panic: pool_do_get: pfstkey: page empty

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1bd4ef1cf579 Add missing include of vlan.h in vmx(4).
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=10490516180000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=83d75c1b2913ee696456

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bf3d7975beab/disk-1bd4ef1c.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/df64fbfde86f/bsd-1bd4ef1c.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bef78ba4ed70/kernel-1bd4ef1c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83d75c...@syzkaller.appspotmail.com

panic: pool_do_get: pfstkey: page empty
Starting stack trace...
panic(ffffffff828aa2f9) at panic+0x16f sys/kern/subr_prf.c:229
pool_do_get(ffffffff82e5a838,a,ffff800034b478f8) at pool_do_get+0x412 sys/kern/subr_pool.c:726
pool_get(ffffffff82e5a838,a) at pool_get+0xed sys/kern/subr_pool.c:582
pf_state_key_setup(ffff800034b47b98,ffff800034b47aa8,ffff800034b47aa0,0) at pf_state_key_setup+0x6f pf_alloc_state_key sys/net/pf.c:878 [inline]
pf_state_key_setup(ffff800034b47b98,ffff800034b47aa8,ffff800034b47aa0,0) at pf_state_key_setup+0x6f sys/net/pf.c:947
pf_test_rule(ffff800034b47b98,ffff800034b47c90,ffff800034b47ca0,ffff800034b47c80,ffff800034b47c60,ffff800034b47cae) at pf_test_rule+0x1564 pf_create_state sys/net/pf.c:4713 [inline]
pf_test_rule(ffff800034b47b98,ffff800034b47c90,ffff800034b47ca0,ffff800034b47c80,ffff800034b47c60,ffff800034b47cae) at pf_test_rule+0x1564 sys/net/pf.c:4522
pf_test(18,1,ffff800000dff000,ffff800034b47e68) at pf_test+0x1bab
ip6_input_if(ffff800034b47e68,ffff800034b47e74,29,0,ffff800000dff000) at ip6_input_if+0x2cc sys/netinet6/ip6_input.c:409
ipv6_input(ffff800000dff000,fffffd8061665500) at ipv6_input+0x4c sys/netinet6/ip6_input.c:262
ether_input(ffff800000dff000,fffffd8061665500) at ether_input+0x58a
tun_dev_write(5d04,ffff800034b481d8,0,2) at tun_dev_write+0x203 sys/net/if_tun.c:914
spec_write(ffff800034b48030) at spec_write+0xd9 sys/kern/spec_vnops.c:302
VOP_WRITE(fffffd8061b58398,ffff800034b481d8,11,fffffd807f7d7548) at VOP_WRITE+0xc3 sys/kern/vfs_vops.c:245
vn_write(fffffd805d631858,ffff800034b481d8,0) at vn_write+0x15b sys/kern/vfs_vnops.c:408
dofilewritev(ffff80002a1cb818,c8,ffff800034b481d8,0,ffff800034b48290) at dofilewritev+0x1a0 sys/kern/sys_generic.c:375
sys_write(ffff80002a1cb818,ffff800034b48340,ffff800034b48290) at sys_write+0x87 sys/kern/sys_generic.c:295
syscall(ffff800034b48340) at syscall+0x5ae mi_syscall sys/sys/syscall_mi.h:183 [inline]
syscall(ffff800034b48340) at syscall+0x5ae sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x94a2268dd50, count: 240
End of stack trace.


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup