panic: LOCKDEBUG: Mutex error: rw_vector_enter,309: spin lock held

0 views

Skip to first unread message

syzbot

unread,

Jul 29, 2020, 3:56:18 AM7/29/20

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 47132c89 cninit - don't reset cn_tab on entry.
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=162abbac900000
kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=217ab285d8dc942722fe
compiler: clang version 3.8.0-2ubuntu4 (tags/RELEASE_380/final)

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+217ab2...@syzkaller.appspotmail.com

[ 1071.8158141] panic: LOCKDEBUG: Mutex error: rw_vector_enter,309: spin lock held
[ 1071.8258133] cpu1: Begin traceback...
[ 1071.9058298] vpanic() at netbsd:vpanic+0x91a sys/kern/subr_prf.c:288
[ 1072.0358268] panic() at netbsd:panic+0x1ad sys/kern/subr_prf.c:209
[ 1072.1858269] lockdebug_abort1() at netbsd:lockdebug_abort1+0xe82
[ 1072.3258241] rw_enter() at netbsd:rw_enter+0x35f sys/kern/kern_rwlock.c:321
[ 1072.4658454] uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 uvmfault_lookup sys/uvm/uvm_fault_i.h:128 [inline]
[ 1072.4658454] uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 uvm_fault_check sys/uvm/uvm_fault.c:987 [inline]
[ 1072.4658454] uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 sys/uvm/uvm_fault.c:897
[ 1072.5958350] trap() at netbsd:trap+0x21c2 sys/arch/amd64/amd64/trap.c:520
[ 1072.6258236] --- trap (number 6) ---
[ 1072.7458221] config_devalloc() at netbsd:config_devalloc+0xd30 config_unit_nextfree sys/kern/subr_autoconf.c:1343 [inline]
[ 1072.7458221] config_devalloc() at netbsd:config_devalloc+0xd30 config_unit_alloc sys/kern/subr_autoconf.c:1365 [inline]
[ 1072.7458221] config_devalloc() at netbsd:config_devalloc+0xd30 sys/kern/subr_autoconf.c:1420
[ 1072.8758230] config_attach_pseudo() at netbsd:config_attach_pseudo+0x62 sys/kern/subr_autoconf.c:1648
[ 1073.0258218] vndopen() at netbsd:vndopen+0x427 vnd_spawn sys/dev/vnd.c:308 [inline]
[ 1073.0258218] vndopen() at netbsd:vndopen+0x427 sys/dev/vnd.c:339
[ 1073.1658224] cdev_open() at netbsd:cdev_open+0x2a9 sys/kern/subr_devsw.c:871
[ 1073.2958331] spec_open() at netbsd:spec_open+0xb04 sys/miscfs/specfs/spec_vnops.c:563
[ 1073.4358217] VOP_OPEN() at netbsd:VOP_OPEN+0x21c sys/kern/vnode_if.c:298
[ 1073.5658228] vn_open() at netbsd:vn_open+0x1516 sys/kern/vfs_vnops.c:261
[ 1073.6958355] do_open() at netbsd:do_open+0x5b1 sys/kern/vfs_syscalls.c:1668
[ 1073.8358203] do_sys_openat() at netbsd:do_sys_openat+0x44b sys/kern/vfs_syscalls.c:1752
[ 1073.9758230] sys_open() at netbsd:sys_open+0x13d sys/kern/vfs_syscalls.c:1773
[ 1074.1058212] sys___syscall() at netbsd:sys___syscall+0x2a4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 1074.1058212] sys___syscall() at netbsd:sys___syscall+0x2a4 sys/kern/sys_syscall.c:77
[ 1074.2558220] syscall() at netbsd:syscall+0x42d sy_call sys/sys/syscallvar.h:65 [inline]
[ 1074.2558220] syscall() at netbsd:syscall+0x42d sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 1074.2558220] syscall() at netbsd:syscall+0x42d sys/arch/x86/x86/syscall.c:138
[ 1074.2858215] --- syscall (number 198) ---
[ 1074.3258233] netbsd:syscall+0x42d:
[ 1074.3258233] cpu1: End traceback...
[ 1074.3358186] fatal breakpoint trap in supervisor mode
[ 1074.3358186] trap type 1 code 0 rip 0xffffffff8022286d cs 0x8 rflags 0x246 cr2 0xffffe1801282c910 ilevel 0x8 rsp 0xffffe1808f4e19c0
[ 1074.3458191] curlwp 0xffffe18012665140 pid 4585.5552 lowest kstack 0xffffe1808f4db2c0
Stopped in pid 4585.5552 (syz-executor.3) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x91a sys/kern/subr_prf.c:288
panic() at netbsd:panic+0x1ad sys/kern/subr_prf.c:209
lockdebug_abort1() at netbsd:lockdebug_abort1+0xe82
rw_enter() at netbsd:rw_enter+0x35f sys/kern/kern_rwlock.c:321
uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 uvmfault_lookup sys/uvm/uvm_fault_i.h:128 [inline]
uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 uvm_fault_check sys/uvm/uvm_fault.c:987 [inline]
uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 sys/uvm/uvm_fault.c:897
trap() at netbsd:trap+0x21c2 sys/arch/amd64/amd64/trap.c:520
--- trap (number 6) ---
config_devalloc() at netbsd:config_devalloc+0xd30 config_unit_nextfree sys/kern/subr_autoconf.c:1343 [inline]
config_devalloc() at netbsd:config_devalloc+0xd30 config_unit_alloc sys/kern/subr_autoconf.c:1365 [inline]
config_devalloc() at netbsd:config_devalloc+0xd30 sys/kern/subr_autoconf.c:1420
config_attach_pseudo() at netbsd:config_attach_pseudo+0x62 sys/kern/subr_autoconf.c:1648
vndopen() at netbsd:vndopen+0x427 vnd_spawn sys/dev/vnd.c:308 [inline]
vndopen() at netbsd:vndopen+0x427 sys/dev/vnd.c:339
cdev_open() at netbsd:cdev_open+0x2a9 sys/kern/subr_devsw.c:871
spec_open() at netbsd:spec_open+0xb04 sys/miscfs/specfs/spec_vnops.c:563
VOP_OPEN() at netbsd:VOP_OPEN+0x21c sys/kern/vnode_if.c:298
vn_open() at netbsd:vn_open+0x1516 sys/kern/vfs_vnops.c:261
do_open() at netbsd:do_open+0x5b1 sys/kern/vfs_syscalls.c:1668
do_sys_openat() at netbsd:do_sys_openat+0x44b sys/kern/vfs_syscalls.c:1752
sys_open() at netbsd:sys_open+0x13d sys/kern/vfs_syscalls.c:1773
sys___syscall() at netbsd:sys___syscall+0x2a4 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x2a4 sys/kern/sys_syscall.c:77
syscall() at netbsd:syscall+0x42d sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x42d sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x42d sys/arch/x86/x86/syscall.c:138
--- syscall (number 198) ---
netbsd:syscall+0x42d:
Panic string: LOCKDEBUG: Mutex error: rw_vector_enter,309: spin lock held
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
5474 5474 2 0 0 ffffe18012756200 syz-executor.0
4585 >5552 7 1 0 ffffe18012665140 syz-executor.3
4585 4585 2 1 10000000 ffffe18012ee5a80 syz-executor.3
4134 4134 2 0 0 ffffe18012ee5200 syz-executor.2
4759 6459 3 1 80 ffffe18012738600 syz-executor.1 parked
4759 6247 2 1 0 ffffe1801286d700 syz-executor.1
4759 >4759 7 0 10000000 ffffe18012c9e080 syz-executor.1
5001 5544 3 1 80 ffffe18012851680 syz-executor.4 parked
5001 6698 3 0 80 ffffe18012873780 syz-executor.4 parked
5001 5001 2 0 10040000 ffffe18012ee5640 syz-executor.4
507 507 3 1 80 ffffe1801286d2c0 syz-executor.1 parked
1764 1764 3 0 80 ffffe18012c9e4c0 syz-executor.1 parked
2385 2385 3 0 80 ffffe180126659c0 syz-executor.1 parked
2759 2759 3 1 80 ffffe18012665580 syz-executor.1 parked
1461 1461 3 0 80 ffffe18012873bc0 syz-executor.1 parked
293 293 3 0 80 ffffe18012870300 syz-executor.1 parked
405 405 3 0 80 ffffe18012756a80 syz-executor.1 parked
400 400 3 1 80 ffffe18012a6e480 syz-executor.1 parked
1948 1948 3 1 80 ffffe1801286b6c0 syz-executor.1 parked
1974 1974 3 0 80 ffffe18012870740 syz-executor.1 parked
970 970 3 0 80 ffffe18012a6e040 syz-executor.1 parked
2023 2023 3 0 80 ffffe1801286b280 syz-executor.1 parked
1953 1953 3 1 80 ffffe18012547980 syz-executor.1 parked
1720 1720 3 1 80 ffffe180127381c0 syz-executor.1 parked
1591 1591 3 1 80 ffffe18012873340 syz-executor.1 parked
837 837 3 0 80 ffffe18012870b80 syz-executor.1 parked
1731 1731 3 1 80 ffffe18012756640 syz-executor.1 parked
1608 1608 3 1 80 ffffe18012738a40 syz-executor.1 parked
1380 1380 3 1 80 ffffe18012682a00 syz-executor.1 parked
1348 1348 3 1 80 ffffe18012851ac0 syz-executor.1 parked
1212 1212 3 0 80 ffffe18012851240 syz-executor.1 parked
1216 1216 3 0 80 ffffe180126825c0 syz-executor.1 parked
942 942 3 1 80 ffffe18012682180 syz-executor.1 parked
1086 1086 3 1 80 ffffe18012547540 syz-executor.4 nanoslp
1186 1186 3 1 40 ffffe18012547100 syz-executor.5 biowait
1097 1097 3 1 80 ffffe180124eb940 syz-executor.3 nanoslp
1077 1077 3 1 80 ffffe180124eb500 syz-executor.2 nanoslp
419 419 3 1 80 ffffe180124eb0c0 syz-executor.1 nanoslp
1102 1102 3 1 80 ffffe180123aa900 syz-executor.0 nanoslp
1250 1085 3 1 c0 ffffe180123aa4c0 syz-fuzzer parked
1250 1082 3 1 80 ffffe180123aa080 syz-fuzzer kqueue
1250 1072 3 1 80 ffffe18011c2d8c0 syz-fuzzer parked
1250 1251 3 1 c0 ffffe18011c2d480 syz-fuzzer parked
1250 1067 3 1 80 ffffe18011c2d040 syz-fuzzer parked
1250 1101 3 0 80 ffffe18011345680 syz-fuzzer parked
1250 991 3 1 80 ffffe18011345240 syz-fuzzer parked
1250 1075 3 0 80 ffffe18011556b40 syz-fuzzer nanoslp
1250 1250 3 1 80 ffffe18011b41bc0 syz-fuzzer parked
1071 1071 3 1 80 ffffe18011246a80 sshd select
1064 1064 3 1 80 ffffe18011b41780 getty nanoslp
1109 1109 3 0 80 ffffe18011246640 getty nanoslp
1117 1117 3 1 80 ffffe18011246200 getty nanoslp
948 948 3 1 c0 ffffe180112105c0 getty ttyraw
1125 1125 3 1 80 ffffe18011b41340 sshd select
1121 1121 3 1 80 ffffe18011b11740 powerd kqueue
870 870 3 1 80 ffffe18011434b00 syslogd kqueue
596 596 3 0 80 ffffe180114346c0 dhcpcd poll
595 595 3 1 80 ffffe18011b11b80 dhcpcd poll
592 592 3 1 80 ffffe18011434280 dhcpcd poll
577 577 3 1 80 ffffe18011b11300 dhcpcd poll
348 348 3 0 80 ffffe18011556700 dhcpcd poll
347 347 3 1 80 ffffe18011345ac0 dhcpcd poll
346 346 3 0 80 ffffe180115562c0 dhcpcd poll
1 1 3 0 80 ffffe18010eef900 init wait
0 5933 3 0 200 ffffe1801286db40 acctwatch actwat
0 818 3 0 200 ffffe18011210a00 physiod physiod
0 166 3 0 200 ffffe18011219a40 pooldrain pooldrain
0 165 3 1 200 ffffe18011219600 ioflush syncer
0 164 3 1 200 ffffe180112191c0 pgdaemon pgdaemon
0 160 3 0 200 ffffe18011210180 usb7 usbevt
0 31 3 1 200 ffffe180111759c0 usb6 usbevt
0 63 3 0 200 ffffe18011175580 usb5 usbevt
0 126 3 1 200 ffffe18011175140 usb4 usbevt
0 125 3 1 200 ffffe180110c2980 usb3 usbevt
0 124 3 1 200 ffffe180110c2540 usb2 usbevt
0 123 3 1 200 ffffe180110c2100 usb1 usbevt
0 122 3 1 200 ffffe180110af940 usb0 usbevt
0 121 3 1 200 ffffe180110af500 usbtask-dr usbtsk
0 120 3 1 200 ffffe180110af0c0 usbtask-hc usbtsk
0 119 3 1 200 ffffe1800f436ac0 npfgc0 npfgcw
0 118 3 1 200 ffffe18010eef4c0 rt_free rt_free
0 117 3 1 200 ffffe18010eef080 unpgc unpgc
0 116 3 1 200 ffffe18010eeb8c0 key_timehandler key_timehandler
0 115 3 1 200 ffffe18010eeb480 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffffe18010eeb040 icmp6_wqinput/0 icmp6_wqinput
0 113 3 1 200 ffffe18010ee2bc0 nd6_timer nd6_timer
0 112 3 1 200 ffffe18010ee2780 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffffe18010ee2340 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffffe18010ceeb80 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffffe18010cee740 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffffe18010cee300 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffffe18010ce0b40 icmp_wqinput/0 icmp_wqinput
0 106 3 0 200 ffffe18010ce0700 rt_timer rt_timer
0 105 3 0 200 ffffe18010820b00 vmem_rehash vmem_rehash
0 104 3 1 200 ffffe18010ce02c0 entbutler entropy
0 30 3 1 200 ffffe180108206c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffffe18010820280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffffe1800f436680 scsibus0 sccomp
0 26 3 0 200 ffffe1800f436240 pms0 pmsreset
0 25 3 1 200 ffffe1800f425a80 xcall/1 xcall
0 24 1 1 200 ffffe1800f425640 softser/1
0 23 1 1 200 ffffe1800f425200 softclk/1
0 22 1 1 200 ffffe1800f423a40 softbio/1
0 21 1 1 200 ffffe1800f423600 softnet/1
0 20 1 1 201 ffffe1800f4231c0 idle/1
0 19 3 1 200 ffffe1800e29ea00 lnxpwrwq lnxpwrwq
0 18 3 1 200 ffffe1800e29e5c0 lnxlngwq lnxlngwq
0 17 3 1 200 ffffe1800e29e180 lnxsyswq lnxsyswq
0 16 3 0 200 ffffe1800e2989c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffe1800e298580 sysmon smtaskq
0 14 3 1 200 ffffe1800e298140 pmfsuspend pmfsuspend
0 13 3 1 200 ffffe1800e294980 pmfevent pmfevent
0 12 3 0 200 ffffe1800e294540 sopendfree sopendfr
0 11 3 0 200 ffffe1800e294100 iflnkst iflnkst
0 10 3 0 200 ffffe1800e28b940 nfssilly nfssilly
0 9 3 0 200 ffffe1800e28b500 vdrain vdrain
0 8 3 1 200 ffffe1800e28b0c0 modunload mod_unld
0 7 3 0 200 ffffe1800dc88900 xcall/0 xcall
0 6 1 0 200 ffffe1800dc884c0 softser/0
0 5 1 0 200 ffffe1800dc88080 softclk/0
0 4 1 0 200 ffffe1800dc868c0 softbio/0
0 3 1 0 200 ffffe1800dc86480 softnet/0
0 2 1 0 201 ffffe1800dc86040 idle/0
0 0 3 0 200 ffffffff8625bf80 swapper uvm
[Locks tracked through LWPs]

****** LWP 5474.5474 (syz-executor.0) @ 0xffffe18012756200, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffffe18011c1cc40 type : sleep/adaptive
initialized : 0xffffffff8187b990
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe18012756200 last held: 0xffffe18012756200
last locked* : 0xffffffff81896b3b unlocked : 0xffffffff818893b5
owner field : 0xffffe18012756200 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 4585.5552 (syz-executor.3) @ 0xffffe18012665140, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffffffff861ecc98 type : sleep/adaptive
initialized : 0xffffffff84b5b800
shared holds : 0 exclusive: 0
shares wanted: 1 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffe18012665140 last held: 000000000000000000
last locked : 0xffffffff84b2786f unlocked*: 0xffffffff84b4c0a7
owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 4134.4134 (syz-executor.2) @ 0xffffe18012ee5200, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at amap_ctor)
lock address : 0xffffe1801252d200 type : sleep/adaptive
initialized : 0xffffffff84acb010
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 0 last held: 1
relevant lwp : 0xffffe18012ee5200 last held: 000000000000000000
last locked : 0xffffffff84b00bc7 unlocked*: 0xffffffff84b10bd5
owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 1186.1186 (syz-executor.5) @ 0xffffe18012547100, l_stat=3

*** Locks held:

* Lock 0 (initialized at vcache_new)
lock address : 0xffffe1801253ad40 type : sleep/adaptive
initialized : 0xffffffff851d0efe
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffe18012547100 last held: 0xffffe18012547100
last locked* : 0xffffffff852540c6 unlocked : 0xffffffff85254475
owner/count : 0xffffe18012547100 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at vcache_new)
lock address : 0xffffe18012642680 type : sleep/adaptive
initialized : 0xffffffff851d0efe
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffe18012547100 last held: 0xffffe18012547100
last locked* : 0xffffffff852540c6 unlocked : 0xffffffff85254475
owner/count : 0xffffe18012547100 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 2 (initialized at genfs_node_init)
lock address : 0xffffe18012c02998 type : sleep/adaptive
initialized : 0xffffffff8525492e
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffe18012547100 last held: 0xffffe18012547100
last locked* : 0xffffffff8489b5de unlocked : 000000000000000000
owner/count : 0xffffe18012547100 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 595.595 (dhcpcd) @ 0xffffe18011b11b80, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862daf80 type : sleep/adaptive
initialized : 0xffffffff84d145f3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffe18011b11b80 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 592.592 (dhcpcd) @ 0xffffe18011434280, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862daf80 type : sleep/adaptive
initialized : 0xffffffff84d145f3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffe18011434280 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 347.347 (dhcpcd) @ 0xffffe18011345ac0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862daf80 type : sleep/adaptive
initialized : 0xffffffff84d145f3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffe18011345ac0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 346.346 (dhcpcd) @ 0xffffe180115562c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862daf80 type : sleep/adaptive
initialized : 0xffffffff84d145f3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe180115562c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffe1800e294100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862daf80 type : sleep/adaptive
initialized : 0xffffffff84d145f3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe1800e294100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffe1800dc88080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862daf80 type : sleep/adaptive
initialized : 0xffffffff84d145f3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe1800dc88080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu1:

* Lock 0 (initialized at main)
lock address : 0xffffffff862dae80 type : spin
initialized : 0xffffffff84c15ddb
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffe18012665140 last held: 0xffffe18012665140
last locked* : 0xffffffff84e8aca8 unlocked : 0xffffffff802f2425
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at config_init)
lock address : 0xffffffff862e3dc0 type : spin
initialized : 0xffffffff84e3edba
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffe18012665140 last held: 0xffffe18012665140
last locked* : 0xffffffff84e4a5b1 unlocked : 0xffffffff84e5e779
owner field : 0x0000000000010600 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffffe18000017180 0041 00000000 0x0 0x0
0xffffe18000017200 0041 00000000 0x0 0x0
0xffffe18000017280 0041 00000000 0x0 0x0
0xffffe18000017300 0041 00000000 0x0 0x0
0xffffe18000017380 0041 00000000 0x0 0x0
0xffffe18000017400 0041 00000000 0x0 0x0
0xffffe18000017480 0041 00000000 0x0 0x0
0xffffe18000017500 0041 00000000 0x0 0x0
0xffffe18000017580 0041 00000000 0x0 0x0
0xffffe18000017600 0041 00000000 0x0 0x0
0xffffe18000017680 0041 00000000 0x0 0x0
0xffffe18000017700 0041 00000000 0x0 0x0
0xffffe18000017780 0041 00000000 0x0 0x0
0xffffe18000017800 0041 00000000 0x0 0x0
0xffffe18000017880 0041 00000000 0x0 0x0
0xffffe18000017900 0041 00000000 0x0 0x0
0xffffe18000017980 0041 00000000 0x0 0x0
0xffffe18000017a00 0041 00000000 0x0 0x0
0xffffe18000017a80 0041 00000000 0x0 0x0
0xffffe18000017b00 0041 00000000 0x0 0x0
0xffffe18000017b80 0041 00000000 0x0 0x0
0xffffe18000017c00 0001 00000000 0x0 0x0
0xffffe18000017c80 0001 00000000 0x0 0x0
0xffffe18000017d00 0001 00000000 0x0 0x0
0xffffe18000017d80 0001 00000000 0x0 0x0
0xffffe18000017e00 0001 00000000 0x0 0x0
0xffffe18000017e80 0001 00000000 0x0 0x0
0xffffe18000017f00 0001 00000000 0x0 0x0
0xffffe18000017f80 0001 00000000 0x0 0x0
0xffffe18000018000 0001 00000000 0x0 0x0
0xffffe18000018080 0001 00000000 0x0 0x0
0xffffe18000018100 0001 00000000 0x0 0x0
0xffffe18000018180 0001 00000000 0x0 0x0
0xffffe18000018200 0001 00000000 0x0 0x0
0xffffe18000018280 0001 00000000 0x0 0x0
0xffffe18000018300 0001 00000000 0x0 0x0
0xffffe18000018380 0001 00000000 0x0 0x0
0xffffe18000018400 0001 00000000 0x0 0x0
0xffffe18000018480 0001 00000000 0x0 0x0
0xffffe18000018500 0001 00000000 0x0 0x0
0xffffe18000018580 0001 00000000 0x0 0x0
0xffffe18000018600 0001 00000000 0x0 0x0
0xffffe18000018680 0001 00000000 0x0 0x0
0xffffe18000018700 0001 00000000 0x0 0x0
0xffffe18000018780 0001 00000000 0x0 0x0
0xffffe18000018800 0001 00000000 0x0 0x0
0xffffe18000018880 0001 00000000 0x0 0x0
0xffffe18000018900 0001 00000000 0x0 0x0
0xffffe18000018980 0001 00000000 0x0 0x0
0xffffe18000018a00 0001 00000000 0x0 0x0
0xffffe18000018a80 0001 00000000 0x0 0x0
0xffffe18000018b00 0001 00000000 0x0 0x0
0xffffe18000018b80 0001 00000000 0x0 0x0
0xffffe18000018c00 0001 00000000 0x0 0x0
0xffffe18000018c80 0001 00000000 0x0 0x0
0xffffe18000018d00 0001 00000000 0x0 0x0
0xffffe18000018d80 0001 00000000 0x0 0x0
0xffffe18000018e00 0001 00000000 0x0 0x0
0xffffe18000018e80 0001 00000000 0x0 0x0
0xffffe18000018f00 0001 00000000 0x0 0x0
0xffffe18000018f80 0001 00000000 0x0 0x0
0xffffe18000019000 0001 00000000 0x0 0x0
0xffffe18000019080 0001 00000000 0x0 0x0
0xffffe18000019100 0001 00000000 0x0 0x0
0xffffe18000019180 0001 00000000 0x0 0x0
0xffffe18000019200 0001 00000000 0x0 0x0
0xffffe18000019280 0001 00000000 0x0 0x0
0xffffe18000019300 0001 00000000 0x0 0x0
0xffffe18000019380 0001 00000000 0x0 0x0
0xffffe18000019400 0001 00000000 0x0 0x0
0xffffe18000019480 0001 00000000 0x0 0x0
0xffffe18000019500 0001 00000000 0x0 0x0
0xffffe18000019580 0001 00000000 0x0 0x0
0xffffe18000019600 0001 00000000 0x0 0x0
0xffffe18000019680 0001 00000000 0x0 0x0
0xffffe18000019700 0001 00000000 0x0 0x0
0xffffe18000019780 0001 00000000 0x0 0x0
0xffffe18000019800 0001 00000000 0x0 0x0
0xffffe18000019880 0001 00000000 0x0 0x0
0xffffe18000019900 0001 00000000 0x0 0x0
0xffffe18000019980 0001 00000000 0x0 0x0
0xffffe18000019a00 0001 00000000 0x0 0x0
0xffffe18000019a80 0001 00000000 0x0 0x0
0xffffe18000019b00 0001 00000000 0x0 0x0
0xffffe18000019b80 0001 00000000 0x0 0x0
0xffffe18000019c00 0001 00000000 0x0 0x0
0xffffe18000019c80 0001 00000000 0x0 0x0
0xffffe18000019d00 0001 00000000 0x0 0x0
0xffffe18000019d80 0001 00000000 0x0 0x0
0xffffe18000019e00 0001 00000000 0x0 0x0
0xffffe18000019e80 0001 00000000 0x0 0x0
0xffffe18000019f00 0001 00000000 0x0 0x0
0xffffe18000019f80 0001 00000000 0x0 0x0
0xffffe1800001a000 0001 00000000 0x0 0x0
0xffffe1800001a080 0001 00000000 0x0 0x0
0xffffe1800001a100 0001 00000000 0x0 0x0
0xffffe1800001a180 0001 00000000 0x0 0x0
0xffffe1800001a200 0001 00000000 0x0 0x0
0xffffe1800001a280 0001 00000000 0x0 0x0
0xffffe1800001a300 0001 00000000 0x0 0x0
0xffffe1800001a380 0001 00000000 0x0 0x0
0xffffe1800001a400 0001 00000000 0x0 0x0
0xffffe1800001a480 0001 00000000 0x0 0x0
0xffffe1800001a500 0001 00000000 0x0 0x0
0xffffe1800001a580 0001 00000000 0x0 0x0
0xffffe1800001a600 0001 00000000 0x0 0x0
0xffffe1800001a680 0001 00000000 0x0 0x0
0xffffe1800001a700 0001 00000000 0x0 0x0
0xffffe1800001a780 0001 00000000 0x0 0x0
0xffffe1800001a800 0001 00000000 0x0 0x0
0xffffe1800001a880 0001 00000000 0x0 0x0
0xffffe1800001a900 0001 00000000 0x0 0x0
0xffffe1800001a980 0001 00000000 0x0 0x0
0xffffe1800001aa00 0001 00000000 0x0 0x0
0xffffe1800001aa80 0001 00000000 0x0 0x0
0xffffe1800001ab00 0001 00000000 0x0 0x0
0xffffe1800001ab80 0001 00000000 0x0 0x0
0xffffe1800001ac00 0001 00000000 0x0 0x0
0xffffe1800001ac80 0001 00000000 0x0 0x0
0xffffe1800001ad00 0001 00000000 0x0 0x0
0xffffe1800001ad80 0001 00000000 0x0 0x0
0xffffe1800001ae00 0001 00000000 0x0 0x0
0xffffe1800001ae80 0001 00000000 0x0 0x0
0xffffe1800001af00 0001 00000000 0x0 0x0
0xffffe1800001af80 0001 00000000 0x0 0x0
0xffffe1800001b000 0001 00000000 0x0 0x0
0xffffe1800001b080 0001 00000000 0x0 0x0
0xffffe1800001b100 0001 00000000 0x0 0x0
0xffffe1800001b180 0001 00000000 0x0 0x0
0xffffe1800001b200 0001 00000000 0x0 0x0
0xffffe1800001b280 0001 00000000 0x0 0x0
0xffffe1800001b300 0001 00000000 0x0 0x0
0xffffe1800001b380 0001 00000000 0x0 0x0
0xffffe1800001b400 0001 00000000 0x0 0x0
0xffffe1800001b480 0001 00000000 0x0 0x0
0xffffe1800001b500 0001 00000000 0x0 0x0
0xffffe1800001b580 0001 00000000 0x0 0x0
0xffffe1800001b600 0001 00000000 0x0 0x0
0xffffe1800001b680 0001 00000000 0x0 0x0
0xffffe1800001b700 0001 00000000 0x0 0x0
0xffffe1800001b780 0001 00000000 0x0 0x0
0xffffe1800001b800 0001 00000000 0x0 0x0
0xffffe1800001b880 0001 00000000 0x0 0x0
0xffffe1800001b900 0001 00000000 0x0 0x0
0xffffe1800001b980 0001 00000000 0x0 0x0
0xffffe1800001ba00 0001 00000000 0x0 0x0
0xffffe1800001ba80 0001 00000000 0x0 0x0
0xffffe1800001bb00 0001 00000000 0x0 0x0
0xffffe1800001bb80 0001 00000000 0x0 0x0
0xffffe1800001bc00 0001 00000000 0x0 0x0
0xffffe1800001bc80 0001 00000000 0x0 0x0
0xffffe1800001bd00 0001 00000000 0x0 0x0
0xffffe1800001bd80 0001 00000000 0x0 0x0
0xffffe1800001be00 0001 00000000 0x0 0x0
0xffffe1800001be80 0001 00000000 0x0 0x0
0xffffe1800001bf00 0001 00000000 0x0 0x0
0xffffe1800001bf80 0001 00000000 0x0 0x0
0xffffe1800001c000 0001 00000000 0x0 0x0
0xffffe1800001c080 0001 00000000 0x0 0x0
0xffffe1800001c100 0001 00000000 0x0 0x0
0xffffe1800001c180 0001 00000000 0x0 0x0
0xffffe1800001c200 0001 00000000 0x0 0x0
0xffffe1800001c280 0001 00000000 0x0 0x0
0xffffe1800001c300 0001 00000000 0x0 0x0
0xffffe1800001c380 0001 00000000 0x0 0x0
0xffffe1800001c400 0001 00000000 0x0 0x0
0xffffe1800001c480 0001 00000000 0x0 0x0
0xffffe1800001c500 0001 00000000 0x0 0x0
0xffffe1800001c580 0001 00000000 0x0 0x0
0xffffe1800001c600 0001 00000000 0x0 0x0
0xffffe1800001c680 0001 00000000 0x0 0x0
0xffffe1800001c700 0001 00000000 0x0 0x0
0xffffe1800001c780 0001 00000000 0x0 0x0
0xffffe1800001c800 0001 00000000 0x0 0x0
0xffffe1800001c880 0001 00000000 0x0 0x0
0xffffe1800001c900 0001 00000000 0x0 0x0
0xffffe1800001c980 0001 00000000 0x0 0x0
0xffffe1800001ca00 0001 00000000 0x0 0x0
0xffffe1800001ca80 0001 00000000 0x0 0x0
0xffffe1800001cb00 0001 00000000 0x0 0x0
0xffffe1800001cb80 0001 00000000 0x0 0x0
0xffffe1800001cc00 0001 00000000 0x0 0x0
0xffffe1800001cc80 0001 00000000 0x0 0x0
0xffffe1800001cd00 0001 00000000 0x0 0x0
0xffffe1800001cd80 0001 00000000 0x0 0x0
0xffffe1800001ce00 0001 00000000 0x0 0x0
0xffffe1800001ce80 0001 00000000 0x0 0x0
0xffffe1800001cf00 0001 00000000 0x0 0x0
0xffffe1800001cf80 0001 00000000 0x0 0x0
0xffffe1800001d000 0001 00000000 0x0 0x0
0xffffe1800001d080 0001 00000000 0x0 0x0
0xffffe1800001d100 0001 00000000 0x0 0x0
0xffffe1800001d180 0001 00000000 0x0 0x0
0xffffe1800001d200 0001 00000000 0x0 0x0
0xffffe1800001d280 0001 00000000 0x0 0x0
0xffffe1800001d300 0001 00000000 0x0 0x0
0xffffe1800001d380 0001 00000000 0x0 0x0
0xffffe1800001d400 0001 00000000 0x0 0x0
0xffffe1800001d480 0001 00000000 0x0 0x0
0xffffe1800001d500 0001 00000000 0x0 0x0
0xffffe1800001d580 0001 00000000 0x0 0x0
0xffffe1800001d600 0001 00000000 0x0 0x0
0xffffe1800001d680 0001 00000000 0x0 0x0
0xffffe1800001d700 0001 00000000 0x0 0x0
0xffffe1800001d780 0001 00000000 0x0 0x0
0xffffe1800001d800 0001 00000000 0x0 0x0
0xffffe1800001d880 0001 00000000 0x0 0x0
0xffffe1800001d900 0001 00000000 0x0 0x0
0xffffe1800001d980 0001 00000000 0x0 0x0
0xffffe1800001da00 0001 00000000 0x0 0x0
0xffffe1800001da80 0001 00000000 0x0 0x0
0xffffe1800001db00 0001 00000000 0x0 0x0
0xffffe1800001db80 0001 00000000 0x0 0x0
0xffffe1800001dc00 0001 00000000 0x0 0x0
0xffffe1800001dc80 0001 00000000 0x0 0x0
0xffffe1800001dd00 0001 00000000 0x0 0x0
0xffffe1800001dd80 0001 00000000 0x0 0x0
0xffffe1800001de00 0001 00000000 0x0 0x0
0xffffe1800001de80 0001 00000000 0x0 0x0
0xffffe1800001df00 0001 00000000 0x0 0x0
0xffffe1800001df80 0001 00000000 0x0 0x0
0xffffe1800001e000 0001 00000000 0x0 0x0
0xffffe1800001e080 0001 00000000 0x0 0x0
0xffffe1800001e100 0001 00000000 0x0 0x0
0xffffe1800001e180 0001 00000000 0x0 0x0
0xffffe1800001e200 0001 00000000 0x0 0x0
0xffffe1800001e280 0001 00000000 0x0 0x0
0xffffe1800001e300 0001 00000000 0x0 0x0
0xffffe1800001e380 0001 00000000 0x0 0x0
0xffffe1800001e400 0001 00000000 0x0 0x0
0xffffe1800001e480 0001 00000000 0x0 0x0
0xffffe1800001e500 0001 00000000 0x0 0x0
0xffffe1800001e580 0001 00000000 0x0 0x0
0xffffe1800001e600 0001 00000000 0x0 0x0
0xffffe1800001e680 0001 00000000 0x0 0x0
0xffffe1800001e700 0001 00000000 0x0 0x0
0xffffe1800001e780 0001 00000000 0x0 0x0
0xffffe1800001e800 0001 00000000 0x0 0x0
0xffffe1800001e880 0001 00000000 0x0 0x0
0xffffe1800001e900 0001 00000000 0x0 0x0
0xffffe1800001e980 0001 00000000 0x0 0x0
0xffffe1800001ea00 0001 00000000 0x0 0x0
0xffffe1800001ea80 0001 00000000 0x0 0x0
0xffffe1800001eb00 0001 00000000 0x0 0x0
0xffffe1800001eb80 0001 00000000 0x0 0x0
0xffffe1800001ec00 0001 00000000 0x0 0x0
0xffffe1800001ec80 0001 00000000 0x0 0x0
0xffffe1800001ed00 0001 00000000 0x0 0x0
0xffffe1800001ed80 0001 00000000 0x0 0x0
0xffffe1800001ee00 0001 00000000 0x0 0x0
0xffffe1800001ee80 0001 00000000 0x0 0x0
0xffffe1800001ef00 0001 00000000 0x0 0x0
0xffffe1800001ef80 0001 00000000 0x0 0x0
0xffffe1800001f000 0001 00000000 0x0 0x0
0xffffe1800001f080 0001 00000000 0x0 0x0
0xffffe1800001f100 0001 00000000 0x0 0x0
0xffffe1800001f180 0001 00000000 0x0 0x0
0xffffe1800001f200 0001 00000000 0x0 0x0
0xffffe1800001f280 0001 00000000 0x0 0x0
0xffffe1800001f300 0001 00000000 0x0 0x0
0xffffe1800001f380 0001 00000000 0x0 0x0
0xffffe1800001f400 0001 00000000 0x0 0x0
0xffffe1800001f480 0001 00000000 0x0 0x0
0xffffe1800001f500 0001 00000000 0x0 0x0
0xffffe1800001f580 0001 00000000 0x0 0x0
0xffffe1800001f600 0001 00000000 0x0 0x0
0xffffe1800001f680 0001 00000000 0x0 0x0
0xffffe1800001f700 0001 00000000 0x0 0x0
0xffffe1800001f780 0001 00000000 0x0 0x0
0xffffe1800001f800 0001 00000000 0x0 0x0
0xffffe1800001f880 0001 00000000 0x0 0x0
0xffffe1800001f900 0001 00000000 0x0 0x0
0xffffe1800001f980 0001 00000000 0x0 0x0
0xffffe1800001fa00 0001 00000000 0x0 0x0
0xffffe1800001fa80 0001 00000000 0x0 0x0
0xffffe1800001fb00 0001 00000000 0x0 0x0
0xffffe1800001fb80 0001 00000000 0x0 0x0
0xffffe1800001fc00 0001 00000000 0x0 0x0
0xffffe1800001fc80 0001 00000000 0x0 0x0
0xffffe1800001fd00 0001 00000000 0x0 0x0
0xffffe1800001fd80 0001 00000000 0x0 0x0
0xffffe1800001fe00 0001 00000000 0x0 0x0
0xffffe1800001fe80 0001 00000000 0x0 0x0
0xffffe1800001ff00 0001 00000000 0x0 0x0
0xffffe1800001ff80 0001 00000000 0x0 0x0
0xffffe18000020000 0001 00000000 0x0 0x0
0xffffe18000020080 0001 00000000 0x0 0x0
0xffffe18000020100 0001 00000000 0x0 0x0
0xffffe18000020180 0001 00000000 0x0 0x0
0xffffe18000020200 0001 00000000 0x0 0x0
0xffffe18000020280 0001 00000000 0x0 0x0
0xffffe18000020300 0001 00000000 0x0 0x0
0xffffe18000020380 0001 00000000 0x0 0x0
0xffffe18000020400 0001 00000000 0x0 0x0
0xffffe18000020480 0001 00000000 0x0 0x0
0xffffe18000020500 0001 00000000 0x0 0x0
0xffffe18000020580 0001 00000000 0x0 0x0
0xffffe18000020600 0001 00000000 0x0 0x0
0xffffe18000020680 0001 00000000 0x0 0x0
0xffffe18000020700 0001 00000000 0x0 0x0
0xffffe18000020780 0001 00000000 0x0 0x0
0xffffe18000020800 0001 00000000 0x0 0x0
0xffffe18000020880 0001 00000000 0x0 0x0
0xffffe18000020900 0001 00000000 0x0 0x0
0xffffe18000020980 0001 00000000 0x0 0x0
0xffffe18000020a00 0001 00000000 0x0 0x0
0xffffe18000020a80 0001 00000000 0x0 0x0
0xffffe18000020b00 0001 00000000 0x0 0x0
0xffffe18000020b80 0001 00000000 0x0 0x0
0xffffe18000020c00 0001 00000000 0x0 0x0
0xffffe18000020c80 0001 00000000 0x0 0x0
0xffffe18000020d00 0001 00000000 0x0 0x0
0xffffe18000020d80 0001 00000000 0x0 0x0
0xffffe18000020e00 0001 00000000 0x0 0x0
0xffffe18000020e80 0001 00000000 0x0 0x0
0xffffe18000020f00 0001 00000000 0x0 0x0
0xffffe18000020f80 0001 00000000 0x0 0x0
0xffffe18000021000 0001 00000000 0x0 0x0
0xffffe18000021080 0001 00000000 0x0 0x0
0xffffe18000021100 0001 00000000 0x0 0x0
0xffffe18000021180 0001 00000000 0x0 0x0
0xffffe18000021200 0001 00000000 0x0 0x0
0xffffe18000021280 0001 00000000 0x0 0x0
0xffffe18000021300 0001 00000000 0x0 0x0
0xffffe18000021380 0001 00000000 0x0 0x0
0xffffe18000021400 0001 00000000 0x0 0x0
0xffffe18000021480 0001 00000000 0x0 0x0
0xffffe18000021500 0001 00000000 0x0 0x0
0xffffe18000021580 0001 00000000 0x0 0x0
0xffffe18000021600 0001 00000000 0x0 0x0
0xffffe18000021680 0001 00000000 0x0 0x0
0xffffe18000021700 0001 00000000 0x0 0x0
0xffffe18000021780 0001 00000000 0x0 0x0
0xffffe18000021800 0001 00000000 0x0 0x0
0xffffe18000021880 0001 00000000 0x0 0x0
0xffffe18000021900 0001 00000000 0x0 0x0
0xffffe18000021980 0001 00000000 0x0 0x0
0xffffe18000021a00 0001 00000000 0x0 0x0
0xffffe18000021a80 0001 00000000 0x0 0x0
0xffffe18000021b00 0001 00000000 0x0 0x0
0xffffe18000021b80 0001 00000000 0x0 0x0
0xffffe18000021c00 0001 00000000 0x0 0x0
0xffffe18000021c80 0001 00000000 0x0 0x0
0xffffe18000021d00 0001 00000000 0x0 0x0
0xffffe18000021d80 0001 00000000 0x0 0x0
0xffffe18000021e00 0001 00000000 0x0 0x0
0xffffe18000021e80 0001 00000000 0x0 0x0
0xffffe18000021f00 0001 00000000 0x0 0x0
0xffffe18000021f80 0001 00000000 0x0 0x0
0xffffe18000022000 0001 00000000 0x0 0x0
0xffffe18000022080 0001 00000000 0x0 0x0
0xffffe18000022100 0001 00000000 0x0 0x0
0xffffe18000022180 0001 00000000 0x0 0x0
0xffffe18000022200 0001 00000000 0x0 0x0
0xffffe18000022280 0001 00000000 0x0 0x0
0xffffe18000022300 0001 00000000 0x0 0x0
0xffffe18000022380 0001 00000000 0x0 0x0
0xffffe18000022400 0001 00000000 0x0 0x0
0xffffe18000022480 0001 00000000 0x0 0x0
0xffffe18000022500 0001 00000000 0x0 0x0
0xffffe18000022580 0001 00000000 0x0 0x0
0xffffe18000022600 0001 00000000 0x0 0x0
0xffffe18000022680 0001 00000000 0x0 0x0
0xffffe18000022700 0001 00000000 0x0 0x0
0xffffe18000022780 0001 00000000 0x0 0x0
0xffffe18000022800 0001 00000000 0x0 0x0
0xffffe18000022880 0001 00000000 0x0 0x0
0xffffe18000022900 0001 00000000 0x0 0x0
0xffffe18000022980 0001 00000000 0x0 0x0
0xffffe18000022a00 0001 00000000 0x0 0x0
0xffffe18000022a80 0001 00000000 0x0 0x0
0xffffe18000022b00 0001 00000000 0x0 0x0
0xffffe18000022b80 0001 00000000 0x0 0x0
0xffffe18000022c00 0001 00000000 0x0 0x0
0xffffe18000022c80 0001 00000000 0x0 0x0
0xffffe18000022d00 0001 00000000 0x0 0x0
0xffffe18000022d80 0001 00000000 0x0 0x0
0xffffe18000022e00 0001 00000000 0x0 0x0
0xffffe18000022e80 0001 00000000 0x0 0x0
0xffffe18000022f00 0001 00000000 0x0 0x0
0xffffe18000022f80 0001 00000000 0x0 0x0
0xffffe18000023000 0001 00000000 0x0 0x0
0xffffe18000023080 0001 00000000 0x0 0x0
0xffffe18000023100 0001 00000000 0x0 0x0
0xffffe18000023180 0001 00000000 0x0 0x0
0xffffe18000023200 0001 00000000 0x0 0x0
0xffffe18000023280 0001 00000000 0x0 0x0
0xffffe18000023300 0001 00000000 0x0 0x0
0xffffe18000023380 0001 00000000 0x0 0x0
0xffffe18000023400 0001 00000000 0x0 0x0
0xffffe18000023480 0001 00000000 0x0 0x0
0xffffe18000023500 0001 00000000 0x0 0x0
0xffffe18000023580 0001 00000000 0x0 0x0
0xffffe18000023600 0001 00000000 0x0 0x0
0xffffe18000023680 0001 00000000 0x0 0x0
0xffffe18000023700 0001 00000000 0x0 0x0
0xffffe18000023780 0001 00000000 0x0 0x0
0xffffe18000023800 0001 00000000 0x0 0x0
0xffffe18000023880 0001 00000000 0x0 0x0
0xffffe18000023900 0001 00000000 0x0 0x0

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Jul 29, 2020, 4:20:15 AM7/29/20

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 47132c89 cninit - don't reset cn_tab on entry.
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=12605f1b100000

kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=217ab285d8dc942722fe
compiler: clang version 3.8.0-2ubuntu4 (tags/RELEASE_380/final)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f2e4a8900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=177fce18900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+217ab2...@syzkaller.appspotmail.com

[ 102.8019348] panic: LOCKDEBUG: Mutex error: rw_vector_enter,309: spin lock held
[ 102.8019348] cpu0: Begin traceback...
[ 102.8019348] vpanic() at netbsd:vpanic+0x91a sys/kern/subr_prf.c:288
[ 102.8019348] panic() at netbsd:panic+0x1ad sys/kern/subr_prf.c:209
[ 102.8019348] lockdebug_abort1() at netbsd:lockdebug_abort1+0xe82
[ 102.8019348] rw_enter() at netbsd:rw_enter+0x35f sys/kern/kern_rwlock.c:321
[ 102.8019348] uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 uvmfault_lookup sys/uvm/uvm_fault_i.h:128 [inline]
[ 102.8019348] uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 uvm_fault_check sys/uvm/uvm_fault.c:987 [inline]
[ 102.8019348] uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 sys/uvm/uvm_fault.c:897
[ 102.8019348] trap() at netbsd:trap+0x21c2 sys/arch/amd64/amd64/trap.c:520
[ 102.8019348] --- trap (number 6) ---
[ 102.8019348] config_devalloc() at netbsd:config_devalloc+0xd30 config_unit_nextfree sys/kern/subr_autoconf.c:1343 [inline]
[ 102.8019348] config_devalloc() at netbsd:config_devalloc+0xd30 config_unit_alloc sys/kern/subr_autoconf.c:1365 [inline]
[ 102.8019348] config_devalloc() at netbsd:config_devalloc+0xd30 sys/kern/subr_autoconf.c:1420
[ 102.8019348] config_attach_pseudo() at netbsd:config_attach_pseudo+0x62 sys/kern/subr_autoconf.c:1648
[ 102.8019348] vndopen() at netbsd:vndopen+0x427 vnd_spawn sys/dev/vnd.c:308 [inline]
[ 102.8019348] vndopen() at netbsd:vndopen+0x427 sys/dev/vnd.c:339
[ 102.8019348] cdev_open() at netbsd:cdev_open+0x2a9 sys/kern/subr_devsw.c:871
[ 102.8019348] spec_open() at netbsd:spec_open+0xb04 sys/miscfs/specfs/spec_vnops.c:563
[ 102.8019348] VOP_OPEN() at netbsd:VOP_OPEN+0x21c sys/kern/vnode_if.c:298
[ 102.8019348] vn_open() at netbsd:vn_open+0x1516 sys/kern/vfs_vnops.c:261
[ 102.8019348] do_open() at netbsd:do_open+0x5b1 sys/kern/vfs_syscalls.c:1668
[ 102.8019348] do_sys_openat() at netbsd:do_sys_openat+0x44b sys/kern/vfs_syscalls.c:1752
[ 102.8019348] sys_open() at netbsd:sys_open+0x13d sys/kern/vfs_syscalls.c:1773
[ 102.8019348] sys_syscall() at netbsd:sys_syscall+0x2a1 sy_call sys/sys/syscallvar.h:65 [inline]
[ 102.8019348] sys_syscall() at netbsd:sys_syscall+0x2a1 sys/kern/sys_syscall.c:77
[ 102.8019348] syscall() at netbsd:syscall+0x42d sy_call sys/sys/syscallvar.h:65 [inline]
[ 102.8019348] syscall() at netbsd:syscall+0x42d sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 102.8019348] syscall() at netbsd:syscall+0x42d sys/arch/x86/x86/syscall.c:138
[ 102.8019348] --- syscall (number 0) ---
[ 102.8019348] netbsd:syscall+0x42d:
[ 102.8019348] cpu0: End traceback...
[ 102.8019348] fatal breakpoint trap in supervisor mode
[ 102.8019348] trap type 1 code 0 rip 0xffffffff8022286d cs 0x8 rflags 0x246 cr2 0xfffffffffffc0010 ilevel 0x8 rsp 0xffffe480827969c0
[ 102.8019348] curlwp 0xffffe48011c5e040 pid 1118.1118 lowest kstack 0xffffe480827902c0
Stopped in pid 1118.1118 (syz-executor0895) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x91a sys/kern/subr_prf.c:288
panic() at netbsd:panic+0x1ad sys/kern/subr_prf.c:209
lockdebug_abort1() at netbsd:lockdebug_abort1+0xe82
rw_enter() at netbsd:rw_enter+0x35f sys/kern/kern_rwlock.c:321
uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 uvmfault_lookup sys/uvm/uvm_fault_i.h:128 [inline]
uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 uvm_fault_check sys/uvm/uvm_fault.c:987 [inline]
uvm_fault_internal() at netbsd:uvm_fault_internal+0x5c6 sys/uvm/uvm_fault.c:897
trap() at netbsd:trap+0x21c2 sys/arch/amd64/amd64/trap.c:520
--- trap (number 6) ---
config_devalloc() at netbsd:config_devalloc+0xd30 config_unit_nextfree sys/kern/subr_autoconf.c:1343 [inline]
config_devalloc() at netbsd:config_devalloc+0xd30 config_unit_alloc sys/kern/subr_autoconf.c:1365 [inline]
config_devalloc() at netbsd:config_devalloc+0xd30 sys/kern/subr_autoconf.c:1420
config_attach_pseudo() at netbsd:config_attach_pseudo+0x62 sys/kern/subr_autoconf.c:1648
vndopen() at netbsd:vndopen+0x427 vnd_spawn sys/dev/vnd.c:308 [inline]
vndopen() at netbsd:vndopen+0x427 sys/dev/vnd.c:339
cdev_open() at netbsd:cdev_open+0x2a9 sys/kern/subr_devsw.c:871
spec_open() at netbsd:spec_open+0xb04 sys/miscfs/specfs/spec_vnops.c:563
VOP_OPEN() at netbsd:VOP_OPEN+0x21c sys/kern/vnode_if.c:298
vn_open() at netbsd:vn_open+0x1516 sys/kern/vfs_vnops.c:261
do_open() at netbsd:do_open+0x5b1 sys/kern/vfs_syscalls.c:1668
do_sys_openat() at netbsd:do_sys_openat+0x44b sys/kern/vfs_syscalls.c:1752
sys_open() at netbsd:sys_open+0x13d sys/kern/vfs_syscalls.c:1773

sys_syscall() at netbsd:sys_syscall+0x2a1 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x2a1 sys/kern/sys_syscall.c:77

syscall() at netbsd:syscall+0x42d sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x42d sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x42d sys/arch/x86/x86/syscall.c:138

--- syscall (number 0) ---

netbsd:syscall+0x42d:
Panic string: LOCKDEBUG: Mutex error: rw_vector_enter,309: spin lock held
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1255 1255 2 1 0 ffffe480124550c0 syz-executor0895
1074 1074 2 1 0 ffffe4801243b900 syz-executor0895
1119 1119 2 0 0 ffffe4801243b4c0 syz-executor0895
416 416 2 0 0 ffffe4801243b080 syz-executor0895
1084 1084 3 0 80 ffffe48011c5e8c0 syz-executor0895 nanoslp
1082 1082 3 1 80 ffffe48011c5e480 syz-executor0895 nanoslp
1118 >1118 7 0 0 ffffe48011c5e040 syz-executor0895
1075 1075 2 0 0 ffffe48011362680 syz-executor0895
1072 1072 3 1 80 ffffe48011362240 syz-executor0895 nanoslp
1091 1091 3 1 80 ffffe48011b4abc0 syz-executor0895 nanoslp
1253 1253 3 0 40080 ffffe48011263a80 syz-executor0895 nanoslp
1078 >1078 7 1 0 ffffe48011b2f740 sshd
945 945 3 0 80 ffffe48011b4a780 getty nanoslp
1102 1102 3 0 80 ffffe48011263640 getty nanoslp
697 697 3 1 80 ffffe48011263200 getty nanoslp
1115 1115 3 0 c0 ffffe4801122d5c0 getty ttyraw
955 955 3 0 80 ffffe48011b4a340 sshd select
727 727 3 0 80 ffffe48011450b00 powerd kqueue
554 554 3 0 80 ffffe48011b2f300 syslogd kqueue
436 436 3 1 80 ffffe480114506c0 dhcpcd poll
424 424 3 1 80 ffffe48011b2fb80 dhcpcd poll
595 595 3 1 80 ffffe48011450280 dhcpcd poll
576 576 3 1 80 ffffe48011573b40 dhcpcd poll
349 349 3 1 80 ffffe48011573700 dhcpcd poll
348 348 3 0 80 ffffe48011362ac0 dhcpcd poll
346 346 3 0 80 ffffe480115732c0 dhcpcd poll
1 1 3 0 80 ffffe48010f34900 init wait
0 847 3 0 200 ffffe4801122da00 physiod physiod
0 162 3 0 200 ffffe48011236a40 pooldrain pooldrain
0 166 3 0 200 ffffe48011236600 ioflush syncer
0 165 3 1 200 ffffe480112361c0 pgdaemon pgdaemon
0 161 3 0 200 ffffe4801122d180 usb7 usbevt
0 31 3 1 200 ffffe480111929c0 usb6 usbevt
0 63 3 0 200 ffffe48011192580 usb5 usbevt
0 126 3 0 200 ffffe48011192140 usb4 usbevt
0 125 3 0 200 ffffe480110df980 usb3 usbevt
0 124 3 1 200 ffffe480110df540 usb2 usbevt
0 123 3 0 200 ffffe480110df100 usb1 usbevt
0 122 3 0 200 ffffe480110cc940 usb0 usbevt
0 121 3 1 200 ffffe480110cc500 usbtask-dr usbtsk
0 120 3 1 200 ffffe480110cc0c0 usbtask-hc usbtsk
0 119 3 0 200 ffffe4800f436ac0 npfgc0 npfgcw
0 118 3 1 200 ffffe48010f344c0 rt_free rt_free
0 117 3 1 200 ffffe48010f34080 unpgc unpgc
0 116 3 0 200 ffffe48010f308c0 key_timehandler key_timehandler
0 115 3 1 200 ffffe48010f30480 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffffe48010f30040 icmp6_wqinput/0 icmp6_wqinput
0 113 3 0 200 ffffe48010ce1b40 nd6_timer nd6_timer
0 112 3 1 200 ffffe48010ce1700 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffffe48010ce12c0 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffffe48010ce5bc0 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffffe48010ce5340 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffffe48010ce3b80 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffffe48010ce3740 icmp_wqinput/0 icmp_wqinput
0 106 3 0 200 ffffe48010ce3300 rt_timer rt_timer
0 105 3 0 200 ffffe48010820b00 vmem_rehash vmem_rehash
0 104 3 0 200 ffffe48010ce5780 entbutler entropy
0 30 3 1 200 ffffe480108206c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffffe48010820280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffffe4800f436680 scsibus0 sccomp
0 26 3 0 200 ffffe4800f436240 pms0 pmsreset
0 25 3 1 200 ffffe4800f425a80 xcall/1 xcall
0 24 1 1 200 ffffe4800f425640 softser/1
0 23 1 1 200 ffffe4800f425200 softclk/1
0 22 1 1 200 ffffe4800f423a40 softbio/1
0 21 1 1 200 ffffe4800f423600 softnet/1
0 20 1 1 201 ffffe4800f4231c0 idle/1
0 19 3 0 200 ffffe4800e29ea00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffffe4800e29e5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffffe4800e29e180 lnxsyswq lnxsyswq
0 16 3 0 200 ffffe4800e2989c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffe4800e298580 sysmon smtaskq
0 14 3 0 200 ffffe4800e298140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffe4800e294980 pmfevent pmfevent
0 12 3 0 200 ffffe4800e294540 sopendfree sopendfr
0 11 3 1 200 ffffe4800e294100 iflnkst iflnkst
0 10 3 0 200 ffffe4800e28b940 nfssilly nfssilly
0 9 3 0 200 ffffe4800e28b500 vdrain vdrain
0 8 3 0 200 ffffe4800e28b0c0 modunload mod_unld
0 7 3 0 200 ffffe4800dc88900 xcall/0 xcall
0 6 1 0 200 ffffe4800dc884c0 softser/0
0 5 1 0 200 ffffe4800dc88080 softclk/0
0 4 1 0 200 ffffe4800dc868c0 softbio/0
0 3 1 0 200 ffffe4800dc86480 softnet/0
0 2 1 0 201 ffffe4800dc86040 idle/0

0 0 3 0 200 ffffffff8625bf80 swapper uvm
[Locks tracked through LWPs]

****** LWP 1074.1074 (syz-executor0895) @ 0xffffe4801243b900, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvmspace_fork)
lock address : 0xffffe48012433458 type : sleep/adaptive
initialized : 0xffffffff84b5e277

shared holds : 0 exclusive: 0
shares wanted: 1 exclusive: 0

relevant cpu : 1 last held: 65535
relevant lwp : 0xffffe4801243b900 last held: 000000000000000000
last locked : 0xffffffff84afe6c6 unlocked*: 0xffffffff84b139c5

owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 1119.1119 (syz-executor0895) @ 0xffffe4801243b4c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)

lock address : 0xffffe48011c52c40 type : sleep/adaptive

initialized : 0xffffffff8187b990
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffe4801243b4c0 last held: 0xffffe4801243b4c0

last locked* : 0xffffffff81896b3b unlocked : 0xffffffff818893b5

owner field : 0xffffe4801243b4c0 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at pmap_ctor)
lock address : 0xffffe48011c52c48 type : sleep/adaptive
initialized : 0xffffffff8187b9a6

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffe4801243b4c0 last held: 0xffffe4801243b4c0
last locked* : 0xffffffff81896f34 unlocked : 0xffffffff8188553a
owner/count : 0xffffe4801243b4c0 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

* Lock 2 (initialized at pool_init)
lock address : 0xffffe4800dc8c370 type : sleep/adaptive
initialized : 0xffffffff84ef0ebd

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffe4801243b4c0 last held: 0xffffe4801243b4c0
last locked* : 0xffffffff84ef69c2 unlocked : 0xffffffff84ef9ae0
owner field : 0xffffe4801243b4c0 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1082.1082 (syz-executor0895) @ 0xffffe48011c5e480, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffffe48011c52700 type : sleep/adaptive
initialized : 0xffffffff8187b990

shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 1

relevant lwp : 0xffffe48011c5e480 last held: 000000000000000000
last locked : 0xffffffff81888dbd unlocked*: 0xffffffff818893b5

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 1118.1118 (syz-executor0895) @ 0xffffe48011c5e040, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffffffff861ecc98 type : sleep/adaptive
initialized : 0xffffffff84b5b800
shared holds : 0 exclusive: 0
shares wanted: 1 exclusive: 0

relevant cpu : 0 last held: 65535
relevant lwp : 0xffffe48011c5e040 last held: 000000000000000000
last locked : 0xffffffff84b08894 unlocked*: 0xffffffff84b139c5

owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 424.424 (dhcpcd) @ 0xffffe48011b2fb80, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862daf80 type : sleep/adaptive
initialized : 0xffffffff84d145f3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffffe48011b2fb80 last held: 000000000000000000