KASAN: invalid memory access in __mp_lock
0 views
Skip to first unread message
syzbot
Jul 11, 2026, 10:48:34 AMJul 11
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 275dedaf93b0 drm/amdgpu: tear down userq mgr and eviction ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=169590b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=e25d17ace82c96de4887
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7c4ef6ece368/disk-275dedaf.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/f37413fa5768/bsd-275dedaf.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ae4a84e28f1c/kernel-275dedaf.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e25d17...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff800001c0c918 size 160 op 1
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 72261 60870 0 0 0x4000000 0K syz-executor
242938 81502 73 0x1100010 0x1 1 syslogd
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff800001c0c918,ffff800001c2bb00,a0) at kasan_memcpy+0x1ec
sysctl_sysvmsg(ffff80003bb34c88,1,200000000040,ffff80003bb34c60) at sysctl_sysvmsg+0x216 sys/kern/sysv_msg.c:734
kern_sysctl_dirs(33,ffff80003bb34c88,1,200000000040,ffff80003bb34c60,0,1,1ffff00007766908) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
kern_sysctl(ffff80003bb34c84,2,200000000040,ffff80003bb34c60,0,0,ffff80003bb34ed0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ffd4d8,ffff80003bb34ed0,ffff80003bb34e40) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bb34ed0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb34ed0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc25cdc24f10, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff800001c0c918 size 160 op 1
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff800001c0c918,ffff800001c2bb00,a0) at kasan_memcpy+0x1ec
sysctl_sysvmsg(ffff80003bb34c88,1,200000000040,ffff80003bb34c60) at sysctl_sysvmsg+0x216 sys/kern/sysv_msg.c:734
kern_sysctl_dirs(33,ffff80003bb34c88,1,200000000040,ffff80003bb34c60,0,1,1ffff00007766908) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
kern_sysctl(ffff80003bb34c84,2,200000000040,ffff80003bb34c60,0,0,ffff80003bb34ed0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ffd4d8,ffff80003bb34ed0,ffff80003bb34e40) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bb34ed0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb34ed0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc25cdc24f10, count: -9
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff80003bb344f0
rbx 0xffff80003bb34560
rdx 0
rcx 0xffffffff853a2ff0 cpu_info_full_primary+0x1ff0
rax 0xffff80000016e500
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff80003bb342d8
r11 0xffffffff814e1f30 x86_bus_space_io_read_1
r12 0xffffffff846334c7 db_machine_command_table+0x9b027
r13 0xffffffff853a3c08 cpu_info_full_primary+0x2c08
r14 0xffffffff853a3e07 cpu_info_full_primary+0x2e07
r15 0x1
rip 0xffffffff81006567 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff80003bb344f0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=72261 pid=60870 tcnt=3 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff8000298b2030,0xffff80003bbba568
process=0xffff80003ab09368 user=0xffff80003bb29000, vmspace=0xffff800001afa5d8
estcpu=36, cpticks=24, pctcpu=0.0, user=0, sys=23, intr=1
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
82984 377821 99397 0 2 0 syz-executor
82984 447160 99397 0 2 0x4000000 syz-executor
54457 326751 4276 0 2 0 syz-executor
54457 254456 4276 0 3 0x4000080 fifow syz-executor
54457 314791 4276 0 2 0x4000000 syz-executor
60870 7334 46509 0 2 0 syz-executor
*60870 72261 46509 0 7 0x4000000 syz-executor
60870 19337 46509 0 3 0x4000080 fsleep syz-executor
57516 34786 72223 0 2 0 syz-executor
57516 332001 72223 0 3 0x4000080 fsleep syz-executor
71332 457685 10247 0 2 0 syz-executor
71332 111064 10247 0 3 0x4000080 fsleep syz-executor
16710 374792 0 0 3 0x14280 nfsidl nfsio
32519 322997 0 0 3 0x14280 nfsidl nfsio
21372 391255 0 0 3 0x14280 nfsidl nfsio
96328 102508 0 0 3 0x14280 nfsidl nfsio
42404 398741 0 0 3 0x14280 nfsidl nfsio
97256 21691 0 0 3 0x14280 nfsidl nfsio
4206 347325 0 0 3 0x14280 nfsidl nfsio
63314 226067 0 0 3 0x14280 nfsidl nfsio
63756 268066 0 0 3 0x14280 nfsidl nfsio
63079 246835 0 0 3 0x14280 nfsidl nfsio
50522 496308 0 0 3 0x14280 nfsidl nfsio
34844 318537 0 0 3 0x14280 nfsidl nfsio
68617 311530 0 0 3 0x14280 nfsidl nfsio
13587 218179 0 0 3 0x14280 nfsidl nfsio
79359 69489 0 0 3 0x14280 nfsidl nfsio
45686 139621 0 0 3 0x14280 nfsidl nfsio
76403 26307 0 0 3 0x14280 nfsidl nfsio
49352 403997 0 0 3 0x14280 nfsidl nfsio
38009 98012 0 0 3 0x14280 nfsidl nfsio
88117 89485 0 0 3 0x14280 nfsidl nfsio
34139 200537 72125 0 4 0x48000000 syz-executor
34139 404615 72125 0 4 0x4c000000 syz-executor
34139 249903 72125 0 4 0x4c000080 fsleep syz-executor
72223 98821 93371 0 2 0xc82 syz-executor
93237 184134 93371 0 3 0x82 wait syz-executor
99397 276869 93371 0 2 0xc82 syz-executor
46509 341642 93371 0 2 0xc82 syz-executor
72125 244497 93371 0 4 0x58000882 syz-executor
10247 50953 93371 0 2 0xc82 syz-executor
4276 497146 93371 0 2 0xc82 syz-executor
37638 121314 93371 0 2 0x2 syz-executor
93371 133390 70436 0 3 0x10000082 kqread syz-executor
70436 226752 85748 0 3 0x10008a sigsusp ksh
85748 239978 25811 0 3 0x98 kqread sshd-session
25811 316606 8261 0 3 0x92 kqread sshd-session
90676 1272 1 0 3 0x100083 ttyin getty
8261 124383 1 0 3 0x88 kqread sshd
82558 44255 71467 74 3 0x1100092 bpf pflogd
71467 495066 1 0 3 0x80 sbwait pflogd
81502 242938 85680 73 7 0x1100011 syslogd
85680 420371 1 0 3 0x100082 sbwait syslogd
60445 7661 1 0 3 0x100080 kqread resolvd
49658 84768 97797 77 3 0x100092 kqread dhcpleased
7813 412140 97797 77 3 0x100092 kqread dhcpleased
97797 246959 1 0 3 0x80 kqread dhcpleased
49422 435122 0 0 3 0x14200 bored smr
32455 359752 0 0 2 0x14200 zerothread
40137 126699 0 0 3 0x14200 aiodoned aiodoned
19116 403848 0 0 3 0x14200 syncer update
70095 275515 0 0 3 0x14200 cleaner cleaner
13830 195839 0 0 3 0x14200 reaper reaper
58699 25783 0 0 3 0x14200 pgdaemon pagedaemon
67889 231814 0 0 3 0x14200 bored viomb
20477 191594 0 0 3 0x40014200 acpi0 acpi0
12185 376404 0 0 3 0x40014200 idle1
51813 334693 0 0 3 0x14200 bored softnet1
76428 46986 0 0 2 0x14200 softnet0
31068 176308 0 0 2 0x14200 systqmp
76867 289426 0 0 3 0x14200 bored systq
57710 368319 0 0 2 0x14200 softclockmp
17870 38713 0 0 3 0x40014200 tmoslp softclock
60061 404318 0 0 3 0x40014200 idle0
1 153144 0 0 3 0x80082 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 60870 (syz-executor) thread 0xffff800045ffd4d8 (72261)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85d533c0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 sysctl_vslock+0x72 sys/kern/kern_sysctl.c:197
#2 kern_sysctl_dirs+0x2d2 sys/kern/kern_sysctl.c:443
#3 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#4 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#6 Xsyscall+0x128
exclusive rwlock sysctllk r = 0 (0xffffffff84ec60b8)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 sysctl_vslock+0x37 sys/kern/kern_sysctl.c:192
#3 kern_sysctl_dirs+0x2d2 sys/kern/kern_sysctl.c:443
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
Process 37638 (syz-executor) thread 0xffff800029922540 (121314)
exclusive rrwlock inode r = 0 (0xffff800001ab1c50)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 ufs_ihashins+0xda sys/ufs/ufs/ufs_ihash.c:146
#5 ffs_vget+0x2e9 sys/ufs/ffs/ffs_vfsops.c:1232
#6 ffs_inode_alloc+0x576 sys/ufs/ffs/ffs_alloc.c:393
#7 ufs_mkdir+0x25d sys/ufs/ufs/ufs_vnops.c:1112
#8 VOP_MKDIR+0x1a8 sys/kern/vfs_vops.c:394
#9 domkdirat+0x1f9 sys/kern/vfs_syscalls.c:3063
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffff8000017f00b0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 vn_lock+0xca sys/kern/vfs_vnops.c:576
#5 vfs_lookup+0x1f7 sys/kern/vfs_lookup.c:431
#6 namei+0xe19 sys/kern/vfs_lookup.c:250
#7 domkdirat+0xe1 sys/kern/vfs_syscalls.c:3048
#8 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#9 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11067 12252K 12395K 166960K 12353 0
pcb 18 24K 24K 166960K 45 0
rtable 240 13K 13K 166960K 356 0
pf 37 23K 39K 166960K 63 0
ifaddr 44 12K 13K 166960K 52 0
ifgroup 60 2K 2K 166960K 75 0
sysctl 3 1K 13K 166960K 8 0
counters 72 43K 43K 166960K 80 0
ioctlops 0 0K 4K 166960K 1507 0
iov 0 0K 12K 166960K 5 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1405 90K 90K 166960K 1585 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 10K 166960K 30 0
VM map 2 1K 1K 166960K 2 0
sem 9 0K 0K 166960K 9 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 17 61K 97K 166960K 381 0
sigio 0 0K 0K 166960K 9 0
proc 72 128K 193K 166960K 593 0
subproc 72 9K 9K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 2 0
in_multi 99 7K 7K 166960K 99 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 16 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 97 668K 668K 166960K 97 0
exec 0 0K 2K 166960K 387 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 233 244K 265K 166960K 5416 0
UVM aobj 38 5K 8K 166960K 39 0
pinsyscall 42 84K 105K 166960K 1540 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 2 0
NDP 13 0K 2K 166960K 33 0
temp 75 9180K 9196K 166960K 6576 0
kqueue 16 46K 61K 166960K 97 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 33 0 30 1 0 1 1 0 8 0
rtentry 176 112 0 1 6 0 6 6 0 8 0
unpcb 144 279 0 260 2 0 2 2 0 8 1
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 96 0 92 7 6 1 7 0 8 0
arp 136 19 0 0 1 0 1 1 0 8 0
inpcb 328 231 0 221 7 5 2 7 0 8 1
nd6 152 24 0 0 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
ppxss 1192 1 0 1 1 0 1 1 0 8 1
pffrag 232 3 0 0 1 0 1 1 0 482 0
pffrnode 88 2 0 0 1 0 1 1 0 8 0
pffrent 40 4 0 1 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfrktable 1344 1 0 1 1 0 1 1 0 8 1
pfqueue 320 1 0 1 1 0 1 1 0 8 1
pfstitem 24 37 0 3 1 0 1 1 0 8 0
pfstkey 128 37 0 3 2 0 2 2 0 8 0
pfstate 448 37 0 3 4 0 4 4 0 8 0
pfrule 1360 22 0 17 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 452 0 0 29 0 29 29 0 8 0
art_table 40 453 0 0 5 0 5 5 0 8 0
art_node 32 112 0 11 1 0 1 1 0 8 0
sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 72 7 0 0 1 0 1 1 0 8 0
shmpl 112 36 0 1 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1973 0 498 93 0 93 93 0 8 0
ffsino 296 1973 0 498 114 0 114 114 0 8 0
nchpl 144 2508 0 804 64 0 64 64 0 8 0
vnodes 216 2237 0 0 125 0 125 125 0 8 0
namei 1024 8424 0 8423 2 1 1 2 0 8 0
percpumem 16 56 0 4 1 0 1 1 0 8 0
kstatmem 264 37 0 8 3 0 3 3 0 8 1
scxspl 216 9004 0 9004 11 8 3 8 1 8 3
plimitpl 152 38 0 21 1 0 1 1 0 8 0
sigapl 424 719 0 652 9 1 8 8 0 8 0
knotepl 120 127 0 0 4 0 4 4 0 8 0
kqueuepl 224 126 0 113 2 1 1 2 0 8 0
pipepl 344 363 0 336 9 1 8 9 0 8 5
fdescpl 528 683 0 652 3 0 3 3 0 8 0
filepl 160 3950 0 3731 21 4 17 21 0 8 7
lockfpl 104 177 0 175 2 1 1 2 0 8 0
lockfspl 48 35 0 33 1 0 1 1 0 8 0
sessionpl 144 34 0 25 1 0 1 1 0 8 0
pgrppl 48 111 0 94 1 0 1 1 0 8 0
ucredpl 104 414 0 401 1 0 1 1 0 8 0
zombiepl 144 653 0 652 1 0 1 1 0 8 0
processpl 1232 719 0 652 6 0 6 6 0 8 0
procpl 664 1154 0 1078 7 0 7 7 0 8 0
sockpl 752 544 0 512 10 5 5 10 0 8 1
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 123 0 0 16 0 16 16 0 8 0
mcl2k 2048 22 0 0 3 0 3 3 0 8 0
mextrefs 64 22 0 0 1 0 1 1 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 214 0 0 13 0 13 13 0 8 0
bufpl 272 2805 0 106 180 0 180 180 0 8 0
anonpl 32 3849 0 0 31 0 31 31 0 222 0
amapchunkpl 152 15851 0 15375 22 0 22 22 0 158 2
amappl16 200 2111 0 2080 6 3 3 5 0 8 0
amappl15 192 9 0 9 3 2 1 1 0 8 1
amappl14 184 432 0 431 1 0 1 1 0 8 0
amappl13 176 121 0 109 1 0 1 1 0 8 0
amappl12 168 933 0 903 2 0 2 2 0 8 0
amappl11 160 19 0 18 1 0 1 1 0 8 0
amappl10 152 66 0 52 1 0 1 1 0 8 0
amappl9 144 276 0 276 2 1 1 1 0 8 1
amappl8 136 99 0 96 1 0 1 1 0 8 0
amappl7 128 158 0 145 1 0 1 1 0 8 0
amappl6 120 158 0 156 1 0 1 1 0 8 0
amappl5 112 109 0 99 1 0 1 1 0 8 0
amappl4 104 303 0 283 1 0 1 1 0 8 0
amappl3 96 3149 0 3036 4 0 4 4 0 8 0
amappl2 88 554 0 493 2 0 2 2 0 8 0
amappl1 80 11481 0 10878 16 3 13 15 0 8 0
amappl 88 4644 0 4482 5 0 5 5 0 92 0
uvmvnodes 80 112 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 38 0 1 1 0 1 1 0 8 0
uaddrrnd 24 683 0 652 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 683 0 652 1 0 1 1 0 8 0
vmmpekpl 168 8252 0 8219 3 0 3 3 0 8 0
vmmpepl 168 51708 0 49793 87 0 87 87 0 357 1
vmsppl 488 682 0 652 5 1 4 5 0 8 0
rwobjpl 80 17539 0 16464 24 0 24 24 0 8 0
pdppl 4096 1375 0 1304 105 32 73 89 0 8 2
pvpl 32 11899 0 0 96 0 96 96 0 265 0
pmappl 256 682 0 652 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 469 0 44 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff800001c0c918,ffff800001c2bb00,a0) at kasan_memcpy+0x1ec
sysctl_sysvmsg(ffff80003bb34c88,1,200000000040,ffff80003bb34c60) at sysctl_sysvmsg+0x216 sys/kern/sysv_msg.c:734
kern_sysctl_dirs(33,ffff80003bb34c88,1,200000000040,ffff80003bb34c60,0,1,1ffff00007766908) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
kern_sysctl(ffff80003bb34c84,2,200000000040,ffff80003bb34c60,0,0,ffff80003bb34ed0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ffd4d8,ffff80003bb34ed0,ffff80003bb34e40) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bb34ed0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb34ed0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc25cdc24f10, count: -9
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffff800028ff3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff85d533b8) at __asan_load4_noabort+0xd kasan_shadow_check sys/kern/subr_kasan.c:911 [inline]
__asan_load4_noabort(ffffffff85d533b8) at __asan_load4_noabort+0xd sys/kern/subr_kasan.c:1037
__mp_lock(ffffffff85d52bc0) at __mp_lock+0x27a __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85d52bc0) at __mp_lock+0x27a sys/kern/kern_lock.c:173
ktrstruct(ffff800029923c98,ffffffff84e19440,ffff8000299a46c0,20) at ktrstruct+0x13f sys/kern/kern_ktrace.c:314
sys_kevent(ffff800029923c98,ffff8000299a49f0,ffff8000299a4960) at sys_kevent+0xacb sys/kern/kern_event.c:1345
syscall(ffff8000299a49f0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299a49f0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7d87aa1b18a0, count: 6
ddb{1}> trace
x86_ipi_db(ffff800028ff3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff85d533b8) at __asan_load4_noabort+0xd kasan_shadow_check sys/kern/subr_kasan.c:911 [inline]
__asan_load4_noabort(ffffffff85d533b8) at __asan_load4_noabort+0xd sys/kern/subr_kasan.c:1037
__mp_lock(ffffffff85d52bc0) at __mp_lock+0x27a __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85d52bc0) at __mp_lock+0x27a sys/kern/kern_lock.c:173
ktrstruct(ffff800029923c98,ffffffff84e19440,ffff8000299a46c0,20) at ktrstruct+0x13f sys/kern/kern_ktrace.c:314
sys_kevent(ffff800029923c98,ffff8000299a49f0,ffff8000299a4960) at sys_kevent+0xacb sys/kern/kern_event.c:1345
syscall(ffff8000299a49f0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299a49f0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7d87aa1b18a0, count: -9
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 275dedaf93b0 drm/amdgpu: tear down userq mgr and eviction ..
git tree: https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan
console output: https://syzkaller.appspot.com/x/log.txt?x=169590b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85e25e37d09e1b88
dashboard link: https://syzkaller.appspot.com/bug?extid=e25d17ace82c96de4887
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7c4ef6ece368/disk-275dedaf.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/f37413fa5768/bsd-275dedaf.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ae4a84e28f1c/kernel-275dedaf.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e25d17...@syzkaller.appspotmail.com
panic: Caught invalid memory access at ffff800001c0c918 size 160 op 1
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 72261 60870 0 0 0x4000000 0K syz-executor
242938 81502 73 0x1100010 0x1 1 syslogd
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff800001c0c918,ffff800001c2bb00,a0) at kasan_memcpy+0x1ec
sysctl_sysvmsg(ffff80003bb34c88,1,200000000040,ffff80003bb34c60) at sysctl_sysvmsg+0x216 sys/kern/sysv_msg.c:734
kern_sysctl_dirs(33,ffff80003bb34c88,1,200000000040,ffff80003bb34c60,0,1,1ffff00007766908) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
kern_sysctl(ffff80003bb34c84,2,200000000040,ffff80003bb34c60,0,0,ffff80003bb34ed0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ffd4d8,ffff80003bb34ed0,ffff80003bb34e40) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bb34ed0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb34ed0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc25cdc24f10, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff800001c0c918 size 160 op 1
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff800001c0c918,ffff800001c2bb00,a0) at kasan_memcpy+0x1ec
sysctl_sysvmsg(ffff80003bb34c88,1,200000000040,ffff80003bb34c60) at sysctl_sysvmsg+0x216 sys/kern/sysv_msg.c:734
kern_sysctl_dirs(33,ffff80003bb34c88,1,200000000040,ffff80003bb34c60,0,1,1ffff00007766908) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
kern_sysctl(ffff80003bb34c84,2,200000000040,ffff80003bb34c60,0,0,ffff80003bb34ed0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ffd4d8,ffff80003bb34ed0,ffff80003bb34e40) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bb34ed0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb34ed0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc25cdc24f10, count: -9
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff80003bb344f0
rbx 0xffff80003bb34560
rdx 0
rcx 0xffffffff853a2ff0 cpu_info_full_primary+0x1ff0
rax 0xffff80000016e500
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff80003bb342d8
r11 0xffffffff814e1f30 x86_bus_space_io_read_1
r12 0xffffffff846334c7 db_machine_command_table+0x9b027
r13 0xffffffff853a3c08 cpu_info_full_primary+0x2c08
r14 0xffffffff853a3e07 cpu_info_full_primary+0x2e07
r15 0x1
rip 0xffffffff81006567 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff80003bb344f0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=72261 pid=60870 tcnt=3 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff8000298b2030,0xffff80003bbba568
process=0xffff80003ab09368 user=0xffff80003bb29000, vmspace=0xffff800001afa5d8
estcpu=36, cpticks=24, pctcpu=0.0, user=0, sys=23, intr=1
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
82984 377821 99397 0 2 0 syz-executor
82984 447160 99397 0 2 0x4000000 syz-executor
54457 326751 4276 0 2 0 syz-executor
54457 254456 4276 0 3 0x4000080 fifow syz-executor
54457 314791 4276 0 2 0x4000000 syz-executor
60870 7334 46509 0 2 0 syz-executor
*60870 72261 46509 0 7 0x4000000 syz-executor
60870 19337 46509 0 3 0x4000080 fsleep syz-executor
57516 34786 72223 0 2 0 syz-executor
57516 332001 72223 0 3 0x4000080 fsleep syz-executor
71332 457685 10247 0 2 0 syz-executor
71332 111064 10247 0 3 0x4000080 fsleep syz-executor
16710 374792 0 0 3 0x14280 nfsidl nfsio
32519 322997 0 0 3 0x14280 nfsidl nfsio
21372 391255 0 0 3 0x14280 nfsidl nfsio
96328 102508 0 0 3 0x14280 nfsidl nfsio
42404 398741 0 0 3 0x14280 nfsidl nfsio
97256 21691 0 0 3 0x14280 nfsidl nfsio
4206 347325 0 0 3 0x14280 nfsidl nfsio
63314 226067 0 0 3 0x14280 nfsidl nfsio
63756 268066 0 0 3 0x14280 nfsidl nfsio
63079 246835 0 0 3 0x14280 nfsidl nfsio
50522 496308 0 0 3 0x14280 nfsidl nfsio
34844 318537 0 0 3 0x14280 nfsidl nfsio
68617 311530 0 0 3 0x14280 nfsidl nfsio
13587 218179 0 0 3 0x14280 nfsidl nfsio
79359 69489 0 0 3 0x14280 nfsidl nfsio
45686 139621 0 0 3 0x14280 nfsidl nfsio
76403 26307 0 0 3 0x14280 nfsidl nfsio
49352 403997 0 0 3 0x14280 nfsidl nfsio
38009 98012 0 0 3 0x14280 nfsidl nfsio
88117 89485 0 0 3 0x14280 nfsidl nfsio
34139 200537 72125 0 4 0x48000000 syz-executor
34139 404615 72125 0 4 0x4c000000 syz-executor
34139 249903 72125 0 4 0x4c000080 fsleep syz-executor
72223 98821 93371 0 2 0xc82 syz-executor
93237 184134 93371 0 3 0x82 wait syz-executor
99397 276869 93371 0 2 0xc82 syz-executor
46509 341642 93371 0 2 0xc82 syz-executor
72125 244497 93371 0 4 0x58000882 syz-executor
10247 50953 93371 0 2 0xc82 syz-executor
4276 497146 93371 0 2 0xc82 syz-executor
37638 121314 93371 0 2 0x2 syz-executor
93371 133390 70436 0 3 0x10000082 kqread syz-executor
70436 226752 85748 0 3 0x10008a sigsusp ksh
85748 239978 25811 0 3 0x98 kqread sshd-session
25811 316606 8261 0 3 0x92 kqread sshd-session
90676 1272 1 0 3 0x100083 ttyin getty
8261 124383 1 0 3 0x88 kqread sshd
82558 44255 71467 74 3 0x1100092 bpf pflogd
71467 495066 1 0 3 0x80 sbwait pflogd
81502 242938 85680 73 7 0x1100011 syslogd
85680 420371 1 0 3 0x100082 sbwait syslogd
60445 7661 1 0 3 0x100080 kqread resolvd
49658 84768 97797 77 3 0x100092 kqread dhcpleased
7813 412140 97797 77 3 0x100092 kqread dhcpleased
97797 246959 1 0 3 0x80 kqread dhcpleased
49422 435122 0 0 3 0x14200 bored smr
32455 359752 0 0 2 0x14200 zerothread
40137 126699 0 0 3 0x14200 aiodoned aiodoned
19116 403848 0 0 3 0x14200 syncer update
70095 275515 0 0 3 0x14200 cleaner cleaner
13830 195839 0 0 3 0x14200 reaper reaper
58699 25783 0 0 3 0x14200 pgdaemon pagedaemon
67889 231814 0 0 3 0x14200 bored viomb
20477 191594 0 0 3 0x40014200 acpi0 acpi0
12185 376404 0 0 3 0x40014200 idle1
51813 334693 0 0 3 0x14200 bored softnet1
76428 46986 0 0 2 0x14200 softnet0
31068 176308 0 0 2 0x14200 systqmp
76867 289426 0 0 3 0x14200 bored systq
57710 368319 0 0 2 0x14200 softclockmp
17870 38713 0 0 3 0x40014200 tmoslp softclock
60061 404318 0 0 3 0x40014200 idle0
1 153144 0 0 3 0x80082 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 60870 (syz-executor) thread 0xffff800045ffd4d8 (72261)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85d533c0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 sysctl_vslock+0x72 sys/kern/kern_sysctl.c:197
#2 kern_sysctl_dirs+0x2d2 sys/kern/kern_sysctl.c:443
#3 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#4 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#6 Xsyscall+0x128
exclusive rwlock sysctllk r = 0 (0xffffffff84ec60b8)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 sysctl_vslock+0x37 sys/kern/kern_sysctl.c:192
#3 kern_sysctl_dirs+0x2d2 sys/kern/kern_sysctl.c:443
#4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7 Xsyscall+0x128
Process 37638 (syz-executor) thread 0xffff800029922540 (121314)
exclusive rrwlock inode r = 0 (0xffff800001ab1c50)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 ufs_ihashins+0xda sys/ufs/ufs/ufs_ihash.c:146
#5 ffs_vget+0x2e9 sys/ufs/ffs/ffs_vfsops.c:1232
#6 ffs_inode_alloc+0x576 sys/ufs/ffs/ffs_alloc.c:393
#7 ufs_mkdir+0x25d sys/ufs/ufs/ufs_vnops.c:1112
#8 VOP_MKDIR+0x1a8 sys/kern/vfs_vops.c:394
#9 domkdirat+0x1f9 sys/kern/vfs_syscalls.c:3063
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffff8000017f00b0)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 vn_lock+0xca sys/kern/vfs_vnops.c:576
#5 vfs_lookup+0x1f7 sys/kern/vfs_lookup.c:431
#6 namei+0xe19 sys/kern/vfs_lookup.c:250
#7 domkdirat+0xe1 sys/kern/vfs_syscalls.c:3048
#8 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#9 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11067 12252K 12395K 166960K 12353 0
pcb 18 24K 24K 166960K 45 0
rtable 240 13K 13K 166960K 356 0
pf 37 23K 39K 166960K 63 0
ifaddr 44 12K 13K 166960K 52 0
ifgroup 60 2K 2K 166960K 75 0
sysctl 3 1K 13K 166960K 8 0
counters 72 43K 43K 166960K 80 0
ioctlops 0 0K 4K 166960K 1507 0
iov 0 0K 12K 166960K 5 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1405 90K 90K 166960K 1585 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 10K 166960K 30 0
VM map 2 1K 1K 166960K 2 0
sem 9 0K 0K 166960K 9 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 292K 166960K 11964 0
file desc 17 61K 97K 166960K 381 0
sigio 0 0K 0K 166960K 9 0
proc 72 128K 193K 166960K 593 0
subproc 72 9K 9K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 2 0
in_multi 99 7K 7K 166960K 99 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 16 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 97 668K 668K 166960K 97 0
exec 0 0K 2K 166960K 387 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 233 244K 265K 166960K 5416 0
UVM aobj 38 5K 8K 166960K 39 0
pinsyscall 42 84K 105K 166960K 1540 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 2 0
NDP 13 0K 2K 166960K 33 0
temp 75 9180K 9196K 166960K 6576 0
kqueue 16 46K 61K 166960K 97 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 33 0 30 1 0 1 1 0 8 0
rtentry 176 112 0 1 6 0 6 6 0 8 0
unpcb 144 279 0 260 2 0 2 2 0 8 1
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 96 0 92 7 6 1 7 0 8 0
arp 136 19 0 0 1 0 1 1 0 8 0
inpcb 328 231 0 221 7 5 2 7 0 8 1
nd6 152 24 0 0 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
ppxss 1192 1 0 1 1 0 1 1 0 8 1
pffrag 232 3 0 0 1 0 1 1 0 482 0
pffrnode 88 2 0 0 1 0 1 1 0 8 0
pffrent 40 4 0 1 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfrktable 1344 1 0 1 1 0 1 1 0 8 1
pfqueue 320 1 0 1 1 0 1 1 0 8 1
pfstitem 24 37 0 3 1 0 1 1 0 8 0
pfstkey 128 37 0 3 2 0 2 2 0 8 0
pfstate 448 37 0 3 4 0 4 4 0 8 0
pfrule 1360 22 0 17 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 452 0 0 29 0 29 29 0 8 0
art_table 40 453 0 0 5 0 5 5 0 8 0
art_node 32 112 0 11 1 0 1 1 0 8 0
sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 72 7 0 0 1 0 1 1 0 8 0
shmpl 112 36 0 1 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1973 0 498 93 0 93 93 0 8 0
ffsino 296 1973 0 498 114 0 114 114 0 8 0
nchpl 144 2508 0 804 64 0 64 64 0 8 0
vnodes 216 2237 0 0 125 0 125 125 0 8 0
namei 1024 8424 0 8423 2 1 1 2 0 8 0
percpumem 16 56 0 4 1 0 1 1 0 8 0
kstatmem 264 37 0 8 3 0 3 3 0 8 1
scxspl 216 9004 0 9004 11 8 3 8 1 8 3
plimitpl 152 38 0 21 1 0 1 1 0 8 0
sigapl 424 719 0 652 9 1 8 8 0 8 0
knotepl 120 127 0 0 4 0 4 4 0 8 0
kqueuepl 224 126 0 113 2 1 1 2 0 8 0
pipepl 344 363 0 336 9 1 8 9 0 8 5
fdescpl 528 683 0 652 3 0 3 3 0 8 0
filepl 160 3950 0 3731 21 4 17 21 0 8 7
lockfpl 104 177 0 175 2 1 1 2 0 8 0
lockfspl 48 35 0 33 1 0 1 1 0 8 0
sessionpl 144 34 0 25 1 0 1 1 0 8 0
pgrppl 48 111 0 94 1 0 1 1 0 8 0
ucredpl 104 414 0 401 1 0 1 1 0 8 0
zombiepl 144 653 0 652 1 0 1 1 0 8 0
processpl 1232 719 0 652 6 0 6 6 0 8 0
procpl 664 1154 0 1078 7 0 7 7 0 8 0
sockpl 752 544 0 512 10 5 5 10 0 8 1
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 123 0 0 16 0 16 16 0 8 0
mcl2k 2048 22 0 0 3 0 3 3 0 8 0
mextrefs 64 22 0 0 1 0 1 1 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 214 0 0 13 0 13 13 0 8 0
bufpl 272 2805 0 106 180 0 180 180 0 8 0
anonpl 32 3849 0 0 31 0 31 31 0 222 0
amapchunkpl 152 15851 0 15375 22 0 22 22 0 158 2
amappl16 200 2111 0 2080 6 3 3 5 0 8 0
amappl15 192 9 0 9 3 2 1 1 0 8 1
amappl14 184 432 0 431 1 0 1 1 0 8 0
amappl13 176 121 0 109 1 0 1 1 0 8 0
amappl12 168 933 0 903 2 0 2 2 0 8 0
amappl11 160 19 0 18 1 0 1 1 0 8 0
amappl10 152 66 0 52 1 0 1 1 0 8 0
amappl9 144 276 0 276 2 1 1 1 0 8 1
amappl8 136 99 0 96 1 0 1 1 0 8 0
amappl7 128 158 0 145 1 0 1 1 0 8 0
amappl6 120 158 0 156 1 0 1 1 0 8 0
amappl5 112 109 0 99 1 0 1 1 0 8 0
amappl4 104 303 0 283 1 0 1 1 0 8 0
amappl3 96 3149 0 3036 4 0 4 4 0 8 0
amappl2 88 554 0 493 2 0 2 2 0 8 0
amappl1 80 11481 0 10878 16 3 13 15 0 8 0
amappl 88 4644 0 4482 5 0 5 5 0 92 0
uvmvnodes 80 112 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 38 0 1 1 0 1 1 0 8 0
uaddrrnd 24 683 0 652 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 683 0 652 1 0 1 1 0 8 0
vmmpekpl 168 8252 0 8219 3 0 3 3 0 8 0
vmmpepl 168 51708 0 49793 87 0 87 87 0 357 1
vmsppl 488 682 0 652 5 1 4 5 0 8 0
rwobjpl 80 17539 0 16464 24 0 24 24 0 8 0
pdppl 4096 1375 0 1304 105 32 73 89 0 8 2
pvpl 32 11899 0 0 96 0 96 96 0 265 0
pmappl 256 682 0 652 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 469 0 44 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff800001c0c918,ffff800001c2bb00,a0) at kasan_memcpy+0x1ec
sysctl_sysvmsg(ffff80003bb34c88,1,200000000040,ffff80003bb34c60) at sysctl_sysvmsg+0x216 sys/kern/sysv_msg.c:734
kern_sysctl_dirs(33,ffff80003bb34c88,1,200000000040,ffff80003bb34c60,0,1,1ffff00007766908) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
kern_sysctl(ffff80003bb34c84,2,200000000040,ffff80003bb34c60,0,0,ffff80003bb34ed0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ffd4d8,ffff80003bb34ed0,ffff80003bb34e40) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bb34ed0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb34ed0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc25cdc24f10, count: -9
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffff800028ff3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff85d533b8) at __asan_load4_noabort+0xd kasan_shadow_check sys/kern/subr_kasan.c:911 [inline]
__asan_load4_noabort(ffffffff85d533b8) at __asan_load4_noabort+0xd sys/kern/subr_kasan.c:1037
__mp_lock(ffffffff85d52bc0) at __mp_lock+0x27a __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85d52bc0) at __mp_lock+0x27a sys/kern/kern_lock.c:173
ktrstruct(ffff800029923c98,ffffffff84e19440,ffff8000299a46c0,20) at ktrstruct+0x13f sys/kern/kern_ktrace.c:314
sys_kevent(ffff800029923c98,ffff8000299a49f0,ffff8000299a4960) at sys_kevent+0xacb sys/kern/kern_event.c:1345
syscall(ffff8000299a49f0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299a49f0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7d87aa1b18a0, count: 6
ddb{1}> trace
x86_ipi_db(ffff800028ff3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff85d533b8) at __asan_load4_noabort+0xd kasan_shadow_check sys/kern/subr_kasan.c:911 [inline]
__asan_load4_noabort(ffffffff85d533b8) at __asan_load4_noabort+0xd sys/kern/subr_kasan.c:1037
__mp_lock(ffffffff85d52bc0) at __mp_lock+0x27a __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85d52bc0) at __mp_lock+0x27a sys/kern/kern_lock.c:173
ktrstruct(ffff800029923c98,ffffffff84e19440,ffff8000299a46c0,20) at ktrstruct+0x13f sys/kern/kern_ktrace.c:314
sys_kevent(ffff800029923c98,ffff8000299a49f0,ffff8000299a4960) at sys_kevent+0xacb sys/kern/kern_event.c:1345
syscall(ffff8000299a49f0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299a49f0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7d87aa1b18a0, count: -9
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages