KASAN: invalid memory access in sysvipc_infoout
0 views
Skip to first unread message
syzbot
Jul 18, 2026, 6:43:30 AM (3 days ago) Jul 18
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 1a2082c4ae19 kasan: pool describe: only the owning pool ma..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=12a3bcb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=d03bb4f3fadd1868289a
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ecbbb2ad5427/disk-1a2082c4.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/ec3c43ba9928/bsd-1a2082c4.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/12ca3bcc1c1e/kernel-1a2082c4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d03bb4...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff8000018d1f20 size 20 op 1
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 25208 5468 2 0x10 0x4000000 0 syz-executor
136606 96194 0 0x2 0 1 syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018d1f20,ffff80003bc23790,14) at kasan_memcpy+0x1ec
sysvipc_infoout(200000000080,ffff80003bc23de0,ffff80003bc23790,14,18,68,1ffff000077846e4,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff80003bc23e08,1,200000000080,ffff80003bc23de0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff80003bc23e08,1,200000000080,ffff80003bc23de0,0,1,1ffff00007784738) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff80003bc23e04,2,200000000080,ffff80003bc23de0,0,14,ffff80003bc24060) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff42d0,ffff80003bc24060,ffff80003bc23fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bc24060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bc24060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a01e429a10, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff8000018d1f20 size 20 op 1
ddb{0}> show kasan
KASAN: invalid write of 20 bytes at 0xffff8000018d1f20 from pc 0xffffffff83484679
KASAN: first bad byte at 0xffff8000018d1f21 (+1); shadow 0x01: partial granule (out-of-bounds)
KASAN: 0xffff8000018d1f21 is 1 bytes inside the 16-byte malloc slot [0xffff8000018d1f20..0xffff8000018d1f30)
KASAN: allocated at:
#0 malloc+0xda0 sys/kern/kern_malloc.c:446
#1 sysvipc_infoout+0x18e sys/kern/kern_sysctl.c:2711
#2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
#3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
KASAN: pc: sysvipc_infoout+0x1a9
KASAN: call trace:
#0 kasan_memcpy+0x1ca kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 kasan_memcpy+0x1ca sys/kern/subr_kasan.c:1025
#1 sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
#2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
#3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
KASAN: shadow of 0xffff8000018d1e00..0xffff8000018d2080 (1 cell = 8 bytes):
0xffff8000018d1e00: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 08 fb
0xffff8000018d1e80: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08
>0xffff8000018d1f00: fc 08 fc 08[01]fb 08 08 08 08 08 08 08 08 08 08
0xffff8000018d1f80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
0xffff8000018d2000: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018d1f20,ffff80003bc23790,14) at kasan_memcpy+0x1ec
sysvipc_infoout(200000000080,ffff80003bc23de0,ffff80003bc23790,14,18,68,1ffff000077846e4,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff80003bc23e08,1,200000000080,ffff80003bc23de0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff80003bc23e08,1,200000000080,ffff80003bc23de0,0,1,1ffff00007784738) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff80003bc23e04,2,200000000080,ffff80003bc23de0,0,14,ffff80003bc24060) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff42d0,ffff80003bc24060,ffff80003bc23fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bc24060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bc24060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a01e429a10, count: -10
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff80003bc234d0
rbx 0xffff80003bc23540
rdx 0
rcx 0xffffffff850aeff0 cpu_info_full_primary+0x1ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff80003bc232b8
r11 0xffffffff8263c7e0 x86_bus_space_io_read_1
r12 0xffffffff84634053 .str.5+0x9c553
r13 0xffffffff850afc08 cpu_info_full_primary+0x2c08
r14 0xffffffff850afe07 cpu_info_full_primary+0x2e07
r15 0x1
rip 0xffffffff81fd2ec7 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff80003bc234d0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=25208 pid=5468 tcnt=4 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
runpri=32, usrpri=81, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045ff5a28,0xffff800045ff4aa8
process=0xffff800045ff1d08 user=0xffff80003bc19000, vmspace=0xffff800001c69b90
estcpu=31, cpticks=30, pctcpu=0.11, user=0, sys=25, intr=5
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
5468 197560 20526 2 2 0x10 0xc80 syz-executor
* 5468 25208 20526 2 7 0x10 0x4000000 syz-executor
5468 270744 20526 2 3 0x10 0x4000080 kqsel syz-executor
5468 25626 20526 2 3 0x10 0x4000080 fsleep syz-executor
35372 40558 23246 2 2 0x10 0 syz-executor
35372 378545 23246 2 3 0x10 0x4000080 fsleep syz-executor
57212 163024 67827 0 2 0 0 syz-executor
57212 189157 67827 0 2 0 0x4000000 syz-executor
57212 419915 67827 0 3 0 0x4000080 fsleep syz-executor
88457 34816 96194 0 2 0 0 syz-executor
88457 366013 96194 0 3 0 0x4000080 fsleep syz-executor
20526 48365 82114 0 2 0x2 0xc80 syz-executor
27196 322107 0 0 3 0x14000 0x280 nfsidl nfsio
23761 37018 0 0 3 0x14000 0x280 nfsidl nfsio
14060 8789 0 0 3 0x14000 0x280 nfsidl nfsio
3001 35901 0 0 3 0x14000 0x280 nfsidl nfsio
69506 273627 0 0 3 0x14000 0x280 nfsidl nfsio
42268 297929 0 0 3 0x14000 0x280 nfsidl nfsio
28507 455184 0 0 3 0x14000 0x280 nfsidl nfsio
49598 36869 0 0 3 0x14000 0x280 nfsidl nfsio
30016 259069 0 0 3 0x14000 0x280 nfsidl nfsio
93065 140644 0 0 3 0x14000 0x280 nfsidl nfsio
55664 10121 0 0 3 0x14000 0x280 nfsidl nfsio
19070 97068 0 0 3 0x14000 0x280 nfsidl nfsio
69710 332483 0 0 3 0x14000 0x280 nfsidl nfsio
254 270404 0 0 3 0x14000 0x280 nfsidl nfsio
54828 336706 0 0 3 0x14000 0x280 nfsidl nfsio
78619 505095 0 0 3 0x14000 0x280 nfsidl nfsio
53254 60263 0 0 3 0x14000 0x280 nfsidl nfsio
71203 216700 0 0 3 0x14000 0x280 nfsidl nfsio
85235 491772 0 0 3 0x14000 0x280 nfsidl nfsio
69113 496740 0 0 3 0x14000 0x280 nfsidl nfsio
99385 418761 82114 0 2 0x2 0xc80 syz-executor
35822 92120 82114 0 3 0x2 0x80 piperd syz-executor
62001 292555 82114 0 2 0x10000002 0xc80 syz-executor
23246 328883 82114 0 2 0x2 0xc80 syz-executor
75245 339930 82114 0 2 0x2 0xc80 syz-executor
67827 259423 82114 0 2 0x2 0xc80 syz-executor
96194 136606 82114 0 7 0x2 0 syz-executor
82114 437851 98324 0 2 0x2 0x80 syz-executor
98324 343870 69827 0 3 0x100002 0x88 sigsusp ksh
69827 364615 42497 0 3 0x10 0x88 kqread sshd-session
42497 252629 51384 0 3 0x12 0x80 kqread sshd-session
36082 257528 1 0 3 0x100003 0x80 ttyin getty
51384 369783 1 0 3 0 0x88 kqread sshd
66303 339029 51612 74 3 0x1100012 0x80 bpf pflogd
51612 243131 1 0 3 0 0x80 sbwait pflogd
73173 246542 9688 73 2 0x1100010 0 syslogd
9688 397025 1 0 3 0x100002 0x80 sbwait syslogd
69887 216908 1 0 3 0x100000 0x80 kqread resolvd
29191 503481 45344 77 3 0x100012 0x80 kqread dhcpleased
15462 425658 45344 77 3 0x100012 0x80 kqread dhcpleased
45344 211659 1 0 3 0 0x80 kqread dhcpleased
90187 334857 0 0 2 0x14000 0x40000200 smr
86140 29163 0 0 2 0x14000 0x200 zerothread
96966 87460 0 0 3 0x14000 0x200 aiodoned aiodoned
91757 521926 0 0 3 0x14000 0x200 syncer update
66883 116259 0 0 3 0x14000 0x200 cleaner cleaner
99554 449550 0 0 3 0x14000 0x200 reaper reaper
27418 416510 0 0 3 0x14000 0x200 pgdaemon pagedaemon
61748 290422 0 0 3 0x14000 0x200 bored viomb
36630 401692 0 0 3 0x14000 0x40000200 acpi0 acpi0
91758 224633 0 0 3 0x14000 0x40000200 idle1
68040 245201 0 0 3 0x14000 0x200 bored softnet1
76998 30005 0 0 3 0x14000 0x200 bored softnet0
66240 347297 0 0 3 0x14000 0x200 bored systqmp
33840 400864 0 0 3 0x14000 0x200 bored systq
61437 440351 0 0 3 0x14000 0x200 tmoslp softclockmp
45038 450070 0 0 3 0x14000 0x40000200 tmoslp softclock
872 24074 0 0 3 0x14000 0x40000200 idle0
1 199283 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 73173 (syslogd) thread 0xffff8000299134d0 (246542)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85df2400)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1
#2 sleep_finish+0x423 sys/kern/kern_synch.c:369
#3 biowait+0xe6 sys/kern/vfs_bio.c:1110
#4 bwrite+0x4e1 sys/kern/vfs_bio.c:625
#5 ffs_update+0x619 sys/ufs/ffs/ffs_inode.c:111
#6 VOP_FSYNC+0x1bb sys/kern/vfs_vops.c:311
#7 sys_fsync+0x232 sys/kern/vfs_syscalls.c:2890
#8 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#9 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffff8000018a85a0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 vn_lock+0xca sys/kern/vfs_vnops.c:576
#5 sys_fsync+0x200 sys/kern/vfs_syscalls.c:2890
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11063 12317K 12636K 166960K 12391 0
pcb 17 26K 27K 166960K 52 0
rtable 240 13K 13K 166960K 386 0
pf 34 22K 38K 166960K 96 0
ifaddr 43 12K 13K 166960K 54 0
ifgroup 55 2K 2K 166960K 72 0
sysctl 3 1K 13K 166960K 7 0
counters 70 42K 43K 166960K 78 0
ioctlops 0 0K 4K 166960K 1593 0
iov 0 0K 12K 166960K 5 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1331 86K 86K 166960K 1601 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 14K 166960K 19 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 45 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 16 57K 93K 166960K 337 0
sigio 0 0K 0K 166960K 2 0
proc 74 128K 177K 166960K 604 0
subproc 72 9K 9K 166960K 82 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 3 0
in_multi 99 7K 7K 166960K 110 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 14 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 67 465K 465K 166960K 67 0
exec 0 0K 2K 166960K 402 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 238 221K 240K 166960K 4712 0
UVM aobj 21 4K 4K 166960K 22 0
pinsyscall 1065 1799K 1801K 166960K 1522 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 1 0
NDP 12 0K 2K 166960K 34 0
temp 38 9162K 9482K 166960K 4606 0
kqueue 13 40K 56K 166960K 52 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 35 0 32 1 0 1 1 0 8 0
rtentry 176 123 0 12 6 0 6 6 0 8 0
unpcb 144 334 0 307 4 3 1 4 0 8 0
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 34 0 29 1 0 1 1 0 8 0
arp 136 20 0 2 1 0 1 1 0 8 0
ipq 40 1 0 0 1 0 1 1 0 8 0
ipqe 40 1 0 0 1 0 1 1 0 8 0
inpcb 328 213 0 204 4 2 2 4 0 8 0
nd6 152 28 0 3 1 0 1 1 0 8 0
kcovpl 48 9 0 1 1 0 1 1 0 8 0
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 3 0 2 1 0 1 1 0 8 0
pfosfp 40 1429 0 1428 5 4 1 5 0 8 0
pfosfpen 112 1429 0 1428 21 20 1 21 0 8 0
pfrktable 1344 1 0 1 1 1 0 1 0 8 0
pfstitem 24 26 0 1 1 0 1 1 0 8 0
pfstkey 128 26 0 1 1 0 1 1 0 8 0
pfstate 448 26 0 1 3 0 3 3 0 8 0
pfrule 1360 23 0 18 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 499 0 44 29 0 29 29 0 8 0
art_table 40 500 0 44 5 0 5 5 0 8 0
art_node 32 123 0 22 1 0 1 1 0 8 0
sysvmsgpl 40 1 0 1 1 1 0 1 0 8 0
semapl 72 42 0 32 1 0 1 1 0 8 0
shmpl 112 19 0 1 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1941 0 470 93 0 93 93 0 8 0
ffsino 296 1941 0 470 114 0 114 114 0 8 0
nchpl 144 2408 0 708 64 0 64 64 0 8 0
vnodes 216 2165 0 0 121 0 121 121 0 8 0
namei 1024 7825 0 7825 2 1 1 1 0 8 1
percpumem 16 55 0 4 1 0 1 1 0 8 0
kstatmem 264 35 0 8 2 0 2 2 0 8 0
scxspl 216 8135 0 8135 4 3 1 3 1 8 1
plimitpl 152 47 0 29 1 0 1 1 0 8 0
sigapl 424 673 0 606 8 0 8 8 0 8 0
knotepl 120 121 0 0 4 0 4 4 0 8 0
kqueuepl 224 80 0 69 1 0 1 1 0 8 0
pipepl 344 203 0 176 6 3 3 6 0 8 0
fdescpl 528 637 0 607 3 0 3 3 0 8 0
filepl 160 3351 0 3118 20 9 11 20 0 8 0
lockfpl 104 69 0 66 1 0 1 1 0 8 0
lockfspl 48 35 0 32 1 0 1 1 0 8 0
sessionpl 144 31 0 21 1 0 1 1 0 8 0
pgrppl 48 45 0 27 1 0 1 1 0 8 0
ucredpl 104 524 0 505 1 0 1 1 0 8 0
zombiepl 144 609 0 606 1 0 1 1 0 8 0
processpl 1232 673 0 606 6 0 6 6 0 8 0
procpl 664 1014 0 940 8 0 8 8 0 8 0
sosppl 176 1 0 1 1 1 0 1 0 8 0
sockpl 752 587 0 547 11 6 5 11 0 8 0
mcl64k 65536 6 0 0 1 0 1 1 0 8 0
mcl16k 16384 4 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 4 0 0 1 0 1 1 0 8 0
mcl4k 4096 123 0 0 16 0 16 16 0 8 0
mcl2k 2048 19 0 0 3 0 3 3 0 8 0
mextrefs 64 19 0 0 1 0 1 1 0 8 0
mtagpl 96 4 0 0 1 0 1 1 0 8 0
mbufpl 256 161 0 0 11 0 11 11 0 8 0
bufpl 272 2615 0 106 168 0 168 168 0 8 0
anonpl 32 4459 0 0 36 0 36 36 0 222 0
amapchunkpl 152 13937 0 13439 25 3 22 24 0 158 0
amappl16 200 1947 0 1915 5 3 2 5 0 8 0
amappl15 192 5 0 5 2 2 0 1 0 8 0
amappl14 184 443 0 442 1 0 1 1 0 8 0
amappl13 176 131 0 119 1 0 1 1 0 8 0
amappl12 168 889 0 860 2 0 2 2 0 8 0
amappl11 160 13 0 13 2 2 0 1 0 8 0
amappl10 152 66 0 50 1 0 1 1 0 8 0
amappl9 144 302 0 302 1 1 0 1 0 8 0
amappl8 136 99 0 97 1 0 1 1 0 8 0
amappl7 128 146 0 132 1 0 1 1 0 8 0
amappl6 120 181 0 179 1 0 1 1 0 8 0
amappl5 112 102 0 92 1 0 1 1 0 8 0
amappl4 104 318 0 298 1 0 1 1 0 8 0
amappl3 96 2709 0 2591 4 0 4 4 0 8 0
amappl2 88 554 0 491 2 0 2 2 0 8 0
amappl1 80 11383 0 10784 15 2 13 15 0 8 0
amappl 88 3943 0 3775 5 0 5 5 0 92 0
uvmvnodes 80 101 0 0 3 0 3 3 0 8 0
dma4096 4096 2 0 2 2 2 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 21 0 1 1 0 1 1 0 8 0
uaddrrnd 24 637 0 607 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 637 0 607 1 0 1 1 0 8 0
vmmpekpl 168 7400 0 7363 3 0 3 3 0 8 0
vmmpepl 168 49128 0 47229 90 2 88 88 0 357 0
vmsppl 488 636 0 607 5 0 5 5 0 8 0
rwobjpl 80 16721 0 15648 24 0 24 24 0 8 0
pdppl 4096 1283 0 1214 103 30 73 87 0 8 4
pvpl 32 11880 0 0 98 2 96 96 0 265 0
pmappl 256 636 0 607 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 120 447 0 37 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018d1f20,ffff80003bc23790,14) at kasan_memcpy+0x1ec
sysvipc_infoout(200000000080,ffff80003bc23de0,ffff80003bc23790,14,18,68,1ffff000077846e4,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff80003bc23e08,1,200000000080,ffff80003bc23de0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff80003bc23e08,1,200000000080,ffff80003bc23de0,0,1,1ffff00007784738) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff80003bc23e04,2,200000000080,ffff80003bc23de0,0,14,ffff80003bc24060) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff42d0,ffff80003bc24060,ffff80003bc23fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bc24060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bc24060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a01e429a10, count: -10
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85df1c00) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85df1c00) at __mp_lock+0x272 sys/kern/kern_lock.c:173
syscall(ffff8000299f0970) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff8000299f0970) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x712d11881a80, count: 9
ddb{1}> trace
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85df1c00) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85df1c00) at __mp_lock+0x272 sys/kern/kern_lock.c:173
syscall(ffff8000299f0970) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff8000299f0970) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x712d11881a80, count: -6
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 1a2082c4ae19 kasan: pool describe: only the owning pool ma..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=12a3bcb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=d03bb4f3fadd1868289a
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ecbbb2ad5427/disk-1a2082c4.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/ec3c43ba9928/bsd-1a2082c4.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/12ca3bcc1c1e/kernel-1a2082c4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d03bb4...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff8000018d1f20 size 20 op 1
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 25208 5468 2 0x10 0x4000000 0 syz-executor
136606 96194 0 0x2 0 1 syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018d1f20,ffff80003bc23790,14) at kasan_memcpy+0x1ec
sysvipc_infoout(200000000080,ffff80003bc23de0,ffff80003bc23790,14,18,68,1ffff000077846e4,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff80003bc23e08,1,200000000080,ffff80003bc23de0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff80003bc23e08,1,200000000080,ffff80003bc23de0,0,1,1ffff00007784738) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff80003bc23e04,2,200000000080,ffff80003bc23de0,0,14,ffff80003bc24060) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff42d0,ffff80003bc24060,ffff80003bc23fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bc24060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bc24060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a01e429a10, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff8000018d1f20 size 20 op 1
ddb{0}> show kasan
KASAN: invalid write of 20 bytes at 0xffff8000018d1f20 from pc 0xffffffff83484679
KASAN: first bad byte at 0xffff8000018d1f21 (+1); shadow 0x01: partial granule (out-of-bounds)
KASAN: 0xffff8000018d1f21 is 1 bytes inside the 16-byte malloc slot [0xffff8000018d1f20..0xffff8000018d1f30)
KASAN: allocated at:
#0 malloc+0xda0 sys/kern/kern_malloc.c:446
#1 sysvipc_infoout+0x18e sys/kern/kern_sysctl.c:2711
#2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
#3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
KASAN: pc: sysvipc_infoout+0x1a9
KASAN: call trace:
#0 kasan_memcpy+0x1ca kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 kasan_memcpy+0x1ca sys/kern/subr_kasan.c:1025
#1 sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
#2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
#3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
KASAN: shadow of 0xffff8000018d1e00..0xffff8000018d2080 (1 cell = 8 bytes):
0xffff8000018d1e00: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 08 fb
0xffff8000018d1e80: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08
>0xffff8000018d1f00: fc 08 fc 08[01]fb 08 08 08 08 08 08 08 08 08 08
0xffff8000018d1f80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
0xffff8000018d2000: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018d1f20,ffff80003bc23790,14) at kasan_memcpy+0x1ec
sysvipc_infoout(200000000080,ffff80003bc23de0,ffff80003bc23790,14,18,68,1ffff000077846e4,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff80003bc23e08,1,200000000080,ffff80003bc23de0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff80003bc23e08,1,200000000080,ffff80003bc23de0,0,1,1ffff00007784738) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff80003bc23e04,2,200000000080,ffff80003bc23de0,0,14,ffff80003bc24060) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff42d0,ffff80003bc24060,ffff80003bc23fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bc24060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bc24060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a01e429a10, count: -10
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff80003bc234d0
rbx 0xffff80003bc23540
rdx 0
rcx 0xffffffff850aeff0 cpu_info_full_primary+0x1ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff80003bc232b8
r11 0xffffffff8263c7e0 x86_bus_space_io_read_1
r12 0xffffffff84634053 .str.5+0x9c553
r13 0xffffffff850afc08 cpu_info_full_primary+0x2c08
r14 0xffffffff850afe07 cpu_info_full_primary+0x2e07
r15 0x1
rip 0xffffffff81fd2ec7 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff80003bc234d0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=25208 pid=5468 tcnt=4 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
runpri=32, usrpri=81, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045ff5a28,0xffff800045ff4aa8
process=0xffff800045ff1d08 user=0xffff80003bc19000, vmspace=0xffff800001c69b90
estcpu=31, cpticks=30, pctcpu=0.11, user=0, sys=25, intr=5
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
5468 197560 20526 2 2 0x10 0xc80 syz-executor
* 5468 25208 20526 2 7 0x10 0x4000000 syz-executor
5468 270744 20526 2 3 0x10 0x4000080 kqsel syz-executor
5468 25626 20526 2 3 0x10 0x4000080 fsleep syz-executor
35372 40558 23246 2 2 0x10 0 syz-executor
35372 378545 23246 2 3 0x10 0x4000080 fsleep syz-executor
57212 163024 67827 0 2 0 0 syz-executor
57212 189157 67827 0 2 0 0x4000000 syz-executor
57212 419915 67827 0 3 0 0x4000080 fsleep syz-executor
88457 34816 96194 0 2 0 0 syz-executor
88457 366013 96194 0 3 0 0x4000080 fsleep syz-executor
20526 48365 82114 0 2 0x2 0xc80 syz-executor
27196 322107 0 0 3 0x14000 0x280 nfsidl nfsio
23761 37018 0 0 3 0x14000 0x280 nfsidl nfsio
14060 8789 0 0 3 0x14000 0x280 nfsidl nfsio
3001 35901 0 0 3 0x14000 0x280 nfsidl nfsio
69506 273627 0 0 3 0x14000 0x280 nfsidl nfsio
42268 297929 0 0 3 0x14000 0x280 nfsidl nfsio
28507 455184 0 0 3 0x14000 0x280 nfsidl nfsio
49598 36869 0 0 3 0x14000 0x280 nfsidl nfsio
30016 259069 0 0 3 0x14000 0x280 nfsidl nfsio
93065 140644 0 0 3 0x14000 0x280 nfsidl nfsio
55664 10121 0 0 3 0x14000 0x280 nfsidl nfsio
19070 97068 0 0 3 0x14000 0x280 nfsidl nfsio
69710 332483 0 0 3 0x14000 0x280 nfsidl nfsio
254 270404 0 0 3 0x14000 0x280 nfsidl nfsio
54828 336706 0 0 3 0x14000 0x280 nfsidl nfsio
78619 505095 0 0 3 0x14000 0x280 nfsidl nfsio
53254 60263 0 0 3 0x14000 0x280 nfsidl nfsio
71203 216700 0 0 3 0x14000 0x280 nfsidl nfsio
85235 491772 0 0 3 0x14000 0x280 nfsidl nfsio
69113 496740 0 0 3 0x14000 0x280 nfsidl nfsio
99385 418761 82114 0 2 0x2 0xc80 syz-executor
35822 92120 82114 0 3 0x2 0x80 piperd syz-executor
62001 292555 82114 0 2 0x10000002 0xc80 syz-executor
23246 328883 82114 0 2 0x2 0xc80 syz-executor
75245 339930 82114 0 2 0x2 0xc80 syz-executor
67827 259423 82114 0 2 0x2 0xc80 syz-executor
96194 136606 82114 0 7 0x2 0 syz-executor
82114 437851 98324 0 2 0x2 0x80 syz-executor
98324 343870 69827 0 3 0x100002 0x88 sigsusp ksh
69827 364615 42497 0 3 0x10 0x88 kqread sshd-session
42497 252629 51384 0 3 0x12 0x80 kqread sshd-session
36082 257528 1 0 3 0x100003 0x80 ttyin getty
51384 369783 1 0 3 0 0x88 kqread sshd
66303 339029 51612 74 3 0x1100012 0x80 bpf pflogd
51612 243131 1 0 3 0 0x80 sbwait pflogd
73173 246542 9688 73 2 0x1100010 0 syslogd
9688 397025 1 0 3 0x100002 0x80 sbwait syslogd
69887 216908 1 0 3 0x100000 0x80 kqread resolvd
29191 503481 45344 77 3 0x100012 0x80 kqread dhcpleased
15462 425658 45344 77 3 0x100012 0x80 kqread dhcpleased
45344 211659 1 0 3 0 0x80 kqread dhcpleased
90187 334857 0 0 2 0x14000 0x40000200 smr
86140 29163 0 0 2 0x14000 0x200 zerothread
96966 87460 0 0 3 0x14000 0x200 aiodoned aiodoned
91757 521926 0 0 3 0x14000 0x200 syncer update
66883 116259 0 0 3 0x14000 0x200 cleaner cleaner
99554 449550 0 0 3 0x14000 0x200 reaper reaper
27418 416510 0 0 3 0x14000 0x200 pgdaemon pagedaemon
61748 290422 0 0 3 0x14000 0x200 bored viomb
36630 401692 0 0 3 0x14000 0x40000200 acpi0 acpi0
91758 224633 0 0 3 0x14000 0x40000200 idle1
68040 245201 0 0 3 0x14000 0x200 bored softnet1
76998 30005 0 0 3 0x14000 0x200 bored softnet0
66240 347297 0 0 3 0x14000 0x200 bored systqmp
33840 400864 0 0 3 0x14000 0x200 bored systq
61437 440351 0 0 3 0x14000 0x200 tmoslp softclockmp
45038 450070 0 0 3 0x14000 0x40000200 tmoslp softclock
872 24074 0 0 3 0x14000 0x40000200 idle0
1 199283 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 73173 (syslogd) thread 0xffff8000299134d0 (246542)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85df2400)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1
#2 sleep_finish+0x423 sys/kern/kern_synch.c:369
#3 biowait+0xe6 sys/kern/vfs_bio.c:1110
#4 bwrite+0x4e1 sys/kern/vfs_bio.c:625
#5 ffs_update+0x619 sys/ufs/ffs/ffs_inode.c:111
#6 VOP_FSYNC+0x1bb sys/kern/vfs_vops.c:311
#7 sys_fsync+0x232 sys/kern/vfs_syscalls.c:2890
#8 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#9 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffff8000018a85a0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 vn_lock+0xca sys/kern/vfs_vnops.c:576
#5 sys_fsync+0x200 sys/kern/vfs_syscalls.c:2890
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11063 12317K 12636K 166960K 12391 0
pcb 17 26K 27K 166960K 52 0
rtable 240 13K 13K 166960K 386 0
pf 34 22K 38K 166960K 96 0
ifaddr 43 12K 13K 166960K 54 0
ifgroup 55 2K 2K 166960K 72 0
sysctl 3 1K 13K 166960K 7 0
counters 70 42K 43K 166960K 78 0
ioctlops 0 0K 4K 166960K 1593 0
iov 0 0K 12K 166960K 5 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1331 86K 86K 166960K 1601 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 14K 166960K 19 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 45 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 16 57K 93K 166960K 337 0
sigio 0 0K 0K 166960K 2 0
proc 74 128K 177K 166960K 604 0
subproc 72 9K 9K 166960K 82 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 3 0
in_multi 99 7K 7K 166960K 110 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 14 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 67 465K 465K 166960K 67 0
exec 0 0K 2K 166960K 402 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 238 221K 240K 166960K 4712 0
UVM aobj 21 4K 4K 166960K 22 0
pinsyscall 1065 1799K 1801K 166960K 1522 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 1 0
NDP 12 0K 2K 166960K 34 0
temp 38 9162K 9482K 166960K 4606 0
kqueue 13 40K 56K 166960K 52 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 35 0 32 1 0 1 1 0 8 0
rtentry 176 123 0 12 6 0 6 6 0 8 0
unpcb 144 334 0 307 4 3 1 4 0 8 0
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 34 0 29 1 0 1 1 0 8 0
arp 136 20 0 2 1 0 1 1 0 8 0
ipq 40 1 0 0 1 0 1 1 0 8 0
ipqe 40 1 0 0 1 0 1 1 0 8 0
inpcb 328 213 0 204 4 2 2 4 0 8 0
nd6 152 28 0 3 1 0 1 1 0 8 0
kcovpl 48 9 0 1 1 0 1 1 0 8 0
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 3 0 2 1 0 1 1 0 8 0
pfosfp 40 1429 0 1428 5 4 1 5 0 8 0
pfosfpen 112 1429 0 1428 21 20 1 21 0 8 0
pfrktable 1344 1 0 1 1 1 0 1 0 8 0
pfstitem 24 26 0 1 1 0 1 1 0 8 0
pfstkey 128 26 0 1 1 0 1 1 0 8 0
pfstate 448 26 0 1 3 0 3 3 0 8 0
pfrule 1360 23 0 18 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 499 0 44 29 0 29 29 0 8 0
art_table 40 500 0 44 5 0 5 5 0 8 0
art_node 32 123 0 22 1 0 1 1 0 8 0
sysvmsgpl 40 1 0 1 1 1 0 1 0 8 0
semapl 72 42 0 32 1 0 1 1 0 8 0
shmpl 112 19 0 1 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1941 0 470 93 0 93 93 0 8 0
ffsino 296 1941 0 470 114 0 114 114 0 8 0
nchpl 144 2408 0 708 64 0 64 64 0 8 0
vnodes 216 2165 0 0 121 0 121 121 0 8 0
namei 1024 7825 0 7825 2 1 1 1 0 8 1
percpumem 16 55 0 4 1 0 1 1 0 8 0
kstatmem 264 35 0 8 2 0 2 2 0 8 0
scxspl 216 8135 0 8135 4 3 1 3 1 8 1
plimitpl 152 47 0 29 1 0 1 1 0 8 0
sigapl 424 673 0 606 8 0 8 8 0 8 0
knotepl 120 121 0 0 4 0 4 4 0 8 0
kqueuepl 224 80 0 69 1 0 1 1 0 8 0
pipepl 344 203 0 176 6 3 3 6 0 8 0
fdescpl 528 637 0 607 3 0 3 3 0 8 0
filepl 160 3351 0 3118 20 9 11 20 0 8 0
lockfpl 104 69 0 66 1 0 1 1 0 8 0
lockfspl 48 35 0 32 1 0 1 1 0 8 0
sessionpl 144 31 0 21 1 0 1 1 0 8 0
pgrppl 48 45 0 27 1 0 1 1 0 8 0
ucredpl 104 524 0 505 1 0 1 1 0 8 0
zombiepl 144 609 0 606 1 0 1 1 0 8 0
processpl 1232 673 0 606 6 0 6 6 0 8 0
procpl 664 1014 0 940 8 0 8 8 0 8 0
sosppl 176 1 0 1 1 1 0 1 0 8 0
sockpl 752 587 0 547 11 6 5 11 0 8 0
mcl64k 65536 6 0 0 1 0 1 1 0 8 0
mcl16k 16384 4 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 4 0 0 1 0 1 1 0 8 0
mcl4k 4096 123 0 0 16 0 16 16 0 8 0
mcl2k 2048 19 0 0 3 0 3 3 0 8 0
mextrefs 64 19 0 0 1 0 1 1 0 8 0
mtagpl 96 4 0 0 1 0 1 1 0 8 0
mbufpl 256 161 0 0 11 0 11 11 0 8 0
bufpl 272 2615 0 106 168 0 168 168 0 8 0
anonpl 32 4459 0 0 36 0 36 36 0 222 0
amapchunkpl 152 13937 0 13439 25 3 22 24 0 158 0
amappl16 200 1947 0 1915 5 3 2 5 0 8 0
amappl15 192 5 0 5 2 2 0 1 0 8 0
amappl14 184 443 0 442 1 0 1 1 0 8 0
amappl13 176 131 0 119 1 0 1 1 0 8 0
amappl12 168 889 0 860 2 0 2 2 0 8 0
amappl11 160 13 0 13 2 2 0 1 0 8 0
amappl10 152 66 0 50 1 0 1 1 0 8 0
amappl9 144 302 0 302 1 1 0 1 0 8 0
amappl8 136 99 0 97 1 0 1 1 0 8 0
amappl7 128 146 0 132 1 0 1 1 0 8 0
amappl6 120 181 0 179 1 0 1 1 0 8 0
amappl5 112 102 0 92 1 0 1 1 0 8 0
amappl4 104 318 0 298 1 0 1 1 0 8 0
amappl3 96 2709 0 2591 4 0 4 4 0 8 0
amappl2 88 554 0 491 2 0 2 2 0 8 0
amappl1 80 11383 0 10784 15 2 13 15 0 8 0
amappl 88 3943 0 3775 5 0 5 5 0 92 0
uvmvnodes 80 101 0 0 3 0 3 3 0 8 0
dma4096 4096 2 0 2 2 2 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 21 0 1 1 0 1 1 0 8 0
uaddrrnd 24 637 0 607 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 637 0 607 1 0 1 1 0 8 0
vmmpekpl 168 7400 0 7363 3 0 3 3 0 8 0
vmmpepl 168 49128 0 47229 90 2 88 88 0 357 0
vmsppl 488 636 0 607 5 0 5 5 0 8 0
rwobjpl 80 16721 0 15648 24 0 24 24 0 8 0
pdppl 4096 1283 0 1214 103 30 73 87 0 8 4
pvpl 32 11880 0 0 98 2 96 96 0 265 0
pmappl 256 636 0 607 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 120 447 0 37 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018d1f20,ffff80003bc23790,14) at kasan_memcpy+0x1ec
sysvipc_infoout(200000000080,ffff80003bc23de0,ffff80003bc23790,14,18,68,1ffff000077846e4,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff80003bc23e08,1,200000000080,ffff80003bc23de0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff80003bc23e08,1,200000000080,ffff80003bc23de0,0,1,1ffff00007784738) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff80003bc23e04,2,200000000080,ffff80003bc23de0,0,14,ffff80003bc24060) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ff42d0,ffff80003bc24060,ffff80003bc23fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bc24060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bc24060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x1a01e429a10, count: -10
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85df1c00) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85df1c00) at __mp_lock+0x272 sys/kern/kern_lock.c:173
syscall(ffff8000299f0970) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff8000299f0970) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x712d11881a80, count: 9
ddb{1}> trace
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85df1c00) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85df1c00) at __mp_lock+0x272 sys/kern/kern_lock.c:173
syscall(ffff8000299f0970) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff8000299f0970) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x712d11881a80, count: -6
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 18, 2026, 9:49:28 AM (3 days ago) Jul 18
to syzkaller-o...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 1a2082c4ae19 kasan: pool describe: only the owning pool ma..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=130e8746580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14bd42b9580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ecbbb2ad5427/disk-1a2082c4.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/ec3c43ba9928/bsd-1a2082c4.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/12ca3bcc1c1e/kernel-1a2082c4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d03bb4...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff8000018cabf0 size 36 op 1
245762 24114 73 0x1100010 0 0K syslogd
sysvipc_infoout(200000000180,ffff800029a57ec0,ffff800029a57820,24,28,70,1ffff0000534af00,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff800029a57ee8,1,200000000180,ffff800029a57ec0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff800029a57ee8,1,200000000180,ffff800029a57ec0,0,1,1ffff0000534af54) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff800029a57ee4,2,200000000180,ffff800029a57ec0,0,fffa,ffff800029a58140) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff8000299e2a80,ffff800029a58140,ffff800029a580a0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800029a58140) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a58140) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffff8000018cabf0 size 36 op 1
ddb{1}> show kasan
KASAN: invalid write of 36 bytes at 0xffff8000018cabf0 from pc 0xffffffff83484679
KASAN: first bad byte at 0xffff8000018cabf3 (+3); shadow 0x03: partial granule (out-of-bounds)
KASAN: 0xffff8000018cabf3 is 3 bytes inside the 16-byte malloc slot [0xffff8000018cabf0..0xffff8000018cac00)
0xffff8000018caa80: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08
0xffff8000018cab00: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08
>0xffff8000018cab80: fc 08 08 fb fc 08 fc 08 fc 08 fc 08 fc 08[03]fb
0xffff8000018cac00: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
0xffff8000018cac80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
sysvipc_infoout(200000000180,ffff800029a57ec0,ffff800029a57820,24,28,70,1ffff0000534af00,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff800029a57ee8,1,200000000180,ffff800029a57ec0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff800029a57ee8,1,200000000180,ffff800029a57ec0,0,1,1ffff0000534af54) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff800029a57ee4,2,200000000180,ffff800029a57ec0,0,fffa,ffff800029a58140) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff8000299e2a80,ffff800029a58140,ffff800029a580a0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800029a58140) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a58140) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800029a575b0
rbx 0xffff800029a57620
rdx 0
rcx 0xffff800028fe3ff0
r14 0xffff800028fe4e07
PROC (syz-executor) tid=215788 pid=11982 tcnt=3 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=71, slppri=32, nice=20
process=0xffff8000298a4008 user=0xffff800029a4d000, vmspace=0xffff800000d8a000
estcpu=21, cpticks=18, pctcpu=0.11, user=0, sys=18, intr=0
ddb{1}> ps
*11982 215788 22176 0 7 0 0x4000000 syz-executor
11982 27590 22176 0 3 0 0x4000080 fsleep syz-executor
22176 495284 79898 0 3 0x2 0x80 nanoslp syz-executor
79898 80864 75763 0 3 0x2 0x80 kqread syz-executor
75763 291731 74309 0 3 0x2 0x80 thrsleep syz-execprog
75763 37308 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 38970 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 439110 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 49773 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 521803 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 482010 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 294211 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 183332 74309 0 3 0x2 0x4000080 kqread syz-execprog
75763 259081 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 200416 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 35790 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
74309 293074 50089 0 3 0x100002 0x88 sigsusp ksh
50089 241415 84713 0 3 0x10 0x88 kqread sshd-session
84713 181269 52666 0 3 0x12 0x80 kqread sshd-session
90724 266036 1 0 3 0x100003 0x80 ttyin getty
52666 115549 1 0 3 0 0x88 kqread sshd
43510 255344 50195 74 3 0x1100012 0x80 bpf pflogd
50195 266469 1 0 3 0 0x80 sbwait pflogd
24114 245762 17450 73 7 0x1100010 0 syslogd
17450 49993 1 0 3 0x100002 0x80 sbwait syslogd
28571 234852 1 0 3 0x100000 0x80 kqread resolvd
82809 246450 39805 77 3 0x100012 0x80 kqread dhcpleased
24223 131363 39805 77 3 0x100012 0x80 kqread dhcpleased
39805 211543 1 0 3 0 0x80 kqread dhcpleased
19243 5163 0 0 2 0x14000 0x40000200 smr
75974 174292 0 0 3 0x14000 0x200 pgzero zerothread
93057 50408 0 0 3 0x14000 0x200 aiodoned aiodoned
5120 128653 0 0 3 0x14000 0x200 syncer update
25073 289280 0 0 3 0x14000 0x200 cleaner cleaner
57420 263917 0 0 3 0x14000 0x200 reaper reaper
21606 480813 0 0 3 0x14000 0x200 pgdaemon pagedaemon
11150 349048 0 0 3 0x14000 0x200 bored viomb
23036 337904 0 0 3 0x14000 0x40000200 acpi0 acpi0
49123 424022 0 0 3 0x14000 0x40000200 idle1
62161 156795 0 0 3 0x14000 0x200 bored softnet1
45135 224385 0 0 3 0x14000 0x200 bored softnet0
46643 236931 0 0 3 0x14000 0x200 smrbar systqmp
69484 246128 0 0 3 0x14000 0x200 bored systq
35040 164881 0 0 3 0x14000 0x200 tmoslp softclockmp
9910 9901 0 0 3 0x14000 0x40000200 tmoslp softclock
94221 235980 0 0 3 0x14000 0x40000200 idle0
1 229475 0 0 3 0x2 0x80 wait init
Process 24114 (syslogd) thread 0xffff800029913a00 (245762)
#1 syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
#2 Xsyscall+0x128
Process 46643 (systqmp) thread 0xffff800045ffe298 (236931)
shared rwlock systqmp r = 0 (0xffffffff85368d18)
#2 proc_trampoline+0x10
ddb{1}> show malloc
pcb 17 24K 24K 166960K 17 0
rtable 83 4K 4K 166960K 171 0
pf 20 18K 20K 166960K 34 0
ifaddr 15 3K 3K 166960K 19 0
ifgroup 27 1K 1K 166960K 32 0
sysctl 1 1K 13K 166960K 5 0
counters 56 39K 39K 166960K 58 0
ioctlops 0 0K 4K 166960K 1477 0
proc 70 128K 144K 166960K 384 0
subproc 0 0K 1K 166960K 30 0
exec 0 0K 2K 166960K 352 0
UVM aobj 3 4K 4K 166960K 3 0
pinsyscall 1055 1722K 1727K 166960K 1263 0
temp 2 9160K 9172K 166960K 4927 0
kqueue 14 44K 44K 166960K 40 0
rtentry 176 45 0 12 2 0 2 2 0 8 0
unpcb 144 65 0 46 1 0 1 1 0 8 0
syncache 336 9 0 9 1 0 1 1 0 8 1
tcpqe 32 31 0 31 1 1 0 1 0 8 0
tcpcb 736 16 0 10 1 0 1 1 0 8 0
arp 136 6 0 2 1 0 1 1 0 8 0
inpcb 328 49 0 40 1 0 1 1 0 8 0
nd6 152 6 0 3 1 0 1 1 0 8 0
kcovpl 48 4 0 4 1 0 1 1 0 8 1
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 14 0 0 1 0 1 1 0 8 0
pfstkey 128 14 0 0 1 0 1 1 0 8 0
pfstate 448 14 0 0 2 0 2 2 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_table 40 194 0 48 2 0 2 2 0 8 0
art_node 32 45 0 14 1 0 1 1 0 8 0
ffsino 296 1590 0 113 114 0 114 114 0 8 0
nchpl 144 1840 0 84 66 0 66 66 0 8 0
vnodes 216 1634 0 0 91 0 91 91 0 8 0
namei 1024 5889 0 5889 2 0 2 2 0 8 2
percpumem 16 45 0 1 1 0 1 1 0 8 0
kstatmem 264 15 0 2 1 0 1 1 0 8 0
scxspl 216 11700 0 11700 5 3 2 3 1 8 2
plimitpl 152 55 0 44 1 0 1 1 0 8 0
sigapl 424 436 0 401 6 0 6 6 0 8 2
knotepl 120 65 0 0 2 0 2 2 0 8 0
kqueuepl 224 36 0 26 1 0 1 1 0 8 0
pipepl 344 185 0 178 2 0 2 2 0 8 1
fdescpl 528 420 0 401 3 0 3 3 0 8 1
filepl 160 1870 0 1790 4 0 4 4 0 8 0
lockfpl 104 6 0 4 1 0 1 1 0 8 0
lockfspl 48 4 0 2 1 0 1 1 0 8 0
sessionpl 144 38 0 29 1 0 1 1 0 8 0
pgrppl 48 54 0 44 1 0 1 1 0 8 0
ucredpl 104 141 0 128 1 0 1 1 0 8 0
zombiepl 144 401 0 401 1 0 1 1 0 8 1
processpl 1232 436 0 401 4 0 4 4 0 8 1
procpl 664 462 0 414 5 0 5 5 0 8 0
sockpl 752 135 0 104 4 0 4 4 0 8 0
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl16k 16384 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 170 0 0 22 0 22 22 0 8 0
mcl2k 2048 17 0 0 3 0 3 3 0 8 0
mextrefs 64 11 0 0 1 0 1 1 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 170 0 0 11 0 11 11 0 8 0
bufpl 272 7266 0 225 470 0 470 470 0 8 0
anonpl 32 11160 0 0 91 1 90 90 0 222 0
amapchunkpl 152 11270 0 10793 34 1 33 33 0 158 12
amappl16 200 3925 0 3790 9 0 9 9 0 8 1
amappl15 192 13 0 13 2 2 0 1 0 8 0
amappl14 184 374 0 372 1 0 1 1 0 8 0
amappl13 176 183 0 170 3 1 2 3 0 8 1
amappl12 168 687 0 667 2 0 2 2 0 8 0
amappl11 160 14 0 14 1 1 0 1 0 8 0
amappl10 152 96 0 81 2 0 2 2 0 8 1
amappl9 144 1792 0 1792 2 1 1 1 0 8 1
amappl8 136 147 0 117 2 0 2 2 0 8 0
amappl7 128 202 0 183 2 0 2 2 0 8 0
amappl6 120 132 0 129 1 0 1 1 0 8 0
amappl5 112 274 0 263 1 0 1 1 0 8 0
amappl4 104 384 0 362 2 0 2 2 0 8 1
amappl3 96 1459 0 1403 3 0 3 3 0 8 1
amappl2 88 804 0 739 5 0 5 5 0 8 3
amappl1 80 15493 0 14923 25 4 21 24 0 8 8
amappl 88 2704 0 2581 5 0 5 5 0 92 1
uvmvnodes 80 88 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
uaddrrnd 24 420 0 401 1 0 1 1 0 8 0
vmmpekpl 168 9328 0 9301 2 0 2 2 0 8 0
vmmpepl 168 54103 0 52502 131 1 130 130 0 357 59
vmsppl 488 419 0 401 4 0 4 4 0 8 1
rwobjpl 80 23065 0 22008 41 7 34 41 0 8 8
pdppl 4096 849 0 802 77 26 51 69 0 8 4
pvpl 32 58552 0 0 475 2 473 473 0 265 0
pmappl 256 419 0 401 2 0 2 2 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffffffff850aeff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 copyin sys/kern/kern_subr.c:101 [inline]
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 sys/kern/kern_subr.c:143
ffs_write(ffff800029997b80) at ffs_write+0xcb4 sys/ufs/ffs/ffs_vnops.c:359
VOP_WRITE(ffff8000018a23b0,ffff800029997e40,3,ffff800000119a28) at VOP_WRITE+0x1a8 sys/kern/vfs_vops.c:245
vn_write(ffff8000016a8c80,ffff800029997e40,0) at vn_write+0x295 sys/kern/vfs_vnops.c:414
dofilewritev(ffff800029913a00,e,ffff800029997e40,0,ffff800029998000) at dofilewritev+0x3ef sys/kern/sys_generic.c:384
sys_writev(ffff800029913a00,ffff800029998090,ffff800029998000) at sys_writev+0x168 sys/kern/sys_generic.c:327
syscall(ffff800029998090) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029998090) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
ddb{0}> trace
x86_ipi_db(ffffffff850aeff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 copyin sys/kern/kern_subr.c:101 [inline]
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 sys/kern/kern_subr.c:143
ffs_write(ffff800029997b80) at ffs_write+0xcb4 sys/ufs/ffs/ffs_vnops.c:359
VOP_WRITE(ffff8000018a23b0,ffff800029997e40,3,ffff800000119a28) at VOP_WRITE+0x1a8 sys/kern/vfs_vops.c:245
vn_write(ffff8000016a8c80,ffff800029997e40,0) at vn_write+0x295 sys/kern/vfs_vnops.c:414
dofilewritev(ffff800029913a00,e,ffff800029997e40,0,ffff800029998000) at dofilewritev+0x3ef sys/kern/sys_generic.c:384
sys_writev(ffff800029913a00,ffff800029998090,ffff800029998000) at sys_writev+0x168 sys/kern/sys_generic.c:327
syscall(ffff800029998090) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029998090) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
sysvipc_infoout(200000000180,ffff800029a57ec0,ffff800029a57820,24,28,70,1ffff0000534af00,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff800029a57ee8,1,200000000180,ffff800029a57ec0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff800029a57ee8,1,200000000180,ffff800029a57ec0,0,1,1ffff0000534af54) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff800029a57ee4,2,200000000180,ffff800029a57ec0,0,fffa,ffff800029a58140) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff8000299e2a80,ffff800029a58140,ffff800029a580a0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800029a58140) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a58140) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
ddb{1}> trace
sysvipc_infoout(200000000180,ffff800029a57ec0,ffff800029a57820,24,28,70,1ffff0000534af00,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff800029a57ee8,1,200000000180,ffff800029a57ec0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff800029a57ee8,1,200000000180,ffff800029a57ec0,0,1,1ffff0000534af54) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff800029a57ee4,2,200000000180,ffff800029a57ec0,0,fffa,ffff800029a58140) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff8000299e2a80,ffff800029a58140,ffff800029a580a0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800029a58140) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a58140) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 1a2082c4ae19 kasan: pool describe: only the owning pool ma..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=d03bb4f3fadd1868289a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16f49cb9580000
dashboard link: https://syzkaller.appspot.com/bug?extid=d03bb4f3fadd1868289a
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14bd42b9580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ecbbb2ad5427/disk-1a2082c4.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/ec3c43ba9928/bsd-1a2082c4.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/12ca3bcc1c1e/kernel-1a2082c4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d03bb4...@syzkaller.appspotmail.com
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*215788 11982 0 0 0x4000000 1 syz-executor
TID PID UID PRFLAGS PFLAGS CPU COMMAND
245762 24114 73 0x1100010 0 0K syslogd
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018cabf0,ffff800029a57820,24) at kasan_memcpy+0x1ec
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
sysvipc_infoout(200000000180,ffff800029a57ec0,ffff800029a57820,24,28,70,1ffff0000534af00,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff800029a57ee8,1,200000000180,ffff800029a57ec0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff800029a57ee8,1,200000000180,ffff800029a57ec0,0,1,1ffff0000534af54) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff800029a57ee4,2,200000000180,ffff800029a57ec0,0,fffa,ffff800029a58140) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff8000299e2a80,ffff800029a58140,ffff800029a580a0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800029a58140) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a58140) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3d242c6bc20, count: 5
end of kernel
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffff8000018cabf0 size 36 op 1
ddb{1}> show kasan
KASAN: invalid write of 36 bytes at 0xffff8000018cabf0 from pc 0xffffffff83484679
KASAN: first bad byte at 0xffff8000018cabf3 (+3); shadow 0x03: partial granule (out-of-bounds)
KASAN: 0xffff8000018cabf3 is 3 bytes inside the 16-byte malloc slot [0xffff8000018cabf0..0xffff8000018cac00)
KASAN: allocated at:
#0 malloc+0xda0 sys/kern/kern_malloc.c:446
#1 sysvipc_infoout+0x18e sys/kern/kern_sysctl.c:2711
#2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
#3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
KASAN: pc: sysvipc_infoout+0x1a9
KASAN: call trace:
#0 kasan_memcpy+0x1ca kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 kasan_memcpy+0x1ca sys/kern/subr_kasan.c:1025
#1 sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
#2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
#3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
KASAN: shadow of 0xffff8000018caa80..0xffff8000018cad00 (1 cell = 8 bytes):
#0 malloc+0xda0 sys/kern/kern_malloc.c:446
#1 sysvipc_infoout+0x18e sys/kern/kern_sysctl.c:2711
#2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
#3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
KASAN: pc: sysvipc_infoout+0x1a9
KASAN: call trace:
#0 kasan_memcpy+0x1ca kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 kasan_memcpy+0x1ca sys/kern/subr_kasan.c:1025
#1 sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
#2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
#3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
0xffff8000018caa80: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08
0xffff8000018cab00: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08
>0xffff8000018cab80: fc 08 08 fb fc 08 fc 08 fc 08 fc 08 fc 08[03]fb
0xffff8000018cac00: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
0xffff8000018cac80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018cabf0,ffff800029a57820,24) at kasan_memcpy+0x1ec
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
sysvipc_infoout(200000000180,ffff800029a57ec0,ffff800029a57820,24,28,70,1ffff0000534af00,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff800029a57ee8,1,200000000180,ffff800029a57ec0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff800029a57ee8,1,200000000180,ffff800029a57ec0,0,1,1ffff0000534af54) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff800029a57ee4,2,200000000180,ffff800029a57ec0,0,fffa,ffff800029a58140) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff8000299e2a80,ffff800029a58140,ffff800029a580a0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800029a58140) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a58140) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3d242c6bc20, count: -10
end of kernel
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800029a575b0
rbx 0xffff800029a57620
rdx 0
rcx 0xffff800028fe3ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff800029a57398
r8 0x101010101010101
r9 0x8080808080808080
r11 0xffffffff8263c7e0 x86_bus_space_io_read_1
r12 0xffffffff84634053 .str.5+0x9c553
r13 0xffff800028fe4c08
r12 0xffffffff84634053 .str.5+0x9c553
r14 0xffff800028fe4e07
r15 0x1
rip 0xffffffff81fd2ec7 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff800029a575b0
rip 0xffffffff81fd2ec7 db_enter+0x17
cs 0x8
rflags 0x246
ss 0x10
db_enter+0x17: popq %rbp
ddb{1}> show proc
db_enter+0x17: popq %rbp
PROC (syz-executor) tid=215788 pid=11982 tcnt=3 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=71, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff8000299e2d18,0xffff8000299e34f0
process=0xffff8000298a4008 user=0xffff800029a4d000, vmspace=0xffff800000d8a000
estcpu=21, cpticks=18, pctcpu=0.11, user=0, sys=18, intr=0
ddb{1}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
11982 312594 22176 0 3 0 0x80 nanoslp syz-executor
*11982 215788 22176 0 7 0 0x4000000 syz-executor
11982 27590 22176 0 3 0 0x4000080 fsleep syz-executor
22176 495284 79898 0 3 0x2 0x80 nanoslp syz-executor
79898 80864 75763 0 3 0x2 0x80 kqread syz-executor
75763 291731 74309 0 3 0x2 0x80 thrsleep syz-execprog
75763 37308 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 38970 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 439110 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 49773 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 521803 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 482010 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 294211 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 183332 74309 0 3 0x2 0x4000080 kqread syz-execprog
75763 259081 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 200416 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
75763 35790 74309 0 3 0x2 0x4000080 thrsleep syz-execprog
74309 293074 50089 0 3 0x100002 0x88 sigsusp ksh
50089 241415 84713 0 3 0x10 0x88 kqread sshd-session
84713 181269 52666 0 3 0x12 0x80 kqread sshd-session
90724 266036 1 0 3 0x100003 0x80 ttyin getty
52666 115549 1 0 3 0 0x88 kqread sshd
43510 255344 50195 74 3 0x1100012 0x80 bpf pflogd
50195 266469 1 0 3 0 0x80 sbwait pflogd
24114 245762 17450 73 7 0x1100010 0 syslogd
17450 49993 1 0 3 0x100002 0x80 sbwait syslogd
28571 234852 1 0 3 0x100000 0x80 kqread resolvd
82809 246450 39805 77 3 0x100012 0x80 kqread dhcpleased
24223 131363 39805 77 3 0x100012 0x80 kqread dhcpleased
39805 211543 1 0 3 0 0x80 kqread dhcpleased
19243 5163 0 0 2 0x14000 0x40000200 smr
75974 174292 0 0 3 0x14000 0x200 pgzero zerothread
93057 50408 0 0 3 0x14000 0x200 aiodoned aiodoned
5120 128653 0 0 3 0x14000 0x200 syncer update
25073 289280 0 0 3 0x14000 0x200 cleaner cleaner
57420 263917 0 0 3 0x14000 0x200 reaper reaper
21606 480813 0 0 3 0x14000 0x200 pgdaemon pagedaemon
11150 349048 0 0 3 0x14000 0x200 bored viomb
23036 337904 0 0 3 0x14000 0x40000200 acpi0 acpi0
49123 424022 0 0 3 0x14000 0x40000200 idle1
62161 156795 0 0 3 0x14000 0x200 bored softnet1
45135 224385 0 0 3 0x14000 0x200 bored softnet0
46643 236931 0 0 3 0x14000 0x200 smrbar systqmp
69484 246128 0 0 3 0x14000 0x200 bored systq
35040 164881 0 0 3 0x14000 0x200 tmoslp softclockmp
9910 9901 0 0 3 0x14000 0x40000200 tmoslp softclock
94221 235980 0 0 3 0x14000 0x40000200 idle0
1 229475 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{1}> show all locks
Process 24114 (syslogd) thread 0xffff800029913a00 (245762)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85df2400)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
#2 Xsyscall+0x128
Process 46643 (systqmp) thread 0xffff800045ffe298 (236931)
shared rwlock systqmp r = 0 (0xffffffff85368d18)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x1ba sys/kern/kern_task.c:442
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#2 proc_trampoline+0x10
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11029 12226K 12226K 166960K 12123 0
pcb 17 24K 24K 166960K 17 0
rtable 83 4K 4K 166960K 171 0
pf 20 18K 20K 166960K 34 0
ifaddr 15 3K 3K 166960K 19 0
ifgroup 27 1K 1K 166960K 32 0
sysctl 1 1K 13K 166960K 5 0
counters 56 39K 39K 166960K 58 0
ioctlops 0 0K 4K 166960K 1477 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1226 79K 79K 166960K 1315 0
log 0 0K 0K 166960K 4 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 2K 166960K 2 0
UFS mount 5 44K 44K 166960K 5 0
VM map 2 1K 1K 166960K 2 0
sem 2 0K 0K 166960K 2 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 4 9K 13K 166960K 108 0
ACPI 1734 201K 292K 166960K 11964 0
proc 70 128K 144K 166960K 384 0
subproc 0 0K 1K 166960K 30 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
in_multi 22 1K 1K 166960K 33 0
NFS daemon 1 20K 20K 166960K 1 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 1 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 25 182K 182K 166960K 25 0
MSDOSFS mount 1 20K 20K 166960K 1 0
exec 0 0K 2K 166960K 352 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 208 150K 307K 166960K 3584 0
tdb 3 1K 1K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM aobj 3 4K 4K 166960K 3 0
pinsyscall 1055 1722K 1727K 166960K 1263 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
NDP 7 0K 0K 166960K 10 0
crypto data 1 1K 1K 166960K 1 0
temp 2 9160K 9172K 166960K 4927 0
kqueue 14 44K 44K 166960K 40 0
SYN cache 2 16K 16K 166960K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 21 0 18 1 0 1 1 0 8 0
plcache 128 28 0 0 1 0 1 1 0 8 0
rtentry 176 45 0 12 2 0 2 2 0 8 0
unpcb 144 65 0 46 1 0 1 1 0 8 0
syncache 336 9 0 9 1 0 1 1 0 8 1
tcpqe 32 31 0 31 1 1 0 1 0 8 0
tcpcb 736 16 0 10 1 0 1 1 0 8 0
arp 136 6 0 2 1 0 1 1 0 8 0
inpcb 328 49 0 40 1 0 1 1 0 8 0
nd6 152 6 0 3 1 0 1 1 0 8 0
kcovpl 48 4 0 4 1 0 1 1 0 8 1
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 14 0 0 1 0 1 1 0 8 0
pfstkey 128 14 0 0 1 0 1 1 0 8 0
pfstate 448 14 0 0 2 0 2 2 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 193 0 48 10 0 10 10 0 8 0
art_table 40 194 0 48 2 0 2 2 0 8 0
art_node 32 45 0 14 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1590 0 113 93 0 93 93 0 8 0
ffsino 296 1590 0 113 114 0 114 114 0 8 0
nchpl 144 1840 0 84 66 0 66 66 0 8 0
vnodes 216 1634 0 0 91 0 91 91 0 8 0
namei 1024 5889 0 5889 2 0 2 2 0 8 2
percpumem 16 45 0 1 1 0 1 1 0 8 0
kstatmem 264 15 0 2 1 0 1 1 0 8 0
scxspl 216 11700 0 11700 5 3 2 3 1 8 2
plimitpl 152 55 0 44 1 0 1 1 0 8 0
sigapl 424 436 0 401 6 0 6 6 0 8 2
knotepl 120 65 0 0 2 0 2 2 0 8 0
kqueuepl 224 36 0 26 1 0 1 1 0 8 0
pipepl 344 185 0 178 2 0 2 2 0 8 1
fdescpl 528 420 0 401 3 0 3 3 0 8 1
filepl 160 1870 0 1790 4 0 4 4 0 8 0
lockfpl 104 6 0 4 1 0 1 1 0 8 0
lockfspl 48 4 0 2 1 0 1 1 0 8 0
sessionpl 144 38 0 29 1 0 1 1 0 8 0
pgrppl 48 54 0 44 1 0 1 1 0 8 0
ucredpl 104 141 0 128 1 0 1 1 0 8 0
zombiepl 144 401 0 401 1 0 1 1 0 8 1
processpl 1232 436 0 401 4 0 4 4 0 8 1
procpl 664 462 0 414 5 0 5 5 0 8 0
sockpl 752 135 0 104 4 0 4 4 0 8 0
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl16k 16384 2 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 170 0 0 22 0 22 22 0 8 0
mcl2k 2048 17 0 0 3 0 3 3 0 8 0
mextrefs 64 11 0 0 1 0 1 1 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 170 0 0 11 0 11 11 0 8 0
bufpl 272 7266 0 225 470 0 470 470 0 8 0
anonpl 32 11160 0 0 91 1 90 90 0 222 0
amapchunkpl 152 11270 0 10793 34 1 33 33 0 158 12
amappl16 200 3925 0 3790 9 0 9 9 0 8 1
amappl15 192 13 0 13 2 2 0 1 0 8 0
amappl14 184 374 0 372 1 0 1 1 0 8 0
amappl13 176 183 0 170 3 1 2 3 0 8 1
amappl12 168 687 0 667 2 0 2 2 0 8 0
amappl11 160 14 0 14 1 1 0 1 0 8 0
amappl10 152 96 0 81 2 0 2 2 0 8 1
amappl9 144 1792 0 1792 2 1 1 1 0 8 1
amappl8 136 147 0 117 2 0 2 2 0 8 0
amappl7 128 202 0 183 2 0 2 2 0 8 0
amappl6 120 132 0 129 1 0 1 1 0 8 0
amappl5 112 274 0 263 1 0 1 1 0 8 0
amappl4 104 384 0 362 2 0 2 2 0 8 1
amappl3 96 1459 0 1403 3 0 3 3 0 8 1
amappl2 88 804 0 739 5 0 5 5 0 8 3
amappl1 80 15493 0 14923 25 4 21 24 0 8 8
amappl 88 2704 0 2581 5 0 5 5 0 92 1
uvmvnodes 80 88 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 2 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
uaddrrnd 24 420 0 401 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 420 0 401 1 0 1 1 0 8 0
vmmpekpl 168 9328 0 9301 2 0 2 2 0 8 0
vmmpepl 168 54103 0 52502 131 1 130 130 0 357 59
vmsppl 488 419 0 401 4 0 4 4 0 8 1
rwobjpl 80 23065 0 22008 41 7 34 41 0 8 8
pdppl 4096 849 0 802 77 26 51 69 0 8 4
pvpl 32 58552 0 0 475 2 473 473 0 265 0
pmappl 256 419 0 401 2 0 2 2 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 120 706 0 29 21 0 21 21 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffffffff850aeff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 check_copyin sys/kern/kern_subr.c:-1 [inline]
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 copyin sys/kern/kern_subr.c:101 [inline]
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 sys/kern/kern_subr.c:143
ffs_write(ffff800029997b80) at ffs_write+0xcb4 sys/ufs/ffs/ffs_vnops.c:359
VOP_WRITE(ffff8000018a23b0,ffff800029997e40,3,ffff800000119a28) at VOP_WRITE+0x1a8 sys/kern/vfs_vops.c:245
vn_write(ffff8000016a8c80,ffff800029997e40,0) at vn_write+0x295 sys/kern/vfs_vnops.c:414
dofilewritev(ffff800029913a00,e,ffff800029997e40,0,ffff800029998000) at dofilewritev+0x3ef sys/kern/sys_generic.c:384
sys_writev(ffff800029913a00,ffff800029998090,ffff800029998000) at sys_writev+0x168 sys/kern/sys_generic.c:327
syscall(ffff800029998090) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029998090) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70abb72ce260, count: 4
end of kernel
ddb{0}> trace
x86_ipi_db(ffffffff850aeff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 check_copyin sys/kern/kern_subr.c:-1 [inline]
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 copyin sys/kern/kern_subr.c:101 [inline]
uiomove(ffff800014642f10,24,ffff800029997e40) at uiomove+0x5f5 sys/kern/kern_subr.c:143
ffs_write(ffff800029997b80) at ffs_write+0xcb4 sys/ufs/ffs/ffs_vnops.c:359
VOP_WRITE(ffff8000018a23b0,ffff800029997e40,3,ffff800000119a28) at VOP_WRITE+0x1a8 sys/kern/vfs_vops.c:245
vn_write(ffff8000016a8c80,ffff800029997e40,0) at vn_write+0x295 sys/kern/vfs_vnops.c:414
dofilewritev(ffff800029913a00,e,ffff800029997e40,0,ffff800029998000) at dofilewritev+0x3ef sys/kern/sys_generic.c:384
sys_writev(ffff800029913a00,ffff800029998090,ffff800029998000) at sys_writev+0x168 sys/kern/sys_generic.c:327
syscall(ffff800029998090) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029998090) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70abb72ce260, count: -11
end of kernel
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x17: popq %rbp
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018cabf0,ffff800029a57820,24) at kasan_memcpy+0x1ec
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
sysvipc_infoout(200000000180,ffff800029a57ec0,ffff800029a57820,24,28,70,1ffff0000534af00,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff800029a57ee8,1,200000000180,ffff800029a57ec0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff800029a57ee8,1,200000000180,ffff800029a57ec0,0,1,1ffff0000534af54) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff800029a57ee4,2,200000000180,ffff800029a57ec0,0,fffa,ffff800029a58140) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff8000299e2a80,ffff800029a58140,ffff800029a580a0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800029a58140) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a58140) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3d242c6bc20, count: 5
end of kernel
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff8000018cabf0,ffff800029a57820,24) at kasan_memcpy+0x1ec
panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198
sysvipc_infoout(200000000180,ffff800029a57ec0,ffff800029a57820,24,28,70,1ffff0000534af00,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713
sysctl_sysvipc(ffff800029a57ee8,1,200000000180,ffff800029a57ec0) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(33,ffff800029a57ee8,1,200000000180,ffff800029a57ec0,0,1,1ffff0000534af54) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429
kern_sysctl(ffff800029a57ee4,2,200000000180,ffff800029a57ec0,0,fffa,ffff800029a58140) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff8000299e2a80,ffff800029a58140,ffff800029a580a0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800029a58140) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029a58140) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3d242c6bc20, count: -10
end of kernel
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages