KASAN: invalid memory access in in_ifdetach
2 views
Skip to first unread message
syzbot
Sep 20, 2026, 9:39:39 PMSep 20
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 028451d23544 Merge remote-tracking branch 'origin/master' ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=11e6e4c9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=b10e9391817d32ad31ad
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ce64bb69c46c/disk-028451d2.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/41d1a1259f1d/bsd-028451d2.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c29eca2c9db1/kernel-028451d2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b10e93...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff80000016d800 size 8 op 0
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff800001729000) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff800001729000) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff800001729000) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299ed940) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d01,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299eda80) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001ae4af8,7,ffff800000119208,ffff8000298f4540) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001bd4220,ffff8000298f4540) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001bd4220,ffff8000298f4540) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000298f4540) at fdfree+0x16d sys/kern/kern_descrip.c:1203
end trace frame: 0xffff8000299ede50, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff80000016d800 size 8 op 0
ddb{0}> show kasan
KASAN: invalid read of 8 bytes at 0xffff80000016d800 from pc 0xffffffff83146c58
KASAN: first bad byte at 0xffff80000016d800 (+0); shadow 0xfc: malloc use-after-free
KASAN: 0xffff80000016d800 is 0 bytes inside the 128-byte malloc slot [0xffff80000016d800..0xffff80000016d880)
KASAN: allocated at:
#0 malloc+0xf70 sys/kern/kern_malloc.c:493
#1 in_addmulti+0x248 sys/netinet/in.c:891
#2 ip_setmoptions+0x1534 sys/netinet/ip_output.c:1603
#3 sosetopt+0x19e sys/kern/uipc_socket.c:1899
#4 sys_setsockopt+0x466 sys/kern/uipc_syscalls.c:1234
#5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#6 Xsyscall+0x128
KASAN: freed at:
#0 free+0x41b kasan_quarantine_push sys/kern/kern_malloc.c:168 [inline]
#0 free+0x41b sys/kern/kern_malloc.c:665
#1 in_delmulti+0x2e7 sys/netinet/in.c:985
#2 ip_freemoptions+0x9f sys/netinet/ip_output.c:-1
#3 in_pcbdetach+0x187 sys/netinet/in_pcb.c:605
#4 rip_detach+0x72 sys/netinet/raw_ip.c:509
#5 soclose+0x10a pru_detach sys/sys/protosw.h:281 [inline]
#5 soclose+0x10a sys/kern/uipc_socket.c:403
#6 soo_close+0x72 sys/kern/sys_socket.c:169
#7 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#8 closef+0x263 sys/kern/kern_descrip.c:1265
#9 fdfree+0x16d sys/kern/kern_descrip.c:1203
#10 exit1+0x81e sys/kern/kern_exit.c:217
#11 sys_exit+0x4a
#12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#13 Xsyscall+0x128
KASAN: pc: in_ifdetach+0x78
KASAN: call trace:
#0 __asan_load8_noabort+0xbd kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 __asan_load8_noabort+0xbd sys/kern/subr_kasan.c:1099
#1 in_ifdetach+0x78 sys/netinet/in.c:1017
#2 if_detach+0x491 sys/net/if.c:1311
#3 tun_clone_destroy+0x43b sys/net/if_tun.c:343
#4 if_clone_destroy+0x24d sys/net/if.c:1480
#5 tun_dev_close+0x2c0 sys/net/if_tun.c:526
#6 spec_close+0x56b sys/kern/spec_vnops.c:538
#7 VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
#8 vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
#8 vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
#9 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#10 closef+0x263 sys/kern/kern_descrip.c:1265
#11 fdfree+0x16d sys/kern/kern_descrip.c:1203
#12 exit1+0x81e sys/kern/kern_exit.c:217
#13 sys_exit+0x4a
#14 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
KASAN: shadow of 0xffff80000016d700..0xffff80000016d980 (1 cell = 8 bytes):
0xffff80000016d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff80000016d780: 08 08 08 08 08 08 08 08 08 08 08 08 08 fb fc fc
>0xffff80000016d800:[fc]fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff80000016d880: 08 08 08 08 08 08 08 08 08 08 fb fc fc fc fc fc
0xffff80000016d900: 08 08 08 08 08 08 08 08 08 08 08 08 08 fb fc fc
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff800001729000) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff800001729000) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff800001729000) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299ed940) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d01,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299eda80) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001ae4af8,7,ffff800000119208,ffff8000298f4540) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001bd4220,ffff8000298f4540) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001bd4220,ffff8000298f4540) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000298f4540) at fdfree+0x16d sys/kern/kern_descrip.c:1203
exit1(ffff8000298f4540,43,0,1) at exit1+0x81e sys/kern/kern_exit.c:217
sys_exit(ffff8000298f4540,ffff8000299ee020,ffff8000299edf80) at sys_exit+0x4a
syscall(ffff8000299ee020) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299ee020) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ec9995640d0, count: -18
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff8000299ed5b0
rbx 0xffff8000299ed620
rdx 0
rcx 0xffffffff853d8ff0 cpu_info_full_primary+0x1ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff8000299ed398
r11 0xffffffff8399cf40 x86_bus_space_io_read_1
r12 0xffffffff846453fc switch.table.intel_memory_region_create+0x9d43c
r13 0xffffffff853d9c10 cpu_info_full_primary+0x2c10
r14 0xffffffff853d9e0f cpu_info_full_primary+0x2e0f
r15 0x1
rip 0xffffffff82176867 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff8000299ed5b0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=374768 pid=73878 tcnt=0 stat=onproc
flags process=a<EXEC,EXITING> proc=2000<WEXIT>
runpri=32, usrpri=76, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1
forw=0xffffffffffffffff, list=0xffff8000298959f8,0xffff8000298f4fb0
process=0xffff8000298a4e90 user=0xffff8000299e3000, vmspace=0xffff800001ac53e0
estcpu=26, cpticks=42, pctcpu=0.14, user=0, sys=24, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
40204 43639 79983 0 3 0x2 0 clonelk ifconfig
79983 170125 99172 0 3 0x100002 0x88 sigsusp sh
99172 378153 50925 0 3 0x2 0x80 wait syz-executor
13994 387148 1 0 3 0x100003 0x80 ttyin getty
48600 457339 50925 0 3 0x2 0x80 piperd syz-executor
94297 80530 50925 0 3 0x2 0x80 piperd syz-executor
40681 421394 50925 0 3 0x2 0x80 piperd syz-executor
78208 383929 50925 0 3 0x2 0x80 piperd syz-executor
26605 173437 50925 0 3 0x2 0x80 piperd syz-executor
50925 353463 37303 0 3 0x2 0x80 wait syz-executor
37303 247703 4540 0 3 0x100002 0x88 sigsusp ksh
4540 329573 24228 0 3 0x10 0x88 kqread sshd-session
24228 43014 87476 0 3 0x12 0x80 kqread sshd-session
87476 482707 1 0 3 0 0x88 kqread sshd
23270 346956 54916 74 3 0x1100012 0x80 bpf pflogd
54916 135187 1 0 3 0 0x80 sbwait pflogd
59542 230688 92371 73 3 0x1100010 0x80 kqread syslogd
92371 435736 1 0 3 0x100002 0x80 sbwait syslogd
1122 514123 1 0 3 0x100000 0x80 kqread resolvd
39934 103492 98418 77 3 0x100012 0x80 kqread dhcpleased
96270 235195 98418 77 3 0x100012 0x80 kqread dhcpleased
98418 238979 1 0 3 0 0x80 kqread dhcpleased
9151 232093 0 0 3 0x14000 0x200 bored smr
30667 484836 0 0 3 0x14000 0x200 pgzero zerothread
55098 141218 0 0 3 0x14000 0x200 aiodoned aiodoned
2546 342691 0 0 3 0x14000 0x200 syncer update
96974 424651 0 0 3 0x14000 0x200 cleaner cleaner
77895 491198 0 0 3 0x14000 0x200 reaper reaper
14160 76965 0 0 3 0x14000 0x200 pgdaemon pagedaemon
79999 515730 0 0 3 0x14000 0x200 bored viomb
11090 346840 0 0 3 0x14000 0x40000200 acpi0 acpi0
51090 455264 0 0 7 0x14000 0x40000200 idle1
83892 494514 0 0 3 0x14000 0x200 bored softnet1
65566 275250 0 0 3 0x14000 0x200 bored softnet0
8968 303727 0 0 3 0x14000 0x200 smrbar systqmp
95716 302690 0 0 3 0x14000 0x200 bored systq
24763 18873 0 0 3 0x14000 0x200 tmoslp softclockmp
37175 172656 0 0 3 0x14000 0x40000200 tmoslp softclock
2428 208698 0 0 3 0x14000 0x40000200 idle0
1 388740 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 8968 (systqmp) thread 0xffff800045ffe530 (303727)
shared rwlock systqmp r = 0 (0xffffffff85317cd8)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x1ba sys/kern/kern_task.c:442
#2 proc_trampoline+0x10
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11065 12246K 12394K 166960K 12159 0
pcb 26 24K 24K 166960K 26 0
rtable 255 22K 30K 166960K 341 0
pf 34 22K 26K 166960K 45 0
ifaddr 43 12K 12K 166960K 45 0
ifgroup 55 2K 2K 166960K 55 0
sysctl 1 1K 13K 166960K 5 0
counters 70 42K 42K 166960K 70 0
ioctlops 10 10K 194K 166960K 1491 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1321 85K 85K 166960K 1392 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 2K 166960K 2 0
VM map 2 1K 1K 166960K 2 0
sem 4 0K 0K 166960K 4 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1692 195K 405K 166960K 12470 0
file desc 13 40K 121K 166960K 166 0
proc 102 146K 179K 166960K 571 0
subproc 81 10K 10K 166960K 81 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 2 0K 0K 166960K 2 0
in_multi 100 7K 7K 166960K 100 0
ether_multi 1 0K 0K 166960K 1 0
mrt 5 0K 0K 166960K 7 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 55 384K 384K 166960K 55 0
exec 15 3K 17K 166960K 386 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM amap 621 300K 363K 166960K 3393 0
UVM aobj 6 4K 4K 166960K 6 0
pinsyscall 127 235K 382K 166960K 1330 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 2 0K 0K 166960K 2 0
NDP 28 2K 2K 166960K 28 0
temp 226 9250K 9461K 166960K 3590 0
kqueue 24 77K 84K 166960K 36 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 35 0 32 1 0 1 1 0 8 0
rtentry 176 111 0 23 5 0 5 5 0 8 0
unpcb 144 64 0 47 1 0 1 1 0 8 0
syncache 336 4 0 4 2 1 1 1 0 8 1
tcpcb 736 12 0 8 1 0 1 1 0 8 0
arp 136 18 0 4 1 0 1 1 0 8 0
inpcb 328 87 0 79 2 0 2 2 0 8 0
nd6 152 24 0 6 1 0 1 1 0 8 0
kcovpl 48 9 0 2 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 33 0 0 1 0 1 1 0 8 0
pfstkey 128 33 0 0 2 0 2 2 0 8 0
pfstate 448 33 0 0 4 0 4 4 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 453 0 44 29 0 29 29 0 8 1
art_table 40 454 0 44 5 0 5 5 0 8 0
art_node 32 111 0 31 1 0 1 1 0 8 0
semapl 72 2 0 0 1 0 1 1 0 8 0
shmpl 120 3 0 0 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1628 0 157 93 0 93 93 0 8 0
ffsino 296 1628 0 157 114 0 114 114 0 8 0
nchpl 144 1870 0 171 64 0 64 64 0 8 0
vnodes 216 1732 0 0 97 0 97 97 0 8 0
namei 1024 6566 0 6566 3 1 2 2 0 8 2
percpumem 16 51 0 2 1 0 1 1 0 8 0
kstatmem 264 27 0 4 2 0 2 2 0 8 0
scxspl 216 6864 0 6864 4 3 1 3 1 8 1
plimitpl 152 38 0 21 1 0 1 1 0 8 0
sigapl 424 482 0 440 7 0 7 7 0 8 1
knotepl 120 137 0 0 5 0 5 5 0 8 0
kqueuepl 224 39 0 30 1 0 1 1 0 8 0
pipepl 344 138 0 111 3 0 3 3 0 8 0
fdescpl 528 466 0 441 3 0 3 3 0 8 0
filepl 160 1797 0 1603 10 0 10 10 0 8 0
lockfpl 104 12 0 10 1 0 1 1 0 8 0
lockfspl 48 7 0 5 1 0 1 1 0 8 0
sessionpl 144 28 0 19 1 0 1 1 0 8 0
pgrppl 48 37 0 20 1 0 1 1 0 8 0
ucredpl 104 137 0 124 1 0 1 1 0 8 0
zombiepl 144 442 0 440 1 0 1 1 0 8 0
processpl 1240 482 0 440 5 0 5 5 0 8 0
procpl 664 538 0 496 6 0 6 6 0 8 1
sockpl 752 186 0 158 4 0 4 4 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 106 0 0 14 0 14 14 0 8 0
mcl2k 2048 29 0 0 4 0 4 4 0 8 0
mextrefs 64 24 0 0 1 0 1 1 0 8 0
mtagpl 96 1 0 0 1 0 1 1 0 8 0
mbufpl 256 210 0 0 14 0 14 14 0 8 0
bufpl 272 2356 0 106 150 0 150 150 0 8 0
anonpl 32 4099 0 0 33 0 33 33 0 222 0
amapchunkpl 152 9347 0 9071 22 0 22 22 0 158 6
amappl16 200 1875 0 1858 5 1 4 5 0 8 2
amappl15 192 5 0 5 1 1 0 1 0 8 0
amappl14 184 436 0 434 1 0 1 1 0 8 0
amappl13 176 136 0 123 1 0 1 1 0 8 0
amappl12 168 715 0 692 2 0 2 2 0 8 0
amappl11 160 9 0 9 2 1 1 1 0 8 1
amappl10 152 69 0 55 1 0 1 1 0 8 0
amappl9 144 290 0 289 1 0 1 1 0 8 0
amappl8 136 221 0 219 1 0 1 1 0 8 0
amappl7 128 164 0 150 1 0 1 1 0 8 0
amappl6 120 157 0 154 1 0 1 1 0 8 0
amappl5 112 107 0 97 1 0 1 1 0 8 0
amappl4 104 294 0 274 1 0 1 1 0 8 0
amappl3 96 1578 0 1520 3 0 3 3 0 8 0
amappl2 88 598 0 525 2 0 2 2 0 8 0
amappl1 80 10600 0 10028 15 0 15 15 0 8 2
amappl 88 2655 0 2557 5 0 5 5 0 92 0
uvmvnodes 80 98 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 5 0 0 1 0 1 1 0 8 0
uaddrrnd 24 466 0 441 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 466 0 441 1 0 1 1 0 8 0
vmmpekpl 168 5967 0 5918 3 0 3 3 0 8 0
vmmpepl 168 40018 0 38500 87 0 87 87 0 357 8
vmsppl 488 465 0 441 5 0 5 5 0 8 1
rwobjpl 80 15038 0 14091 24 0 24 24 0 8 2
pdppl 4096 941 0 882 97 30 67 87 0 8 8
pvpl 32 10430 0 0 86 1 85 85 0 265 0
pmappl 256 465 0 441 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 120 424 0 35 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff800001729000) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff800001729000) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff800001729000) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299ed940) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d01,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299eda80) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001ae4af8,7,ffff800000119208,ffff8000298f4540) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001bd4220,ffff8000298f4540) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001bd4220,ffff8000298f4540) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000298f4540) at fdfree+0x16d sys/kern/kern_descrip.c:1203
exit1(ffff8000298f4540,43,0,1) at exit1+0x81e sys/kern/kern_exit.c:217
sys_exit(ffff8000298f4540,ffff8000299ee020,ffff8000299edf80) at sys_exit+0x4a
syscall(ffff8000299ee020) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299ee020) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ec9995640d0, count: -18
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x63c sys/dev/acpi/acpicpu_x86.c:-1
sched_idle(ffff800028fe3ff0) at sched_idle+0x566 sys/kern/kern_sched.c:204
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x63c sys/dev/acpi/acpicpu_x86.c:-1
sched_idle(ffff800028fe3ff0) at sched_idle+0x566 sys/kern/kern_sched.c:204
end trace frame: 0x0, count: -5
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 028451d23544 Merge remote-tracking branch 'origin/master' ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=11e6e4c9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=b10e9391817d32ad31ad
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ce64bb69c46c/disk-028451d2.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/41d1a1259f1d/bsd-028451d2.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c29eca2c9db1/kernel-028451d2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b10e93...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff80000016d800 size 8 op 0
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff800001729000) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff800001729000) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff800001729000) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299ed940) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d01,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299eda80) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001ae4af8,7,ffff800000119208,ffff8000298f4540) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001bd4220,ffff8000298f4540) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001bd4220,ffff8000298f4540) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000298f4540) at fdfree+0x16d sys/kern/kern_descrip.c:1203
end trace frame: 0xffff8000299ede50, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff80000016d800 size 8 op 0
ddb{0}> show kasan
KASAN: invalid read of 8 bytes at 0xffff80000016d800 from pc 0xffffffff83146c58
KASAN: first bad byte at 0xffff80000016d800 (+0); shadow 0xfc: malloc use-after-free
KASAN: 0xffff80000016d800 is 0 bytes inside the 128-byte malloc slot [0xffff80000016d800..0xffff80000016d880)
KASAN: allocated at:
#0 malloc+0xf70 sys/kern/kern_malloc.c:493
#1 in_addmulti+0x248 sys/netinet/in.c:891
#2 ip_setmoptions+0x1534 sys/netinet/ip_output.c:1603
#3 sosetopt+0x19e sys/kern/uipc_socket.c:1899
#4 sys_setsockopt+0x466 sys/kern/uipc_syscalls.c:1234
#5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#6 Xsyscall+0x128
KASAN: freed at:
#0 free+0x41b kasan_quarantine_push sys/kern/kern_malloc.c:168 [inline]
#0 free+0x41b sys/kern/kern_malloc.c:665
#1 in_delmulti+0x2e7 sys/netinet/in.c:985
#2 ip_freemoptions+0x9f sys/netinet/ip_output.c:-1
#3 in_pcbdetach+0x187 sys/netinet/in_pcb.c:605
#4 rip_detach+0x72 sys/netinet/raw_ip.c:509
#5 soclose+0x10a pru_detach sys/sys/protosw.h:281 [inline]
#5 soclose+0x10a sys/kern/uipc_socket.c:403
#6 soo_close+0x72 sys/kern/sys_socket.c:169
#7 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#8 closef+0x263 sys/kern/kern_descrip.c:1265
#9 fdfree+0x16d sys/kern/kern_descrip.c:1203
#10 exit1+0x81e sys/kern/kern_exit.c:217
#11 sys_exit+0x4a
#12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#13 Xsyscall+0x128
KASAN: pc: in_ifdetach+0x78
KASAN: call trace:
#0 __asan_load8_noabort+0xbd kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 __asan_load8_noabort+0xbd sys/kern/subr_kasan.c:1099
#1 in_ifdetach+0x78 sys/netinet/in.c:1017
#2 if_detach+0x491 sys/net/if.c:1311
#3 tun_clone_destroy+0x43b sys/net/if_tun.c:343
#4 if_clone_destroy+0x24d sys/net/if.c:1480
#5 tun_dev_close+0x2c0 sys/net/if_tun.c:526
#6 spec_close+0x56b sys/kern/spec_vnops.c:538
#7 VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
#8 vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
#8 vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
#9 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#10 closef+0x263 sys/kern/kern_descrip.c:1265
#11 fdfree+0x16d sys/kern/kern_descrip.c:1203
#12 exit1+0x81e sys/kern/kern_exit.c:217
#13 sys_exit+0x4a
#14 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
KASAN: shadow of 0xffff80000016d700..0xffff80000016d980 (1 cell = 8 bytes):
0xffff80000016d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff80000016d780: 08 08 08 08 08 08 08 08 08 08 08 08 08 fb fc fc
>0xffff80000016d800:[fc]fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff80000016d880: 08 08 08 08 08 08 08 08 08 08 fb fc fc fc fc fc
0xffff80000016d900: 08 08 08 08 08 08 08 08 08 08 08 08 08 fb fc fc
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff800001729000) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff800001729000) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff800001729000) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299ed940) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d01,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299eda80) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001ae4af8,7,ffff800000119208,ffff8000298f4540) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001bd4220,ffff8000298f4540) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001bd4220,ffff8000298f4540) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000298f4540) at fdfree+0x16d sys/kern/kern_descrip.c:1203
exit1(ffff8000298f4540,43,0,1) at exit1+0x81e sys/kern/kern_exit.c:217
sys_exit(ffff8000298f4540,ffff8000299ee020,ffff8000299edf80) at sys_exit+0x4a
syscall(ffff8000299ee020) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299ee020) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ec9995640d0, count: -18
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff8000299ed5b0
rbx 0xffff8000299ed620
rdx 0
rcx 0xffffffff853d8ff0 cpu_info_full_primary+0x1ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff8000299ed398
r11 0xffffffff8399cf40 x86_bus_space_io_read_1
r12 0xffffffff846453fc switch.table.intel_memory_region_create+0x9d43c
r13 0xffffffff853d9c10 cpu_info_full_primary+0x2c10
r14 0xffffffff853d9e0f cpu_info_full_primary+0x2e0f
r15 0x1
rip 0xffffffff82176867 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff8000299ed5b0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=374768 pid=73878 tcnt=0 stat=onproc
flags process=a<EXEC,EXITING> proc=2000<WEXIT>
runpri=32, usrpri=76, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1
forw=0xffffffffffffffff, list=0xffff8000298959f8,0xffff8000298f4fb0
process=0xffff8000298a4e90 user=0xffff8000299e3000, vmspace=0xffff800001ac53e0
estcpu=26, cpticks=42, pctcpu=0.14, user=0, sys=24, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
40204 43639 79983 0 3 0x2 0 clonelk ifconfig
79983 170125 99172 0 3 0x100002 0x88 sigsusp sh
99172 378153 50925 0 3 0x2 0x80 wait syz-executor
13994 387148 1 0 3 0x100003 0x80 ttyin getty
48600 457339 50925 0 3 0x2 0x80 piperd syz-executor
94297 80530 50925 0 3 0x2 0x80 piperd syz-executor
40681 421394 50925 0 3 0x2 0x80 piperd syz-executor
78208 383929 50925 0 3 0x2 0x80 piperd syz-executor
26605 173437 50925 0 3 0x2 0x80 piperd syz-executor
50925 353463 37303 0 3 0x2 0x80 wait syz-executor
37303 247703 4540 0 3 0x100002 0x88 sigsusp ksh
4540 329573 24228 0 3 0x10 0x88 kqread sshd-session
24228 43014 87476 0 3 0x12 0x80 kqread sshd-session
87476 482707 1 0 3 0 0x88 kqread sshd
23270 346956 54916 74 3 0x1100012 0x80 bpf pflogd
54916 135187 1 0 3 0 0x80 sbwait pflogd
59542 230688 92371 73 3 0x1100010 0x80 kqread syslogd
92371 435736 1 0 3 0x100002 0x80 sbwait syslogd
1122 514123 1 0 3 0x100000 0x80 kqread resolvd
39934 103492 98418 77 3 0x100012 0x80 kqread dhcpleased
96270 235195 98418 77 3 0x100012 0x80 kqread dhcpleased
98418 238979 1 0 3 0 0x80 kqread dhcpleased
9151 232093 0 0 3 0x14000 0x200 bored smr
30667 484836 0 0 3 0x14000 0x200 pgzero zerothread
55098 141218 0 0 3 0x14000 0x200 aiodoned aiodoned
2546 342691 0 0 3 0x14000 0x200 syncer update
96974 424651 0 0 3 0x14000 0x200 cleaner cleaner
77895 491198 0 0 3 0x14000 0x200 reaper reaper
14160 76965 0 0 3 0x14000 0x200 pgdaemon pagedaemon
79999 515730 0 0 3 0x14000 0x200 bored viomb
11090 346840 0 0 3 0x14000 0x40000200 acpi0 acpi0
51090 455264 0 0 7 0x14000 0x40000200 idle1
83892 494514 0 0 3 0x14000 0x200 bored softnet1
65566 275250 0 0 3 0x14000 0x200 bored softnet0
8968 303727 0 0 3 0x14000 0x200 smrbar systqmp
95716 302690 0 0 3 0x14000 0x200 bored systq
24763 18873 0 0 3 0x14000 0x200 tmoslp softclockmp
37175 172656 0 0 3 0x14000 0x40000200 tmoslp softclock
2428 208698 0 0 3 0x14000 0x40000200 idle0
1 388740 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 8968 (systqmp) thread 0xffff800045ffe530 (303727)
shared rwlock systqmp r = 0 (0xffffffff85317cd8)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x1ba sys/kern/kern_task.c:442
#2 proc_trampoline+0x10
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11065 12246K 12394K 166960K 12159 0
pcb 26 24K 24K 166960K 26 0
rtable 255 22K 30K 166960K 341 0
pf 34 22K 26K 166960K 45 0
ifaddr 43 12K 12K 166960K 45 0
ifgroup 55 2K 2K 166960K 55 0
sysctl 1 1K 13K 166960K 5 0
counters 70 42K 42K 166960K 70 0
ioctlops 10 10K 194K 166960K 1491 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1321 85K 85K 166960K 1392 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 2K 166960K 2 0
VM map 2 1K 1K 166960K 2 0
sem 4 0K 0K 166960K 4 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1692 195K 405K 166960K 12470 0
file desc 13 40K 121K 166960K 166 0
proc 102 146K 179K 166960K 571 0
subproc 81 10K 10K 166960K 81 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 2 0K 0K 166960K 2 0
in_multi 100 7K 7K 166960K 100 0
ether_multi 1 0K 0K 166960K 1 0
mrt 5 0K 0K 166960K 7 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 55 384K 384K 166960K 55 0
exec 15 3K 17K 166960K 386 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM amap 621 300K 363K 166960K 3393 0
UVM aobj 6 4K 4K 166960K 6 0
pinsyscall 127 235K 382K 166960K 1330 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 2 0K 0K 166960K 2 0
NDP 28 2K 2K 166960K 28 0
temp 226 9250K 9461K 166960K 3590 0
kqueue 24 77K 84K 166960K 36 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 35 0 32 1 0 1 1 0 8 0
rtentry 176 111 0 23 5 0 5 5 0 8 0
unpcb 144 64 0 47 1 0 1 1 0 8 0
syncache 336 4 0 4 2 1 1 1 0 8 1
tcpcb 736 12 0 8 1 0 1 1 0 8 0
arp 136 18 0 4 1 0 1 1 0 8 0
inpcb 328 87 0 79 2 0 2 2 0 8 0
nd6 152 24 0 6 1 0 1 1 0 8 0
kcovpl 48 9 0 2 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 33 0 0 1 0 1 1 0 8 0
pfstkey 128 33 0 0 2 0 2 2 0 8 0
pfstate 448 33 0 0 4 0 4 4 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 453 0 44 29 0 29 29 0 8 1
art_table 40 454 0 44 5 0 5 5 0 8 0
art_node 32 111 0 31 1 0 1 1 0 8 0
semapl 72 2 0 0 1 0 1 1 0 8 0
shmpl 120 3 0 0 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1628 0 157 93 0 93 93 0 8 0
ffsino 296 1628 0 157 114 0 114 114 0 8 0
nchpl 144 1870 0 171 64 0 64 64 0 8 0
vnodes 216 1732 0 0 97 0 97 97 0 8 0
namei 1024 6566 0 6566 3 1 2 2 0 8 2
percpumem 16 51 0 2 1 0 1 1 0 8 0
kstatmem 264 27 0 4 2 0 2 2 0 8 0
scxspl 216 6864 0 6864 4 3 1 3 1 8 1
plimitpl 152 38 0 21 1 0 1 1 0 8 0
sigapl 424 482 0 440 7 0 7 7 0 8 1
knotepl 120 137 0 0 5 0 5 5 0 8 0
kqueuepl 224 39 0 30 1 0 1 1 0 8 0
pipepl 344 138 0 111 3 0 3 3 0 8 0
fdescpl 528 466 0 441 3 0 3 3 0 8 0
filepl 160 1797 0 1603 10 0 10 10 0 8 0
lockfpl 104 12 0 10 1 0 1 1 0 8 0
lockfspl 48 7 0 5 1 0 1 1 0 8 0
sessionpl 144 28 0 19 1 0 1 1 0 8 0
pgrppl 48 37 0 20 1 0 1 1 0 8 0
ucredpl 104 137 0 124 1 0 1 1 0 8 0
zombiepl 144 442 0 440 1 0 1 1 0 8 0
processpl 1240 482 0 440 5 0 5 5 0 8 0
procpl 664 538 0 496 6 0 6 6 0 8 1
sockpl 752 186 0 158 4 0 4 4 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 106 0 0 14 0 14 14 0 8 0
mcl2k 2048 29 0 0 4 0 4 4 0 8 0
mextrefs 64 24 0 0 1 0 1 1 0 8 0
mtagpl 96 1 0 0 1 0 1 1 0 8 0
mbufpl 256 210 0 0 14 0 14 14 0 8 0
bufpl 272 2356 0 106 150 0 150 150 0 8 0
anonpl 32 4099 0 0 33 0 33 33 0 222 0
amapchunkpl 152 9347 0 9071 22 0 22 22 0 158 6
amappl16 200 1875 0 1858 5 1 4 5 0 8 2
amappl15 192 5 0 5 1 1 0 1 0 8 0
amappl14 184 436 0 434 1 0 1 1 0 8 0
amappl13 176 136 0 123 1 0 1 1 0 8 0
amappl12 168 715 0 692 2 0 2 2 0 8 0
amappl11 160 9 0 9 2 1 1 1 0 8 1
amappl10 152 69 0 55 1 0 1 1 0 8 0
amappl9 144 290 0 289 1 0 1 1 0 8 0
amappl8 136 221 0 219 1 0 1 1 0 8 0
amappl7 128 164 0 150 1 0 1 1 0 8 0
amappl6 120 157 0 154 1 0 1 1 0 8 0
amappl5 112 107 0 97 1 0 1 1 0 8 0
amappl4 104 294 0 274 1 0 1 1 0 8 0
amappl3 96 1578 0 1520 3 0 3 3 0 8 0
amappl2 88 598 0 525 2 0 2 2 0 8 0
amappl1 80 10600 0 10028 15 0 15 15 0 8 2
amappl 88 2655 0 2557 5 0 5 5 0 92 0
uvmvnodes 80 98 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 5 0 0 1 0 1 1 0 8 0
uaddrrnd 24 466 0 441 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 466 0 441 1 0 1 1 0 8 0
vmmpekpl 168 5967 0 5918 3 0 3 3 0 8 0
vmmpepl 168 40018 0 38500 87 0 87 87 0 357 8
vmsppl 488 465 0 441 5 0 5 5 0 8 1
rwobjpl 80 15038 0 14091 24 0 24 24 0 8 2
pdppl 4096 941 0 882 97 30 67 87 0 8 8
pvpl 32 10430 0 0 86 1 85 85 0 265 0
pmappl 256 465 0 441 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 120 424 0 35 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff80000016d800) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff800001729000) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff800001729000) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff800001729000) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299ed940) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d01,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299eda80) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001ae4af8,7,ffff800000119208,ffff8000298f4540) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001bd4220,ffff8000298f4540) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001bd4220,ffff8000298f4540) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001bd4220,ffff8000298f4540) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000298f4540) at fdfree+0x16d sys/kern/kern_descrip.c:1203
exit1(ffff8000298f4540,43,0,1) at exit1+0x81e sys/kern/kern_exit.c:217
sys_exit(ffff8000298f4540,ffff8000299ee020,ffff8000299edf80) at sys_exit+0x4a
syscall(ffff8000299ee020) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299ee020) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ec9995640d0, count: -18
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x63c sys/dev/acpi/acpicpu_x86.c:-1
sched_idle(ffff800028fe3ff0) at sched_idle+0x566 sys/kern/kern_sched.c:204
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x63c sys/dev/acpi/acpicpu_x86.c:-1
sched_idle(ffff800028fe3ff0) at sched_idle+0x566 sys/kern/kern_sched.c:204
end trace frame: 0x0, count: -5
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages