assert "uvm_page_owner_locked_p(pg)" failed in managers/multicore/kernel/sys/uvm/uvm_page.c

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 845086ffb80c fix RBT_ENTRY in pf_state and pf_state_key
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16ea9f29980000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=fe1976d752744c7b6920

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/00456d62c54f/disk-845086ff.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/66c88bc878e2/bsd-845086ff.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f592c027bb49/kernel-845086ff.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fe1976...@syzkaller.appspotmail.com

panic: kernel diagnostic assertion "uvm_page_owner_locked_p(pg)" failed: file "/syzkaller/ma
nagers/multicore/kernel/sys/uvm/uvm_page.c", line 1248
Starting stack trace...
panic(ffffffff830e5ba8) at panic+0x1d0 sys/kern/subr_prf.c:229
__assert(ffffffff8309b56c,ffffffff8304189f,4e0,ffffffff830f0b1f) at __assert+0x29
uvm_pageunwire(fffffd8008974840) at uvm_pageunwire+0x1dd sys/uvm/uvm_page.c:1248
uvm_fault_unwire_locked(fffffd806bfae6f0,fe83d6fb000,fe83d8fa000) at uvm_fault_unwire_locked+0x33e sys/uvm/uvm_fault.c:1695
uvm_unmap_kill_entry_withlock(fffffd806bfae6f0,fffffd805b60ca98,0) at uvm_unmap_kill_entry_withlock+0x86 sys/uvm/uvm_map.c:1862
uvm_map_teardown(fffffd806bfae6f0) at uvm_map_teardown+0x1c7 sys/uvm/uvm_map.c:2498
uvmspace_free(fffffd806bfae6f0) at uvmspace_free+0xcd sys/uvm/uvm_map.c:3422
reaper(ffff800029fd91c0) at reaper+0x246 sys/kern/kern_exit.c:480
end trace frame: 0x0, count: 249
End of stack trace.


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup