uvm_fault: pmap_write_protect
0 views
Skip to first unread message
syzbot
Mar 17, 2026, 8:25:33 PM (14 hours ago) Mar 17
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 7b59c65f5490 Show CH hash memory usage in 'show rib mem' o..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16e1d8ba580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=e6774d13f7f39738c4ef
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/68c11f697abb/disk-7b59c65f.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/1ac0b0a3cad3/bsd-7b59c65f.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d46cfe7cb9a4/kernel-7b59c65f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e6774d...@syzkaller.appspotmail.com
uvm_fault(0xfffffd807e9c1738, 0x7f8315416000, 0, 1) -> e
kernel: page fault trap, code=9
Stopped at pmap_write_protect+0x410: movq 0(%r15),%r14
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*221122 70736 0 0 0 0 syz-executor
pmap_write_protect(fffffd806cfaf290,62a828c1000,62a82cc0000,3) at pmap_write_protect+0x410 sys/arch/amd64/amd64/pmap.c:2208
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:476 [inline]
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202
sys_mprotect(ffff800033cde2c0,ffff8000374e53a0,ffff8000374e52f0) at sys_mprotect+0x341 sys/uvm/uvm_mmap.c:590
syscall(ffff8000374e53a0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000374e53a0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x741aadd7dfa0, count: 10
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd807e9c1738, 0x7f8315416000, 0, 1) -> e
ddb> trace
pmap_write_protect(fffffd806cfaf290,62a828c1000,62a82cc0000,3) at pmap_write_protect+0x410 sys/arch/amd64/amd64/pmap.c:2208
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:476 [inline]
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202
sys_mprotect(ffff800033cde2c0,ffff8000374e53a0,ffff8000374e52f0) at sys_mprotect+0x341 sys/uvm/uvm_mmap.c:590
syscall(ffff8000374e53a0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000374e53a0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x741aadd7dfa0, count: -5
ddb> show registers
rdi 0x3fdff03000
rsi 0xffff86aa82c04000
rbp 0xffff8000374e51a0
rbx 0x62a82cc0000
rdx 0xfffffffff
rcx 0x7f8000000000
rax 0x62a82cc0
r8 0
r9 0
r10 0
r11 0xe99310f56cc4922d
r12 0x7f8315416600
r13 0x62a82e00000
r14 0x3fdff03000
r15 0x7f8315416000
rip 0xffffffff82969b70 pmap_write_protect+0x410
cs 0x8
rflags 0x10287 __ALIGN_SIZE+0xf287
rsp 0xffff8000374e5100
ss 0x10
pmap_write_protect+0x410: movq 0(%r15),%r14
ddb> show proc
PROC (syz-executor) tid=221122 pid=70736 tcnt=2 stat=onproc
flags process=0 proc=0
runpri=86, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80003c91a560,0xffff800033cdefc8
process=0xffff80003c904920 user=0xffff8000374e0000, vmspace=0xfffffd807e9c1738
estcpu=36, cpticks=3, pctcpu=0.0, user=2, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
30507 91641 46935 0 2 0 syz-executor
98085 217712 43776 0 2 0 syz-executor
98085 424571 43776 0 3 0x4000080 kqsel syz-executor
68356 403885 64805 0 2 0 syz-executor
68356 6947 64805 0 3 0x4000080 netcon syz-executor
*70736 221122 48541 0 7 0 syz-executor
70736 315314 48541 0 3 0x4000080 fsleep syz-executor
46935 374975 38228 0 3 0x82 nanoslp syz-executor
43776 369916 38228 0 3 0x82 nanoslp syz-executor
67721 215585 38228 0 3 0x82 nanoslp syz-executor
9048 112784 38228 0 3 0x82 nanoslp syz-executor
94276 175633 0 0 3 0x14280 nfsidl nfsio
51945 73884 0 0 3 0x14280 nfsidl nfsio
74667 246251 0 0 3 0x14280 nfsidl nfsio
20085 167249 0 0 3 0x14280 nfsidl nfsio
6351 72116 0 0 3 0x14280 nfsidl nfsio
84429 235576 0 0 3 0x14280 nfsidl nfsio
61779 275504 0 0 3 0x14280 nfsidl nfsio
94625 376845 0 0 3 0x14280 nfsidl nfsio
67472 70454 0 0 3 0x14280 nfsidl nfsio
80865 493238 0 0 3 0x14280 nfsidl nfsio
24789 85529 0 0 3 0x14280 nfsidl nfsio
17543 402509 0 0 3 0x14280 nfsidl nfsio
59190 268281 0 0 3 0x14280 nfsidl nfsio
89405 17324 0 0 3 0x14280 nfsidl nfsio
39748 212641 0 0 3 0x14280 nfsidl nfsio
7238 113848 0 0 3 0x14280 nfsidl nfsio
3220 425667 0 0 3 0x14280 nfsidl nfsio
91475 111956 0 0 3 0x14280 nfsidl nfsio
98213 100396 0 0 3 0x14280 nfsidl nfsio
30811 82935 0 0 3 0x14280 nfsidl nfsio
64805 269704 38228 0 3 0x82 nanoslp syz-executor
50363 502406 38228 0 3 0x2 biowait syz-executor
48541 201598 38228 0 3 0x82 nanoslp syz-executor
72381 500623 38228 0 3 0x82 wait syz-executor
38228 124117 44774 0 3 0x82 kqread syz-executor
44774 456087 51828 0 3 0x10008a sigsusp ksh
51828 22529 8947 0 3 0x98 kqread sshd-session
8947 234020 64062 0 3 0x92 kqread sshd-session
92283 202682 1 0 3 0x100083 ttyin getty
64062 137079 1 0 3 0x88 kqread sshd
98788 481428 49484 73 3 0x1100090 kqread syslogd
49484 151295 1 0 3 0x100082 sbwait syslogd
48021 55439 1 0 3 0x100080 kqread resolvd
36900 485992 84958 77 3 0x100092 kqread dhcpleased
8094 96727 84958 77 3 0x100092 kqread dhcpleased
84958 274863 1 0 3 0x80 kqread dhcpleased
84919 271098 0 0 3 0x14200 bored smr
62657 230160 0 0 2 0x14200 zerothread
40452 521826 0 0 3 0x14200 aiodoned aiodoned
29127 181640 0 0 3 0x14200 syncer update
15974 189837 0 0 3 0x14200 cleaner cleaner
96954 250425 0 0 3 0x14200 reaper reaper
69532 2517 0 0 3 0x14200 pgdaemon pagedaemon
51662 274613 0 0 3 0x14200 bored viomb
65668 247692 0 0 3 0x40014200 acpi0 acpi0
41479 466319 0 0 3 0x14200 bored softnet0
24216 482179 0 0 3 0x14200 bored systqmp
9425 58044 0 0 3 0x14200 bored systq
78929 254948 0 0 3 0x40014200 tmoslp softclock
17840 235512 0 0 3 0x40014200 idle0
1 162588 0 0 3 0x82 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11068 12113K 13233K 166960K 14281 0
pcb 17 16K 22K 166960K 535 0
rtable 241 11K 12K 166960K 761 0
pf 30 12K 14K 166960K 147 0
ifaddr 39 7K 8K 166960K 126 0
ifgroup 48 2K 2K 166960K 205 0
sysctl 4 1K 9K 166960K 44 0
counters 33 17K 18K 166960K 146 0
ioctlops 0 0K 4K 166960K 531 0
iov 0 0K 32K 166960K 180 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1388 87K 88K 166960K 2520 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 9K 166960K 23 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 164 0
dirhash 12 2K 2K 166960K 30 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 17 61K 102K 166960K 1431 0
sigio 0 0K 0K 166960K 24 0
proc 60 59K 83K 166960K 709 0
subproc 72 4K 4K 166960K 110 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 267 0
in_multi 88 6K 7K 166960K 201 0
ether_multi 1 0K 0K 166960K 12 0
mrt 1 0K 0K 166960K 28 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 253 1129K 1129K 166960K 253 0
exec 0 0K 1K 166960K 627 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 2 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 211 142K 164K 166960K 14742 0
UVM aobj 45 16K 16K 166960K 47 0
pinsyscall 38 76K 92K 166960K 2639 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 1K 166960K 71 0
NDP 11 0K 2K 166960K 88 0
temp 113 9076K 9142K 166960K 55915 0
kqueue 13 20K 32K 166960K 263 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 344 0 341 3 0 3 3 0 8 2
rtentry 136 221 0 126 4 0 4 4 0 8 0
unpcb 144 1288 0 1271 6 0 6 6 0 8 5
syncache 336 6 0 6 1 0 1 1 0 8 1
tcpqe 32 6 0 6 1 0 1 1 0 8 1
tcpcb 736 503 0 496 7 0 7 7 0 8 6
arp 96 30 0 14 1 0 1 1 0 8 0
ipq 40 6 0 3 1 0 1 1 0 8 0
ipqe 40 10 0 7 1 0 1 1 0 8 0
inpcb 328 1595 0 1584 7 0 7 7 0 8 5
ip6q 72 4 0 0 1 0 1 1 0 8 0
ip6af 40 4 0 0 1 0 1 1 0 8 0
nd6 112 40 0 17 1 0 1 1 0 8 0
pkpcb 40 77 0 77 1 0 1 1 0 8 1
kcovpl 48 12 0 4 1 0 1 1 0 8 0
mppekey 1024 2 0 2 1 0 1 1 0 8 1
ppxss 1072 94 0 93 1 0 1 1 0 8 0
pppxif 1384 7 0 7 1 0 1 1 0 8 1
art_heap8 4096 3 0 0 3 0 3 3 0 8 0
art_heap4 256 766 0 382 31 0 31 31 0 8 3
art_table 40 769 0 382 5 0 5 5 0 8 0
art_node 32 219 0 136 1 0 1 1 0 8 0
sysvmsgpl 40 8 0 8 1 0 1 1 0 8 1
semupl 112 2 0 2 1 0 1 1 0 8 1
semapl 112 127 0 117 1 0 1 1 0 8 0
shmpl 112 39 0 1 2 0 2 2 0 8 0
dirhash 1024 29 0 12 3 0 3 3 0 8 0
dino2pl 256 4215 0 2759 92 0 92 92 0 8 0
ffsino 256 4215 0 2759 92 0 92 92 0 8 0
nchpl 144 6164 0 4462 64 0 64 64 0 8 0
rtmask 32 10 0 10 1 0 1 1 0 8 1
vnodes 216 4738 0 0 264 0 264 264 0 8 0
namei 1024 24201 0 24201 1 0 1 1 0 8 1
vcpupl 3904 5 0 1 1 0 1 1 0 8 0
vmpool 808 5 0 1 1 0 1 1 0 8 0
kstatmem 264 128 0 106 3 0 3 3 0 8 1
acpiwqpl 32 1 0 1 1 0 1 1 1 8 1
scsiplug 72 11 0 11 1 0 1 1 0 8 1
scxspl 216 21609 0 21608 8 0 8 8 1 8 7
plimitpl 152 407 0 390 1 0 1 1 0 8 0
sigapl 424 1734 0 1672 8 0 8 8 0 8 0
knotepl 120 76853 0 76806 31 21 10 18 0 8 8
kqueuepl 184 686 0 673 4 0 4 4 0 8 3
pipepl 304 222 0 195 3 0 3 3 0 8 0
fdescpl 448 1699 0 1670 4 0 4 4 0 8 0
filepl 120 13441 0 13216 14 0 14 14 0 8 4
lockfpl 104 498 0 495 1 0 1 1 0 8 0
lockfspl 48 172 0 169 1 0 1 1 0 8 0
sessionpl 144 28 0 20 1 0 1 1 0 8 0
pgrppl 48 55 0 39 1 0 1 1 0 8 0
ucredpl 104 2565 0 2552 1 0 1 1 0 8 0
zombiepl 144 1675 0 1672 1 0 1 1 0 8 0
processpl 1152 1734 0 1672 5 0 5 5 0 8 0
procpl 664 3641 0 3576 7 0 7 7 0 8 0
sosppl 176 11 0 11 1 0 1 1 0 8 1
sockpl 552 3496 0 3465 16 5 11 13 0 8 8
mcl64k 65536 61 0 59 1 0 1 1 0 8 0
mcl16k 16384 1 0 1 1 0 1 1 0 8 1
mcl9k 9216 1 0 1 1 0 1 1 0 8 1
mcl8k 8192 20 0 20 1 0 1 1 0 8 1
mcl4k 4096 4152 0 4100 14 0 14 14 0 8 6
mcl2k2 2112 1 0 1 1 0 1 1 0 8 1
mcl2k 2048 1772 0 1769 2 0 2 2 0 8 1
mtagpl 96 10 0 10 1 0 1 1 0 8 1
mbufpl 256 18731 0 18570 19 0 19 19 0 8 4
bufpl 280 6568 0 354 444 0 444 444 0 8 0
anonpl 24 246738 0 243636 58 0 58 58 0 187 25
amapchunkpl 152 50962 0 50533 36 0 36 36 0 158 14
amappl16 200 4198 0 4164 22 10 12 15 0 8 8
amappl15 192 5 0 5 1 0 1 1 0 8 1
amappl14 184 459 0 458 1 0 1 1 0 8 0
amappl13 176 132 0 122 1 0 1 1 0 8 0
amappl12 168 1957 0 1929 2 0 2 2 0 8 0
amappl11 160 2 0 2 1 0 1 1 0 8 1
amappl10 152 152 0 142 1 0 1 1 0 8 0
amappl9 144 257 0 257 1 0 1 1 0 8 1
amappl8 136 120 0 118 1 0 1 1 0 8 0
amappl7 128 156 0 145 1 0 1 1 0 8 0
amappl6 120 190 0 189 1 0 1 1 0 8 0
amappl5 112 101 0 93 1 0 1 1 0 8 0
amappl4 104 283 0 269 1 0 1 1 0 8 0
amappl3 96 9797 0 9697 4 0 4 4 0 8 0
amappl2 88 581 0 526 2 0 2 2 0 8 0
amappl1 80 15877 0 15329 15 0 15 15 0 8 0
amappl 88 13743 0 13595 5 0 5 5 0 92 0
uvmvnodes 80 146 0 0 3 0 3 3 0 8 0
dma4096 4096 2 0 2 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 255 0 255 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 46 0 2 1 0 1 1 0 8 0
uaddrrnd 24 1699 0 1670 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1699 0 1670 1 0 1 1 0 8 0
vmmpekpl 168 14277 0 14229 3 0 3 3 0 8 0
vmmpepl 168 112327 0 110560 93 0 93 93 0 357 11
vmsppl 368 1698 0 1670 4 0 4 4 0 8 1
rwobjpl 40 30311 0 29290 13 0 13 13 0 8 0
pdppl 4096 3414 0 3346 130 60 70 76 0 8 2
pvpl 32 740078 0 730948 140 0 140 140 0 265 48
pmappl 216 1703 0 1671 2 0 2 2 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 411 0 60 11 0 11 11 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
pmap_write_protect(fffffd806cfaf290,62a828c1000,62a82cc0000,3) at pmap_write_protect+0x410 sys/arch/amd64/amd64/pmap.c:2208
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:476 [inline]
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202
sys_mprotect(ffff800033cde2c0,ffff8000374e53a0,ffff8000374e52f0) at sys_mprotect+0x341 sys/uvm/uvm_mmap.c:590
syscall(ffff8000374e53a0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000374e53a0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x741aadd7dfa0, count: -5
ddb> machine ddbcpu 1
No such command
ddb> trace
pmap_write_protect(fffffd806cfaf290,62a828c1000,62a82cc0000,3) at pmap_write_protect+0x410 sys/arch/amd64/amd64/pmap.c:2208
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:476 [inline]
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202
sys_mprotect(ffff800033cde2c0,ffff8000374e53a0,ffff8000374e52f0) at sys_mprotect+0x341 sys/uvm/uvm_mmap.c:590
syscall(ffff8000374e53a0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000374e53a0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x741aadd7dfa0, count: -5
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 7b59c65f5490 Show CH hash memory usage in 'show rib mem' o..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16e1d8ba580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=e6774d13f7f39738c4ef
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/68c11f697abb/disk-7b59c65f.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/1ac0b0a3cad3/bsd-7b59c65f.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d46cfe7cb9a4/kernel-7b59c65f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e6774d...@syzkaller.appspotmail.com
uvm_fault(0xfffffd807e9c1738, 0x7f8315416000, 0, 1) -> e
kernel: page fault trap, code=9
Stopped at pmap_write_protect+0x410: movq 0(%r15),%r14
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*221122 70736 0 0 0 0 syz-executor
pmap_write_protect(fffffd806cfaf290,62a828c1000,62a82cc0000,3) at pmap_write_protect+0x410 sys/arch/amd64/amd64/pmap.c:2208
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:476 [inline]
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202
sys_mprotect(ffff800033cde2c0,ffff8000374e53a0,ffff8000374e52f0) at sys_mprotect+0x341 sys/uvm/uvm_mmap.c:590
syscall(ffff8000374e53a0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000374e53a0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x741aadd7dfa0, count: 10
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd807e9c1738, 0x7f8315416000, 0, 1) -> e
ddb> trace
pmap_write_protect(fffffd806cfaf290,62a828c1000,62a82cc0000,3) at pmap_write_protect+0x410 sys/arch/amd64/amd64/pmap.c:2208
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:476 [inline]
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202
sys_mprotect(ffff800033cde2c0,ffff8000374e53a0,ffff8000374e52f0) at sys_mprotect+0x341 sys/uvm/uvm_mmap.c:590
syscall(ffff8000374e53a0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000374e53a0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x741aadd7dfa0, count: -5
ddb> show registers
rdi 0x3fdff03000
rsi 0xffff86aa82c04000
rbp 0xffff8000374e51a0
rbx 0x62a82cc0000
rdx 0xfffffffff
rcx 0x7f8000000000
rax 0x62a82cc0
r8 0
r9 0
r10 0
r11 0xe99310f56cc4922d
r12 0x7f8315416600
r13 0x62a82e00000
r14 0x3fdff03000
r15 0x7f8315416000
rip 0xffffffff82969b70 pmap_write_protect+0x410
cs 0x8
rflags 0x10287 __ALIGN_SIZE+0xf287
rsp 0xffff8000374e5100
ss 0x10
pmap_write_protect+0x410: movq 0(%r15),%r14
ddb> show proc
PROC (syz-executor) tid=221122 pid=70736 tcnt=2 stat=onproc
flags process=0 proc=0
runpri=86, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80003c91a560,0xffff800033cdefc8
process=0xffff80003c904920 user=0xffff8000374e0000, vmspace=0xfffffd807e9c1738
estcpu=36, cpticks=3, pctcpu=0.0, user=2, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
30507 91641 46935 0 2 0 syz-executor
98085 217712 43776 0 2 0 syz-executor
98085 424571 43776 0 3 0x4000080 kqsel syz-executor
68356 403885 64805 0 2 0 syz-executor
68356 6947 64805 0 3 0x4000080 netcon syz-executor
*70736 221122 48541 0 7 0 syz-executor
70736 315314 48541 0 3 0x4000080 fsleep syz-executor
46935 374975 38228 0 3 0x82 nanoslp syz-executor
43776 369916 38228 0 3 0x82 nanoslp syz-executor
67721 215585 38228 0 3 0x82 nanoslp syz-executor
9048 112784 38228 0 3 0x82 nanoslp syz-executor
94276 175633 0 0 3 0x14280 nfsidl nfsio
51945 73884 0 0 3 0x14280 nfsidl nfsio
74667 246251 0 0 3 0x14280 nfsidl nfsio
20085 167249 0 0 3 0x14280 nfsidl nfsio
6351 72116 0 0 3 0x14280 nfsidl nfsio
84429 235576 0 0 3 0x14280 nfsidl nfsio
61779 275504 0 0 3 0x14280 nfsidl nfsio
94625 376845 0 0 3 0x14280 nfsidl nfsio
67472 70454 0 0 3 0x14280 nfsidl nfsio
80865 493238 0 0 3 0x14280 nfsidl nfsio
24789 85529 0 0 3 0x14280 nfsidl nfsio
17543 402509 0 0 3 0x14280 nfsidl nfsio
59190 268281 0 0 3 0x14280 nfsidl nfsio
89405 17324 0 0 3 0x14280 nfsidl nfsio
39748 212641 0 0 3 0x14280 nfsidl nfsio
7238 113848 0 0 3 0x14280 nfsidl nfsio
3220 425667 0 0 3 0x14280 nfsidl nfsio
91475 111956 0 0 3 0x14280 nfsidl nfsio
98213 100396 0 0 3 0x14280 nfsidl nfsio
30811 82935 0 0 3 0x14280 nfsidl nfsio
64805 269704 38228 0 3 0x82 nanoslp syz-executor
50363 502406 38228 0 3 0x2 biowait syz-executor
48541 201598 38228 0 3 0x82 nanoslp syz-executor
72381 500623 38228 0 3 0x82 wait syz-executor
38228 124117 44774 0 3 0x82 kqread syz-executor
44774 456087 51828 0 3 0x10008a sigsusp ksh
51828 22529 8947 0 3 0x98 kqread sshd-session
8947 234020 64062 0 3 0x92 kqread sshd-session
92283 202682 1 0 3 0x100083 ttyin getty
64062 137079 1 0 3 0x88 kqread sshd
98788 481428 49484 73 3 0x1100090 kqread syslogd
49484 151295 1 0 3 0x100082 sbwait syslogd
48021 55439 1 0 3 0x100080 kqread resolvd
36900 485992 84958 77 3 0x100092 kqread dhcpleased
8094 96727 84958 77 3 0x100092 kqread dhcpleased
84958 274863 1 0 3 0x80 kqread dhcpleased
84919 271098 0 0 3 0x14200 bored smr
62657 230160 0 0 2 0x14200 zerothread
40452 521826 0 0 3 0x14200 aiodoned aiodoned
29127 181640 0 0 3 0x14200 syncer update
15974 189837 0 0 3 0x14200 cleaner cleaner
96954 250425 0 0 3 0x14200 reaper reaper
69532 2517 0 0 3 0x14200 pgdaemon pagedaemon
51662 274613 0 0 3 0x14200 bored viomb
65668 247692 0 0 3 0x40014200 acpi0 acpi0
41479 466319 0 0 3 0x14200 bored softnet0
24216 482179 0 0 3 0x14200 bored systqmp
9425 58044 0 0 3 0x14200 bored systq
78929 254948 0 0 3 0x40014200 tmoslp softclock
17840 235512 0 0 3 0x40014200 idle0
1 162588 0 0 3 0x82 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11068 12113K 13233K 166960K 14281 0
pcb 17 16K 22K 166960K 535 0
rtable 241 11K 12K 166960K 761 0
pf 30 12K 14K 166960K 147 0
ifaddr 39 7K 8K 166960K 126 0
ifgroup 48 2K 2K 166960K 205 0
sysctl 4 1K 9K 166960K 44 0
counters 33 17K 18K 166960K 146 0
ioctlops 0 0K 4K 166960K 531 0
iov 0 0K 32K 166960K 180 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1388 87K 88K 166960K 2520 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 9K 166960K 23 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 164 0
dirhash 12 2K 2K 166960K 30 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 17 61K 102K 166960K 1431 0
sigio 0 0K 0K 166960K 24 0
proc 60 59K 83K 166960K 709 0
subproc 72 4K 4K 166960K 110 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 267 0
in_multi 88 6K 7K 166960K 201 0
ether_multi 1 0K 0K 166960K 12 0
mrt 1 0K 0K 166960K 28 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 253 1129K 1129K 166960K 253 0
exec 0 0K 1K 166960K 627 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 2 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 211 142K 164K 166960K 14742 0
UVM aobj 45 16K 16K 166960K 47 0
pinsyscall 38 76K 92K 166960K 2639 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 1K 166960K 71 0
NDP 11 0K 2K 166960K 88 0
temp 113 9076K 9142K 166960K 55915 0
kqueue 13 20K 32K 166960K 263 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 344 0 341 3 0 3 3 0 8 2
rtentry 136 221 0 126 4 0 4 4 0 8 0
unpcb 144 1288 0 1271 6 0 6 6 0 8 5
syncache 336 6 0 6 1 0 1 1 0 8 1
tcpqe 32 6 0 6 1 0 1 1 0 8 1
tcpcb 736 503 0 496 7 0 7 7 0 8 6
arp 96 30 0 14 1 0 1 1 0 8 0
ipq 40 6 0 3 1 0 1 1 0 8 0
ipqe 40 10 0 7 1 0 1 1 0 8 0
inpcb 328 1595 0 1584 7 0 7 7 0 8 5
ip6q 72 4 0 0 1 0 1 1 0 8 0
ip6af 40 4 0 0 1 0 1 1 0 8 0
nd6 112 40 0 17 1 0 1 1 0 8 0
pkpcb 40 77 0 77 1 0 1 1 0 8 1
kcovpl 48 12 0 4 1 0 1 1 0 8 0
mppekey 1024 2 0 2 1 0 1 1 0 8 1
ppxss 1072 94 0 93 1 0 1 1 0 8 0
pppxif 1384 7 0 7 1 0 1 1 0 8 1
art_heap8 4096 3 0 0 3 0 3 3 0 8 0
art_heap4 256 766 0 382 31 0 31 31 0 8 3
art_table 40 769 0 382 5 0 5 5 0 8 0
art_node 32 219 0 136 1 0 1 1 0 8 0
sysvmsgpl 40 8 0 8 1 0 1 1 0 8 1
semupl 112 2 0 2 1 0 1 1 0 8 1
semapl 112 127 0 117 1 0 1 1 0 8 0
shmpl 112 39 0 1 2 0 2 2 0 8 0
dirhash 1024 29 0 12 3 0 3 3 0 8 0
dino2pl 256 4215 0 2759 92 0 92 92 0 8 0
ffsino 256 4215 0 2759 92 0 92 92 0 8 0
nchpl 144 6164 0 4462 64 0 64 64 0 8 0
rtmask 32 10 0 10 1 0 1 1 0 8 1
vnodes 216 4738 0 0 264 0 264 264 0 8 0
namei 1024 24201 0 24201 1 0 1 1 0 8 1
vcpupl 3904 5 0 1 1 0 1 1 0 8 0
vmpool 808 5 0 1 1 0 1 1 0 8 0
kstatmem 264 128 0 106 3 0 3 3 0 8 1
acpiwqpl 32 1 0 1 1 0 1 1 1 8 1
scsiplug 72 11 0 11 1 0 1 1 0 8 1
scxspl 216 21609 0 21608 8 0 8 8 1 8 7
plimitpl 152 407 0 390 1 0 1 1 0 8 0
sigapl 424 1734 0 1672 8 0 8 8 0 8 0
knotepl 120 76853 0 76806 31 21 10 18 0 8 8
kqueuepl 184 686 0 673 4 0 4 4 0 8 3
pipepl 304 222 0 195 3 0 3 3 0 8 0
fdescpl 448 1699 0 1670 4 0 4 4 0 8 0
filepl 120 13441 0 13216 14 0 14 14 0 8 4
lockfpl 104 498 0 495 1 0 1 1 0 8 0
lockfspl 48 172 0 169 1 0 1 1 0 8 0
sessionpl 144 28 0 20 1 0 1 1 0 8 0
pgrppl 48 55 0 39 1 0 1 1 0 8 0
ucredpl 104 2565 0 2552 1 0 1 1 0 8 0
zombiepl 144 1675 0 1672 1 0 1 1 0 8 0
processpl 1152 1734 0 1672 5 0 5 5 0 8 0
procpl 664 3641 0 3576 7 0 7 7 0 8 0
sosppl 176 11 0 11 1 0 1 1 0 8 1
sockpl 552 3496 0 3465 16 5 11 13 0 8 8
mcl64k 65536 61 0 59 1 0 1 1 0 8 0
mcl16k 16384 1 0 1 1 0 1 1 0 8 1
mcl9k 9216 1 0 1 1 0 1 1 0 8 1
mcl8k 8192 20 0 20 1 0 1 1 0 8 1
mcl4k 4096 4152 0 4100 14 0 14 14 0 8 6
mcl2k2 2112 1 0 1 1 0 1 1 0 8 1
mcl2k 2048 1772 0 1769 2 0 2 2 0 8 1
mtagpl 96 10 0 10 1 0 1 1 0 8 1
mbufpl 256 18731 0 18570 19 0 19 19 0 8 4
bufpl 280 6568 0 354 444 0 444 444 0 8 0
anonpl 24 246738 0 243636 58 0 58 58 0 187 25
amapchunkpl 152 50962 0 50533 36 0 36 36 0 158 14
amappl16 200 4198 0 4164 22 10 12 15 0 8 8
amappl15 192 5 0 5 1 0 1 1 0 8 1
amappl14 184 459 0 458 1 0 1 1 0 8 0
amappl13 176 132 0 122 1 0 1 1 0 8 0
amappl12 168 1957 0 1929 2 0 2 2 0 8 0
amappl11 160 2 0 2 1 0 1 1 0 8 1
amappl10 152 152 0 142 1 0 1 1 0 8 0
amappl9 144 257 0 257 1 0 1 1 0 8 1
amappl8 136 120 0 118 1 0 1 1 0 8 0
amappl7 128 156 0 145 1 0 1 1 0 8 0
amappl6 120 190 0 189 1 0 1 1 0 8 0
amappl5 112 101 0 93 1 0 1 1 0 8 0
amappl4 104 283 0 269 1 0 1 1 0 8 0
amappl3 96 9797 0 9697 4 0 4 4 0 8 0
amappl2 88 581 0 526 2 0 2 2 0 8 0
amappl1 80 15877 0 15329 15 0 15 15 0 8 0
amappl 88 13743 0 13595 5 0 5 5 0 92 0
uvmvnodes 80 146 0 0 3 0 3 3 0 8 0
dma4096 4096 2 0 2 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 255 0 255 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 46 0 2 1 0 1 1 0 8 0
uaddrrnd 24 1699 0 1670 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1699 0 1670 1 0 1 1 0 8 0
vmmpekpl 168 14277 0 14229 3 0 3 3 0 8 0
vmmpepl 168 112327 0 110560 93 0 93 93 0 357 11
vmsppl 368 1698 0 1670 4 0 4 4 0 8 1
rwobjpl 40 30311 0 29290 13 0 13 13 0 8 0
pdppl 4096 3414 0 3346 130 60 70 76 0 8 2
pvpl 32 740078 0 730948 140 0 140 140 0 265 48
pmappl 216 1703 0 1671 2 0 2 2 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 411 0 60 11 0 11 11 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
pmap_write_protect(fffffd806cfaf290,62a828c1000,62a82cc0000,3) at pmap_write_protect+0x410 sys/arch/amd64/amd64/pmap.c:2208
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:476 [inline]
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202
sys_mprotect(ffff800033cde2c0,ffff8000374e53a0,ffff8000374e52f0) at sys_mprotect+0x341 sys/uvm/uvm_mmap.c:590
syscall(ffff8000374e53a0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000374e53a0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x741aadd7dfa0, count: -5
ddb> machine ddbcpu 1
No such command
ddb> trace
pmap_write_protect(fffffd806cfaf290,62a828c1000,62a82cc0000,3) at pmap_write_protect+0x410 sys/arch/amd64/amd64/pmap.c:2208
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 pmap_protect sys/arch/amd64/compile/SYZKALLER/obj/machine/pmap.h:476 [inline]
uvm_map_protect(fffffd807e9c1738,62a828c0000,62a82cc0000,3,0,0,f8cfe4b121bbde51) at uvm_map_protect+0xb95 sys/uvm/uvm_map.c:3202
sys_mprotect(ffff800033cde2c0,ffff8000374e53a0,ffff8000374e52f0) at sys_mprotect+0x341 sys/uvm/uvm_mmap.c:590
syscall(ffff8000374e53a0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000374e53a0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x741aadd7dfa0, count: -5
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages