kernel panic: nbuf 37, STAT_FIX_LEN_9P 49 assertion failed: krefBIT16SZ 2, GBIT16(buf) 0

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: bf9a9ba0d6af Add panic_hwtf() for kernel faults
git tree: https://github.com/akaros/akaros.git/master
console output: https://syzkaller.appspot.com/x/log.txt?x=130c408c400000
kernel config: https://syzkaller.appspot.com/x/.config?x=efef8cf2939304d3
dashboard link: https://syzkaller.appspot.com/bug?extid=982eca1cc48085ee4cf4
compiler:

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+982eca...@syzkaller.appspotmail.com

kernel panic at /syzkaller/managers/main/kernel/kern/include/kref.h:61,
from core 2: nbuf 37, STAT_FIX_LEN_9P 49 assertion failed: krefBIT16SZ 2,
GBIT16(buf) 0
This is bad!
Stack Backtrace on Core 2:
#01 [<0xffffffffc200a3e7>] in backtrace at src/kdebug.c:219
#02 [<0xffffffffc2009bb2>] in _panic at src/init.c:273
#03 [<0xffffffffc20495e6>] in kref_get at include/kref.h:61
#04 [< [inline] >] in proc_incref.10194 at src/process.c:563
#04 [<0xffffffffc204961e>] in enum_proc.10194 at src/process.c:2346
#05 [<0xffffffffc20091b1>] in hash_for_each at src/hashtable.c:427
#06 [<0xffffffffc204eb17>] in proc_get_set at src/process.c:2367
#07 [<0xffffffffc2045de1>] in profiler_emit_current_system_status at
src/profiler.c:270
#08 [<0xffffffffc2045f03>] in profiler_setup at src/profiler.c:421
#09 [<0xffffffffc207b07a>] in kprof_open at drivers/dev/kprof.c:228
#10 [<0xffffffffc2033a10>] in __namec_from at src/ns/chan.c:1225
#11 [<0xffffffffc20341ef>] in namec at src/ns/chan.c:1509
#12 [<0xffffffffc20416d6>] in sysopenat at src/ns/sysfile.c:590
#13 [<0xffffffffc205881f>] in sys_openat at src/syscall.c:1805
#14 [<0xffffffffc20593c9>] in syscall at src/syscall.c:2528
#15 [<0xffffffffc2059584>] in run_local_syscall at src/syscall.c:2563
#16 [<0xffffffffc2059ab9>] in prep_syscalls at src/syscall.c:2583
#17 [<0xffffffffc20ab29a>] in sysenter_callwrapper at arch/x86/trap.c:851


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[Barret Rhoden]

On 2018-07-18 at 11:00 syzbot

#syz invalid