KASAN: invalid memory access in rw_status
0 views
Skip to first unread message
syzbot
Jul 14, 2026, 3:48:27 AMJul 14
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 85db861bb080 kasan: debug free-quarantine for M_PINSYSCALL
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=12287346580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=63aa5c5f0765df8a5ed5
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/87595791d0f2/disk-85db861b.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/1331da1397a6/bsd-85db861b.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4039558e70dc/kernel-85db861b.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+63aa5c...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff800045ffccb8 size 8 op 0
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*163282 42201 0 0x2000 0x4080000 1 syz-executor
337116 1434 0 0x2 0 0 syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84632841) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ffccb8) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ffccb8) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
rw_status(ffff800045ffccb8) at rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
rw_status(ffff800045ffccb8) at rw_status+0x27 sys/kern/kern_rwlock.c:517
KQRELE(ffff8000017d1e00) at KQRELE+0x77 sys/kern/kern_event.c:244
kqueue_close(ffff8000016a9320,ffff800045ff6a80) at kqueue_close+0x70 sys/kern/kern_event.c:1956
fdrop(ffff8000016a9320,ffff800045ff6a80) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
fd_iterfile(ffff8000016a9320,ffff800045ff6a80) at fd_iterfile+0x162 sys/kern/kern_descrip.c:222
sysctl_file(ffff8000299b2468,4,200000000040,ffff8000299b2440,ffff800045ff6a80) at sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(49,ffff8000299b2468,4,200000000040,ffff8000299b2440,200000000440,4,1ffff00005336404) at kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
kern_sysctl(ffff8000299b2464,5,200000000040,ffff8000299b2440,200000000440,fe6,ffff8000299b26b0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff6a80,ffff8000299b26b0,ffff8000299b2620) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000299b26b0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299b26b0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x23c92f26b80, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffff800045ffccb8 size 8 op 0
ddb{1}> show kasan
KASAN: invalid read of 8 bytes at 0xffff800045ffccb8 from pc 0xffffffff81c7ea07
KASAN: first bad byte at 0xffff800045ffccb8 (+0); shadow 0xfd: pool use-after-free (or unallocated item)
KASAN: 0xffff800045ffccb8 is 280 bytes inside the 592-byte item [0xffff800045ffcba0..0xffff800045ffcdf0) in pool 'hfscclass'
KASAN: pc: rw_status+0x27
KASAN: call trace:
#0 __asan_load8_noabort+0xbd kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 __asan_load8_noabort+0xbd sys/kern/subr_kasan.c:1099
#1 rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
#1 rw_status+0x27 sys/kern/kern_rwlock.c:517
#2 KQRELE+0x77 sys/kern/kern_event.c:244
#3 kqueue_close+0x70 sys/kern/kern_event.c:1956
#4 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#5 fd_iterfile+0x162 sys/kern/kern_descrip.c:222
#6 sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
#7 kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
#8 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#9 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
KASAN: shadow of 0xffff800045ffcb80..0xffff800045ffce00 (1 cell = 8 bytes):
0xffff800045ffcb80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
0xffff800045ffcc00: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
>0xffff800045ffcc80: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
0xffff800045ffcd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0xffff800045ffcd80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84632841) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ffccb8) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ffccb8) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
rw_status(ffff800045ffccb8) at rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
rw_status(ffff800045ffccb8) at rw_status+0x27 sys/kern/kern_rwlock.c:517
KQRELE(ffff8000017d1e00) at KQRELE+0x77 sys/kern/kern_event.c:244
kqueue_close(ffff8000016a9320,ffff800045ff6a80) at kqueue_close+0x70 sys/kern/kern_event.c:1956
fdrop(ffff8000016a9320,ffff800045ff6a80) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
fd_iterfile(ffff8000016a9320,ffff800045ff6a80) at fd_iterfile+0x162 sys/kern/kern_descrip.c:222
sysctl_file(ffff8000299b2468,4,200000000040,ffff8000299b2440,ffff800045ff6a80) at sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(49,ffff8000299b2468,4,200000000040,ffff8000299b2440,200000000440,4,1ffff00005336404) at kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
kern_sysctl(ffff8000299b2464,5,200000000040,ffff8000299b2440,200000000440,fe6,ffff8000299b26b0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff6a80,ffff8000299b26b0,ffff8000299b2620) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000299b26b0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299b26b0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x23c92f26b80, count: -14
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff8000299b18b0
rbx 0xffff8000299b1920
rdx 0
rcx 0xffff800028ff3ff0
rax 0xffff800000172400
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff8000299b1698
r11 0xffffffff82322ea0 x86_bus_space_io_read_1
r12 0xffffffff84632841 switch.table.vce_v1_0_load_fw+0x99e41
r13 0xffff800028ff4c08
r14 0xffff800028ff4e07
r15 0x1
rip 0xffffffff81734fa7 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff8000299b18b0
ss 0x10
db_enter+0x17: popq %rbp
ddb{1}> show proc
PROC (syz-executor) tid=163282 pid=42201 tcnt=3 stat=onproc
flags process=2000<SINGLEUNWIND> proc=4080000<SUSPSINGLE,THREAD>
runpri=32, usrpri=82, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0xffff8000298a4d00 scnt=1 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045ff6fb0,0xffff8000298a4d10
process=0xffff800045ff3518 user=0xffff8000299a7000, vmspace=0xffff800001c7a3f0
estcpu=32, cpticks=23, pctcpu=0.17, user=0, sys=23, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
38640 343694 25539 0 2 0 syz-executor
36518 305740 75454 0 2 0 syz-executor
83446 352512 16828 0 2 0 syz-executor
10133 260080 14396 0 2 0 syz-executor
42201 340300 12401 0 4 0x82000 syz-executor
*42201 163282 12401 0 7 0x4082000 syz-executor
42201 62108 12401 0 3 0x4002000 suspend syz-executor
9031 275931 66428 0 3 0x91 nanoslp syz-executor
9031 460952 66428 0 3 0x4000091 msgwait syz-executor
9031 222474 66428 0 3 0x4000091 fsleep syz-executor
50137 315340 15416 0 3 0x80 nanoslp syz-executor
50137 422736 15416 0 3 0x4000080 nanoslp syz-executor
50137 375819 15416 0 3 0x4000080 fsleep syz-executor
50137 160047 15416 0 3 0x4000080 fsleep syz-executor
18848 190225 1 0 3 0x100083 ttyin getty
81460 118651 0 0 3 0x14200 acct acct
90441 509424 0 0 3 0x14280 nfsidl nfsio
59691 229168 0 0 3 0x14280 nfsidl nfsio
95509 470043 0 0 3 0x14280 nfsidl nfsio
76951 397742 0 0 3 0x14280 nfsidl nfsio
90567 259770 0 0 3 0x14280 nfsidl nfsio
87041 77995 0 0 3 0x14280 nfsidl nfsio
4371 131081 0 0 3 0x14280 nfsidl nfsio
95691 176355 0 0 3 0x14280 nfsidl nfsio
82162 98585 0 0 3 0x14280 nfsidl nfsio
4631 134547 0 0 3 0x14280 nfsidl nfsio
66207 134779 0 0 3 0x14280 nfsidl nfsio
61279 465538 0 0 3 0x14280 nfsidl nfsio
42898 190822 0 0 3 0x14280 nfsidl nfsio
79742 400743 0 0 3 0x14280 nfsidl nfsio
2223 502123 0 0 3 0x14280 nfsidl nfsio
77206 286510 0 0 3 0x14280 nfsidl nfsio
24427 32520 0 0 3 0x14280 nfsidl nfsio
29928 6712 0 0 3 0x14280 nfsidl nfsio
35024 190296 0 0 3 0x14280 nfsidl nfsio
64471 398133 0 0 3 0x14280 nfsidl nfsio
14396 322995 39218 0 3 0x82 nanoslp syz-executor
66428 265572 39218 0 3 0x82 nanoslp syz-executor
12401 152859 39218 0 3 0x82 nanoslp syz-executor
1434 337116 39218 0 7 0x2 syz-executor
25539 514334 39218 0 2 0x2 syz-executor
15416 212026 39218 0 2 0xc82 syz-executor
16828 132477 39218 0 3 0x82 nanoslp syz-executor
75454 203724 39218 0 3 0x82 nanoslp syz-executor
39218 409076 1 0 2 0x2 syz-executor
47773 84601 0 0 3 0x14200 bored smr
62048 264280 0 0 3 0x14200 pgzero zerothread
68078 111651 0 0 3 0x14200 aiodoned aiodoned
96865 443260 0 0 3 0x14200 syncer update
76826 158344 0 0 3 0x14200 cleaner cleaner
4840 22258 0 0 3 0x14200 reaper reaper
5764 83159 0 0 3 0x14200 pgdaemon pagedaemon
58108 400819 0 0 3 0x14200 bored viomb
13787 41218 0 0 3 0x40014200 acpi0 acpi0
32483 289636 0 0 3 0x40014200 idle1
53930 86919 0 0 3 0x14200 bored softnet1
68029 34577 0 0 2 0x14200 softnet0
76408 256629 0 0 3 0x14200 bored systqmp
65843 44472 0 0 3 0x14200 bored systq
68684 15035 0 0 3 0x14200 tmoslp softclockmp
94232 190614 0 0 3 0x40014200 tmoslp softclock
28233 453749 0 0 3 0x40014200 idle0
1 326902 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
Process 1434 (syz-executor) thread 0xffff800029943ca0 (337116)
exclusive rrwlock inode r = 0 (0xffff800001df80d0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 vn_lock+0xca sys/kern/vfs_vnops.c:576
#5 vget+0x321 sys/kern/vfs_subr.c:694
#6 ufs_ihashget+0x233 sys/ufs/ufs/ufs_ihash.c:98
#7 ffs_vget+0x10b sys/ufs/ffs/ffs_vfsops.c:1203
#8 ufs_lookup+0x1529 sys/ufs/ufs/ufs_lookup.c:478
#9 VOP_LOOKUP+0xda sys/kern/vfs_vops.c:85
#10 vfs_lookup+0xfbd sys/kern/vfs_lookup.c:580
#11
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 85db861bb080 kasan: debug free-quarantine for M_PINSYSCALL
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=12287346580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=63aa5c5f0765df8a5ed5
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/87595791d0f2/disk-85db861b.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/1331da1397a6/bsd-85db861b.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4039558e70dc/kernel-85db861b.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+63aa5c...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff800045ffccb8 size 8 op 0
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*163282 42201 0 0x2000 0x4080000 1 syz-executor
337116 1434 0 0x2 0 0 syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84632841) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ffccb8) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ffccb8) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
rw_status(ffff800045ffccb8) at rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
rw_status(ffff800045ffccb8) at rw_status+0x27 sys/kern/kern_rwlock.c:517
KQRELE(ffff8000017d1e00) at KQRELE+0x77 sys/kern/kern_event.c:244
kqueue_close(ffff8000016a9320,ffff800045ff6a80) at kqueue_close+0x70 sys/kern/kern_event.c:1956
fdrop(ffff8000016a9320,ffff800045ff6a80) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
fd_iterfile(ffff8000016a9320,ffff800045ff6a80) at fd_iterfile+0x162 sys/kern/kern_descrip.c:222
sysctl_file(ffff8000299b2468,4,200000000040,ffff8000299b2440,ffff800045ff6a80) at sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(49,ffff8000299b2468,4,200000000040,ffff8000299b2440,200000000440,4,1ffff00005336404) at kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
kern_sysctl(ffff8000299b2464,5,200000000040,ffff8000299b2440,200000000440,fe6,ffff8000299b26b0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff6a80,ffff8000299b26b0,ffff8000299b2620) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000299b26b0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299b26b0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x23c92f26b80, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffff800045ffccb8 size 8 op 0
ddb{1}> show kasan
KASAN: invalid read of 8 bytes at 0xffff800045ffccb8 from pc 0xffffffff81c7ea07
KASAN: first bad byte at 0xffff800045ffccb8 (+0); shadow 0xfd: pool use-after-free (or unallocated item)
KASAN: 0xffff800045ffccb8 is 280 bytes inside the 592-byte item [0xffff800045ffcba0..0xffff800045ffcdf0) in pool 'hfscclass'
KASAN: pc: rw_status+0x27
KASAN: call trace:
#0 __asan_load8_noabort+0xbd kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 __asan_load8_noabort+0xbd sys/kern/subr_kasan.c:1099
#1 rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
#1 rw_status+0x27 sys/kern/kern_rwlock.c:517
#2 KQRELE+0x77 sys/kern/kern_event.c:244
#3 kqueue_close+0x70 sys/kern/kern_event.c:1956
#4 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#5 fd_iterfile+0x162 sys/kern/kern_descrip.c:222
#6 sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
#7 kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
#8 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#9 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
KASAN: shadow of 0xffff800045ffcb80..0xffff800045ffce00 (1 cell = 8 bytes):
0xffff800045ffcb80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
0xffff800045ffcc00: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
>0xffff800045ffcc80: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
0xffff800045ffcd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0xffff800045ffcd80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84632841) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ffccb8) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ffccb8) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
rw_status(ffff800045ffccb8) at rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
rw_status(ffff800045ffccb8) at rw_status+0x27 sys/kern/kern_rwlock.c:517
KQRELE(ffff8000017d1e00) at KQRELE+0x77 sys/kern/kern_event.c:244
kqueue_close(ffff8000016a9320,ffff800045ff6a80) at kqueue_close+0x70 sys/kern/kern_event.c:1956
fdrop(ffff8000016a9320,ffff800045ff6a80) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
fd_iterfile(ffff8000016a9320,ffff800045ff6a80) at fd_iterfile+0x162 sys/kern/kern_descrip.c:222
sysctl_file(ffff8000299b2468,4,200000000040,ffff8000299b2440,ffff800045ff6a80) at sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(49,ffff8000299b2468,4,200000000040,ffff8000299b2440,200000000440,4,1ffff00005336404) at kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
kern_sysctl(ffff8000299b2464,5,200000000040,ffff8000299b2440,200000000440,fe6,ffff8000299b26b0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff6a80,ffff8000299b26b0,ffff8000299b2620) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000299b26b0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299b26b0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x23c92f26b80, count: -14
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff8000299b18b0
rbx 0xffff8000299b1920
rdx 0
rcx 0xffff800028ff3ff0
rax 0xffff800000172400
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff8000299b1698
r11 0xffffffff82322ea0 x86_bus_space_io_read_1
r12 0xffffffff84632841 switch.table.vce_v1_0_load_fw+0x99e41
r13 0xffff800028ff4c08
r14 0xffff800028ff4e07
r15 0x1
rip 0xffffffff81734fa7 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff8000299b18b0
ss 0x10
db_enter+0x17: popq %rbp
ddb{1}> show proc
PROC (syz-executor) tid=163282 pid=42201 tcnt=3 stat=onproc
flags process=2000<SINGLEUNWIND> proc=4080000<SUSPSINGLE,THREAD>
runpri=32, usrpri=82, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0xffff8000298a4d00 scnt=1 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045ff6fb0,0xffff8000298a4d10
process=0xffff800045ff3518 user=0xffff8000299a7000, vmspace=0xffff800001c7a3f0
estcpu=32, cpticks=23, pctcpu=0.17, user=0, sys=23, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
38640 343694 25539 0 2 0 syz-executor
36518 305740 75454 0 2 0 syz-executor
83446 352512 16828 0 2 0 syz-executor
10133 260080 14396 0 2 0 syz-executor
42201 340300 12401 0 4 0x82000 syz-executor
*42201 163282 12401 0 7 0x4082000 syz-executor
42201 62108 12401 0 3 0x4002000 suspend syz-executor
9031 275931 66428 0 3 0x91 nanoslp syz-executor
9031 460952 66428 0 3 0x4000091 msgwait syz-executor
9031 222474 66428 0 3 0x4000091 fsleep syz-executor
50137 315340 15416 0 3 0x80 nanoslp syz-executor
50137 422736 15416 0 3 0x4000080 nanoslp syz-executor
50137 375819 15416 0 3 0x4000080 fsleep syz-executor
50137 160047 15416 0 3 0x4000080 fsleep syz-executor
18848 190225 1 0 3 0x100083 ttyin getty
81460 118651 0 0 3 0x14200 acct acct
90441 509424 0 0 3 0x14280 nfsidl nfsio
59691 229168 0 0 3 0x14280 nfsidl nfsio
95509 470043 0 0 3 0x14280 nfsidl nfsio
76951 397742 0 0 3 0x14280 nfsidl nfsio
90567 259770 0 0 3 0x14280 nfsidl nfsio
87041 77995 0 0 3 0x14280 nfsidl nfsio
4371 131081 0 0 3 0x14280 nfsidl nfsio
95691 176355 0 0 3 0x14280 nfsidl nfsio
82162 98585 0 0 3 0x14280 nfsidl nfsio
4631 134547 0 0 3 0x14280 nfsidl nfsio
66207 134779 0 0 3 0x14280 nfsidl nfsio
61279 465538 0 0 3 0x14280 nfsidl nfsio
42898 190822 0 0 3 0x14280 nfsidl nfsio
79742 400743 0 0 3 0x14280 nfsidl nfsio
2223 502123 0 0 3 0x14280 nfsidl nfsio
77206 286510 0 0 3 0x14280 nfsidl nfsio
24427 32520 0 0 3 0x14280 nfsidl nfsio
29928 6712 0 0 3 0x14280 nfsidl nfsio
35024 190296 0 0 3 0x14280 nfsidl nfsio
64471 398133 0 0 3 0x14280 nfsidl nfsio
14396 322995 39218 0 3 0x82 nanoslp syz-executor
66428 265572 39218 0 3 0x82 nanoslp syz-executor
12401 152859 39218 0 3 0x82 nanoslp syz-executor
1434 337116 39218 0 7 0x2 syz-executor
25539 514334 39218 0 2 0x2 syz-executor
15416 212026 39218 0 2 0xc82 syz-executor
16828 132477 39218 0 3 0x82 nanoslp syz-executor
75454 203724 39218 0 3 0x82 nanoslp syz-executor
39218 409076 1 0 2 0x2 syz-executor
47773 84601 0 0 3 0x14200 bored smr
62048 264280 0 0 3 0x14200 pgzero zerothread
68078 111651 0 0 3 0x14200 aiodoned aiodoned
96865 443260 0 0 3 0x14200 syncer update
76826 158344 0 0 3 0x14200 cleaner cleaner
4840 22258 0 0 3 0x14200 reaper reaper
5764 83159 0 0 3 0x14200 pgdaemon pagedaemon
58108 400819 0 0 3 0x14200 bored viomb
13787 41218 0 0 3 0x40014200 acpi0 acpi0
32483 289636 0 0 3 0x40014200 idle1
53930 86919 0 0 3 0x14200 bored softnet1
68029 34577 0 0 2 0x14200 softnet0
76408 256629 0 0 3 0x14200 bored systqmp
65843 44472 0 0 3 0x14200 bored systq
68684 15035 0 0 3 0x14200 tmoslp softclockmp
94232 190614 0 0 3 0x40014200 tmoslp softclock
28233 453749 0 0 3 0x40014200 idle0
1 326902 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
Process 1434 (syz-executor) thread 0xffff800029943ca0 (337116)
exclusive rrwlock inode r = 0 (0xffff800001df80d0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 vn_lock+0xca sys/kern/vfs_vnops.c:576
#5 vget+0x321 sys/kern/vfs_subr.c:694
#6 ufs_ihashget+0x233 sys/ufs/ufs/ufs_ihash.c:98
#7 ffs_vget+0x10b sys/ufs/ffs/ffs_vfsops.c:1203
#8 ufs_lookup+0x1529 sys/ufs/ufs/ufs_lookup.c:478
#9 VOP_LOOKUP+0xda sys/kern/vfs_vops.c:85
#10 vfs_lookup+0xfbd sys/kern/vfs_lookup.c:580
#11
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Greg Steuck
Jul 14, 2026, 7:47:46 AMJul 14
to syzbot, syzkaller-o...@googlegroups.com, Visa Hankala
Tha attached Fable analysis still has a pool attribution mistake because the fix has not been deployed.
--
You received this message because you are subscribed to the Google Groups "syzkaller-openbsd-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-openbsd...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/syzkaller-openbsd-bugs/6a55e9ca.c90005c7.37d349.0019.GAE%40google.com.
Reply all
Reply to author
Forward
0 new messages