assert failed: bytes != 0 (2)

0 views

Skip to first unread message

syzbot

unread,

Sep 17, 2020, 9:55:20 PM9/17/20

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 80b208dc ndp_rtm: Only ping once
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=17177673900000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=3146183e465aec4b8571
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+314618...@syzkaller.appspotmail.com

[ 245.8662405] panic: kernel diagnostic assertion "bytes != 0" failed: file "/syzkaller/managers/netbsd-kubsan/kernel/sys/miscfs/genfs/genfs_io.c", line 1470
[ 245.8851185] cpu0: Begin traceback...
[ 245.9062266] vpanic() at netbsd:vpanic+0x2cd sys/kern/subr_prf.c:290
[ 245.9662273] db_print_address.cold() at netbsd:db_print_address.cold
[ 246.0262271] genfs_do_io() at netbsd:genfs_do_io+0x9f5 sys/miscfs/genfs/genfs_io.c:1470
[ 246.0862258] genfs_gop_write() at netbsd:genfs_gop_write+0xb1 sys/miscfs/genfs/genfs_io.c:1399
[ 246.1362267] genfs_do_putpages() at netbsd:genfs_do_putpages+0x1496 sys/miscfs/genfs/genfs_io.c:1293
[ 246.1962284] VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x141 sys/kern/vnode_if.c:1666
[ 246.2562270] vinvalbuf() at netbsd:vinvalbuf+0x78 sys/kern/vfs_subr.c:159
[ 246.3162265] vcache_reclaim() at netbsd:vcache_reclaim+0x421 sys/kern/vfs_vnode.c:1745
[ 246.3862264] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 246.3862264] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 246.4462271] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 246.4962286] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 246.5562268] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 246.6162270] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 246.6862263] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 246.6862263] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 246.7462269] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 246.7962279] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 246.8562265] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 246.9162265] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 246.9862266] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 246.9862266] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 247.0462261] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 247.0962279] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 247.1562267] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 247.2162261] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 247.2862266] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 247.2862266] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 247.3462267] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 247.3962285] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 247.4562267] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 247.5162273] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 247.5862260] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 247.5862260] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 247.6462265] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 247.6962283] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 247.7562351] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 247.8162267] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 247.8862347] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 247.8862347] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 247.9462258] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 247.9962279] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 248.0562256] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 248.1162262] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 248.1762257] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 248.1762257] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 248.2262252] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 248.2762248] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 248.3262248] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 248.3862248] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 248.4362291] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 248.4362291] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 248.4862242] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 248.5362247] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 248.5862250] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 248.6362243] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 248.6962263] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 248.6962263] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 248.7462248] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 248.7962265] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 248.8462261] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 248.8962258] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 248.9562243] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 248.9562243] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 249.0062252] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 249.0562244] layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
[ 249.1062237] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
[ 249.1562250] vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
[ 249.2162250] vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
[ 249.2162250] vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
[ 249.2662282] vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
[ 249.3162247] layer_remove() at netbsd:layer_remove+0x13b sys/miscfs/genfs/layer_vnops.c:630
[ 249.3662239] VOP_REMOVE() at netbsd:VOP_REMOVE+0x209 sys/kern/vnode_if.c:923
[ 249.4162242] do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x394 sys/kern/vfs_syscalls.c:2827
[ 249.4662248] syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
[ 249.4662248] syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 249.4662248] syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138
[ 249.4762238] --- syscall (number 10) ---
[ 249.4962250] netbsd:syscall+0x2d5:
[ 249.4962250] cpu0: End traceback...
[ 249.4962250] fatal breakpoint trap in supervisor mode
[ 249.5082877] trap type 1 code 0 rip 0xffffffff80221a85 cs 0x8 rflags 0x246 cr2 0x72c23c213a28 ilevel 0 rsp 0xffffd800bf0533e0
[ 249.5199871] curlwp 0xfffffa25a9b7b680 pid 1079.1079 lowest kstack 0xffffd800bf0502c0
Stopped in pid 1079.1079 (syz-executor.2) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x2cd sys/kern/subr_prf.c:290
db_print_address.cold() at netbsd:db_print_address.cold
genfs_do_io() at netbsd:genfs_do_io+0x9f5 sys/miscfs/genfs/genfs_io.c:1470
genfs_gop_write() at netbsd:genfs_gop_write+0xb1 sys/miscfs/genfs/genfs_io.c:1399
genfs_do_putpages() at netbsd:genfs_do_putpages+0x1496 sys/miscfs/genfs/genfs_io.c:1293
VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x141 sys/kern/vnode_if.c:1666
vinvalbuf() at netbsd:vinvalbuf+0x78 sys/kern/vfs_subr.c:159
vcache_reclaim() at netbsd:vcache_reclaim+0x421 sys/kern/vfs_vnode.c:1745
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_reclaim() at netbsd:layer_reclaim+0x261 sys/miscfs/genfs/layer_vnops.c:747
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x1fb sys/kern/vnode_if.c:1288
vcache_reclaim() at netbsd:vcache_reclaim+0x50d sys/kern/vfs_vnode.c:1766
vrelel() at netbsd:vrelel+0x5df vrefcnt sys/kern/vfs_vnode.c:246 [inline]
vrelel() at netbsd:vrelel+0x5df sys/kern/vfs_vnode.c:919
vrele() at netbsd:vrele+0x69 sys/kern/vfs_vnode.c:954
layer_remove() at netbsd:layer_remove+0x13b sys/miscfs/genfs/layer_vnops.c:630
VOP_REMOVE() at netbsd:VOP_REMOVE+0x209 sys/kern/vnode_if.c:923
do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x394 sys/kern/vfs_syscalls.c:2827
syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138
--- syscall (number 10) ---
netbsd:syscall+0x2d5:
Panic string: kernel diagnostic assertion "bytes != 0" failed: file "/syzkaller/managers/netbsd-kubsan/kernel/sys/miscfs/genfs/genfs_io.c", line 1470
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
16049 16049 2 0 0 fffffa25b9a92340 syz-executor.1
8685 9685 2 1 0 fffffa25bec37540 syz-executor.0
8685 8685 2 1 10000000 fffffa25be65c480 syz-executor.0
8737 15956 3 1 80 fffffa25ba2a02c0 syz-executor.4 parked
8737 8737 2 1 10000000 fffffa25bf185080 syz-executor.4
16059 16059 2 1 0 fffffa25be49cbc0 syz-executor.5
9399 9399 3 0 80 fffffa25bafb4300 syz-executor.4 parked
8432 8432 3 0 80 fffffa25b94eb080 syz-executor.5 parked
8185 8185 3 0 80 fffffa25b961e8c0 syz-executor.4 parked
15825 15825 3 0 80 fffffa25ba178200 syz-executor.0 parked
7831 7831 3 0 80 fffffa25ba3ee240 syz-executor.0 parked
8658 8658 3 0 80 fffffa25ba72bb00 syz-executor.0 parked
7676 7676 3 1 80 fffffa25bf1854c0 syz-executor.0 parked
13648 13648 3 1 80 fffffa25bad035c0 syz-executor.0 parked
6875 6875 3 0 80 fffffa25be49c340 syz-executor.3 parked
6432 6432 3 0 80 fffffa25b96dd300 syz-executor.0 parked
13222 13222 3 0 80 fffffa25bad03180 syz-executor.0 parked
6383 6383 3 1 80 fffffa25bf185900 syz-executor.0 parked
6544 6544 3 1 80 fffffa25be65c8c0 syz-executor.0 parked
12734 12734 3 1 80 fffffa25be49c780 syz-executor.0 parked
9568 9568 3 0 80 fffffa25ba6f2600 syz-executor.1 parked
2294 2294 3 1 80 fffffa25bb7f0700 syz-executor.5 parked
9959 9959 3 0 80 fffffa25bafb4b80 syz-executor.1 parked
2521 2521 3 0 80 fffffa25b9a670c0 syz-executor.5 parked
2735 2735 3 0 80 fffffa25bb7f02c0 syz-executor.1 parked
3267 3267 3 0 80 fffffa25aac04bc0 syz-executor.5 parked
2520 2520 3 0 80 fffffa25ba3eeac0 syz-executor.4 parked
10198 10198 3 0 80 fffffa25ba9dfa80 syz-executor.4 parked
9276 9276 3 1 80 fffffa25ba9df640 syz-executor.4 parked
2892 2892 3 0 80 fffffa25b94eb4c0 syz-executor.4 parked
803 803 3 0 80 fffffa25aa390b80 syz-executor.3 parked
7206 7206 3 0 80 fffffa25b9a77100 syz-executor.0 parked
406 406 3 1 80 fffffa25acb76a40 syz-executor.0 parked
401 401 3 1 80 fffffa25ba178640 syz-executor.5 parked
7217 7217 3 0 80 fffffa25ba2a0b40 syz-executor.5 parked
7591 7591 3 0 80 fffffa25b9a77980 syz-executor.0 parked
7481 7481 3 0 80 fffffa25b90abb00 syz-executor.1 parked
7521 7521 3 1 80 fffffa25ba2a0700 syz-executor.1 parked
7518 7518 3 1 80 fffffa25b9a77540 syz-executor.5 parked
7783 7783 3 0 80 fffffa25b9e75580 syz-executor.5 parked
6597 6597 3 0 80 fffffa25b9e759c0 syz-executor.1 parked
7356 7356 3 1 80 fffffa25b9e75140 syz-executor.4 parked
7516 7516 3 1 80 fffffa25ab6380c0 syz-executor.4 parked
7211 7211 3 1 80 fffffa25b94eb900 syz-executor.4 parked
7227 7227 3 0 80 fffffa25b9a67940 syz-executor.4 parked
6602 6602 3 0 80 fffffa25aac6d480 syz-executor.4 parked
6371 6371 3 0 80 fffffa25b90ab6c0 syz-executor.2 parked
6320 6320 3 0 80 fffffa25b9a92780 syz-executor.5 parked
6749 6749 3 1 80 fffffa25b96de680 syz-executor.5 parked
6592 6592 3 0 80 fffffa25b96de240 syz-executor.2 parked
6352 6352 3 0 80 fffffa25b9a67500 syz-executor.5 parked
6458 6458 3 0 80 fffffa25aac6d8c0 syz-executor.2 parked
6206 6206 3 1 80 fffffa25b96dd740 syz-executor.2 parked
1074 1074 2 1 40 fffffa25acb76600 syz-executor.4
1071 1071 2 1 40 fffffa25abc9da00 syz-executor.5
1078 >1078 7 1 40 fffffa25a9c2c2c0 syz-executor.3
1079 >1079 7 0 40 fffffa25a9b7b680 syz-executor.2
1091 1091 2 0 40 fffffa25aac5f080 syz-executor.1
419 419 2 0 40 fffffa25abafa100 syz-executor.0
1252 1076 2 0 40 fffffa25ab638500 syz-fuzzer
1252 1077 3 1 80 fffffa25abafa540 syz-fuzzer parked
1252 1069 3 1 80 fffffa25acb761c0 syz-fuzzer parked
1252 1068 2 0 40 fffffa25aac5f4c0 syz-fuzzer
1252 930 3 1 80 fffffa25abafa980 syz-fuzzer parked
1252 1065 3 1 80 fffffa25ab8e4580 syz-fuzzer parked
1252 1250 3 0 c0 fffffa25a96465c0 syz-fuzzer parked
1252 1254 2 1 40 fffffa25a9b7b240 syz-fuzzer
1252 1252 3 0 80 fffffa25aac5f900 syz-fuzzer parked
1119 1119 3 0 80 fffffa25abc9d5c0 sshd select
1102 1102 3 1 80 fffffa25a988b640 getty nanoslp
696 696 3 1 80 fffffa25a988b200 getty nanoslp
850 850 3 1 80 fffffa25ab8e49c0 getty nanoslp
1089 1089 3 1 c0 fffffa25abc9d180 getty ttyraw
972 972 3 1 80 fffffa25ab638940 sshd select
962 962 3 0 80 fffffa25ab8e4140 powerd kqueue
563 563 3 1 80 fffffa25a9c2cb40 syslogd kqueue
591 591 3 0 80 fffffa25aa390300 dhcpcd poll
589 589 3 0 80 fffffa25a9b7bac0 dhcpcd poll
587 587 3 0 80 fffffa25a9cd9280 dhcpcd poll
412 412 3 1 80 fffffa25aa390740 dhcpcd poll
347 347 3 1 80 fffffa25a9cd96c0 dhcpcd poll
346 346 3 0 80 fffffa25a9cd9b00 dhcpcd poll
345 345 3 1 80 fffffa25a9c2c700 dhcpcd poll
1 1 3 0 80 fffffa25a14c54c0 init wait
0 15103 5 1 600 fffffa25b961e480 (zombie)
0 2505 3 0 200 fffffa25b96deac0 acctwatch actwat
0 853 3 0 200 fffffa25a9646a00 physiod physiod
0 160 3 0 200 fffffa25a96c6a40 pooldrain pooldrain
0 165 2 0 240 fffffa25a96c6600 ioflush
0 164 3 1 200 fffffa25a96c61c0 pgdaemon pgdaemon
0 161 3 1 200 fffffa25a9646180 usb7 usbevt
0 31 3 1 200 fffffa25a65f19c0 usb6 usbevt
0 63 3 0 200 fffffa25a65f1580 usb5 usbevt
0 126 3 1 200 fffffa25a65f1140 usb4 usbevt
0 125 3 1 200 fffffa25a356c980 usb3 usbevt
0 124 3 1 200 fffffa25a356c540 usb2 usbevt
0 123 3 0 200 fffffa25a356c100 usb1 usbevt
0 122 3 1 200 fffffa25a24ff940 usb0 usbevt
0 121 3 1 200 fffffa25a24ff500 usbtask-dr usbtsk
0 120 3 1 200 fffffa25a24ff0c0 usbtask-hc usbtsk
0 119 2 0 240 fffffa25a14c5900 npfgc0
0 118 3 1 200 fffffa25a14c5080 rt_free rt_free
0 117 3 0 200 fffffa25a14988c0 unpgc unpgc
0 116 2 1 200 fffffa25a1498480 key_timehandler
0 115 3 1 200 fffffa25a1498040 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 fffffa25a1443bc0 icmp6_wqinput/0 icmp6_wqinput
0 113 2 0 200 fffffa25a1443780 nd6_timer
0 112 3 1 200 fffffa25a1443340 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 fffffa25a1416b80 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 fffffa25a13f9700 carp_wqinput/1 carp_wqinput
0 109 3 0 200 fffffa25a13f9b40 carp_wqinput/0 carp_wqinput
0 108 3 1 200 fffffa25a0d98b00 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 fffffa25a1416300 icmp_wqinput/0 icmp_wqinput
0 106 2 0 200 fffffa259e942ac0 rt_timer
0 105 3 1 200 fffffa25a1416740 vmem_rehash vmem_rehash
0 104 3 1 200 fffffa25a13f92c0 entbutler entropy
0 30 3 1 200 fffffa25a0d986c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 fffffa25a0d98280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 fffffa259e942680 scsibus0 sccomp
0 26 3 0 200 fffffa259e942240 pms0 pmsreset
0 25 3 1 200 fffffa259e87ca80 xcall/1 xcall
0 24 1 1 200 fffffa259e87c640 softser/1
0 23 1 1 200 fffffa259e87c200 softclk/1
0 22 1 1 200 fffffa259e847a40 softbio/1
0 21 1 1 200 fffffa259e847600 softnet/1
0 20 1 1 201 fffffa259e8471c0 idle/1
0 19 3 0 200 fffffa26ae78fa00 lnxpwrwq lnxpwrwq
0 18 3 0 200 fffffa26ae78f5c0 lnxlngwq lnxlngwq
0 17 3 0 200 fffffa26ae78f180 lnxsyswq lnxsyswq
0 16 3 0 200 fffffa26ae7a09c0 lnxrcugc lnxrcugc
0 15 3 0 200 fffffa26ae7a0580 sysmon smtaskq
0 14 3 0 200 fffffa26ae7a0140 pmfsuspend pmfsuspend
0 13 3 0 200 fffffa26ae7b9980 pmfevent pmfevent
0 12 3 0 200 fffffa26ae7b9540 sopendfree sopendfr
0 11 3 0 200 fffffa26ae7b9100 iflnkst iflnkst
0 10 3 0 200 fffffa26af7dc940 nfssilly nfssilly
0 9 3 0 200 fffffa26af7dc500 vdrain vdrain
0 8 3 0 200 fffffa26af7dc0c0 modunload mod_unld
0 7 3 0 200 fffffa26af815900 xcall/0 xcall
0 6 1 0 200 fffffa26af8154c0 softser/0
0 5 1 0 200 fffffa26af815080 softclk/0
0 4 1 0 200 fffffa26af83f8c0 softbio/0
0 3 1 0 200 fffffa26af83f480 softnet/0
0 2 1 0 201 fffffa26af83f040 idle/0
0 0 2 0 240 ffffffff85ed8480 swapper
[Locks tracked through LWPs]

****** LWP 16049.16049 (syz-executor.1) @ 0xfffffa25b9a92340, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xfffffa25bae41180 type : sleep/adaptive
initialized : 0xffffffff80f5972e
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa25b9a92340 last held: 0xfffffa25b9a92340
last locked* : 0xffffffff80f5bdda unlocked : 0xffffffff80f59464
owner field : 0xfffffa25b9a92340 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 8737.8737 (syz-executor.4) @ 0xfffffa25bf185080, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xfffffa25beb19758 type : sleep/adaptive
initialized : 0xffffffff83161f12
shared holds : 0 exclusive: 0
shares wanted: 1 exclusive: 0
relevant cpu : 1 last held: 65535
relevant lwp : 0xfffffa25bf185080 last held: 000000000000000000
last locked : 0xffffffff8313ee53 unlocked*: 0xffffffff8313d252
owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 16059.16059 (syz-executor.5) @ 0xfffffa25be49cbc0, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xfffffa25bf488780 type : sleep/adaptive
initialized : 0xffffffff80f5972e
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffffa25be49cbc0 last held: 0xfffffa25be49cbc0
last locked* : 0xffffffff80f5bdda unlocked : 0xffffffff80f59464
owner field : 0xfffffa25be49cbc0 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1078.1078 (syz-executor.3) @ 0xfffffa25a9c2c2c0, l_stat=7

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xfffffa25af1c0740 type : sleep/adaptive
initialized : 0xffffffff83523418
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffffa25a9c2c2c0 last held: 0xfffffa25a9c2c2c0
last locked* : 0xffffffff8357da10 unlocked : 0xffffffff8357d79d
owner/count : 0xfffffa25a9c2c2c0 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1079.1079 (syz-executor.2) @ 0xfffffa25a9b7b680, l_stat=7

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xfffffa25c009bc40 type : sleep/adaptive
initialized : 0xffffffff83523418
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa25a9b7b680 last held: 0xfffffa25a9b7b680
last locked* : 0xffffffff8357da10 unlocked : 0xffffffff8357d79d
owner/count : 0xfffffa25a9b7b680 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at vcache_alloc)
lock address : 0xfffffa25ba4eaa40 type : sleep/adaptive
initialized : 0xffffffff83523418
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa25a9b7b680 last held: 0xfffffa25a9b7b680
last locked* : 0xffffffff8357d98f unlocked : 0xffffffff8357d79d
owner/count : 0xfffffa25a9b7b680 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 589.589 (dhcpcd) @ 0xfffffa25a9b7bac0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862d1680 type : sleep/adaptive
initialized : 0xffffffff83268557
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa25a9b7bac0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 587.587 (dhcpcd) @ 0xfffffa25a9cd9280, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862d1680 type : sleep/adaptive
initialized : 0xffffffff83268557
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa25a9cd9280 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 346.346 (dhcpcd) @ 0xfffffa25a9cd9b00, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862d1680 type : sleep/adaptive
initialized : 0xffffffff83268557
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa25a9cd9b00 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 345.345 (dhcpcd) @ 0xfffffa25a9c2c700, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862d1680 type : sleep/adaptive
initialized : 0xffffffff83268557
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffa25a9c2c700 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xfffffa26ae7b9100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862d1680 type : sleep/adaptive
initialized : 0xffffffff83268557
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa26ae7b9100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xfffffa26af815080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862d1680 type : sleep/adaptive
initialized : 0xffffffff83268557
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa26af815080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at main)
lock address : 0xffffffff862d1580 type : spin
initialized : 0xffffffff83a51dd6
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffa25a9b7b680 last held: 0xfffffa25a9b7b680
last locked* : 0xffffffff832cf298 unlocked : 0xffffffff80f295bb
curcpu holds : 11 wanted by: 000000000000000000

PAGE FLAG PQ UOBJECT UANON
0xffffd80000007180 0045 00000000 0x0 0x0
0xffffd80000007200 0045 00000000 0x0 0x0
0xffffd80000007280 0045 00000000 0x0 0x0
0xffffd80000007300 0045 00000000 0x0 0x0
0xffffd80000007380 0045 00000000 0x0 0x0
0xffffd80000007400 0045 00000000 0x0 0x0
0xffffd80000007480 0045 00000000 0x0 0x0
0xffffd80000007500 0045 00000000 0x0 0x0
0xffffd80000007580 0041 00000000 0x0 0x0
0xffffd80000007600 0041 00000000 0x0 0x0
0xffffd80000007680 0041 00000000 0x0 0x0
0xffffd80000007700 0045 00000000 0x0 0x0
0xffffd80000007780 0045 00000000 0x0 0x0
0xffffd80000007800 0045 00000000 0x0 0x0
0xffffd80000007880 0041 00000000 0x0 0x0
0xffffd80000007900 0041 00000000 0x0 0x0
0xffffd80000007980 0041 00000000 0x0 0x0
0xffffd80000007a00 0041 00000000 0x0 0x0
0xffffd80000007a80 0041 00000000 0x0 0x0
0xffffd80000007b00 0041 00000000 0x0 0x0
0xffffd80000007b80 0041 00000000 0x0 0x0
0xffffd80000007c00 0041 00000000 0x0 0x0
0xffffd80000007c80 0041 00000000 0x0 0x0
0xffffd80000007d00 0041 00000000 0x0 0x0
0xffffd80000007d80 0041 00000000 0x0 0x0
0xffffd80000007e00 0041 00000000 0x0 0x0
0xffffd80000007e80 0041 00000000 0x0 0x0
0xffffd80000007f00 0041 00000000 0x0 0x0
0xffffd80000007f80 0041 00000000 0x0 0x0
0xffffd80000008000 0041 00000000 0x0 0x0
0xffffd80000008080 0041 00000000 0x0 0x0
0xffffd80000008100 0041 00000000 0x0 0x0
0xffffd80000008180 0041 00000000 0x0 0x0
0xffffd80000008200 0041 00000000 0x0 0x0
0xffffd80000008280 0041 00000000 0x0 0x0
0xffffd80000008300 0041 00000000 0x0 0x0
0xffffd80000008380 0041 00000000 0x0 0x0
0xffffd80000008400 0041 00000000 0x0 0x0
0xffffd80000008480 0041 00000000 0x0 0x0
0xffffd80000008500 0041 00000000 0x0 0x0
0xffffd80000008580 0041 00000000 0x0 0x0
0xffffd80000008600 0041 00000000 0x0 0x0
0xffffd80000008680 0045 00000000 0x0 0x0
0xffffd80000008700 0041 00000000 0x0 0x0
0xffffd80000008780 0041 00000000 0x0 0x0
0xffffd80000008800 0041 00000000 0x0 0x0
0xffffd80000008880 0041 00000000 0x0 0x0
0xffffd80000008900 0041 00000000 0x0 0x0
0xffffd80000008980 0041 00000000 0x0 0x0
0xffffd80000008a00 0041 00000000 0x0 0x0
0xffffd80000008a80 0041 00000000 0x0 0x0
0xffffd80000008b00 0041 00000000 0x0 0x0
0xffffd80000008b80 0045 00000000 0x0 0x0
0xffffd80000008c00 0041 00000000 0x0 0x0
0xffffd80000008c80 0041 00000000 0x0 0x0
0xffffd80000008d00 0041 00000000 0x0 0x0
0xffffd80000008d80 0041 00000000 0x0 0x0
0xffffd80000008e00 0041 00000000 0x0 0x0
0xffffd80000008e80 0041 00000000 0x0 0x0
0xffffd80000008f00 0045 00000000 0x0 0x0
0xffffd80000008f80 0041 00000000 0x0 0x0
0xffffd80000009000 0041 00000000 0x0 0x0
0xffffd80000009080 0041 00000000 0x0 0x0
0xffffd80000009100 0041 00000000 0x0 0x0
0xffffd80000009180 0041 00000000 0x0 0x0
0xffffd80000009200 0041 00000000 0x0 0x0
0xffffd80000009280 0041 00000000 0x0 0x0
0xffffd80000009300 0041 00000000 0x0 0x0
0xffffd80000009380 0041 00000000 0x0 0x0
0xffffd80000009400 0041 00000000 0x0 0x0
0xffffd80000009480 0041 00000000 0x0 0x0
0xffffd80000009500 0041 00000000 0x0 0x0
0xffffd80000009580 0041 00000000 0x0 0x0
0xffffd80000009600 0041 00000000 0x0 0x0
0xffffd80000009680 0041 00000000 0x0 0x0
0xffffd80000009700 0041 00000000 0x0 0x0
0xffffd80000009780 0041 00000000 0x0 0x0
0xffffd80000009800 0041 00000000 0x0 0x0
0xffffd80000009880 0041 00000000 0x0 0x0
0xffffd80000009900 0041 00000000 0x0 0x0
0xffffd80000009980 0041 00000000 0x0 0x0
0xffffd80000009a00 0041 00000000 0x0 0x0
0xffffd80000009a80 0041 00000000 0x0 0x0
0xffffd80000009b00 0041 00000000 0x0 0x0
0xffffd80000009b80 0041 00000000 0x0 0x0
0xffffd80000009c00 0041 00000000 0x0 0x0
0xffffd80000009c80 0041 00000000 0x0 0x0
0xffffd80000009d00 0041 00000000 0x0 0x0
0xffffd80000009d80 0041 00000000 0x0 0x0
0xffffd80000009e00 0041 00000000 0x0 0x0
0xffffd80000009e80 0041 00000000 0x0 0x0
0xffffd80000009f00 0041 00000000 0x0 0x0
0xffffd80000009f80 0041 00000000 0x0 0x0
0xffffd8000000a000 0041 00000000 0x0 0x0
0xffffd8000000a080 0041 00000000 0x0 0x0
0xffffd8000000a100 0045 00000000 0x0 0x0
0xffffd8000000a180 0041 00000000 0x0 0x0
0xffffd8000000a200 0041 00000000 0x0 0x0
0xffffd8000000a280 0041 00000000 0x0 0x0
0xffffd8000000a300 0041 00000000 0x0 0x0
0xffffd8000000a380 0041 00000000 0x0 0x0
0xffffd8000000a400 0041 00000000 0x0 0x0
0xffffd8000000a480 0041 00000000 0x0 0x0
0xffffd8000000a500 0041 00000000 0x0 0x0
0xffffd8000000a580 0041 00000000 0x0 0x0
0xffffd8000000a600 0041 00000000 0x0 0x0
0xffffd8000000a680 0041 00000000 0x0 0x0
0xffffd8000000a700 0041 00000000 0x0 0x0
0xffffd8000000a780 0041 00000000 0x0 0x0
0xffffd8000000a800 0041 00000000 0x0 0x0
0xffffd8000000a880 0041 00000000 0x0 0x0
0xffffd8000000a900 0041 00000000 0x0 0x0
0xffffd8000000a980 0041 00000000 0x0 0x0
0xffffd8000000aa00 0045 00000000 0x0 0x0
0xffffd8000000aa80 0041 00000000 0x0 0x0
0xffffd8000000ab00 0041 00000000 0x0 0x0
0xffffd8000000ab80 0041 00000000 0x0 0x0
0xffffd8000000ac00 0041 00000000 0x0 0x0
0xffffd8000000ac80 0041 00000000 0x0 0x0
0xffffd8000000ad00 0041 00000000 0x0 0x0
0xffffd8000000ad80 0045 00000000 0x0 0x0
0xffffd8000000ae00 0045 00000000 0x0 0x0
0xffffd8000000ae80 0045 00000000 0x0 0x0
0xffffd8000000af00 0041 00000000 0x0 0x0
0xffffd8000000af80 0041 00000000 0x0 0x0
0xffffd8000000b000 0041 00000000 0x0 0x0
0xffffd8000000b080 0041 00000000 0x0 0x0
0xffffd8000000b100 0041 00000000 0x0 0x0

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Feb 4, 2021, 1:58:17 AM2/4/21

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 59ee1e30 make(1): replace global preserveUndefined with VA..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=166f9d5f500000
kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a

dashboard link: https://syzkaller.appspot.com/bug?extid=3146183e465aec4b8571
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11dfd65f500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124735c8d00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+314618...@syzkaller.appspotmail.com

[ 127.0324441] panic: kernel diagnostic assertion "bytes != 0" failed: file "/syzkaller/managers/netbsd/kernel/sys/miscfs/genfs/genfs_io.c", line 1470
[ 127.0423907] cpu1: Begin traceback...
[ 127.0823924] vpanic() at netbsd:vpanic+0x265 sys/kern/subr_prf.c:290
[ 127.1623953] _GLOBAL__sub_D_65535_0_cpu_configure() at [ 127.1824264] netbsd:_GLOBAL__sub_D_65535_0_cpu_configure
[ 127.2424224] genfs_do_io() at netbsd:genfs_do_io+0x877 sys/miscfs/genfs/genfs_io.c:1470
[ 127.3124214] genfs_gop_write() at netbsd:genfs_gop_write+0x6e sys/miscfs/genfs/genfs_io.c:1399
[ 127.3823976] genfs_do_putpages() at netbsd:genfs_do_putpages+0x1062 sys/miscfs/genfs/genfs_io.c:1293
[ 127.4623969] VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x11e sys/kern/vnode_if.c:1666
[ 127.5523981] vflushbuf() at netbsd:vflushbuf+0x76 sys/kern/vfs_subr.c:296
[ 127.6324012] ffs_full_fsync() at netbsd:ffs_full_fsync+0x2f5 sys/ufs/ffs/ffs_vnops.c:536
[ 127.7123971] ffs_fsync() at netbsd:ffs_fsync+0x369 sys/ufs/ffs/ffs_vnops.c:359
[ 127.8024009] VOP_FSYNC() at netbsd:VOP_FSYNC+0x132 sys/kern/vnode_if.c:852
[ 127.8823958] sys_fdatasync() at netbsd:sys_fdatasync+0xd1 sys/kern/vfs_syscalls.c:4239
[ 127.9623961] sys_syscall() at netbsd:sys_syscall+0xff sy_call sys/sys/syscallvar.h:65 [inline]
[ 127.9623961] sys_syscall() at netbsd:sys_syscall+0xff sys/kern/sys_syscall.c:77
[ 128.0523961] syscall() at netbsd:syscall+0x259 sy_call sys/sys/syscallvar.h:65 [inline]
[ 128.0523961] syscall() at netbsd:syscall+0x259 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 128.0523961] syscall() at netbsd:syscall+0x259 sys/arch/x86/x86/syscall.c:138
[ 128.0723975] --- syscall (number 0) ---
[ 128.0923958] netbsd:syscall+0x259:
[ 128.1023944] cpu1: End traceback...
[ 128.1023944] fatal breakpoint trap in supervisor mode
[ 128.1123920] trap type 1 code 0 rip 0xffffffff80220a2d cs 0x8 rflags 0x286 cr2 0xffff94818672a000 ilevel 0 rsp 0xffff94819db303f0
[ 128.1223920] curlwp 0xffff94801516b1c0 pid 1102.1102 lowest kstack 0xffff94819db292c0
Stopped in pid 1102.1102 (syz-executor3858) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5

db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x265 sys/kern/subr_prf.c:290
_GLOBAL__sub_D_65535_0_cpu_configure() at netbsd:_GLOBAL__sub_D_65535_0_cpu_configure
genfs_do_io() at netbsd:genfs_do_io+0x877 sys/miscfs/genfs/genfs_io.c:1470
genfs_gop_write() at netbsd:genfs_gop_write+0x6e sys/miscfs/genfs/genfs_io.c:1399
genfs_do_putpages() at netbsd:genfs_do_putpages+0x1062 sys/miscfs/genfs/genfs_io.c:1293
VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x11e sys/kern/vnode_if.c:1666
vflushbuf() at netbsd:vflushbuf+0x76 sys/kern/vfs_subr.c:296
ffs_full_fsync() at netbsd:ffs_full_fsync+0x2f5 sys/ufs/ffs/ffs_vnops.c:536
ffs_fsync() at netbsd:ffs_fsync+0x369 sys/ufs/ffs/ffs_vnops.c:359
VOP_FSYNC() at netbsd:VOP_FSYNC+0x132 sys/kern/vnode_if.c:852
sys_fdatasync() at netbsd:sys_fdatasync+0xd1 sys/kern/vfs_syscalls.c:4239
sys_syscall() at netbsd:sys_syscall+0xff sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0xff sys/kern/sys_syscall.c:77
syscall() at netbsd:syscall+0x259 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x259 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x259 sys/arch/x86/x86/syscall.c:138
--- syscall (number 0) ---
netbsd:syscall+0x259:
Panic string: kernel diagnostic assertion "bytes != 0" failed: file "/syzkaller/managers/netbsd/kernel/sys/miscfs/genfs/genfs_io.c", line 1470

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1075 1075 3 1 0 ffff948013bfb200 syz-executor3858 tstile
1255 1255 2 1 1000000 ffff94801516b600 syz-executor3858
1102 >1102 7 1 0 ffff94801516b1c0 syz-executor3858
1188 1188 3 0 1000000 ffff948015146a00 syz-executor3858 tstile
1220 1220 3 0 1000000 ffff9480151465c0 syz-executor3858 tstile
422 422 2 1 40 ffff948015146180 syz-executor3858
1225 1225 2 1 140 ffff9480148778c0 syz-executor3858
1219 1219 2 1 140 ffff948014877480 syz-executor3858
1218 1218 2 1 140 ffff948013c79bc0 syz-executor3858
1221 1221 2 1 140 ffff948014889500 syz-executor3858
1189 1189 2 1 140 ffff948013b7d980 syz-executor3858
1083 1083 3 0 180 ffff948013a51bc0 syz-executor3858 nanoslp
949 949 3 1 180 ffff948013a998c0 sshd select
1125 1125 3 0 180 ffff948013abb900 getty nanoslp
1256 1256 3 0 180 ffff948013abb4c0 getty nanoslp
1070 1070 3 1 180 ffff948013b630c0 getty nanoslp
1099 1099 3 1 1c0 ffff948013959a80 getty ttyraw
954 954 3 1 180 ffff94801481ab40 sshd select
978 978 3 0 180 ffff948013dd0500 powerd kqueue
692 692 2 1 100 ffff94801486bbc0 syslogd
739 739 3 1 180 ffff948013c8e8c0 dhcpcd poll
601 601 3 1 180 ffff948013cc8140 dhcpcd poll
596 596 3 1 180 ffff948013c8e480 dhcpcd poll
591 591 3 1 180 ffff948013c63740 dhcpcd poll
482 482 3 1 180 ffff948013d95900 dhcpcd poll
288 288 3 1 180 ffff948013d954c0 dhcpcd poll
351 351 3 1 180 ffff948013d95080 dhcpcd poll
1 1 3 1 180 ffff94801385c140 init wait
0 870 3 0 200 ffff94801398c240 physiod physiod
0 192 3 0 200 ffff94801398e280 pooldrain pooldrain
0 163 2 0 240 ffff94801398cac0 ioflush
0 168 3 1 200 ffff94801398c680 pgdaemon pgdaemon
0 162 3 1 200 ffff948013959640 usb7 usbevt
0 161 3 0 200 ffff948013959200 usb6 usbevt
0 31 3 1 200 ffff94801390ba40 usb5 usbevt
0 63 3 0 200 ffff94801390b600 usb4 usbevt
0 126 3 1 200 ffff94801390b1c0 usb3 usbevt
0 125 3 0 200 ffff9480138b9a00 usb2 usbevt
0 124 3 0 200 ffff9480138b95c0 usb1 usbevt
0 123 3 0 200 ffff9480138b9180 usb0 usbevt
0 122 3 0 200 ffff94801385c9c0 usbtask-dr usbtsk
0 121 3 0 200 ffff948010dbbac0 usbtask-hc usbtsk
0 120 3 1 200 ffff94801385c580 npfgc0 npfgcw
0 119 3 0 200 ffff94801384c980 rt_free rt_free
0 118 3 0 200 ffff94801384c540 unpgc unpgc
0 117 3 0 200 ffff94801384c100 key_timehandler key_timehandler
0 116 3 1 200 ffff94801371b940 icmp6_wqinput/1 icmp6_wqinput
0 115 3 0 200 ffff94801371b500 icmp6_wqinput/0 icmp6_wqinput
0 114 3 0 200 ffff94801371b0c0 nd6_timer nd6_timer
0 113 3 1 200 ffff948013711900 carp6_wqinput/1 carp6_wqinput
0 112 3 0 200 ffff9480137114c0 carp6_wqinput/0 carp6_wqinput
0 111 3 1 200 ffff948013711080 carp_wqinput/1 carp_wqinput
0 110 3 0 200 ffff9480137008c0 carp_wqinput/0 carp_wqinput
0 109 3 1 200 ffff948013700480 icmp_wqinput/1 icmp_wqinput
0 108 3 0 200 ffff948013700040 icmp_wqinput/0 icmp_wqinput
0 107 3 0 200 ffff9480136edbc0 rt_timer rt_timer
0 106 3 1 200 ffff9480136ed780 vmem_rehash vmem_rehash
0 105 3 0 200 ffff9480136ecb80 entbutler entropy
0 96 3 1 200 ffff9480130c0b00 viomb balloon
0 30 3 1 200 ffff9480130c06c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffff9480130c0280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffff948010dbb680 scsibus0 sccomp
0 26 3 0 200 ffff948010dbb240 pms0 pmsreset
0 25 3 1 200 ffff948010d0ea80 xcall/1 xcall
0 24 1 1 200 ffff948010d0e640 softser/1
0 23 1 1 200 ffff948010d0e200 softclk/1
0 22 1 1 200 ffff948010d0ca40 softbio/1
0 21 1 1 200 ffff948010d0c600 softnet/1
0 20 1 1 201 ffff948010d0c1c0 idle/1
0 19 3 0 200 ffff94800f77da00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffff94800f77d5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffff94800f77d180 lnxsyswq lnxsyswq
0 16 3 0 200 ffff94800f7759c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffff94800f775580 sysmon smtaskq
0 14 3 0 200 ffff94800f775140 pmfsuspend pmfsuspend
0 13 3 0 200 ffff94800f771980 pmfevent pmfevent
0 12 3 0 200 ffff94800f771540 sopendfree sopendfr
0 11 3 0 200 ffff94800f771100 iflnkst iflnkst
0 10 3 0 200 ffff94800f766940 nfssilly nfssilly
0 9 3 0 200 ffff94800f766500 vdrain vdrain
0 8 3 0 200 ffff94800f7660c0 modunload mod_unld
0 7 3 0 200 ffff94800f758900 xcall/0 xcall
0 6 1 0 200 ffff94800f7584c0 softser/0
0 5 1 0 200 ffff94800f758080 softclk/0
0 4 1 0 200 ffff94800f7568c0 softbio/0
0 3 1 0 200 ffff94800f756480 softnet/0
0 2 1 0 201 ffff94800f756040 idle/0
0 > 0 7 0 240 ffffffff82eee940 swapper
[Locks tracked through LWPs]

****** LWP 1075.1075 (syz-executor3858) @ 0xffff948013bfb200, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffff9480150b2700 type : sleep/adaptive
initialized : 0xffffffff81a5b250

shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 1

relevant lwp : 0xffff948013bfb200 last held: 0xffff94801516b600
last locked* : 0xffffffff81a8df50 unlocked : 0xffffffff81a8dfb2
owner/count : 0xffff94801516b600 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 1 waiting writers: 0xffff948013bfb200

****** LWP 1255.1255 (syz-executor3858) @ 0xffff94801516b600, l_stat=2

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffff9480150b2700 type : sleep/adaptive
initialized : 0xffffffff81a5b250

shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 1

relevant lwp : 0xffff94801516b600 last held: 0xffff94801516b600
last locked* : 0xffffffff81a8df50 unlocked : 0xffffffff81a8dfb2
owner/count : 0xffff94801516b600 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 1 waiting writers: 0xffff948013bfb200

*** Locks wanted:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffff948015138980 type : sleep/adaptive
initialized : 0xffffffff81a5b250

shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 2

relevant cpu : 1 last held: 1

relevant lwp : 0xffff94801516b600 last held: 0xffff948015146a00
last locked* : 0xffffffff81a8df50 unlocked : 0xffffffff81a8dfb2

owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 1102.1102 (syz-executor3858) @ 0xffff94801516b1c0, l_stat=7

*** Locks held:

* Lock 0 (initialized at vcache_alloc)

lock address : 0xffff948015138700 type : sleep/adaptive
initialized : 0xffffffff81a5b250

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1

relevant lwp : 0xffff94801516b1c0 last held: 0xffff94801516b1c0
last locked* : 0xffffffff81a8df50 unlocked : 0xffffffff81a8dfb2
owner/count : 0xffff94801516b1c0 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 2 waiting writers: 0xffff9480151465c0 0xffff948015146a00

*** Locks wanted: none

****** LWP 1188.1188 (syz-executor3858) @ 0xffff948015146a00, l_stat=3

*** Locks held:

* Lock 0 (initialized at vcache_alloc)

lock address : 0xffff948015138980 type : sleep/adaptive
initialized : 0xffffffff81a5b250

shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 2
relevant cpu : 0 last held: 1
relevant lwp : 0xffff948015146a00 last held: 0xffff948015146a00
last locked* : 0xffffffff81a8df50 unlocked : 0xffffffff81a8dfb2

owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)