panic: softclock: invalid to_clock: ADDR

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f2888ae16d7e Skip btcfi tests on amd64 CPUs not supporting..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11d07b8c180000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=973881c4ee3014ab8188

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/088d001ba5af/disk-f2888ae1.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/622f0843b1c1/bsd-f2888ae1.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb0c59a2f842/kernel-f2888ae1.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+973881...@syzkaller.appspotmail.com

panic: softclock: invalid to_clock: 13212056
Starting stack trace...
panic(ffffffff828f030a) at panic+0x159 sys/kern/subr_prf.c:229
softclock(0) at softclock+0x1fd sys/kern/kern_timeout.c:759
softintr_dispatch(0) at softintr_dispatch+0xd1 sys/arch/amd64/amd64/softintr.c:90
Xsoftclock() at Xsoftclock+0x27
x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x2c sys/arch/amd64/amd64/bus_space.c:666
acpitimer_delay(3e8) at acpitimer_delay+0x113 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline]
acpitimer_delay(3e8) at acpitimer_delay+0x113 sys/dev/acpi/acpitimer.c:125
pckbc_poll_cmd1(ffff80000002ff00,0,ffff8000341c6e80) at pckbc_poll_cmd1+0x285 pckbc_poll_data1 sys/dev/ic/pckbc.c:148 [inline]
pckbc_poll_cmd1(ffff80000002ff00,0,ffff8000341c6e80) at pckbc_poll_cmd1+0x285 sys/dev/ic/pckbc.c:620
pckbc_poll_cmd(ffff80000002ff00,0,ffff8000341c6f3f,1,0,0,40cdebea65076437) at pckbc_poll_cmd+0xfa sys/dev/ic/pckbc.c:692
pckbd_enable(ffff800000683700,1) at pckbd_enable+0xc4 sys/dev/pckbc/pckbd.c:502
wskbdopen(4300,9,2000,ffff80002a62fd50) at wskbdopen+0x1fa wskbd_enable sys/dev/wscons/wskbd.c:810 [inline]
wskbdopen(4300,9,2000,ffff80002a62fd50) at wskbdopen+0x1fa wskbd_do_open sys/dev/wscons/wskbd.c:886 [inline]
wskbdopen(4300,9,2000,ffff80002a62fd50) at wskbdopen+0x1fa sys/dev/wscons/wskbd.c:868
spec_open(ffff8000341c7058) at spec_open+0x3e3 sys/kern/spec_vnops.c:150
VOP_OPEN(fffffd80702f2518,9,fffffd807f7d7888,ffff80002a62fd50) at VOP_OPEN+0x70 sys/kern/vfs_vops.c:138
vn_open(ffff8000341c72a8,9,0) at vn_open+0x452 sys/kern/vfs_vnops.c:177
doopenat(ffff80002a62fd50,ffffff9c,200000c0,8,0,ffff8000341c7450) at doopenat+0x26e sys/kern/vfs_syscalls.c:1126
syscall(ffff8000341c7500) at syscall+0x751 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf425d5d0140, count: 241
End of stack trace.


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup