panic: inp_leave_group: imf_sources not empty

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 2b636169 Fix missing restoring of the mouse cursor positio..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15efb077200000
dashboard link: https://syzkaller.appspot.com/bug?extid=ba7c4943547e0604faca

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ba7c49...@syzkaller.appspotmail.com

panic: inp_leave_group: imf_sources not empty
cpuid = 0
time = 501
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame
0xfffffe0025526520
vpanic() at vpanic+0x1e0/frame 0xfffffe0025526580
panic() at panic+0x43/frame 0xfffffe00255265e0
inp_setmoptions() at inp_setmoptions+0x40bd/frame 0xfffffe00255267c0
ip_ctloutput() at ip_ctloutput+0x80f/frame 0xfffffe0025526810
rip_ctloutput() at rip_ctloutput+0x2c9/frame 0xfffffe0025526850
sosetopt() at sosetopt+0x101/frame 0xfffffe00255268d0
kern_setsockopt() at kern_setsockopt+0x158/frame 0xfffffe0025526950
sys_setsockopt() at sys_setsockopt+0x33/frame 0xfffffe0025526980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe0025526ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0025526ab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x412f9a, rsp =
0x7fffdffdcf38, rbp = 0x5 ---
KDB: enter: panic
[ thread pid 1938 tid 100909 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: b537b150 Report DIF protection type the disk is formatted ..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1428f928a00000
dashboard link: https://syzkaller.appspot.com/bug?extid=ba7c4943547e0604faca
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1499143d200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10399da0a00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ba7c49...@syzkaller.appspotmail.com

panic: inp_leave_group: imf_sources not empty
cpuid = 0

time = 1555940445

KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame

0xfffffe0021240520
vpanic() at vpanic+0x1e0/frame 0xfffffe0021240580
panic() at panic+0x43/frame 0xfffffe00212405e0
inp_setmoptions() at inp_setmoptions+0x40bd/frame 0xfffffe00212407c0
ip_ctloutput() at ip_ctloutput+0x80f/frame 0xfffffe0021240810
rip_ctloutput() at rip_ctloutput+0x2c9/frame 0xfffffe0021240850
sosetopt() at sosetopt+0x101/frame 0xfffffe00212408d0
kern_setsockopt() at kern_setsockopt+0x158/frame 0xfffffe0021240950
sys_setsockopt() at sys_setsockopt+0x33/frame 0xfffffe0021240980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe0021240ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0021240ab0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x45763a, rsp =
0x7fffdffdcf88, rbp = 0x6b5bc0 ---
KDB: enter: panic
[ thread pid 1118 tid 100822 ]