 0041 00000000 0x0 0x0
0xffff95800000a000 0041 00000000 0x0 0x0
0xffff95800000a080 0041 00000000 0x0 0x0
0xffff95800000a100 0041 00000000 0x0 0x0
0xffff95800000a180 0041 00000000 0x0 0x0
0xffff95800000a200 0041 00000000 0x0 0x0
0xffff95800000a280 0041 00000000 0x0 0x0
0xffff95800000a300 0041 00000000 0x0 0x0
0xffff95800000a380 0041 00000000 0x0 0x0
0xffff95800000a400 0041 00000000 0x0 0x0
0xffff95800000a480 0041 00000000 0x0 0x0
0xffff95800000a500 0041 00000000 0x0 0x0
0xffff95800000a580 0041 00000000 0x0 0x0
0xffff95800000a600 0041 00000000 0x0 0x0
0xffff95800000a680 0041 00000000 0x0 0x0
0xffff95800000a700 0041 00000000 0x0 0x0
0xffff95800000a780 0041 00000000 0x0 0x0
0xffff95800000a800 0041 00000000 0x0 0x0
0xffff95800000a880 0041 00000000 0x0 0x0
0xffff95800000a900 0041 00000000 0x0 0x0
0xffff95800000a980 0041 00000000 0x0 0x0
0xffff95800000aa00 0041 00000000 0x0 0x0
0xffff95800000aa80 0041 00000000 0x0 0x0
0xffff95800000ab00 0041 00000000 0x0 0x0
0xffff95800000ab80 0041 00000000 0x0 0x0
0xffff95800000ac00 0041 00000000 0x0 0x0
0xffff95800000ac80 0041 00000000 0x0 0x0
0xffff95800000ad00 0041 00000000 0x0 0x0
0xffff95800000ad80 0041 00000000 0x0 0x0
0xffff95800000ae00 0041 00000000 0x0 0x0
0xffff95800000ae80 0041 00000000 0x0 0x0
0xffff95800000af00 0045 00000000 0x0 0x0
0xffff95800000af80 0045 00000000 0x0 0x0
0xffff95800000b000 0041 00000000 0x0 0x0
0xffff95800000b080 0041 00000000 0x0 0x0
0xffff95800000b100 0041 00000000 0x0 0x0
0xffff95800000b180 0045 00000000 0x0 0x0
0xffff95800000b200 0041 00000000 0x0 0x0
0xffff95800000b280 0045 00000000 0x0 0x0
0xffff95800000b300 0045 00000000 0x0 0x0
0xffff95800000b380 0045 00000000 0x0 0x0
0xffff95800000b400 0041 00000000 0x0 0x0
0xffff95800000b480 0041 00000000 0x0 0x0
0xffff95800000b500 0045 00000000 0x0 0x0
0xffff95800000b580 0045 00000000 0x0 0x0
0xffff95800000b600 0045 00000000 0x0 0x0
0xffff95800000b680 0045 00000000 0x0 0x0
0xffff95800000b700 0045 00000000 0x0 0x0
0xffff95800000b780 0045 00000000 0x0 0x0
0xffff95800000b800 0045 00000000 0x0 0x0
0xffff95800000b880 0041 00000000 0x0 0x0
0xffff95800000b900 0045 00000000 0x0 0x0
0xffff95800000b980 0045 00000000 0x0 0x0
0xffff95800000ba00 0045 00000000 0x0 0x0
0xffff95800000ba80 0045 00000000 0x0 0x0
0xffff95800000bb00 0045 00000000 0x0 0x0
0xffff95800000bb80 0045 00000000 0x0 0x0
0xffff95800000bc00 0045 00000000 0x0 0x0
0xffff95800000bc80 0041 00000000 0x0 0x0
0xffff95800000bd00 0045 00000000 0x0 0x0
0xffff95800000bd80 0045 00000000 0x0 0x0
0xffff95800000be00 0045 00000000 0x0 0x0
0xffff95800000be80 0045 00000000 0x0 0x0
0xffff95800000bf00 0045 00000000 0x0 0x0
0xffff95800000bf80 0045 00000000 0x0 0x0
0xffff95800000c000 0045 00000000 0x0 0x0
0xffff95800000c080 0045 00000000 0x0 0x0
0xffff95800000c100 0045 00000000 0x0 0x0
0xffff95800000c180 0045 00000000 0x0 0x0
0xffff95800000c200 0045 00000000 0x0 0x0
0xffff95800000c280 0045 00000000 0x0 0x0
0xffff95800000c300 0045 00000000 0x0 0x0
0xffff95800000c380 0045 00000000 0x0 0x0
0xffff95800000c400 0045 00000000 0x0 0x0
0xffff95800000c480 0045 00000000 0x0 0x0
0xffff95800000c500 0045 00000000 0x0 0x0
0xffff95800000c580 0045 00000000 0x0 0x0
0xffff95800000c600 0045 00000000 0x0 0x0
0xffff95800000c680 0045 00000000 0x0 0x0
0xffff95800000c700 0041 00000000 0x0 0x0
0xffff95800000c780 0041 00000000 0x0 0x0
0xffff95800000c800 0045 00000000 0x0 0x0
0xffff95800000c880 0045 00000000 0x0 0x0
0xffff95800000c900 0045 00000000 0x0 0x0
0xffff95800000c980 0045 00000000 0x0 0x0
0xffff95800000ca00 0045 00000000 0x0 0x0
0xffff95800000ca80 0045 00000000 0x0 0x0
0xffff95800000cb00 0041 00000000 0x0 0x0
0xffff95800000cb80 0041 00000000 0x0 0x0
0xffff95800000cc00 0045 00000000 0x0 0x0
0xffff95800000cc80 0045 00000000 0x0 0x0
0xffff95800000cd00 0045 00000000 0x0 0x0
0xffff95800000cd80 0041 00000000 0x0 0x0
0xffff95800000ce00 0045 00000000 0x0 0x0
0xffff95800000ce80 0041 00000000 0x0 0x0
0xffff95800000cf00 0041 00000000 0x0 0x0
0xffff95800000cf80 0041 00000000 0x0 0x0
0xffff95800000d000 0041 00000000 0x0 0x0
0xffff95800000d080 0045 00000000 0x0 0x0
0xffff95800000d100 0041 00000000 0x0 0x0
0xffff95800000d180 0041 00000000 0x0 0x0
0xffff95800000d200 0041 00000000 0x0 0x0
0xffff95800000d280 0041 00000000 0x0 0x0
0xffff95800000d300 0045 00000000 0x0 0x0
0xffff95800000d380 0041 00000000 0x0 0x0
0xffff95800000d400 0041 00000000 0x0 0x0
0xffff95800000d480 0045 00000000 0x0 0x0
0xffff95800000d500 0041 00000000 0x0 0x0
0xffff95800000d580 0041 00000000 0x0 0x0
0xffff95800000d600 0041 00000000 0x0 0x0
0xffff95800000d680 0041 00000000 0x0 0x0
0xffff95800000d700 0041 00000000 0x0 0x0
0xffff95800000d780 0045 00000000 0x0 0x0
0xffff95800000d800 0041 00000000 0x0 0x0
0xffff95800000d880 0041 00000000 0x0 0x0
0xffff95800000d900 0041 00000000 0x0 0x0
0xffff95800000d980 0041 00000000 0x0 0x0
0xffff95800000da00 0041 00000000 0x0 0x0
0xffff95800000da80 0045 00000000 0x0 0x0
0xffff95800000db00 0045 00000000 0x0 0x0
0xffff95800000db80 0045 00000000 0x0 0x0
0xffff95800000dc00 0041 00000000 0x0 0x0
0xffff95800000dc80 0041 00000000 0x0 0x0
0xffff95800000dd00 0041 00000000 0x0 0x0
0xffff95800000dd80 0041 00000000 0x0 0x0
0xffff95800000de00 0041 00000000 0x0 0x0
0xffff95800000de80 0041 00000000 0x0 0x0
0xffff95800000df00 0045 00000000 0x0 0x0
0xffff95800000df80 0045 00000000 0x0 0x0
0xffff95800000e000 0045 00000000 0x0 0x0
0xffff95800000e080 0041 00000000 0x0 0x0
0xffff95800000e100 0041 00000000 0x0 0x0
0xffff95800000e180 0045 00000000 0x0 0x0
0xffff95800000e200 0041 00000000 0x0 0x0
0xffff95800000e280 0041 00000000 0x0 0x0
0xffff95800000e300 0045 00000000 0x0 0x0
0xffff95800000e380 0041 00000000 0x0 0x0
0xffff95800000e400 0045 00000000 0x0 0x0
0xffff95800000e480 0041 00000000 0x0 0x0
0xffff95800000e500 0045 00000000 0x0 0x0
0xffff95800000e580 0041 00000000 0x0 0x0
0xffff95800000e600 0045 00000000 0x0 0x0
0xffff95800000e680 0045 00000000 0x0 0x0
0xffff95800000e700 0041 00000000 0x0 0x0
0xffff95800000e780 0041 00000000 0x0 0x0
0xffff95800000e800 0045 00000000 0x0 0x0
0xffff95800000e880 0045 00000000 0x0 0x0
0xffff95800000e900 0041 00000000 0x0 0x0
0xffff95800000e980 0041 00000000 0x0 0x0
0xffff95800000ea00 0041 00000000 0x0 0x0
0xffff95800000ea80 0041 00000000 0x0 0x0
0xffff95800000eb00 0041 00000000 0x0 0x0
0xffff95800000eb80 0045 00000000 0x0 0x0
0xffff95800000ec00 0041 00000000 0x0 0x0
0xffff95800000ec80 0041 00000000 0x0 0x0
0xffff95800000ed00 0041 00000000 0x0 0x0
0xffff95800000ed80 0041 00000000 0x0 0x0
0xffff95800000ee00 0041 00000000 0x0 0x0
0xffff95800000ee80 0045 00000000 0x0 0x0
0xffff95800000ef00 0041 00000000 0x0 0x0
0xffff95800000ef80 0041 00000000 0x0 0x0
0xffff95800000f000 0041 00000000 0x0 0x0
0xffff95800000f080 0045 00000000 0x0 0x0
0xffff95800000f100 0041 00000000 0x0 0x0
0xffff95800000f180 0041 00000000 0x0 0x0
0xffff95800000f200 0041 00000000 0x0 0x0
0xffff95800000f280 0041 00000000 0x0 0x0
0xffff95800000f300 0041 00000000 0x0 0x0
0xffff95800000f380 0041 00000000 0x0 0x0
0xffff95800000f400 0045 00000000 0x0 0x0
0xffff95800000f480 0041 00000000 0x0 0x0
0xffff95800000f500 0041 00000000 0x0 0x0
0xffff95800000f580 0041 00000000 0x0 0x0
0xffff95800000f600 0041 00000000 0x0 0x0
0xffff95800000f680 0045 00000000 0x0 0x0
0xffff95800000f700 0041 00000000 0x0 0x0
0xffff95800000f780 0041 00000000 0x0 0x0
0xffff95800000f800 0041 00000000 0x0 0x0
0xffff95800000f880 0045 00000000 0x0 0x0
0xffff95800000f900 0041 00000000 0x0 0x0
0xffff95800000f980 0045 00000000 0x0 0x0
0xffff95800000fa00 0041 00000000 0x0 0x0
0xffff95800000fa80 0041 00000000 0x0 0x0
0xffff95800000fb00 0041 00000000 0x0 0x0
0xffff95800000fb80 0041 00000000 0x0 0x0
0xffff95800000fc00 0045 00000000 0x0 0x0
0xffff95800000fc80 0041 00000000 0x0 0x0
0xffff95800000fd00 0045 00000000 0x0 0x0
0xffff95800000fd80 0041 00000000 0x0 0x0
0xffff95800000fe00 0041 00000000 0x0 0x0
0xffff95800000fe80 0041 00000000 0x0 0x0
0xffff95800000ff00 0041 00000000 0x0 0x0
0xffff95800000ff80 0041 00000000 0x0 0x0
0xffff958000010000 0041 00000000 0x0 0x0
0xffff958000010080 0041 00000000 0x0 0x0
0xffff958000010100 0041 00000000 0x0 0x0
0xffff958000010180 0045 00000000 0x0 0x0
0xffff958000010200 0045 00000000 0x0 0x0
0xffff958000010280 0041 00000000 0x0 0x0
0xffff958000010300 0041 00000000 0x0 0x0
0xffff958000010380 0041 00000000 0x0 0x0
0xffff958000010400 0041 00000000 0x0 0x0
0xffff958000010480 0045 00000000 0x0 0x0
0xffff958000010500 0045 00000000 0x0 0x0
0xffff958000010580 0041 00000000 0x0 0x0
0xffff958000010600 0041 00000000 0x0 0x0
0xffff958000010680 0041 00000000 0x0 0x0
0xffff958000010700 0041 00000000 0x0 0x0
0xffff958000010780 0041 00000000 0x0 0x0
0xffff958000010800 0041 00000000 0x0 0x0
0xffff958000010880 0041 00000000 0x0 0x0
0xffff958000010900 0041 00000000 0x0 0x0
0xffff958000010980 0045 00000000 0x0 0x0
0xffff958000010a00 0045 00000000 0x0 0x0
0xffff958000010a80 0045 00000000 0x0 0x0
0xffff958000010b00 0041 00000000 0x0 0x0
0xffff958000010b80 0041 00000000 0x0 0x0
0xffff958000010c00 0041 00000000 0x0 0x0
0xffff958000010c80 0045 00000000 0x0 0x0
0xffff958000010d00 0041 00000000 0x0 0x0
0xffff958000010d80 0041 00000000 0x0 0x0
0xffff958000010e00 0041 00000000 0x0 0x0
0xffff958000010e80 0041 00000000 0x0 0x0
0xffff958000010f00 0041 00000000 0x0 0x0
0xffff958000010f80 0041 00000000 0x0 0x0
0xffff958000011000 0041 00000000 0x0 0x0
0xffff958000011080 0041 00000000 0x0 0x0
0xffff958000011100 0041 00000000 0x0 0x0
0xffff958000011180 0041 00000000 0x0 0x0
0xffff958000011200 0045 00000000 0x0 0x0
0xffff958000011280 0045 00000000 0x0 0x0
0xffff958000011300 0041 00000000 0x0 0x0
0xffff958000011380 0041 00000000 0x0 0x0
0xffff958000011400 0041 00000000 0x0 0x0
0xffff958000011480 0041 00000000 0x0 0x0
0xffff958000011500 0045 00000000 0x0 0x0
0xffff958000011580 0041 00000000 0x0 0x0
0xffff958000011600 0041 00000000 0x0 0x0
0xffff958000011680 0041 00000000 0x0 0x0
0xffff958000011700 0045 00000000 0x0 0x0
0xffff958000011780 0045 00000000 0x0 0x0
0xffff958000011800 0041 00000000 0x0 0x0
0xffff958000011880 0041 00000000 0x0 0x0
0xffff958000011900 0041 00000000 0x0 0x0
0xffff958000011980 0041 00000000 0x0 0x0
0xffff958000011a00 0041 00000000 0x0 0x0
0xffff958000011a80 0041 00000000 0x0 0x0
0xffff958000011b00 0041 00000000 0x0 0x0
0xffff958000011b80 0041 00000000 0x0 0x0
0xffff958000011c00 0041 00000000 0x0 0x0
0xffff958000011c80 0041 00000000 0x0 0x0
0xffff958000011d00 0041 00000000 0x0 0x0
0xffff958000011d80 0041 00000000 0x0 0x0
0xffff958000011e00 0045 00000000 0x0 0x0
0xffff958000011e80 0041 00000000 0x0 0x0
0xffff958000011f00 0041 00000000 0x0 0x0
0xffff958000011f80 0041 00000000 0x0 0x0
0xffff958000012000 0041 00000000 0x0 0x0
0xffff958000012080 0041 00000000 0x0 0x0
0xffff958000012100 0045 00000000 0x0 0x0
0xffff958000012180 0045 00000000 0x0 0x0
0xffff958000012200 0041 00000000 0x0 0x0
0xffff958000012280 0041 00000000 0x0 0x0
0xffff958000012300 0041 00000000 0x0 0x0
0xffff958000012380 0041 00000000 0x0 0x0
0xffff958000012400 0041 00000000 0x0 0x0
0xffff958000012480 0041 00000000 0x0 0x0
0xffff958000012500 0041 00000000 0x0 0x0
0xffff958000012580 0041 00000000 0x0 0x0
0xffff958000012600 0041 00000000 0x0 0x0
0xffff958000012680 0045 00000000 0x0 0x0
0xffff958000012700 0041 00000000 0x0 0x0
0xffff958000012780 0041 00000000 0x0 0x0
0xffff958000012800 0041 00000000 0x0 0x0
0xffff958000012880 0045 00000000 0x0 0x0
0xffff958000012900 0001 00000000 0x0 0x0
0xffff958000012980 0001 00000000 0x0 0x0
0xffff958000012a00 0001 00000000 0x0 0x0
0xffff958000012a80 0001 00000000 0x0 0x0
0xffff958000012b00 0001 00000000 0x0 0x0
0xffff958000012b80 0001 00000000 0x0 0x0
0xffff958000012c00 0001 00000000 0x0 0x0
0xffff958000012c80 0001 00000000 0x0 0x0
0xffff958000012d00 0001 00000000 0x0 0x0
0xffff958000012d80 0001 00000000 0x0 0x0
0xffff958000012e00 0001 00000000 0x0 0x0
0xffff958000012e80 0001 00000000 0x0 0x0
0xffff958000012f00 0001 00000000 0x0 0x0
0xffff958000012f80 0001 00000000 0x0 0x0
0xffff958000013000 0001 00000000 0x0 0x0
0xffff958000013080 0001 00000000 0x0 0x0
0xffff958000013100 0001 00000000 0x0 0x0
0xffff958000013180 0001 00000000 0x0 0x0
0xffff958000013200 0001 00000000 0x0 0x0
0xffff958000013280 0001 00000000 0x0 0x0
0xffff958000013300 0001 00000000 0x0 0x0
0xffff958000013380 0001 00000000 0x0 0x0
0xffff958000013400 0001 00000000 0x0 0x0
0xffff958000013480 0001 00000000 0x0 0x0
0xffff958000013500 0001 00000000 0x0 0x0
0xffff958000013580 0001 00000000 0x0 0x0
0xffff958000013600 0001 00000000 0x0 0x0
0xffff958000013680 0001 00000000 0x0 0x0
0xffff958000013700 0001 00000000 0x0 0x0
0xffff958000013780 0001 00000000 0x0 0x0
0xffff958000013800 0001 00000000 0x0 0x0
0xffff958000013880 0001 00000000 0x0 0x0
0xffff958000013900 0001 00000000 0x0 0x0
0xffff958000013980 0001 00000000 0x0 0x0
0xffff958000013a00 0001 00000000 0x0 0x0
0xffff958000013a80 0001 00000000 0x0 0x0
0xffff958000013b00 0001 00000000 0x0 0x0
0xffff958000013b80 0001 00000000 0x0 0x0
0xffff958000013c00 0001 00000000 0x0 0x0
0xffff958000013c80 0001 00000000 0x0 0x0
0xffff958000013d00 0001 00000000 0x0 0x0
0xffff958000013d80 0001 00000000 0x0 0x0
0xffff958000013e00 0001 00000000 0x0 0x0
0xffff958000013e80 0001 00000000 0x0 0x0
0xffff958000013f00 0001 00000000 0x0 0x0
0xffff958000013f80 0001 00000000 0x0 0x0
0xffff958000014000 0001 00000000 0x0 0x0
0xffff958000014080 0001 00000000 0x0 0x0
0xffff958000014100 0001 00000000 0x0 0x0
0xffff958000014180 0001 00000000 0x0 0x0
0xffff958000014200 0001 00000000 0x0 0x0
0xffff958000014280 0001 00000000 0x0 0x0
0xffff958000014300 0001 00000000 0x0 0x0
0xffff958000014380 0001 00000000 0x0 0x0
0xffff958000014400 0041 00000000 0x0 0x0
0xffff958000014480 0041 00000000 0x0 0x0
0xffff958000014500 0041 00000000 0x0 0x0
0xffff958000014580 0041 00000000 0x0 0x0
0xffff958000014600 0041 00000000 0x0 0x0
0xffff958000014680 0041 00000000 0x0 0x0
0xffff958000014700 0041 00000000 0x0 0x0
0xffff958000014780 0041 00000000 0x0 0x0
0xffff958000014800 0041 00000000 0x0 0x0
0xffff958000014880 0041 00000000 0x0 0x0
0xffff958000014900 0041 00000000 0x0 0x0
0xffff958000014980 0041 00000000 0x0 0x0
0xffff958000014a00 0041 00000000 0x0 0x0
0xffff958000014a80 0041 00000000 0x0 0x0
0xffff958000014b00 0041 00000000 0x0 0x0
0xffff958000014b80 0041 00000000 0x0 0x0
0xffff958000014c00 0041 00000000 0x0 0x0
0xffff958000014c80 0041 00000000 0x0 0x0
0xffff958000014d00 0041 00000000 0x0 0x0
0xffff958000014d80 0041 00000000 0x0 0x0
0xffff958000014e00 0041 00000000 0x0 0x0
0xffff958000014e80 0041 00000000 0x0 0x0
0xffff958000014f00 0041 00000000 0x0 0x0
0xffff958000014f80 0041 00000000 0x0 0x0
0xffff958000015000 0041 00000000 0x0 0x0
0xffff958000015080 0041 00000000 0x0 0x0
0xffff958000015100 0041 00000000 0x0 0x0
0xffff958000015180 0041 00000000 0x0 0x0
0xffff958000015200 0041 00000000 0x0 0x0
0xffff958000015280 0041 00000000 0x0 0x0
0xffff958000015300 0041 00000000 0x0 0x0
0xffff958000015380 0041 00000000 0x0 0x0
0xffff958000015400 0041 00000000 0x0 0x0
0xffff958000015480 0041 00000000 0x0 0x0
0xffff958000015500 0041 00000000 0x0 0x0
0xffff958000015580 0041 00000000 0x0 0x0
0xffff958000015600 0041 00000000 0x0 0x0
0xffff958000015680 0041 00000000 0x0 0x0
0xffff958000015700 0041 00000000 0x0 0x0
0xffff958000015780 0041 00000000 0x0 0x0
0xffff958000015800 0041 00000000 0x0 0x0
0xffff958000015880 0041 00000000 0x0 0x0
0xffff958000015900 0041 00000000 0x0 0x0
0xffff958000015980 0041 00000000 0x0 0x0
0xffff958000015a00 0041 00000000 0x0 0x0
0xffff958000015a80 0041 00000000 0x0 0x0
0xffff958000015b00 0001 00000000 0x0 0x0
0xffff958000015b80 0001 00000000 0x0 0x0
0xffff958000015c00 0001 00000000 0x0 0x0
0xffff958000015c80 0001 00000000 0x0 0x0
0xffff958000015d00 0001 00000000 0x0 0x0
0xffff958000015d80 0001 00000000 0x0 0x0
0xffff958000015e00 0001 00000000 0x0 0x0
0xffff958000015e80 0001 00000000 0x0 0x0
0xffff958000015f00 0001 00000000 0x0 0x0
0xffff958000015f80 0001 00000000 0x0 0x0
0xffff958000016000 0001 00000000 0x0 0x0
0xffff958000016080 0001 00000000 0x0 0x0
0xffff958000016100 0001 00000000 0x0 0x0
0xffff958000016180 0001 00000000 0x0 0x0
0xffff958000016200 0001 00000000 0x0 0x0
0xffff958000016280 0001 00000000 0x0 0x0
0xffff958000016300 0001 00000000 0x0 0x0
0xffff958000016380 0001 00000000 0x0 0x0
0xffff958000016400 0001 00000000 0x0 0x0
0xffff958000016480 0001 00000000 0x0 0x0
0xffff958000016500 0001 00000000 0x0 0x0
0xffff958000016580 0001 00000000 0x0 0x0
0xffff958000016600 0001 00000000 0x0 0x0
0xffff958000016680 0001 00000000 0x0 0x0
0xffff958000016700 0001 00000000 0x0 0x0
0xffff958000016780 0001 00000000 0x0 0x0
0xffff958000016800 0001 00000000 0x0 0x0
0xffff958000016880 0001 00000000 0x0 0x0
0xffff958000016900 0001 00000000 0x0 0x0
0xffff958000016980 0001 00000000 0x0 0x0
0xffff958000016a00 0001 00000000 0x0 0x0
0xffff958000016a80 0001 00000000 0x0 0x0
0xffff958000016b00 0001 00000000 0x0 0x0
0xffff958000016b80 0001 00000000 0x0 0x0
0xffff958000016c00 0001 00000000 0x0 0x0
0xffff958000016c80 0001 00000000 0x0 0x0
0xffff958000016d00 0001 00000000 0x0 0x0
0xffff958000016d80 0001 00000000 0x0 0x0
0xffff958000016e00 0001 00000000 0x0 0x0
0xffff958000016e80 0001 00000000 0x0 0x0
0xffff958000016f00 0001 00000000 0x0 0x0
0xffff958000016f80 0001 00000000 0x0 0x0
0xffff958000017000 0001 00000000 0x0 0x0
0xffff958000017080 0001 00000000 0x0 0x0
0xffff958000017100 0001 00000000 0x0 0x0
0xffff958000017180 0001 00000000 0x0 0x0
0xffff958000017200 0001 00000000 0x0 0x0
0xffff958000017280 0001 00000000 0x0 0x0
0xffff958000017300 0001 00000000 0x0 0x0
0xffff958000017380 0001 00000000 0x0 0x0
0xffff958000017400 0001 00000000 0x0 0x0
0xffff958000017480 0001 00000000 0x0 0x0
0xffff958000017500 0001 00000000 0x0 0x0
0xffff958000017580 0001 00000000 0x0 0x0
0xffff958000017600 0041 00000000 0x0 0x0
0xffff958000017680 0041 00000000 0x0 0x0
0xffff958000017700 0041 00000000 0x0 0x0
0xffff958000017780 0041 00000000 0x0 0x0
0xffff958000017800 0041 00000000 0x0 0x0
0xffff958000017880 0041 00000000 0x0 0x0
0xffff958000017900 0041 00000000 0x0 0x0
0xffff958000017980 0041 00000000 0x0 0x0
0xffff958000017a00 0041 00000000 0x0 0x0
0xffff958000017a80 0041 00000000 0x0 0x0
0xffff958000017b00 0041 00000000 0x0 0x0
0xffff958000017b80 0041 00000000 0x0 0x0
0xffff958000017c00 0041 00000000 0x0 0x0
0xffff958000017c80 0041 00000000 0x0 0x0
0xffff958000017d00 0041 00000000 0x0 0x0
0xffff958000017d80 0041 00000000 0x0 0x0
0xffff958000017e00 0041 00000000 0x0 0x0
0xffff958000017e80 0041 00000000 0x0 0x0
0xffff958000017f00 0041 00000000 0x0 0x0
0xffff958000017f80 0041 00000000 0x0 0x0
0xffff958000018000 0041 00000000 0x0 0x0
0xffff958000018080 0041 00000000 0x0 0x0
0xffff958000018100 0041 00000000 0x0 0x0
0xffff958000018180 0041 00000000 0x0 0x0
0xffff958000018200 0041 00000000 0x0 0x0
0xffff958000018280 0041 00000000 0x0 0x0
0xffff958000018300 0041 00000000 0x0 0x0
0xffff958000018380 0041 00000000 0x0 0x0
0xffff958000018400 0041 00000000 0x0 0x0
0xffff958000018480 0041 00000000 0x0 0x0
0xffff958000018500 0041 00000000 0x0 0x0
0xffff958000018580 0041 00000000 0x0 0x0
0xffff958000018600 0041 00000000 0x0 0x0
0xffff958000018680 0041 00000000 0x0 0x0
0xffff958000018700 0041 00000000 0x0 0x0
0xffff958000018780 0041 00000000 0x0 0x0
0xffff958000018800 0041 00000000 0x0 0x0
0xffff958000018880 0041 00000000 0x0 0x0
0xffff958000018900 0041 00000000 0x0 0x0
0xffff958000018980 0041 00000000 0x0 0x0
0xffff958000018a00 0041 00000000 0x0 0x0
0xffff958000018a80 0041 00000000 0x0 0x0
0xffff958000018b00 0041 00000000 0x0 0x0
0xffff958000018b80 0041 00000000 0x0 0x0
0xffff958000018c00 0041 00000000 0x0 0x0
0xffff958000018c80 0041 00000000 0x0 0x0
0xffff958000018d00 0001 00000000 0x0 0x0
0xffff958000018d80 0001 00000000 0x0 0x0
0xffff958000018e00 0001 00000000 0x0 0x0
0xffff958000018e80 0001 00000000 0x0 0x0
0xffff958000018f00 0001 00000000 0x0 0x0
0xffff958000018f80 0001 00000000 0x0 0x0
0xffff958000019000 0001 00000000 0x0 0x0
0xffff958000019080 0001 00000000 0x0 0x0
0xffff958000019100 0001 00000000 0x0 0x0
0xffff958000019180 0001 00000000 0x0 0x0
0xffff958000019200 0001 00000000 0x0 0x0
0xffff958000019280 0001 00000000 0x0 0x0
0xffff958000019300 0001 00000000 0x0 0x0
0xffff958000019380 0001 00000000 0x0 0x0
0xffff958000019400 0001 00000000 0x0 0x0
0xffff958000019480 0001 00000000 0x0 0x0
0xffff958000019500 0001 00000000 0x0 0x0
0xffff958000019580 0001 00000000 0x0 0x0
0xffff958000019600 0001 00000000 0x0 0x0
0xffff958000019680 0001 00000000 0x0 0x0
0xffff958000019700 0001 00000000 0x0 0x0
0xffff958000019780 0001 00000000 0x0 0x0
0xffff958000019800 0001 00000000 0x0 0x0
0xffff958000019880 0001 00000000 0x0 0x0
0xffff958000019900 0001 00000000 0x0 0x0
0xffff958000019980 0001 00000000 0x0 0x0
0xffff958000019a00 0001 00000000 0x0 0x0
0xffff958000019a80 0001 00000000 0x0 0x0
0xffff958000019b00 0001 00000000 0x0 0x0
0xffff958000019b80 0001 00000000 0x0 0x0
0xffff958000019c00 0001 00000000 0x0 0x0
0xffff958000019c80 0001 00000000 0x0 0x0
0xffff958000019d00 0001 00000000 0x0 0x0
0xffff958000019d80 0001 00000000 0x0 0x0
0xffff958000019e00 0001 00000000 0x0 0x0
0xffff958000019e80 0001 00000000 0x0 0x0
0xffff958000019f00 0001 00000000 0x0 0x0
0xffff958000019f80 0001 00000000 0x0 0x0
0xffff95800001a000 0001 00000000 0x0 0x0
0xffff95800001a080 0001 00000000 0x0 0x0
0xffff95800001a100 0001 00000000 0x0 0x0
0xffff95800001a180 0001 00000000 0x0 0x0
0xffff95800001a200 0001 00000000 0x0 0x0
0xffff95800001a280 0001 00000000 0x0 0x0
0xffff95800001a300 0001 00000000 0x0 0x0
0xffff9580

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Oct 28, 2022, 10:11:42 AM10/28/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=115753ce880000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=1ea5b8ef3e323b39073a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11e86d16880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=160065f2880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8813f5f371a8/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e5d1760d89e4/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1ea5b8...@syzkaller.appspotmail.com

[ 40.9700624] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:937:5, member access within null pointer of type 'struct inpcb'

[ 40.9700624] cpu0: Begin traceback...
[ 40.9900306] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 41.0600290] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 41.1200300] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 41.1800304] tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x2fe tcp_recvoob sys/netinet/tcp_usrreq.c:937 [inline]
[ 41.1800304] tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x2fe sys/netinet/tcp_usrreq.c:2296
[ 41.2300318] soreceive() at netbsd:soreceive+0x776 sys/kern/uipc_socket.c:1184
[ 41.2900294] do_sys_recvmsg_so() at netbsd:do_sys_recvmsg_so+0x518 sys/kern/uipc_syscalls.c:978
[ 41.3400290] sys_recvmsg() at netbsd:sys_recvmsg+0x129 do_sys_recvmsg sys/kern/uipc_syscalls.c:1017 [inline]
[ 41.3400290] sys_recvmsg() at netbsd:sys_recvmsg+0x129 sys/kern/uipc_syscalls.c:740
[ 41.3900313] sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 41.3900313] sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 41.4400324] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 41.4400324] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 41.4400324] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 41.4500331] --- syscall (number 27 via SYS_syscall) ---
[ 41.4700282] netbsd:syscall+0x2da:
[ 41.4801411] cpu0: End traceback...
[ 41.4801411] fatal breakpoint trap in supervisor mode
[ 41.4801411] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x20000440 ilevel 0 rsp 0xffff9182483b2640
[ 41.4998614] curlwp 0xffffbf0284c86600 pid 1242.1242 lowest kstack 0xffff9182483ae2c0
Stopped in pid 1242.1242 (syz-executor3215) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x2fe tcp_recvoob sys/netinet/tcp_usrreq.c:937 [inline]
tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x2fe sys/netinet/tcp_usrreq.c:2296
soreceive() at netbsd:soreceive+0x776 sys/kern/uipc_socket.c:1184
do_sys_recvmsg_so() at netbsd:do_sys_recvmsg_so+0x518 sys/kern/uipc_syscalls.c:978
sys_recvmsg() at netbsd:sys_recvmsg+0x129 do_sys_recvmsg sys/kern/uipc_syscalls.c:1017 [inline]
sys_recvmsg() at netbsd:sys_recvmsg+0x129 sys/kern/uipc_syscalls.c:740

sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 27 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:937:5, member access within null pointer of type 'struct inpcb'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1120 1120 2 0 0 ffffbf0284bb5200 syz-executor3215
1386 1386 2 0 0 ffffbf02849a1580 syz-executor3215
990 990 2 0 0 ffffbf0284c86a40 syz-executor3215
1239 1239 2 0 0 ffffbf02829c3b00 syz-executor3215
1241 1241 2 0 0 ffffbf02829c36c0 syz-executor3215
1242 >1242 7 0 0 ffffbf0284c86600 syz-executor3215
1243 1243 2 1 0 ffffbf02849a19c0 syz-executor3215
829 829 2 0 140 ffffbf0282c382c0 syz-executor3215
929 929 2 1 0 ffffbf028268dac0 syz-executor3215
449 449 2 1 140 ffffbf0284a965c0 syz-executor3215
942 942 3 0 180 ffffbf0284c861c0 syz-executor3215 nanoslp
1000 1000 3 1 40000 ffffbf0284a96a00 sshd tstile
1151 1151 3 0 180 ffffbf0283111bc0 getty nanoslp
1222 1222 3 1 180 ffffbf0284a96180 getty nanoslp
1082 1082 3 0 180 ffffbf0282677200 getty nanoslp
1184 1184 3 0 1c0 ffffbf02829c3280 getty ttyraw
1102 1102 3 1 180 ffffbf0284da0980 sshd select
1088 1088 3 1 180 ffffbf0284da0540 powerd kqueue
700 700 3 0 180 ffffbf0283270300 syslogd kqueue
747 747 3 0 180 ffffbf0283b41900 dhcpcd poll
742 742 3 0 180 ffffbf0282c38700 dhcpcd poll
466 466 3 0 180 ffffbf02836e4040 dhcpcd poll
598 598 3 1 180 ffffbf0283270740 dhcpcd poll
292 292 3 1 180 ffffbf0283111780 dhcpcd poll
485 485 3 1 180 ffffbf0282c38b40 dhcpcd poll
291 291 3 1 180 ffffbf0283270b80 dhcpcd poll
1 1 3 0 180 ffffbf027a463540 init wait
0 557 3 0 200 ffffbf0282677640 physiod physiod
0 196 3 0 200 ffffbf028268d680 pooldrain pooldrain
0 > 195 7 1 240 ffffbf028268d240 ioflush
0 194 3 1 200 ffffbf0282677a80 pgdaemon pgdaemon
0 170 3 1 200 ffffbf02805b7a40 usb7 usbevt
0 169 3 1 200 ffffbf02805b7600 usb6 usbevt
0 168 3 1 200 ffffbf02805b71c0 usb5 usbevt
0 167 3 1 200 ffffbf027d52aa00 usb4 usbevt
0 166 3 1 200 ffffbf027d52a5c0 usb3 usbevt
0 165 3 1 200 ffffbf027d52a180 usb2 usbevt
0 31 3 1 200 ffffbf027b4fd9c0 usb1 usbevt
0 63 3 1 200 ffffbf027b4fd580 usb0 usbevt
0 126 3 1 200 ffffbf027b4fd140 usbtask-dr usbtsk
0 125 3 1 200 ffffbf027a463980 usbtask-hc usbtsk
0 124 3 0 200 ffffbf02788a1b00 swwreboot swwreboot
0 123 3 0 200 ffffbf027a2e0740 npfgc0 npfgcw
0 122 3 1 200 ffffbf027a463100 rt_free rt_free
0 121 3 1 200 ffffbf027a43e940 unpgc unpgc
0 120 3 0 200 ffffbf027a43e500 key_timehandler key_timehandler
0 119 3 1 200 ffffbf027a2e0b80 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffbf027a3d7340 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffffbf027a43e0c0 nd6_timer nd6_timer
0 116 3 1 200 ffffbf027a42a900 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffbf027a42a4c0 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffbf027a42a080 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffbf027a4148c0 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffbf027a414480 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffbf027a414040 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffffbf027a3d7bc0 rt_timer rt_timer
0 109 3 1 200 ffffbf027a3d7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffffbf027a2e0300 entbutler entropy
0 99 3 1 200 ffffbf0279d50b40 viomb balloon
0 98 3 1 200 ffffbf0279d50700 vioif0_txrx/1 vioif0_txrx
0 97 2 0 200 ffffbf0279d502c0 vioif0_txrx/0
0 30 3 0 200 ffffbf02788a16c0 scsibus0 sccomp
0 29 3 0 200 ffffbf02788a1280 pms0 pmsreset
0 28 3 1 200 ffffbf02787b4ac0 xcall/1 xcall
0 27 1 1 200 ffffbf02787b4680 softser/1
0 26 1 1 200 ffffbf02787b4240 softclk/1
0 25 1 1 200 ffffbf0278787a80 softbio/1
0 24 1 1 200 ffffbf0278787640 softnet/1
0 23 1 1 201 ffffbf0278787200 idle/1
0 22 3 0 200 ffffbf03a6b2da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffffbf03a6b2d600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffbf03a6b2d1c0 lnxpwrwq lnxpwrwq
0 19 3 0 200 ffffbf03a6b34a00 lnxlngwq lnxlngwq
0 18 3 0 200 ffffbf03a6b345c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffffbf03a6b34180 lnxrcugc lnxrcugc
0 16 3 1 200 ffffbf03a6b539c0 sysmon smtaskq
0 15 3 0 200 ffffbf03a6b53580 pmfsuspend pmfsuspend
0 14 3 1 200 ffffbf03a6b53140 pmfevent pmfevent
0 13 3 1 200 ffffbf03a6b5e980 sopendfree sopendfr
0 12 3 0 200 ffffbf03a6b5e540 ifwdog ifwdog
0 11 3 1 200 ffffbf03a6b5e100 iflnkst iflnkst
0 10 3 0 200 ffffbf03a7b93940 nfssilly nfssilly
0 9 3 0 200 ffffbf03a7b93500 vdrain vdrain
0 8 3 1 200 ffffbf03a7b930c0 modunload mod_unld
0 7 3 0 200 ffffbf03a7bbc900 xcall/0 xcall
0 6 1 0 200 ffffbf03a7bbc4c0 softser/0
0 5 3 0 200 ffffbf03a7bbc080 softclk/0 tstile
0 4 1 0 200 ffffbf03a7be98c0 softbio/0
0 3 1 0 200 ffffbf03a7be9480 softnet/0
0 2 1 0 201 ffffbf03a7be9040 idle/0
0 0 3 0 200 ffffffff8673e8c0 swapper uvm
[Locks tracked through LWPs]

****** LWP 1242.1242 (syz-executor3215) @ 0xffffbf0284c86600, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)

lock address : ffffbf03a8069080

type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 1

relevant cpu : 0 last held: 0

relevant lwp : 0xffffbf0284c86600 last held: 0xffffbf0284c86600
last locked* : netbsd:soreceive+0x6bf
unlocked : netbsd:sosend+0x1a95
owner field : 0xffffbf0284c86600 wait/spin: 1/0

Turnstile:
=> 0 waiting readers:

=> 2 waiting writers: 0xffffbf03a7bbc080 0xffffbf0284a96a00

*** Locks wanted: none

****** LWP 929.929 (syz-executor3215) @ 0xffffbf028268dac0, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffffbf0282c03f80
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1

relevant lwp : 0xffffbf028268dac0 last held: 0xffffbf028268dac0
last locked* : netbsd:pmap_enter_ma+0x3c0
unlocked : netbsd:pmap_extract+0x2c8

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1000.1000 (sshd) @ 0xffffbf0284a96a00, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)

lock address : ffffbf03a8069080

type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 0

relevant lwp : 0xffffbf0284a96a00 last held: 0xffffbf0284c86600
last locked* : netbsd:soreceive+0x6bf
unlocked : netbsd:sosend+0x1a95
owner field : 0xffffbf0284c86600 wait/spin: 1/0

Turnstile:
=> 0 waiting readers:

=> 2 waiting writers: 0xffffbf03a7bbc080 0xffffbf0284a96a00

****** LWP 742.742 (dhcpcd) @ 0xffffbf0282c38700, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffbf0282c38700 last held: 000000000000000000