20250423 09:20:24 all (1/1): syzkaller75.sh
panic: vm_pager_assert_in: page 0xfffffe0000b5fcc0 is mapped
cpuid = 11
time = 1745393009
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe016df1d7b0
vpanic() at vpanic+0x136/frame 0xfffffe016df1d8e0
panic() at panic+0x43/frame 0xfffffe016df1d940
vm_pager_assert_in() at vm_pager_assert_in+0x1fa/frame 0xfffffe016df1d980
vm_pager_get_pages() at vm_pager_get_pages+0x3d/frame 0xfffffe016df1d9d0
vm_fault() at vm_fault+0x745/frame 0xfffffe016df1db40
vm_map_wire_locked() at vm_map_wire_locked+0x385/frame 0xfffffe016df1dbf0
vm_mmap_object() at vm_mmap_object+0x2fd/frame 0xfffffe016df1dc50
vn_mmap() at vn_mmap+0x152/frame 0xfffffe016df1dce0
kern_mmap() at kern_mmap+0x621/frame 0xfffffe016df1ddc0
sys_mmap() at sys_mmap+0x42/frame 0xfffffe016df1de00
amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe016df1df30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe016df1df30
--- syscall (0, FreeBSD ELF64, syscall), rip = 0x823efb7fa, rsp = 0x821f52f68, rbp = 0x821f52f90 ---
KDB: enter: panic
[ thread pid 37673 tid 108519 ]
Stopped at      kdb_enter+0x33: movq    $0,0x104d7a2(%rip)
db> x/s version
version:  FreeBSD 15.0-CURRENT #0 main-n276680-d14036ea424d-dirty: Wed Apr 23 09:10:41 CEST 2025
  pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
db>

20250224 11:38:23 all (254/953): mmap8.sh
panic: vm_reserv_from_object: msucc doesn't succeed pindex
cpuid = 4
time = 1740393505
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01087809b0
vpanic() at vpanic+0x136/frame 0xfffffe0108780ae0
panic() at panic+0x43/frame 0xfffffe0108780b40
vm_reserv_from_object() at vm_reserv_from_object+0xc9/frame 0xfffffe0108780b50
vm_reserv_alloc_page() at vm_reserv_alloc_page+0x72/frame 0xfffffe0108780bb0
vm_page_alloc_domain_after() at vm_page_alloc_domain_after+0x140/frame 0xfffffe0108780c40
vm_page_alloc_after() at vm_page_alloc_after+0x54/frame 0xfffffe0108780cb0
vm_fault_copy_entry() at vm_fault_copy_entry+0x32f/frame 0xfffffe0108780d60
vm_map_protect() at vm_map_protect+0x72b/frame 0xfffffe0108780df0
sys_mprotect() at sys_mprotect+0x9f/frame 0xfffffe0108780e00
amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe0108780f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0108780f30
--- syscall (74, FreeBSD ELF64, mprotect), rip = 0x822c0ed7a, rsp = 0x820d0ee78, rbp = 0x820d0eea0 ---
KDB: enter: panic
[ thread pid 82131 tid 102074 ]
Stopped at      kdb_enter+0x33: movq    $0,0x104ed52(%rip)
db>

Trying to mount root from ufs:/dev/vtbd0p1 [rw]...
WARNING: WITNESS option enabled, expect reduced performance.
WARNING: DIAGNOSTIC option enabled, expect reduced performance.
WARNING: 32-bit kernels are deprecated and may be removed in FreeBSD 15.0.
panic: vm_page_t 0x5d49be0 phys_addr mismatch ffffffffb8779000 00000000b8779405
cpuid = 3
time = 1738177579
KDB: stack backtrace:
db_trace_self_wrapper(7,114beb40,5d49be0,ffffffff,ffffffff,...) at db_trace_self_wrapper+0x28/frame 0x113f6744
vpanic(148badd,113f6780,113f6780,113f67f0,13a54e9,...) at vpanic+0xf4/frame 0x113f6760
panic(148badd,5d49be0,b8779000,ffffffff,b8779405,...) at panic+0x14/frame 0x113f6774
pmap_pae_remove_pages(114128e8) at pmap_pae_remove_pages+0x599/frame 0x113f67f0
exec_new_vmspace(113f6994,188247c) at exec_new_vmspace+0x1cb/frame 0x113f6810
exec_elf32_imgact(113f6994,16d4801,113f6984,0,0,...) at exec_elf32_imgact+0x5e4/frame 0x113f6874
kern_execve(114beb40,113f6a8c,0,1141284c) at kern_execve+0x72c/frame 0x113f6a74
sys_execve(114beb40,114bedf0,114beb40,13ae913,114bede4,...) at sys_execve+0x4e/frame 0x113f6ac8
syscall(113f6ba8,3b,3b,3b,402aaf,...) at syscall+0x1e6/frame 0x113f6b9c
Xint0x80_syscall() at 0xffc03479/frame 0x113f6b9c
--- syscall (59, FreeBSD ELF32, execve), eip = 0x47e53f, esp = 0xffbfe848, ebp = 0xffbfe858 ---
KDB: enter: panic
[ thread pid 17 tid 100080 ]
Stopped at      kdb_enter+0x34: movl    $0,kdb_why
db> x/s version
version:        FreeBSD 15.0-CURRENT #0 main-n275068-0078df5f0258-dirty: Wed Jan 29 18:44:45 CET 2025\012    pho@mercat1.netperf.freebsd.org:/mnt25/obj/usr/src/i386.i386/sys/PHO\012
db>

20241011 13:49:02 all (664/970): swapoff4.sh
Oct 11 13:50:22 mercat1 kernel: pid 90548 (swap), jid 0, uid 0, was killed: failed to reclaim memory
Oct 11 13:50:23 mercat1 kernel: pid 90555 (swap), jid 0, uid 0, was killed: failed to reclaim memory
Oct 11 13:50:25 mercat1 kernel: pid 90550 (swap), jid 0, uid 0, was killed: failed to reclaim memory
panic: Assertion (object->flags & OBJ_SWAP) != 0 failed at ../../../vm/swap_pager.c:564
cpuid = 5
time = 1728647425
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01d8174990
vpanic() at vpanic+0x13f/frame 0xfffffe01d8174ac0
panic() at panic+0x43/frame 0xfffffe01d8174b20
swapoff_one() at swapoff_one+0x8a9/frame 0xfffffe01d8174d00
kern_swapoff() at kern_swapoff+0x1ab/frame 0xfffffe01d8174e00
amd64_syscall() at amd64_syscall+0x158/frame 0xfffffe01d8174f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01d8174f30
--- syscall (582, FreeBSD ELF64, swapoff), rip = 0xdc6777123ba, rsp = 0xdc6748c87e8, rbp = 0xdc6748c8920 ---

cc -c -O2 -pipe  -fno-strict-aliasing  -g -nostdinc  -I. -I../../.. -I../../../contrib/ck/include -I../../../contrib/libfdt -D_KERNEL -DHAVE_KERNEL_OPTION_HEADERS -include opt_global.h -fno-common    -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -MD  -MF.depend.subr_rangeset.o -MTsubr_rangeset.o -fdebug-prefix-map=./machine=/usr/src/sys/amd64/include -fdebug-prefix-map=./x86=/usr/src/sys/x86/include -fdebug-prefix-map=./i386=/usr/src/sys/i386/include -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float  -fno-asynchronous-unwind-tables -ffreestanding -fwrapv -fstack-protector -gdwarf-4 -Wall -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wundef -Wno-pointer-sign -D__printf__=__freebsd_kprintf__ -Wmissing-include-dirs -fdiagnostics-show-option -Wno-unknown-pragmas -Wswitch -Wno-error=tautological-compare -Wno-error=empty-body -Wno-error=parentheses-equality -Wno-error=unused-function -Wno-error=pointer-sign -Wno-error=shift-negative-value -Wno-address-of-packed-member -Wno-format-zero-length   -mno-aes -mno-avx  -std=gnu99 -Werror ../../../kern/subr_rangeset.c
../../../kern/subr_rangeset.c:329:25: error: use of undeclared identifier 'src_rs'
  329 |         pctrie_iter_init(&it, &src_rs->rs_trie);
      |                                ^
1 error generated.
*** Error code 1

20240716 09:00:01 all (1/958): pfl4.sh
Jul 16 09:02:51 mercat1 kernel: pid 12456 (swap), jid 0, uid 2007, was killed: a thread waited too long to allocate a page
Jul 16 09:04:09 mercat1 kernel: pid 16534 (rw), uid 2007 inumber 53830 on /mnt12: filesystem full
Kernel page fault with the following non-sleepable locks held:
exclusive rw vmobject (vmobject) r = 0 (0xfffff80013bce738) locked @ vm/vm_object.c:1333
stack backtrace:
#0 0xffffffff80bc82bc at witness_debugger+0x6c
#1 0xffffffff80bc94b3 at witness_warn+0x403
#2 0xffffffff81076ff0 at trap_pfault+0x80
#3 0xffffffff81049258 at calltrap+0x8
#4 0xffffffff80ba6655 at pctrie_remove+0x1e5
#5 0xffffffff80ba7715 at pctrie_iter_remove+0x145
#6 0xffffffff80eeca49 at SWAP_PCTRIE_ITER_REMOVE+0x19
#7 0xffffffff80ee8520 at swp_pager_meta_free+0x380
#8 0xffffffff80ee7e3a at swap_pager_freespace_pgo+0x7a
#9 0xffffffff80f10f19 at vm_object_madvise+0x149
#10 0xffffffff80f05e5a at vm_map_madvise+0x3ea
#11 0xffffffff81077918 at amd64_syscall+0x158
#12 0xffffffff81049b6b at fast_syscall_common+0xf8

20240709 10:24:07 all: crossmp4.sh
<jemalloc>: jemalloc_base.c:190: Failed assertion: "extent_bsize_get(extent) >= *gap_size + size"
<jemalloc>: jemalloc_base.c:190: Failed assertion: "extent_bsize_get(extent) >= *gap_size + size"
<jemalloc>: /usr/src/contrib/jemalloc/include/jemalloc/internal/tcache_inlines.h:52: Failed assertion: "tcache_success == (ret != NULL)"
<jemalloc>: /usr/src/contrib/jemalloc/include/jemalloc/internal/tcache_inlines.h:52: Failed assertion: "tcache_success == (ret != NULL)"

20240705 20:25:38 all (1/1): unionfs19.sh
VNASSERT failed: !__builtin_expect(((_Generic(*(&(dvp)->v_irflag), short: (*(volatile u_short *)(&(dvp)->v_irflag)), u_short: VNASSERT failed: !__builtin_expect(((_Generic(*(&(dvp)->v_irflag), short: (*(volatile u_short *)(&(dvp)->v_irflag)), u_short: (*(volatile u_short *)(&(dvp)->v_irflag))) & 0x0001) != 0), 0) not true at ../../../kern/vfs_cache.c:2481 (cache_enter_time)
VNASSERT failed: !__builtin_expect(((_Generic(*(&(dvp)->v_irflag), short: (*(volatile u_short *)(&(dvp)->v_irflag)), u_short: VNASSERT failed: !__builtin_expect(((_Generic(*(&(dvp)->v_irflag), short: (*(volatile u_short *)(&(dvp)->v_irflag)), u_short: (*(volatile u_short *)(&(dvp)->v_irflag))) & 0x0001) != 0), 0) not true at ../../../kern/vfs_cache.c:2481 (cache_enter_time)
VNASSERT failed: !__builtin_expect(((_Generic(*(&(dvp)->v_irflag), short: (*(volatile u_short *)(&(dvp)->v_irflag)), u_short: (*(volatile u_short *)(&(dvp)->v_irflag))) & 0x0001) != 0), 0) not true at ../../../kern/vfs_cache.c:2481 (cache_enter_time)
0xfffffe016f682bb8: (*(volatile u_short *)(&(dvp)->v_irflag))) & 0x0001) != 0), 0) not true at ../../../kern/vfs_cache.c:2481 (cache_enter_time)
(*(volatile u_short *)(&(dvp)->v_irflag))) & 0x0001) != 0), 0) not true at ../../../kern/vfs_cache.c:2481 (cache_enter_time)
0xfffffe016f6d04b0: 0xfffffe016f1aa068: type VBAD state VSTATE_DEAD op 0xffffffff818ac760
    usecount 2, writecount 0, refcount 1 seqc users 10xfffffe016ffba068: type VBAD state VSTATE_DEAD op 0xffffffff818ac760

<jemalloc>: jemalloc_base.c:190: Failed assertion: "extent_bsize_get(extent) >= *gap_size + size"
<jemalloc>: /usr/src/contrib/jemalloc/include/jemalloc/internal/tcache_inlines.h:52: Failed assertion: "tcache_success == (ret != NULL)"

19:30 ~ $ sync
19:30 ~ $ sync
19:30 ~ $ sort /dev/zero &
[1] 4135
19:30 ~ $ sort /dev/zero &
[2] 4138
19:30 ~ $ sort /dev/zero &
[3] 4139
19:30 ~ $ panic: ASan: Invalid access, 8-byte read at 0xfffffe0182981630, UMAUseAfterFree(fd)
cpuid = 4
time = 1718818384
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xa5/frame 0xfffffe014cc0af50
kdb_backtrace() at kdb_backtrace+0xc6/frame 0xfffffe014cc0b0b0
vpanic() at vpanic+0x226/frame 0xfffffe014cc0b250
panic() at panic+0xb5/frame 0xfffffe014cc0b320
kasan_report() at kasan_report+0xdf/frame 0xfffffe014cc0b3f0
pctrie_keybarr() at pctrie_keybarr+0x29/frame 0xfffffe014cc0b450
pctrie_iter_step() at pctrie_iter_step+0x15e/frame 0xfffffe014cc0b550
SWAP_PCTRIE_ITER_STEP() at SWAP_PCTRIE_ITER_STEP+0x1d/frame 0xfffffe014cc0b570
swp_pager_meta_transfer() at swp_pager_meta_transfer+0x6e9/frame 0xfffffe014cc0b840
swap_pager_copy() at swap_pager_copy+0x4b0/frame 0xfffffe014cc0b960
vm_object_collapse() at vm_object_collapse+0xad5/frame 0xfffffe014cc0ba30
vm_object_deallocate() at vm_object_deallocate+0x5ad/frame 0xfffffe014cc0bb10
vm_map_process_deferred() at vm_map_process_deferred+0x15f/frame 0xfffffe014cc0bb50
vmspace_dofree() at vmspace_dofree+0xdf/frame 0xfffffe014cc0bb90
vmspace_exit() at vmspace_exit+0x203/frame 0xfffffe014cc0bc50
exit1() at exit1+0x76e/frame 0xfffffe014cc0bcf0
sys_exit() at sys_exit+0x28/frame 0xfffffe014cc0bd10
amd64_syscall() at amd64_syscall+0x39e/frame 0xfffffe014cc0bf30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe014cc0bf30
--- syscall (1, FreeBSD ELF64, exit), rip = 0x236e0fe894ba, rsp = 0x236e0c6e78d8, rbp = 0x236e0c6e7900 ---
KDB: enter: panic
[ thread pid 4144 tid 100329 ]
Stopped at      kdb_enter+0x34: movq    $0,0x20d19b1(%rip)
db>