assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (7)
5 views
Skip to first unread message
syzbot
Aug 31, 2026, 6:17:32 AMAug 31
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: aafb676041ac Merge remote-tracking branch 'origin/master' ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=119a4349580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=4879bdffb0be0c094968
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/608ac4b57e87/disk-aafb6760.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/9c04686ee28b/bsd-aafb6760.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/57296e8687f8/kernel-aafb6760.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4879bd...@syzkaller.appspotmail.com
panic: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
214974 11026 0 0 0 0 syz-executor
* 18397 11026 0 0 0x4000000 1K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff800001c8f208,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045fef788,200000000000,10000,3,ffff800032b27b40) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800032b280a0) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800032b27dc0) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963950,ffff800032b280a0,0,ffff800000119478) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d691b0,ffff800032b280a0,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045fef788,4,ffff800032b280a0,1,ffff800032b28280) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045fef788,ffff800032b28320,ffff800032b28280) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800032b28320) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800032b28320) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5dfc3679e00, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764
ddb{1}> show kasan
kasan: no report recorded this boot
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff800001c8f208,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045fef788,200000000000,10000,3,ffff800032b27b40) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800032b280a0) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800032b27dc0) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963950,ffff800032b280a0,0,ffff800000119478) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d691b0,ffff800032b280a0,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045fef788,4,ffff800032b280a0,1,ffff800032b28280) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045fef788,ffff800032b28320,ffff800032b28280) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800032b28320) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800032b28320) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5dfc3679e00, count: -14
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800032b27610
rbx 0xffff800032b27680
rdx 0
rcx 0xffff800028fe3ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x5
r11 0xffffffff82bb0da0 x86_bus_space_io_read_1
r12 0xffffffff84bd03e0 .str.2
r13 0xffff800028fe4c08
r14 0xffff800028fe4e07
r15 0x1
rip 0xffffffff810b7607 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff800032b27610
ss 0x10
db_enter+0x17: popq %rbp
ddb{1}> show proc
PROC (syz-executor) tid=18397 pid=11026 tcnt=4 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=36, usrpri=77, slppri=36, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045feea90,0xffff800045fee2d8
process=0xffff800045ff39e0 user=0xffff800032b1d000, vmspace=0xffff800001c8f208
estcpu=27, cpticks=3, pctcpu=0.0, user=0, sys=3, intr=0
ddb{1}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
2195 433118 39700 0 3 0x2 0 clonelk ifconfig
39700 465556 47533 0 3 0x100002 0x88 sigsusp sh
11026 214974 65609 0 7 0 0 syz-executor
*11026 18397 65609 0 7 0 0x4000000 syz-executor
11026 518365 65609 0 2 0 0x4000000 syz-executor
11026 486283 65609 0 2 0 0x4000000 syz-executor
83015 239337 45028 0 2 0 0 syz-executor
83015 254543 45028 0 3 0 0x4000080 fsleep syz-executor
83015 184053 45028 0 3 0 0x4000080 fsleep syz-executor
83015 343468 45028 0 3 0 0x4000080 fsleep syz-executor
61278 202692 16664 0 2 0 0 syz-executor
61278 276126 16664 0 3 0 0x4000080 kqsel syz-executor
61278 412659 16664 0 3 0 0x4000080 fsleep syz-executor
52527 390043 15801 0 2 0 0 syz-executor
52527 418532 15801 0 3 0 0x4000080 semwait syz-executor
52527 262805 15801 0 3 0 0x4000080 fsleep syz-executor
47533 332211 42607 0 3 0x2 0x80 wait syz-executor
15801 226951 42607 0 3 0x2 0x80 nanoslp syz-executor
16664 174613 42607 0 3 0x2 0x80 nanoslp syz-executor
65609 134755 42607 0 3 0x2 0x80 nanoslp syz-executor
33660 435076 42607 0 3 0x2 0x80 piperd syz-executor
45028 458977 42607 0 3 0x2 0x80 nanoslp syz-executor
61347 514776 42607 0 3 0x2 0x80 nanoslp syz-executor
42607 13559 85668 0 3 0x2 0x80 wait syz-executor
85668 251725 43457 0 3 0x100002 0x88 sigsusp ksh
43457 299336 53859 0 3 0x10 0x88 kqread sshd-session
53859 422578 43260 0 3 0x12 0x80 kqread sshd-session
9207 184020 1 0 3 0x100003 0x80 ttyin getty
43260 432610 1 0 3 0 0x88 kqread sshd
11502 296371 45866 74 3 0x1100012 0x80 bpf pflogd
45866 131873 1 0 3 0 0x80 sbwait pflogd
94682 114394 67667 73 3 0x1100010 0x80 kqread syslogd
67667 135187 1 0 3 0x100002 0x80 sbwait syslogd
4366 322414 1 0 3 0x100000 0x80 kqread resolvd
50813 156038 62333 77 3 0x100012 0x80 kqread dhcpleased
42739 419462 62333 77 3 0x100012 0x80 kqread dhcpleased
62333 409369 1 0 3 0 0x80 kqread dhcpleased
8662 16960 0 0 3 0x14000 0x200 bored smr
27404 284719 0 0 2 0x14000 0x200 zerothread
9238 132235 0 0 3 0x14000 0x200 aiodoned aiodoned
27182 467331 0 0 3 0x14000 0x200 syncer update
16000 496988 0 0 3 0x14000 0x200 cleaner cleaner
76765 92853 0 0 3 0x14000 0x200 reaper reaper
56015 107084 0 0 3 0x14000 0x200 pgdaemon pagedaemon
44794 462920 0 0 3 0x14000 0x200 bored viomb
16200 455696 0 0 3 0x14000 0x40000200 acpi0 acpi0
21517 100896 0 0 3 0x14000 0x40000200 idle1
63056 484809 0 0 3 0x14000 0x200 bored softnet1
22233 220429 0 0 3 0x14000 0x200 bored softnet0
39572 228053 0 0 3 0x14000 0x200 bored systqmp
71127 431652 0 0 3 0x14000 0x200 bored systq
77009 110185 0 0 3 0x14000 0x200 tmoslp softclockmp
59958 266754 0 0 3 0x14000 0x40000200 tmoslp softclock
34875 234826 0 0 3 0x14000 0x40000200 idle0
1 220247 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{1}> show all locks
Process 11026 (syz-executor) thread 0xffff800045fef788 (18397)
exclusive rwlock amaplk r = 0 (0xffff800001b05638)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464
#3 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776
#4 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
#4 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
#5 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#6 physio+0x4a7 sys/kern/kern_physio.c:139
#7 spec_read+0x29a sys/kern/spec_vnops.c:215
#8 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#9 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#10 dofilereadv+0x386 sys/kern/sys_generic.c:252
#11 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#13 Xsyscall+0x128
shared rwlock vmmaplk r = 0 (0xffff800001c8f308)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413
#2 uvm_fault_wire+0x116 uvm_fault_unwire sys/uvm/uvm_fault.c:1723 [inline]
#2 uvm_fault_wire+0x116 sys/uvm/uvm_fault.c:1706
#3 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#4 physio+0x4a7 sys/kern/kern_physio.c:139
#5 spec_read+0x29a sys/kern/spec_vnops.c:215
#6 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#7 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#8 dofilereadv+0x386 sys/kern/sys_generic.c:252
#9 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#11 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85e55840)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1
#2 sleep_finish+0x423 sys/kern/kern_synch.c:369
#3 rw_do_enter_read+0x3bd sys/kern/kern_rwlock.c:392
#4 uvmfault_lookup+0x1a2 sys/uvm/uvm_fault.c:-1
#5 uvm_fault_check+0x43 sys/uvm/uvm_fault.c:693
#6 uvm_fault+0x1e7 sys/uvm/uvm_fault.c:627
#7 uvm_fault_wire+0x73 sys/uvm/uvm_fault.c:1703
#8 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#9 physio+0x4a7 sys/kern/kern_physio.c:139
#10 spec_read+0x29a sys/kern/spec_vnops.c:215
#11 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#12 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#13 dofilereadv+0x386 sys/kern/sys_generic.c:252
#14 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#15 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#15 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#16 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11052 12250K 12390K 166960K 12279 0
pcb 17 24K 24K 166960K 35 0
rtable 193 10K 13K 166960K 955 0
pf 31 21K 24K 166960K 90 0
ifaddr 35 10K 12K 166960K 130 0
ifgroup 47 2K 2K 166960K 140 0
sysctl 1 1K 13K 166960K 5 0
counters 66 41K 42K 166960K 112 0
ioctlops 0 0K 4K 166960K 1520 0
iov 0 0K 4K 166960K 2 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1297 83K 84K 166960K 1605 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 6K 166960K 6 0
VM map 2 1K 1K 166960K 2 0
sem 6 0K 0K 166960K 10 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 17 61K 93K 166960K 549 0
proc 78 145K 177K 166960K 1131 0
subproc 72 9K 9K 166960K 261 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 9 0
in_multi 77 5K 7K 166960K 319 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 8 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 61 425K 425K 166960K 61 0
exec 0 0K 2K 166960K 649 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM amap 223 234K 251K 166960K 5826 0
UVM aobj 8 4K 4K 166960K 8 0
pinsyscall 1066 1788K 1793K 166960K 2229 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 4 0
NDP 18 1K 2K 166960K 89 0
temp 35 9166K 9194K 166960K 11259 0
kqueue 14 41K 46K 166960K 46 0
SYN cache 2 16K 16K 166960K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 74 0 71 1 0 1 1 0 8 0
rtentry 176 333 0 245 6 0 6 6 0 8 1
unpcb 144 116 0 99 1 0 1 1 0 8 0
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 16 0 12 1 0 1 1 0 8 0
arp 136 59 0 45 1 0 1 1 0 8 0
inpcb 328 277 0 269 7 0 7 7 0 8 6
nd6 152 85 0 67 1 0 1 1 0 8 0
kcovpl 48 29 0 21 1 0 1 1 0 8 0
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 1 0 0 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 25 0 0 1 0 1 1 0 8 0
pfstkey 128 25 0 0 1 0 1 1 0 8 0
pfstate 448 24 0 0 3 0 3 3 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 1340 0 970 31 5 26 29 0 8 2
art_table 40 1341 0 970 5 0 5 5 0 8 0
art_node 32 333 0 253 1 0 1 1 0 8 0
semupl 112 4 0 3 1 0 1 1 0 8 0
semapl 72 8 0 4 1 0 1 1 0 8 0
shmpl 112 5 0 0 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1759 0 243 95 0 95 95 0 8 0
ffsino 296 1759 0 243 117 0 117 117 0 8 0
nchpl 144 2131 0 365 66 0 66 66 0 8 0
vnodes 216 2074 0 0 116 0 116 116 0 8 0
namei 1024 10366 0 10366 2 1 1 2 0 8 1
percpumem 16 72 0 23 1 0 1 1 0 8 0
kstatmem 264 69 0 46 2 0 2 2 0 8 0
scxspl 216 7910 0 7910 5 3 2 3 1 8 2
plimitpl 152 60 0 43 1 0 1 1 0 8 0
sigapl 424 824 0 777 8 1 7 7 0 8 0
knotepl 120 87 0 0 3 0 3 3 0 8 0
kqueuepl 224 129 0 116 5 0 5 5 0 8 4
pipepl 344 200 0 173 3 0 3 3 0 8 0
fdescpl 528 808 0 777 3 0 3 3 0 8 0
filepl 160 3176 0 2959 15 0 15 15 0 8 4
lockfpl 104 33 0 31 1 0 1 1 0 8 0
lockfspl 48 16 0 14 1 0 1 1 0 8 0
sessionpl 144 82 0 73 1 0 1 1 0 8 0
pgrppl 48 111 0 94 1 0 1 1 0 8 0
ucredpl 104 182 0 168 1 0 1 1 0 8 0
zombiepl 144 779 0 777 1 0 1 1 0 8 0
processpl 1232 824 0 777 5 0 5 5 0 8 0
procpl 664 1067 0 1010 7 1 6 6 0 8 1
sockpl 752 468 0 440 10 0 10 10 0 8 7
mcl64k 65536 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 120 0 0 15 0 15 15 0 8 0
mcl2k 2048 22 0 0 3 0 3 3 0 8 0
mextrefs 64 24 0 0 1 0 1 1 0 8 0
mtagpl 96 1 0 0 1 0 1 1 0 8 0
mbufpl 256 175 0 0 11 0 11 11 0 8 0
bufpl 272 2646 0 106 170 0 170 170 0 8 0
anonpl 32 3853 0 0 32 0 32 32 0 222 0
amapchunkpl 152 15796 0 15346 22 1 21 21 0 158 3
amappl16 200 2059 0 2026 5 3 2 5 0 8 0
amappl15 192 10 0 10 2 2 0 1 0 8 0
amappl14 184 674 0 672 1 0 1 1 0 8 0
amappl13 176 178 0 166 1 0 1 1 0 8 0
amappl12 168 1154 0 1125 2 0 2 2 0 8 0
amappl11 160 10 0 10 2 1 1 1 0 8 1
amappl10 152 109 0 95 1 0 1 1 0 8 0
amappl9 144 327 0 327 1 1 0 1 0 8 0
amappl8 136 194 0 191 1 0 1 1 0 8 0
amappl7 128 198 0 184 1 0 1 1 0 8 0
amappl6 120 391 0 387 1 0 1 1 0 8 0
amappl5 112 110 0 100 1 0 1 1 0 8 0
amappl4 104 358 0 336 1 0 1 1 0 8 0
amappl3 96 2899 0 2808 3 0 3 3 0 8 0
amappl2 88 853 0 777 2 0 2 2 0 8 0
amappl1 80 13581 0 12972 16 1 15 16 0 8 0
amappl 88 4735 0 4583 4 0 4 4 0 92 0
uvmvnodes 80 99 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 7 0 0 1 0 1 1 0 8 0
uaddrrnd 24 808 0 777 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 808 0 777 1 0 1 1 0 8 0
vmmpekpl 168 8637 0 8599 3 0 3 3 0 8 0
vmmpepl 168 61566 0 59705 87 0 87 87 0 357 4
vmsppl 488 807 0 777 5 0 5 5 0 8 1
rwobjpl 80 20431 0 19382 25 0 25 25 0 8 1
pdppl 4096 1625 0 1554 117 44 73 87 0 8 2
pvpl 32 10432 0 0 86 1 85 85 0 265 0
pmappl 256 807 0 777 3 0 3 3 0 8 0
extentpl 40 47 0 29 1 0 1 1 0 8 0
phpool 120 464 0 55 13 0 13 13 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff85e55040) at __asan_load4_noabort
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 kasan_shadow_8byte_isvalid sys/kern/kasan_shadow.h:146 [inline]
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 kasan_shadow_check sys/kern/subr_kasan.c:991 [inline]
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 sys/kern/subr_kasan.c:1099
syscall(ffff8000353102d0) at syscall+0xa59 pin_check sys/sys/syscall_mi.h:91 [inline]
syscall(ffff8000353102d0) at syscall+0xa59 mi_syscall sys/sys/syscall_mi.h:164 [inline]
syscall(ffff8000353102d0) at syscall+0xa59 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74ff3abac4c0, count: 5
ddb{0}> trace
x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff85e55040) at __asan_load4_noabort
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 kasan_shadow_8byte_isvalid sys/kern/kasan_shadow.h:146 [inline]
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 kasan_shadow_check sys/kern/subr_kasan.c:991 [inline]
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 sys/kern/subr_kasan.c:1099
syscall(ffff8000353102d0) at syscall+0xa59 pin_check sys/sys/syscall_mi.h:91 [inline]
syscall(ffff8000353102d0) at syscall+0xa59 mi_syscall sys/sys/syscall_mi.h:164 [inline]
syscall(ffff8000353102d0) at syscall+0xa59 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74ff3abac4c0, count: -10
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x17: popq %rbp
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff800001c8f208,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045fef788,200000000000,10000,3,ffff800032b27b40) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800032b280a0) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800032b27dc0) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963950,ffff800032b280a0,0,ffff800000119478) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d691b0,ffff800032b280a0,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045fef788,4,ffff800032b280a0,1,ffff800032b28280) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045fef788,ffff800032b28320,ffff800032b28280) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800032b28320) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800032b28320) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5dfc3679e00, count: 1
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff800001c8f208,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045fef788,200000000000,10000,3,ffff800032b27b40) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800032b280a0) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800032b27dc0) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963950,ffff800032b280a0,0,ffff800000119478) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d691b0,ffff800032b280a0,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045fef788,4,ffff800032b280a0,1,ffff800032b28280) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045fef788,ffff800032b28320,ffff800032b28280) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800032b28320) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800032b28320) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5dfc3679e00, count: -14
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: aafb676041ac Merge remote-tracking branch 'origin/master' ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=119a4349580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=4879bdffb0be0c094968
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/608ac4b57e87/disk-aafb6760.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/9c04686ee28b/bsd-aafb6760.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/57296e8687f8/kernel-aafb6760.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4879bd...@syzkaller.appspotmail.com
panic: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
214974 11026 0 0 0 0 syz-executor
* 18397 11026 0 0 0x4000000 1K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff800001c8f208,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045fef788,200000000000,10000,3,ffff800032b27b40) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800032b280a0) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800032b27dc0) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963950,ffff800032b280a0,0,ffff800000119478) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d691b0,ffff800032b280a0,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045fef788,4,ffff800032b280a0,1,ffff800032b28280) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045fef788,ffff800032b28320,ffff800032b28280) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800032b28320) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800032b28320) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5dfc3679e00, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764
ddb{1}> show kasan
kasan: no report recorded this boot
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff800001c8f208,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045fef788,200000000000,10000,3,ffff800032b27b40) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800032b280a0) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800032b27dc0) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963950,ffff800032b280a0,0,ffff800000119478) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d691b0,ffff800032b280a0,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045fef788,4,ffff800032b280a0,1,ffff800032b28280) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045fef788,ffff800032b28320,ffff800032b28280) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800032b28320) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800032b28320) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5dfc3679e00, count: -14
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800032b27610
rbx 0xffff800032b27680
rdx 0
rcx 0xffff800028fe3ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x5
r11 0xffffffff82bb0da0 x86_bus_space_io_read_1
r12 0xffffffff84bd03e0 .str.2
r13 0xffff800028fe4c08
r14 0xffff800028fe4e07
r15 0x1
rip 0xffffffff810b7607 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff800032b27610
ss 0x10
db_enter+0x17: popq %rbp
ddb{1}> show proc
PROC (syz-executor) tid=18397 pid=11026 tcnt=4 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=36, usrpri=77, slppri=36, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045feea90,0xffff800045fee2d8
process=0xffff800045ff39e0 user=0xffff800032b1d000, vmspace=0xffff800001c8f208
estcpu=27, cpticks=3, pctcpu=0.0, user=0, sys=3, intr=0
ddb{1}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
2195 433118 39700 0 3 0x2 0 clonelk ifconfig
39700 465556 47533 0 3 0x100002 0x88 sigsusp sh
11026 214974 65609 0 7 0 0 syz-executor
*11026 18397 65609 0 7 0 0x4000000 syz-executor
11026 518365 65609 0 2 0 0x4000000 syz-executor
11026 486283 65609 0 2 0 0x4000000 syz-executor
83015 239337 45028 0 2 0 0 syz-executor
83015 254543 45028 0 3 0 0x4000080 fsleep syz-executor
83015 184053 45028 0 3 0 0x4000080 fsleep syz-executor
83015 343468 45028 0 3 0 0x4000080 fsleep syz-executor
61278 202692 16664 0 2 0 0 syz-executor
61278 276126 16664 0 3 0 0x4000080 kqsel syz-executor
61278 412659 16664 0 3 0 0x4000080 fsleep syz-executor
52527 390043 15801 0 2 0 0 syz-executor
52527 418532 15801 0 3 0 0x4000080 semwait syz-executor
52527 262805 15801 0 3 0 0x4000080 fsleep syz-executor
47533 332211 42607 0 3 0x2 0x80 wait syz-executor
15801 226951 42607 0 3 0x2 0x80 nanoslp syz-executor
16664 174613 42607 0 3 0x2 0x80 nanoslp syz-executor
65609 134755 42607 0 3 0x2 0x80 nanoslp syz-executor
33660 435076 42607 0 3 0x2 0x80 piperd syz-executor
45028 458977 42607 0 3 0x2 0x80 nanoslp syz-executor
61347 514776 42607 0 3 0x2 0x80 nanoslp syz-executor
42607 13559 85668 0 3 0x2 0x80 wait syz-executor
85668 251725 43457 0 3 0x100002 0x88 sigsusp ksh
43457 299336 53859 0 3 0x10 0x88 kqread sshd-session
53859 422578 43260 0 3 0x12 0x80 kqread sshd-session
9207 184020 1 0 3 0x100003 0x80 ttyin getty
43260 432610 1 0 3 0 0x88 kqread sshd
11502 296371 45866 74 3 0x1100012 0x80 bpf pflogd
45866 131873 1 0 3 0 0x80 sbwait pflogd
94682 114394 67667 73 3 0x1100010 0x80 kqread syslogd
67667 135187 1 0 3 0x100002 0x80 sbwait syslogd
4366 322414 1 0 3 0x100000 0x80 kqread resolvd
50813 156038 62333 77 3 0x100012 0x80 kqread dhcpleased
42739 419462 62333 77 3 0x100012 0x80 kqread dhcpleased
62333 409369 1 0 3 0 0x80 kqread dhcpleased
8662 16960 0 0 3 0x14000 0x200 bored smr
27404 284719 0 0 2 0x14000 0x200 zerothread
9238 132235 0 0 3 0x14000 0x200 aiodoned aiodoned
27182 467331 0 0 3 0x14000 0x200 syncer update
16000 496988 0 0 3 0x14000 0x200 cleaner cleaner
76765 92853 0 0 3 0x14000 0x200 reaper reaper
56015 107084 0 0 3 0x14000 0x200 pgdaemon pagedaemon
44794 462920 0 0 3 0x14000 0x200 bored viomb
16200 455696 0 0 3 0x14000 0x40000200 acpi0 acpi0
21517 100896 0 0 3 0x14000 0x40000200 idle1
63056 484809 0 0 3 0x14000 0x200 bored softnet1
22233 220429 0 0 3 0x14000 0x200 bored softnet0
39572 228053 0 0 3 0x14000 0x200 bored systqmp
71127 431652 0 0 3 0x14000 0x200 bored systq
77009 110185 0 0 3 0x14000 0x200 tmoslp softclockmp
59958 266754 0 0 3 0x14000 0x40000200 tmoslp softclock
34875 234826 0 0 3 0x14000 0x40000200 idle0
1 220247 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{1}> show all locks
Process 11026 (syz-executor) thread 0xffff800045fef788 (18397)
exclusive rwlock amaplk r = 0 (0xffff800001b05638)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464
#3 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776
#4 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
#4 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
#5 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#6 physio+0x4a7 sys/kern/kern_physio.c:139
#7 spec_read+0x29a sys/kern/spec_vnops.c:215
#8 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#9 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#10 dofilereadv+0x386 sys/kern/sys_generic.c:252
#11 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#13 Xsyscall+0x128
shared rwlock vmmaplk r = 0 (0xffff800001c8f308)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413
#2 uvm_fault_wire+0x116 uvm_fault_unwire sys/uvm/uvm_fault.c:1723 [inline]
#2 uvm_fault_wire+0x116 sys/uvm/uvm_fault.c:1706
#3 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#4 physio+0x4a7 sys/kern/kern_physio.c:139
#5 spec_read+0x29a sys/kern/spec_vnops.c:215
#6 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#7 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#8 dofilereadv+0x386 sys/kern/sys_generic.c:252
#9 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#11 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85e55840)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1
#2 sleep_finish+0x423 sys/kern/kern_synch.c:369
#3 rw_do_enter_read+0x3bd sys/kern/kern_rwlock.c:392
#4 uvmfault_lookup+0x1a2 sys/uvm/uvm_fault.c:-1
#5 uvm_fault_check+0x43 sys/uvm/uvm_fault.c:693
#6 uvm_fault+0x1e7 sys/uvm/uvm_fault.c:627
#7 uvm_fault_wire+0x73 sys/uvm/uvm_fault.c:1703
#8 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#9 physio+0x4a7 sys/kern/kern_physio.c:139
#10 spec_read+0x29a sys/kern/spec_vnops.c:215
#11 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#12 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#13 dofilereadv+0x386 sys/kern/sys_generic.c:252
#14 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#15 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#15 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#16 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11052 12250K 12390K 166960K 12279 0
pcb 17 24K 24K 166960K 35 0
rtable 193 10K 13K 166960K 955 0
pf 31 21K 24K 166960K 90 0
ifaddr 35 10K 12K 166960K 130 0
ifgroup 47 2K 2K 166960K 140 0
sysctl 1 1K 13K 166960K 5 0
counters 66 41K 42K 166960K 112 0
ioctlops 0 0K 4K 166960K 1520 0
iov 0 0K 4K 166960K 2 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1297 83K 84K 166960K 1605 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 6K 166960K 6 0
VM map 2 1K 1K 166960K 2 0
sem 6 0K 0K 166960K 10 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 17 61K 93K 166960K 549 0
proc 78 145K 177K 166960K 1131 0
subproc 72 9K 9K 166960K 261 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 9 0
in_multi 77 5K 7K 166960K 319 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 8 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 61 425K 425K 166960K 61 0
exec 0 0K 2K 166960K 649 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM amap 223 234K 251K 166960K 5826 0
UVM aobj 8 4K 4K 166960K 8 0
pinsyscall 1066 1788K 1793K 166960K 2229 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 4 0
NDP 18 1K 2K 166960K 89 0
temp 35 9166K 9194K 166960K 11259 0
kqueue 14 41K 46K 166960K 46 0
SYN cache 2 16K 16K 166960K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 74 0 71 1 0 1 1 0 8 0
rtentry 176 333 0 245 6 0 6 6 0 8 1
unpcb 144 116 0 99 1 0 1 1 0 8 0
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 16 0 12 1 0 1 1 0 8 0
arp 136 59 0 45 1 0 1 1 0 8 0
inpcb 328 277 0 269 7 0 7 7 0 8 6
nd6 152 85 0 67 1 0 1 1 0 8 0
kcovpl 48 29 0 21 1 0 1 1 0 8 0
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 1 0 0 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 25 0 0 1 0 1 1 0 8 0
pfstkey 128 25 0 0 1 0 1 1 0 8 0
pfstate 448 24 0 0 3 0 3 3 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 1340 0 970 31 5 26 29 0 8 2
art_table 40 1341 0 970 5 0 5 5 0 8 0
art_node 32 333 0 253 1 0 1 1 0 8 0
semupl 112 4 0 3 1 0 1 1 0 8 0
semapl 72 8 0 4 1 0 1 1 0 8 0
shmpl 112 5 0 0 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1759 0 243 95 0 95 95 0 8 0
ffsino 296 1759 0 243 117 0 117 117 0 8 0
nchpl 144 2131 0 365 66 0 66 66 0 8 0
vnodes 216 2074 0 0 116 0 116 116 0 8 0
namei 1024 10366 0 10366 2 1 1 2 0 8 1
percpumem 16 72 0 23 1 0 1 1 0 8 0
kstatmem 264 69 0 46 2 0 2 2 0 8 0
scxspl 216 7910 0 7910 5 3 2 3 1 8 2
plimitpl 152 60 0 43 1 0 1 1 0 8 0
sigapl 424 824 0 777 8 1 7 7 0 8 0
knotepl 120 87 0 0 3 0 3 3 0 8 0
kqueuepl 224 129 0 116 5 0 5 5 0 8 4
pipepl 344 200 0 173 3 0 3 3 0 8 0
fdescpl 528 808 0 777 3 0 3 3 0 8 0
filepl 160 3176 0 2959 15 0 15 15 0 8 4
lockfpl 104 33 0 31 1 0 1 1 0 8 0
lockfspl 48 16 0 14 1 0 1 1 0 8 0
sessionpl 144 82 0 73 1 0 1 1 0 8 0
pgrppl 48 111 0 94 1 0 1 1 0 8 0
ucredpl 104 182 0 168 1 0 1 1 0 8 0
zombiepl 144 779 0 777 1 0 1 1 0 8 0
processpl 1232 824 0 777 5 0 5 5 0 8 0
procpl 664 1067 0 1010 7 1 6 6 0 8 1
sockpl 752 468 0 440 10 0 10 10 0 8 7
mcl64k 65536 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 120 0 0 15 0 15 15 0 8 0
mcl2k 2048 22 0 0 3 0 3 3 0 8 0
mextrefs 64 24 0 0 1 0 1 1 0 8 0
mtagpl 96 1 0 0 1 0 1 1 0 8 0
mbufpl 256 175 0 0 11 0 11 11 0 8 0
bufpl 272 2646 0 106 170 0 170 170 0 8 0
anonpl 32 3853 0 0 32 0 32 32 0 222 0
amapchunkpl 152 15796 0 15346 22 1 21 21 0 158 3
amappl16 200 2059 0 2026 5 3 2 5 0 8 0
amappl15 192 10 0 10 2 2 0 1 0 8 0
amappl14 184 674 0 672 1 0 1 1 0 8 0
amappl13 176 178 0 166 1 0 1 1 0 8 0
amappl12 168 1154 0 1125 2 0 2 2 0 8 0
amappl11 160 10 0 10 2 1 1 1 0 8 1
amappl10 152 109 0 95 1 0 1 1 0 8 0
amappl9 144 327 0 327 1 1 0 1 0 8 0
amappl8 136 194 0 191 1 0 1 1 0 8 0
amappl7 128 198 0 184 1 0 1 1 0 8 0
amappl6 120 391 0 387 1 0 1 1 0 8 0
amappl5 112 110 0 100 1 0 1 1 0 8 0
amappl4 104 358 0 336 1 0 1 1 0 8 0
amappl3 96 2899 0 2808 3 0 3 3 0 8 0
amappl2 88 853 0 777 2 0 2 2 0 8 0
amappl1 80 13581 0 12972 16 1 15 16 0 8 0
amappl 88 4735 0 4583 4 0 4 4 0 92 0
uvmvnodes 80 99 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 7 0 0 1 0 1 1 0 8 0
uaddrrnd 24 808 0 777 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 808 0 777 1 0 1 1 0 8 0
vmmpekpl 168 8637 0 8599 3 0 3 3 0 8 0
vmmpepl 168 61566 0 59705 87 0 87 87 0 357 4
vmsppl 488 807 0 777 5 0 5 5 0 8 1
rwobjpl 80 20431 0 19382 25 0 25 25 0 8 1
pdppl 4096 1625 0 1554 117 44 73 87 0 8 2
pvpl 32 10432 0 0 86 1 85 85 0 265 0
pmappl 256 807 0 777 3 0 3 3 0 8 0
extentpl 40 47 0 29 1 0 1 1 0 8 0
phpool 120 464 0 55 13 0 13 13 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff85e55040) at __asan_load4_noabort
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 kasan_shadow_8byte_isvalid sys/kern/kasan_shadow.h:146 [inline]
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 kasan_shadow_check sys/kern/subr_kasan.c:991 [inline]
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 sys/kern/subr_kasan.c:1099
syscall(ffff8000353102d0) at syscall+0xa59 pin_check sys/sys/syscall_mi.h:91 [inline]
syscall(ffff8000353102d0) at syscall+0xa59 mi_syscall sys/sys/syscall_mi.h:164 [inline]
syscall(ffff8000353102d0) at syscall+0xa59 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74ff3abac4c0, count: 5
ddb{0}> trace
x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff85e55040) at __asan_load4_noabort
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 kasan_shadow_8byte_isvalid sys/kern/kasan_shadow.h:146 [inline]
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 kasan_shadow_check sys/kern/subr_kasan.c:991 [inline]
__asan_load8_noabort(ffff800045ff3e10) at __asan_load8_noabort+0x97 sys/kern/subr_kasan.c:1099
syscall(ffff8000353102d0) at syscall+0xa59 pin_check sys/sys/syscall_mi.h:91 [inline]
syscall(ffff8000353102d0) at syscall+0xa59 mi_syscall sys/sys/syscall_mi.h:164 [inline]
syscall(ffff8000353102d0) at syscall+0xa59 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74ff3abac4c0, count: -10
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x17: popq %rbp
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff800001c8f208,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045fef788,200000000000,10000,3,ffff800032b27b40) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800032b280a0) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800032b27dc0) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963950,ffff800032b280a0,0,ffff800000119478) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d691b0,ffff800032b280a0,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045fef788,4,ffff800032b280a0,1,ffff800032b28280) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045fef788,ffff800032b28320,ffff800032b28280) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800032b28320) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800032b28320) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5dfc3679e00, count: 1
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff800001c8f208,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff800001c8f208,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045fef788,200000000000,10000,3,ffff800032b27b40) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800032b280a0) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800032b27dc0) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963950,ffff800032b280a0,0,ffff800000119478) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d691b0,ffff800032b280a0,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045fef788,4,ffff800032b280a0,1,ffff800032b28280) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045fef788,ffff800032b28320,ffff800032b28280) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800032b28320) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800032b28320) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5dfc3679e00, count: -14
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Aug 31, 2026, 7:40:41 AMAug 31
to syzkaller-o...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: aafb676041ac Merge remote-tracking branch 'origin/master' ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=148a1c15580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=167e4349580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/608ac4b57e87/disk-aafb6760.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/9c04686ee28b/bsd-aafb6760.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/57296e8687f8/kernel-aafb6760.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4879bd...@syzkaller.appspotmail.com
panic: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
177343 17362 0 0 0 0 syz-executor
*469042 17362 0 0 0x4000000 1K syz-executor
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
rbx 0xffff800029a8ebe0
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=86, slppri=32, nice=20
process=0xffff8000298a49a8 user=0xffff800029a84000, vmspace=0xffff8000017de7a8
estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
*17362 469042 54827 0 7 0 0x4000000 syz-executor
17362 303158 54827 0 3 0 0x4000080 fsleep syz-executor
54827 29363 99236 0 3 0x2 0x80 nanoslp syz-executor
99236 220416 79799 0 3 0x2 0x80 kqread syz-executor
79799 225619 68697 0 3 0x2 0x80 thrsleep syz-execprog
79799 286650 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 55513 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 352254 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 91187 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 37395 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 365091 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 339226 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 455276 68697 0 3 0x2 0x4000080 kqread syz-execprog
79799 463256 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 339507 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 434413 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
68697 142916 37756 0 3 0x100002 0x88 sigsusp ksh
37756 512159 65851 0 3 0x10 0x88 kqread sshd-session
65851 320140 38793 0 3 0x12 0x80 kqread sshd-session
59720 334042 1 0 3 0x100003 0x80 ttyin getty
38793 63142 1 0 3 0 0x88 kqread sshd
43197 243932 33065 74 3 0x1100012 0x80 bpf pflogd
33065 422757 1 0 3 0 0x80 sbwait pflogd
98684 230197 98532 73 3 0x1100010 0x80 kqread syslogd
98532 498551 1 0 3 0x100002 0x80 sbwait syslogd
28383 409610 1 0 3 0x100000 0x80 kqread resolvd
94150 218820 47431 77 3 0x100012 0x80 kqread dhcpleased
27130 82813 47431 77 3 0x100012 0x80 kqread dhcpleased
47431 77904 1 0 3 0 0x80 kqread dhcpleased
6782 349827 0 0 3 0x14000 0x200 bored smr
56033 320349 0 0 3 0x14000 0x200 pgzero zerothread
9285 163933 0 0 3 0x14000 0x200 aiodoned aiodoned
5334 117758 0 0 3 0x14000 0x200 syncer update
99479 191807 0 0 3 0x14000 0x200 cleaner cleaner
87139 406919 0 0 3 0x14000 0x200 reaper reaper
34067 147137 0 0 3 0x14000 0x200 pgdaemon pagedaemon
43107 418421 0 0 3 0x14000 0x200 bored viomb
62238 52283 0 0 3 0x14000 0x40000200 acpi0 acpi0
42849 511245 0 0 3 0x14000 0x40000200 idle1
66739 288006 0 0 3 0x14000 0x200 bored softnet1
97903 337907 0 0 3 0x14000 0x200 bored softnet0
70582 5073 0 0 3 0x14000 0x200 bored systqmp
57613 447119 0 0 3 0x14000 0x200 bored systq
34275 207176 0 0 3 0x14000 0x200 tmoslp softclockmp
71163 249640 0 0 3 0x14000 0x40000200 tmoslp softclock
92352 461070 0 0 3 0x14000 0x40000200 idle0
1 337956 0 0 3 0x2 0x80 wait init
exclusive rwlock amaplk r = 0 (0xffff800001d627c8)
#4 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464
#5 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776
#6 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
#6 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
#7 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#8 physio+0x4a7 sys/kern/kern_physio.c:139
#9 spec_read+0x29a sys/kern/spec_vnops.c:215
#10 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#11 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#12 dofilereadv+0x386 sys/kern/sys_generic.c:252
#13 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#14 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
shared rwlock vmmaplk r = 0 (0xffff8000017de8a8)
pcb 17 24K 24K 166960K 17 0
rtable 83 4K 4K 166960K 171 0
pf 20 18K 20K 166960K 34 0
ifaddr 15 3K 3K 166960K 19 0
ifgroup 27 1K 1K 166960K 32 0
ioctlops 0 0K 4K 166960K 1477 0
proc 70 128K 144K 166960K 384 0
subproc 0 0K 1K 166960K 30 0
exec 0 0K 2K 166960K 351 0
UVM aobj 3 4K 4K 166960K 3 0
pinsyscall 1055 1737K 1737K 166960K 1299 0
temp 1 9164K 9176K 166960K 4947 0
kqueue 14 44K 44K 166960K 40 0
rtentry 176 45 0 12 2 0 2 2 0 8 0
unpcb 144 63 0 46 1 0 1 1 0 8 0
syncache 336 9 0 9 2 1 1 1 0 8 1
tcpcb 736 16 0 10 1 0 1 1 0 8 0
arp 136 6 0 2 1 0 1 1 0 8 0
inpcb 328 49 0 40 1 0 1 1 0 8 0
nd6 152 6 0 3 1 0 1 1 0 8 0
kcovpl 48 4 0 4 1 0 1 1 0 8 1
pfstkey 128 14 0 2 1 0 1 1 0 8 0
pfstate 448 14 0 2 2 0 2 2 0 8 0
art_table 40 194 0 48 2 0 2 2 0 8 0
art_node 32 45 0 15 1 0 1 1 0 8 0
ffsino 296 1631 0 155 114 0 114 114 0 8 0
nchpl 144 1918 0 165 65 0 65 65 0 8 0
vnodes 216 1675 0 0 94 0 94 94 0 8 0
namei 1024 6786 0 6786 3 2 1 2 0 8 1
percpumem 16 45 0 1 1 0 1 1 0 8 0
kstatmem 264 15 0 2 1 0 1 1 0 8 0
scxspl 216 11937 0 11937 4 3 1 3 1 8 1
plimitpl 152 55 0 44 1 0 1 1 0 8 0
sigapl 424 474 0 439 6 0 6 6 0 8 2
knotepl 120 57 0 0 2 0 2 2 0 8 0
kqueuepl 224 36 0 26 1 0 1 1 0 8 0
pipepl 344 185 0 178 2 0 2 2 0 8 1
fdescpl 528 458 0 439 3 0 3 3 0 8 1
filepl 160 1987 0 1907 5 1 4 5 0 8 0
lockfpl 104 6 0 4 1 0 1 1 0 8 0
lockfspl 48 4 0 2 1 0 1 1 0 8 0
sessionpl 144 38 0 29 1 0 1 1 0 8 0
pgrppl 48 54 0 44 1 0 1 1 0 8 0
ucredpl 104 141 0 128 1 0 1 1 0 8 0
zombiepl 144 439 0 439 1 0 1 1 0 8 1
processpl 1232 474 0 439 4 0 4 4 0 8 1
procpl 664 578 0 530 5 0 5 5 0 8 0
sockpl 752 133 0 104 4 0 4 4 0 8 1
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl2k 2048 14 0 0 2 0 2 2 0 8 0
mextrefs 64 11 0 0 1 0 1 1 0 8 0
mtagpl 96 2 0 0 1 0 1 1 0 8 0
mbufpl 256 146 0 0 10 0 10 10 0 8 0
bufpl 272 7429 0 303 476 0 476 476 0 8 0
anonpl 32 11004 0 0 89 0 89 89 0 222 0
amapchunkpl 152 12529 0 12017 33 1 32 32 0 158 10
amappl16 200 4312 0 4173 8 0 8 8 0 8 0
amappl15 192 4 0 4 1 1 0 1 0 8 0
amappl14 184 383 0 378 1 0 1 1 0 8 0
amappl13 176 178 0 164 2 0 2 2 0 8 1
amappl12 168 728 0 709 2 0 2 2 0 8 1
amappl11 160 85 0 85 1 1 0 1 0 8 0
amappl10 152 101 0 82 2 0 2 2 0 8 1
amappl9 144 1797 0 1797 2 1 1 1 0 8 1
amappl8 136 131 0 103 2 0 2 2 0 8 1
amappl7 128 232 0 210 3 1 2 3 0 8 0
amappl6 120 140 0 136 1 0 1 1 0 8 0
amappl5 112 318 0 308 1 0 1 1 0 8 0
amappl4 104 385 0 363 2 0 2 2 0 8 1
amappl3 96 1782 0 1724 3 0 3 3 0 8 1
amappl2 88 871 0 803 5 0 5 5 0 8 2
amappl1 80 15564 0 15007 24 4 20 24 0 8 8
amappl 88 2995 0 2870 5 0 5 5 0 92 2
uvmvnodes 80 88 0 0 2 0 2 2 0 8 0
uaddrrnd 24 458 0 439 1 0 1 1 0 8 0
vmmpekpl 168 9551 0 9527 2 0 2 2 0 8 0
vmmpepl 168 57124 0 55511 129 0 129 129 0 357 58
vmsppl 488 457 0 439 4 0 4 4 0 8 1
rwobjpl 80 23937 0 22867 41 7 34 41 0 8 8
pdppl 4096 925 0 878 79 28 51 69 0 8 4
pvpl 32 54854 0 0 443 0 443 443 0 265 0
pmappl 256 457 0 439 2 0 2 2 0 8 0
__mp_lock(ffffffff85e55040) at __mp_lock+0x272 sys/kern/kern_lock.c:173
__sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa sys/dev/kcov.c:212
syscall(ffff800029a83a40) at syscall+0x9e8 pin_check sys/sys/syscall_mi.h:89 [inline]
syscall(ffff800029a83a40) at syscall+0x9e8 mi_syscall sys/sys/syscall_mi.h:164 [inline]
syscall(ffff800029a83a40) at syscall+0x9e8 sys/arch/amd64/amd64/trap.c:791
__mp_lock(ffffffff85e55040) at __mp_lock+0x272 sys/kern/kern_lock.c:173
__sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa sys/dev/kcov.c:212
syscall(ffff800029a83a40) at syscall+0x9e8 pin_check sys/sys/syscall_mi.h:89 [inline]
syscall(ffff800029a83a40) at syscall+0x9e8 mi_syscall sys/sys/syscall_mi.h:164 [inline]
syscall(ffff800029a83a40) at syscall+0x9e8 sys/arch/amd64/amd64/trap.c:791
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: aafb676041ac Merge remote-tracking branch 'origin/master' ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=4879bdffb0be0c094968
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=128a1c15580000
dashboard link: https://syzkaller.appspot.com/bug?extid=4879bdffb0be0c094968
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=167e4349580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/608ac4b57e87/disk-aafb6760.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/9c04686ee28b/bsd-aafb6760.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/57296e8687f8/kernel-aafb6760.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4879bd...@syzkaller.appspotmail.com
panic: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*469042 17362 0 0 0x4000000 1K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xfeb2e3d560, count: 1
end of kernel
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764
ddb{1}> show kasan
kasan: no report recorded this boot
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/kasan/kernel/sys/uvm/uvm_fault.c", line 1764
ddb{1}> show kasan
kasan: no report recorded this boot
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xfeb2e3d560, count: -14
end of kernel
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800029a8eb70
rdi 0
rsi 0x1
rbx 0xffff800029a8ebe0
rdx 0
rcx 0xffff800028fe3ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x5
r11 0xffffffff82bb0da0 x86_bus_space_io_read_1
r12 0xffffffff84bd03e0 .str.2
r13 0xffff800028fe4c08
r14 0xffff800028fe4e07
r15 0x1
rip 0xffffffff810b7607 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff800029a8eb70
rcx 0xffff800028fe3ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x5
r11 0xffffffff82bb0da0 x86_bus_space_io_read_1
r12 0xffffffff84bd03e0 .str.2
r13 0xffff800028fe4c08
r14 0xffff800028fe4e07
r15 0x1
rip 0xffffffff810b7607 db_enter+0x17
cs 0x8
rflags 0x246
ss 0x10
db_enter+0x17: popq %rbp
ddb{1}> show proc
PROC (syz-executor) tid=469042 pid=17362 tcnt=3 stat=onproc
db_enter+0x17: popq %rbp
ddb{1}> show proc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045ffb778,0xffff800045ffa2c8
process=0xffff8000298a49a8 user=0xffff800029a84000, vmspace=0xffff8000017de7a8
estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
17362 177343 54827 0 7 0 0 syz-executor
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
*17362 469042 54827 0 7 0 0x4000000 syz-executor
17362 303158 54827 0 3 0 0x4000080 fsleep syz-executor
54827 29363 99236 0 3 0x2 0x80 nanoslp syz-executor
99236 220416 79799 0 3 0x2 0x80 kqread syz-executor
79799 225619 68697 0 3 0x2 0x80 thrsleep syz-execprog
79799 286650 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 55513 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 352254 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 91187 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 37395 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 365091 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 339226 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 455276 68697 0 3 0x2 0x4000080 kqread syz-execprog
79799 463256 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 339507 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
79799 434413 68697 0 3 0x2 0x4000080 thrsleep syz-execprog
68697 142916 37756 0 3 0x100002 0x88 sigsusp ksh
37756 512159 65851 0 3 0x10 0x88 kqread sshd-session
65851 320140 38793 0 3 0x12 0x80 kqread sshd-session
59720 334042 1 0 3 0x100003 0x80 ttyin getty
38793 63142 1 0 3 0 0x88 kqread sshd
43197 243932 33065 74 3 0x1100012 0x80 bpf pflogd
33065 422757 1 0 3 0 0x80 sbwait pflogd
98684 230197 98532 73 3 0x1100010 0x80 kqread syslogd
98532 498551 1 0 3 0x100002 0x80 sbwait syslogd
28383 409610 1 0 3 0x100000 0x80 kqread resolvd
94150 218820 47431 77 3 0x100012 0x80 kqread dhcpleased
27130 82813 47431 77 3 0x100012 0x80 kqread dhcpleased
47431 77904 1 0 3 0 0x80 kqread dhcpleased
6782 349827 0 0 3 0x14000 0x200 bored smr
56033 320349 0 0 3 0x14000 0x200 pgzero zerothread
9285 163933 0 0 3 0x14000 0x200 aiodoned aiodoned
5334 117758 0 0 3 0x14000 0x200 syncer update
99479 191807 0 0 3 0x14000 0x200 cleaner cleaner
87139 406919 0 0 3 0x14000 0x200 reaper reaper
34067 147137 0 0 3 0x14000 0x200 pgdaemon pagedaemon
43107 418421 0 0 3 0x14000 0x200 bored viomb
62238 52283 0 0 3 0x14000 0x40000200 acpi0 acpi0
42849 511245 0 0 3 0x14000 0x40000200 idle1
66739 288006 0 0 3 0x14000 0x200 bored softnet1
97903 337907 0 0 3 0x14000 0x200 bored softnet0
70582 5073 0 0 3 0x14000 0x200 bored systqmp
57613 447119 0 0 3 0x14000 0x200 bored systq
34275 207176 0 0 3 0x14000 0x200 tmoslp softclockmp
71163 249640 0 0 3 0x14000 0x40000200 tmoslp softclock
92352 461070 0 0 3 0x14000 0x40000200 idle0
1 337956 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{1}> show all locks
Process 17362 (syz-executor) thread 0xffff800045ffaa80 (469042)
ddb{1}> show all locks
exclusive rwlock amaplk r = 0 (0xffff800001d627c8)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464
#3 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776
#4 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
#4 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
#5 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#6 physio+0x4a7 sys/kern/kern_physio.c:139
#7 spec_read+0x29a sys/kern/spec_vnops.c:215
#8 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#9 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#10 dofilereadv+0x386 sys/kern/sys_generic.c:252
#11 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#13 Xsyscall+0x128
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464
#3 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776
#4 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
#4 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
#5 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#6 physio+0x4a7 sys/kern/kern_physio.c:139
#7 spec_read+0x29a sys/kern/spec_vnops.c:215
#8 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#9 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#10 dofilereadv+0x386 sys/kern/sys_generic.c:252
#11 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#13 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85e55840)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1
#2 sleep_finish+0x423 sys/kern/kern_synch.c:369
#3 rw_do_enter_write+0x21f sys/kern/kern_rwlock.c:298
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1
#2 sleep_finish+0x423 sys/kern/kern_synch.c:369
#4 uvm_map_lock_entry+0x66 sys/uvm/uvm_map.c:464
#5 uvm_fault_unwire_locked+0x37f sys/uvm/uvm_fault.c:1776
#6 uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
#6 uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
#7 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#8 physio+0x4a7 sys/kern/kern_physio.c:139
#9 spec_read+0x29a sys/kern/spec_vnops.c:215
#10 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#11 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#12 dofilereadv+0x386 sys/kern/sys_generic.c:252
#13 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#14 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
shared rwlock vmmaplk r = 0 (0xffff8000017de8a8)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413
#2 uvm_fault_wire+0x116 uvm_fault_unwire sys/uvm/uvm_fault.c:1723 [inline]
#2 uvm_fault_wire+0x116 sys/uvm/uvm_fault.c:1706
#3 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#4 physio+0x4a7 sys/kern/kern_physio.c:139
#5 spec_read+0x29a sys/kern/spec_vnops.c:215
#6 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#7 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#8 dofilereadv+0x386 sys/kern/sys_generic.c:252
#9 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#11 Xsyscall+0x128
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413
#2 uvm_fault_wire+0x116 uvm_fault_unwire sys/uvm/uvm_fault.c:1723 [inline]
#2 uvm_fault_wire+0x116 sys/uvm/uvm_fault.c:1706
#3 uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
#4 physio+0x4a7 sys/kern/kern_physio.c:139
#5 spec_read+0x29a sys/kern/spec_vnops.c:215
#6 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
#7 vn_read+0x1fc sys/kern/vfs_vnops.c:375
#8 dofilereadv+0x386 sys/kern/sys_generic.c:252
#9 sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#11 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11030 12234K 12234K 166960K 12163 0
Type InUse MemUse HighUse Limit Requests Type Lim
pcb 17 24K 24K 166960K 17 0
rtable 83 4K 4K 166960K 171 0
pf 20 18K 20K 166960K 34 0
ifaddr 15 3K 3K 166960K 19 0
ifgroup 27 1K 1K 166960K 32 0
sysctl 1 1K 13K 166960K 5 0
counters 56 39K 39K 166960K 58 0
ioctlops 0 0K 4K 166960K 1477 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1227 79K 79K 166960K 1319 0
log 0 0K 0K 166960K 4 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 2K 166960K 2 0
UFS mount 5 44K 44K 166960K 5 0
VM map 2 1K 1K 166960K 2 0
sem 2 0K 0K 166960K 2 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 4 9K 13K 166960K 145 0
ACPI 1734 201K 292K 166960K 11964 0
proc 70 128K 144K 166960K 384 0
subproc 0 0K 1K 166960K 30 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
in_multi 22 1K 1K 166960K 33 0
NFS daemon 1 20K 20K 166960K 1 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 1 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 25 182K 182K 166960K 25 0
MSDOSFS mount 1 20K 20K 166960K 1 0
exec 0 0K 2K 166960K 351 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM amap 217 187K 343K 166960K 3912 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM aobj 3 4K 4K 166960K 3 0
pinsyscall 1055 1737K 1737K 166960K 1299 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
NDP 5 0K 0K 166960K 10 0
crypto data 1 1K 1K 166960K 1 0
temp 1 9164K 9176K 166960K 4947 0
kqueue 14 44K 44K 166960K 40 0
SYN cache 2 16K 16K 166960K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 21 0 18 1 0 1 1 0 8 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtentry 176 45 0 12 2 0 2 2 0 8 0
unpcb 144 63 0 46 1 0 1 1 0 8 0
syncache 336 9 0 9 2 1 1 1 0 8 1
tcpcb 736 16 0 10 1 0 1 1 0 8 0
arp 136 6 0 2 1 0 1 1 0 8 0
inpcb 328 49 0 40 1 0 1 1 0 8 0
nd6 152 6 0 3 1 0 1 1 0 8 0
kcovpl 48 4 0 4 1 0 1 1 0 8 1
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 14 0 2 1 0 1 1 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstkey 128 14 0 2 1 0 1 1 0 8 0
pfstate 448 14 0 2 2 0 2 2 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 193 0 48 10 0 10 10 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_table 40 194 0 48 2 0 2 2 0 8 0
art_node 32 45 0 15 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1631 0 155 93 0 93 93 0 8 0
ffsino 296 1631 0 155 114 0 114 114 0 8 0
nchpl 144 1918 0 165 65 0 65 65 0 8 0
vnodes 216 1675 0 0 94 0 94 94 0 8 0
namei 1024 6786 0 6786 3 2 1 2 0 8 1
percpumem 16 45 0 1 1 0 1 1 0 8 0
kstatmem 264 15 0 2 1 0 1 1 0 8 0
scxspl 216 11937 0 11937 4 3 1 3 1 8 1
plimitpl 152 55 0 44 1 0 1 1 0 8 0
sigapl 424 474 0 439 6 0 6 6 0 8 2
knotepl 120 57 0 0 2 0 2 2 0 8 0
kqueuepl 224 36 0 26 1 0 1 1 0 8 0
pipepl 344 185 0 178 2 0 2 2 0 8 1
fdescpl 528 458 0 439 3 0 3 3 0 8 1
filepl 160 1987 0 1907 5 1 4 5 0 8 0
lockfpl 104 6 0 4 1 0 1 1 0 8 0
lockfspl 48 4 0 2 1 0 1 1 0 8 0
sessionpl 144 38 0 29 1 0 1 1 0 8 0
pgrppl 48 54 0 44 1 0 1 1 0 8 0
ucredpl 104 141 0 128 1 0 1 1 0 8 0
zombiepl 144 439 0 439 1 0 1 1 0 8 1
processpl 1232 474 0 439 4 0 4 4 0 8 1
procpl 664 578 0 530 5 0 5 5 0 8 0
sockpl 752 133 0 104 4 0 4 4 0 8 1
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 149 0 0 19 0 19 19 0 8 0
mcl2k 2048 14 0 0 2 0 2 2 0 8 0
mextrefs 64 11 0 0 1 0 1 1 0 8 0
mtagpl 96 2 0 0 1 0 1 1 0 8 0
mbufpl 256 146 0 0 10 0 10 10 0 8 0
bufpl 272 7429 0 303 476 0 476 476 0 8 0
anonpl 32 11004 0 0 89 0 89 89 0 222 0
amapchunkpl 152 12529 0 12017 33 1 32 32 0 158 10
amappl16 200 4312 0 4173 8 0 8 8 0 8 0
amappl15 192 4 0 4 1 1 0 1 0 8 0
amappl14 184 383 0 378 1 0 1 1 0 8 0
amappl13 176 178 0 164 2 0 2 2 0 8 1
amappl12 168 728 0 709 2 0 2 2 0 8 1
amappl11 160 85 0 85 1 1 0 1 0 8 0
amappl10 152 101 0 82 2 0 2 2 0 8 1
amappl9 144 1797 0 1797 2 1 1 1 0 8 1
amappl8 136 131 0 103 2 0 2 2 0 8 1
amappl7 128 232 0 210 3 1 2 3 0 8 0
amappl6 120 140 0 136 1 0 1 1 0 8 0
amappl5 112 318 0 308 1 0 1 1 0 8 0
amappl4 104 385 0 363 2 0 2 2 0 8 1
amappl3 96 1782 0 1724 3 0 3 3 0 8 1
amappl2 88 871 0 803 5 0 5 5 0 8 2
amappl1 80 15564 0 15007 24 4 20 24 0 8 8
amappl 88 2995 0 2870 5 0 5 5 0 92 2
uvmvnodes 80 88 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 2 0 0 1 0 1 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
uaddrrnd 24 458 0 439 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 458 0 439 1 0 1 1 0 8 0
vmmpekpl 168 9551 0 9527 2 0 2 2 0 8 0
vmmpepl 168 57124 0 55511 129 0 129 129 0 357 58
vmsppl 488 457 0 439 4 0 4 4 0 8 1
rwobjpl 80 23937 0 22867 41 7 34 41 0 8 8
pdppl 4096 925 0 878 79 28 51 69 0 8 4
pvpl 32 54854 0 0 443 0 443 443 0 265 0
pmappl 256 457 0 439 2 0 2 2 0 8 0
extentpl 40 47 0 29 1 0 1 1 0 8 0
phpool 120 711 0 34 21 0 21 21 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85e55040) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85e55040) at __mp_lock+0x272 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa kd_curproc sys/dev/kcov.c:580 [inline]
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa sys/dev/kcov.c:212
syscall(ffff800029a83a40) at syscall+0x9e8 pin_check sys/sys/syscall_mi.h:89 [inline]
syscall(ffff800029a83a40) at syscall+0x9e8 mi_syscall sys/sys/syscall_mi.h:164 [inline]
syscall(ffff800029a83a40) at syscall+0x9e8 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b9a9e2d2a20, count: 5
end of kernel
ddb{0}> trace
x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85e55040) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
x86_ipi_db(ffffffff851b7ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85e55040) at __mp_lock+0x272 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa kd_curproc sys/dev/kcov.c:580 [inline]
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_cmp8(57,14a) at __sanitizer_cov_trace_cmp8+0xa sys/dev/kcov.c:212
syscall(ffff800029a83a40) at syscall+0x9e8 pin_check sys/sys/syscall_mi.h:89 [inline]
syscall(ffff800029a83a40) at syscall+0x9e8 mi_syscall sys/sys/syscall_mi.h:164 [inline]
syscall(ffff800029a83a40) at syscall+0x9e8 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b9a9e2d2a20, count: -10
end of kernel
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x17: popq %rbp
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
Stopped at db_enter+0x17: popq %rbp
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xfeb2e3d560, count: 1
end of kernel
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_unwire_locked(ffff8000017de7a8,200000000000,200000005000) at uvm_fault_unwire_locked+0x55f sys/uvm/uvm_fault.c:1761
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84bd03e0) at panic+0x270 sys/kern/subr_prf.c:198
__assert(ffffffff84baa380,ffffffff84baa3a0,6e4,ffffffff84baaf00) at __assert+0x48
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffff8000017de7a8,200000000000,200000010000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff800045ffaa80,200000000000,10000,3,ffff800029a8f0a0) at uvm_vslock_device+0x187 sys/uvm/uvm_glue.c:169
physio(ffffffff8126d760,2902,8000,ffffffff82ed6a50,ffff800029a8f600) at physio+0x4a7 sys/kern/kern_physio.c:139
spec_read(ffff800029a8f320) at spec_read+0x29a sys/kern/spec_vnops.c:215
VOP_READ(ffff800001963b00,ffff800029a8f600,0,ffff800000119340) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227
vn_read(ffff800001d1bbf8,ffff800029a8f600,1) at vn_read+0x1fc sys/kern/vfs_vnops.c:375
dofilereadv(ffff800045ffaa80,4,ffff800029a8f600,1,ffff800029a8f7e0) at dofilereadv+0x386 sys/kern/sys_generic.c:252
sys_preadv(ffff800045ffaa80,ffff800029a8f880,ffff800029a8f7e0) at sys_preadv+0x1b3 sys/kern/vfs_syscalls.c:3286
syscall(ffff800029a8f880) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a8f880) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xfeb2e3d560, count: -14
end of kernel
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages