panic: maddr rwlock ADDR: enter read deadlock
0 views
Skip to first unread message
syzbot
Jan 3, 2026, 7:43:25 AM (9 days ago) Jan 3
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 80bc9799356e Protect IGMP and MLD6 fast timer with rwlock.
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11db669a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=9ef22ca02dffcf088cf6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3af574212cde/disk-80bc9799.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/27206c6c4904/bsd-80bc9799.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d69078a9154c/kernel-80bc9799.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ef22c...@syzkaller.appspotmail.com
panic: maddr rwlock 0xffff800001582860: enter read deadlock
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*279817 82512 0 0x14000 0x40000200 0 softclock
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83325b9d) at panic+0x1cf sys/kern/subr_prf.c:198
rw_do_enter_read(ffff800001582860,0) at rw_do_enter_read+0x435 sys/kern/kern_rwlock.c:379
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd806c72c000,ffffffff839751a0,0,0,ffff80002a739d60,0) at ip6_output+0x1369 sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff80000159a680,83,0) at mld6_sendpkt+0x364 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff838ddf10) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff8383ff00,ffffffff838ddf10) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: maddr rwlock 0xffff800001582860: enter read deadlock
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83325b9d) at panic+0x1cf sys/kern/subr_prf.c:198
rw_do_enter_read(ffff800001582860,0) at rw_do_enter_read+0x435 sys/kern/kern_rwlock.c:379
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd806c72c000,ffffffff839751a0,0,0,ffff80002a739d60,0) at ip6_output+0x1369 sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff80000159a680,83,0) at mld6_sendpkt+0x364 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff838ddf10) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff8383ff00,ffffffff838ddf10) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: -10
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff80002a739a70
rbx 0xffff800001582800
rdx 0
rcx 0
rax 0xffff80002a72d758
r8 0x101010101010101
r9 0x8080808080808080
r10 0x6418f668fa9256ca
r11 0x90c404879bfd3160
r12 0
r13 0xffff80002a72d75c
r14 0
r15 0x1
rip 0xffffffff830eea05 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80002a739a60
ss 0
db_enter+0x25: addq $0x8,%rsp
ddb> show proc
PROC (softclock) tid=279817 pid=82512 tcnt=1 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
runpri=0, usrpri=50, slppri=0, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a72d9f0,0xffff80002a72cfa0
process=0xffff8000ffffe400 user=0xffff80002a734000, vmspace=0xffffffff838cbef8
estcpu=0, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
63446 236849 97636 0 2 0 syz-executor
63446 177329 97636 0 3 0x4000080 fsleep syz-executor
65233 397948 41648 0 2 0 syz-executor
65233 295529 41648 0 3 0x4000080 fsleep syz-executor
61910 136084 91344 0 2 0 syz-executor
61910 381565 91344 0 3 0x4000080 fsleep syz-executor
63980 268823 76209 0 2 0 syz-executor
63980 81577 76209 0 3 0x4000080 fsleep syz-executor
31488 139176 42923 0 2 0 syz-executor
31488 53153 42923 0 3 0x4000080 ttyin syz-executor
31488 207935 42923 0 3 0x4000080 fsleep syz-executor
69847 372987 84179 0 2 0 syz-executor
69847 51397 84179 0 3 0x4000080 fsleep syz-executor
69847 321447 84179 0 3 0x4000080 fsleep syz-executor
41648 442622 98222 0 3 0x82 nanoslp syz-executor
91344 190642 98222 0 2 0xc82 syz-executor
46400 203769 98222 0 2 0x2 syz-executor
42923 361507 98222 0 2 0xc82 syz-executor
97636 203354 98222 0 3 0x82 nanoslp syz-executor
84179 19117 98222 0 2 0xc82 syz-executor
76209 519244 98222 0 3 0x82 nanoslp syz-executor
17577 361194 98222 0 3 0x82 nanoslp syz-executor
98222 284002 40217 0 3 0x82 kqread syz-executor
40217 494286 8417 0 3 0x10008a sigsusp ksh
8417 363203 13101 0 3 0x98 kqread sshd-session
13101 429879 82105 0 3 0x92 kqread sshd-session
16999 52913 1 0 3 0x100083 ttyin getty
82105 326774 1 0 3 0x88 kqread sshd
79204 323087 30767 73 3 0x1100090 kqread syslogd
30767 338487 1 0 3 0x100082 sbwait syslogd
35928 498231 1 0 3 0x100080 kqread resolvd
51596 294957 36879 77 3 0x100092 kqread dhcpleased
48218 41319 36879 77 3 0x100092 kqread dhcpleased
36879 118937 1 0 3 0x80 kqread dhcpleased
47375 172134 0 0 3 0x14200 bored smr
27610 38818 0 0 2 0x14200 zerothread
7206 338657 0 0 3 0x14200 aiodoned aiodoned
38690 442774 0 0 3 0x14200 syncer update
65857 254493 0 0 3 0x14200 cleaner cleaner
4134 359802 0 0 3 0x14200 reaper reaper
12493 412086 0 0 3 0x14200 pgdaemon pagedaemon
24986 160830 0 0 3 0x14200 bored viomb
80382 41095 0 0 3 0x40014200 acpi0 acpi0
93652 164467 0 0 3 0x14200 bored softnet0
49176 254956 0 0 3 0x14200 smrbar systqmp
4646 445250 0 0 3 0x14200 bored systq
*82512 279817 0 0 7 0x40014200 softclock
98943 298843 0 0 3 0x40014200 idle0
1 405721 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11047 12107K 12285K 166960K 12353 0
pcb 18 12K 12K 166960K 37 0
rtable 227 9K 9K 166960K 394 0
pf 39 14K 17K 166960K 99 0
ifaddr 45 7K 8K 166960K 81 0
ifgroup 59 2K 2K 166960K 120 0
sysctl 1 1K 9K 166960K 5 0
counters 39 18K 18K 166960K 80 0
ioctlops 0 0K 4K 166960K 74 0
iov 0 0K 16K 166960K 4 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1344 85K 85K 166960K 1484 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 4 0
VM map 2 1K 1K 166960K 2 0
sem 5 0K 0K 166960K 5 0
dirhash 12 2K 2K 166960K 18 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 17 61K 93K 166960K 246 0
sigio 0 0K 0K 166960K 3 0
proc 61 59K 100K 166960K 478 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 5 0
in_multi 89 6K 7K 166960K 112 0
ether_multi 1 0K 0K 166960K 2 0
mrt 2 0K 0K 166960K 4 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 109 493K 493K 166960K 109 0
exec 0 0K 1K 166960K 369 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 225 150K 160K 166960K 3999 0
UVM aobj 6 4K 4K 166960K 8 0
pinsyscall 38 76K 94K 166960K 1329 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 2 0K 0K 166960K 9 0
NDP 14 0K 2K 166960K 49 0
temp 41 8663K 8727K 166960K 7773 0
kqueue 14 22K 28K 166960K 53 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 39 0 36 1 0 1 1 0 8 0
rtentry 136 124 0 25 4 0 4 4 0 8 0
unpcb 144 74 0 59 1 0 1 1 0 8 0
syncache 336 5 0 5 1 0 1 1 0 8 1
tcpqe 32 2 0 2 1 0 1 1 0 8 1
tcpcb 736 32 0 26 1 0 1 1 0 8 0
arp 96 18 0 2 1 0 1 1 0 8 0
inpcb 328 170 0 159 2 0 2 2 0 8 0
nd6 112 24 0 3 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
ppxss 1072 37 0 32 1 0 1 1 0 8 0
pppxif 1416 11 0 9 1 0 1 1 0 8 0
pfanchor 1288 4 0 0 1 0 1 1 0 8 0
pftag 88 1 0 0 1 0 1 1 0 8 0
pfstitem 24 1 0 0 1 0 1 1 0 8 0
pfstkey 128 1 0 0 1 0 1 1 0 8 0
pfstate 384 1 0 0 1 0 1 1 0 8 0
pfrule 1344 5 0 3 1 0 1 1 0 8 0
rttmr 136 2 0 1 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 562 0 116 30 0 30 30 0 8 1
art_table 40 563 0 116 5 0 5 5 0 8 0
art_node 32 124 0 32 1 0 1 1 0 8 0
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 112 3 0 0 1 0 1 1 0 8 0
shmpl 112 5 0 2 1 0 1 1 0 8 0
dirhash 1024 22 0 5 3 0 3 3 0 8 0
dino2pl 256 1815 0 311 95 0 95 95 0 8 0
ffsino 256 1815 0 311 95 0 95 95 0 8 0
nchpl 144 2122 0 432 64 0 64 64 0 8 0
rtmask 32 11 0 10 1 0 1 1 0 8 0
vnodes 216 1946 0 0 109 0 109 109 0 8 0
namei 1024 6051 0 6050 1 0 1 1 0 8 0
kstatmem 264 66 0 38 3 0 3 3 0 8 1
scsiplug 72 1 0 1 1 0 1 1 0 8 1
scxspl 216 6577 0 6577 2 0 2 2 1 8 2
plimitpl 152 40 0 22 1 0 1 1 0 8 0
sigapl 424 536 0 494 6 0 6 6 0 8 1
knotepl 120 7025 0 6977 17 0 17 17 0 8 15
kqueuepl 184 82 0 71 1 0 1 1 0 8 0
pipepl 304 125 0 98 3 0 3 3 0 8 0
fdescpl 448 523 0 494 5 0 5 5 0 8 1
filepl 120 1966 0 1749 8 0 8 8 0 8 0
lockfpl 104 51 0 49 1 0 1 1 0 8 0
lockfspl 48 25 0 23 1 0 1 1 0 8 0
sessionpl 144 22 0 14 1 0 1 1 0 8 0
pgrppl 48 30 0 14 1 0 1 1 0 8 0
ucredpl 104 187 0 176 1 0 1 1 0 8 0
zombiepl 144 495 0 494 1 0 1 1 0 8 0
processpl 1152 536 0 494 4 0 4 4 0 8 0
procpl 664 666 0 616 5 0 5 5 0 8 0
sosppl 176 13 0 13 1 0 1 1 0 8 1
sockpl 552 283 0 254 3 0 3 3 0 8 0
mcl64k 65536 51 0 51 1 0 1 1 0 8 1
mcl16k 16384 19 0 19 1 0 1 1 0 8 1
mcl12k 12288 11 0 11 1 0 1 1 0 8 1
mcl9k 9216 5 0 5 1 0 1 1 0 8 1
mcl8k 8192 21 0 21 1 0 1 1 0 8 1
mcl4k 4096 2631 0 2575 15 0 15 15 0 8 7
mcl2k 2048 324 0 324 1 0 1 1 0 8 1
mtagpl 96 8 0 5 1 0 1 1 0 8 0
mbufpl 256 6200 0 6049 11 0 11 11 0 8 0
bufpl 280 2457 0 118 168 0 168 168 0 8 0
anonpl 24 96108 0 93035 22 0 22 22 0 187 2
amapchunkpl 152 11222 0 10761 20 0 20 20 0 158 1
amappl16 200 1520 0 1498 5 0 5 5 0 8 3
amappl15 192 2 0 2 1 0 1 1 0 8 1
amappl14 184 4 0 4 1 0 1 1 0 8 1
amappl13 176 405 0 404 1 0 1 1 0 8 0
amappl12 168 870 0 832 2 0 2 2 0 8 0
amappl11 160 3 0 3 1 0 1 1 0 8 1
amappl10 152 41 0 31 1 0 1 1 0 8 0
amappl9 144 277 0 277 1 0 1 1 0 8 1
amappl8 136 20 0 19 1 0 1 1 0 8 0
amappl7 128 78 0 77 1 0 1 1 0 8 0
amappl6 120 260 0 249 1 0 1 1 0 8 0
amappl5 112 69 0 62 1 0 1 1 0 8 0
amappl4 104 378 0 355 1 0 1 1 0 8 0
amappl3 96 1863 0 1779 3 0 3 3 0 8 0
amappl2 88 638 0 571 2 0 2 2 0 8 0
amappl1 80 9522 0 8989 13 0 13 13 0 8 0
amappl 88 3288 0 3131 4 0 4 4 0 92 0
uvmvnodes 80 97 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 2 0 1 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 254 0 254 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 7 0 2 1 0 1 1 0 8 0
uaddrrnd 24 523 0 494 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 523 0 494 1 0 1 1 0 8 0
vmmpekpl 168 5792 0 5765 2 0 2 2 0 8 0
vmmpepl 168 40647 0 38901 82 0 82 82 0 357 3
vmsppl 368 522 0 494 4 0 4 4 0 8 1
rwobjpl 40 13961 0 13048 11 0 11 11 0 8 0
pdppl 4096 1053 0 988 95 28 67 81 0 8 2
pvpl 32 248646 0 239525 84 0 84 84 0 265 4
pmappl 216 522 0 494 3 0 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 364 0 28 10 0 10 10 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83325b9d) at panic+0x1cf sys/kern/subr_prf.c:198
rw_do_enter_read(ffff800001582860,0) at rw_do_enter_read+0x435 sys/kern/kern_rwlock.c:379
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd806c72c000,ffffffff839751a0,0,0,ffff80002a739d60,0) at ip6_output+0x1369 sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff80000159a680,83,0) at mld6_sendpkt+0x364 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff838ddf10) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff8383ff00,ffffffff838ddf10) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: -10
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83325b9d) at panic+0x1cf sys/kern/subr_prf.c:198
rw_do_enter_read(ffff800001582860,0) at rw_do_enter_read+0x435 sys/kern/kern_rwlock.c:379
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd806c72c000,ffffffff839751a0,0,0,ffff80002a739d60,0) at ip6_output+0x1369 sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff80000159a680,83,0) at mld6_sendpkt+0x364 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff838ddf10) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff8383ff00,ffffffff838ddf10) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: -10
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 80bc9799356e Protect IGMP and MLD6 fast timer with rwlock.
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11db669a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=9ef22ca02dffcf088cf6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3af574212cde/disk-80bc9799.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/27206c6c4904/bsd-80bc9799.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d69078a9154c/kernel-80bc9799.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ef22c...@syzkaller.appspotmail.com
panic: maddr rwlock 0xffff800001582860: enter read deadlock
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*279817 82512 0 0x14000 0x40000200 0 softclock
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83325b9d) at panic+0x1cf sys/kern/subr_prf.c:198
rw_do_enter_read(ffff800001582860,0) at rw_do_enter_read+0x435 sys/kern/kern_rwlock.c:379
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd806c72c000,ffffffff839751a0,0,0,ffff80002a739d60,0) at ip6_output+0x1369 sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff80000159a680,83,0) at mld6_sendpkt+0x364 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff838ddf10) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff8383ff00,ffffffff838ddf10) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: maddr rwlock 0xffff800001582860: enter read deadlock
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83325b9d) at panic+0x1cf sys/kern/subr_prf.c:198
rw_do_enter_read(ffff800001582860,0) at rw_do_enter_read+0x435 sys/kern/kern_rwlock.c:379
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd806c72c000,ffffffff839751a0,0,0,ffff80002a739d60,0) at ip6_output+0x1369 sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff80000159a680,83,0) at mld6_sendpkt+0x364 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff838ddf10) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff8383ff00,ffffffff838ddf10) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: -10
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff80002a739a70
rbx 0xffff800001582800
rdx 0
rcx 0
rax 0xffff80002a72d758
r8 0x101010101010101
r9 0x8080808080808080
r10 0x6418f668fa9256ca
r11 0x90c404879bfd3160
r12 0
r13 0xffff80002a72d75c
r14 0
r15 0x1
rip 0xffffffff830eea05 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80002a739a60
ss 0
db_enter+0x25: addq $0x8,%rsp
ddb> show proc
PROC (softclock) tid=279817 pid=82512 tcnt=1 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
runpri=0, usrpri=50, slppri=0, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a72d9f0,0xffff80002a72cfa0
process=0xffff8000ffffe400 user=0xffff80002a734000, vmspace=0xffffffff838cbef8
estcpu=0, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
63446 236849 97636 0 2 0 syz-executor
63446 177329 97636 0 3 0x4000080 fsleep syz-executor
65233 397948 41648 0 2 0 syz-executor
65233 295529 41648 0 3 0x4000080 fsleep syz-executor
61910 136084 91344 0 2 0 syz-executor
61910 381565 91344 0 3 0x4000080 fsleep syz-executor
63980 268823 76209 0 2 0 syz-executor
63980 81577 76209 0 3 0x4000080 fsleep syz-executor
31488 139176 42923 0 2 0 syz-executor
31488 53153 42923 0 3 0x4000080 ttyin syz-executor
31488 207935 42923 0 3 0x4000080 fsleep syz-executor
69847 372987 84179 0 2 0 syz-executor
69847 51397 84179 0 3 0x4000080 fsleep syz-executor
69847 321447 84179 0 3 0x4000080 fsleep syz-executor
41648 442622 98222 0 3 0x82 nanoslp syz-executor
91344 190642 98222 0 2 0xc82 syz-executor
46400 203769 98222 0 2 0x2 syz-executor
42923 361507 98222 0 2 0xc82 syz-executor
97636 203354 98222 0 3 0x82 nanoslp syz-executor
84179 19117 98222 0 2 0xc82 syz-executor
76209 519244 98222 0 3 0x82 nanoslp syz-executor
17577 361194 98222 0 3 0x82 nanoslp syz-executor
98222 284002 40217 0 3 0x82 kqread syz-executor
40217 494286 8417 0 3 0x10008a sigsusp ksh
8417 363203 13101 0 3 0x98 kqread sshd-session
13101 429879 82105 0 3 0x92 kqread sshd-session
16999 52913 1 0 3 0x100083 ttyin getty
82105 326774 1 0 3 0x88 kqread sshd
79204 323087 30767 73 3 0x1100090 kqread syslogd
30767 338487 1 0 3 0x100082 sbwait syslogd
35928 498231 1 0 3 0x100080 kqread resolvd
51596 294957 36879 77 3 0x100092 kqread dhcpleased
48218 41319 36879 77 3 0x100092 kqread dhcpleased
36879 118937 1 0 3 0x80 kqread dhcpleased
47375 172134 0 0 3 0x14200 bored smr
27610 38818 0 0 2 0x14200 zerothread
7206 338657 0 0 3 0x14200 aiodoned aiodoned
38690 442774 0 0 3 0x14200 syncer update
65857 254493 0 0 3 0x14200 cleaner cleaner
4134 359802 0 0 3 0x14200 reaper reaper
12493 412086 0 0 3 0x14200 pgdaemon pagedaemon
24986 160830 0 0 3 0x14200 bored viomb
80382 41095 0 0 3 0x40014200 acpi0 acpi0
93652 164467 0 0 3 0x14200 bored softnet0
49176 254956 0 0 3 0x14200 smrbar systqmp
4646 445250 0 0 3 0x14200 bored systq
*82512 279817 0 0 7 0x40014200 softclock
98943 298843 0 0 3 0x40014200 idle0
1 405721 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11047 12107K 12285K 166960K 12353 0
pcb 18 12K 12K 166960K 37 0
rtable 227 9K 9K 166960K 394 0
pf 39 14K 17K 166960K 99 0
ifaddr 45 7K 8K 166960K 81 0
ifgroup 59 2K 2K 166960K 120 0
sysctl 1 1K 9K 166960K 5 0
counters 39 18K 18K 166960K 80 0
ioctlops 0 0K 4K 166960K 74 0
iov 0 0K 16K 166960K 4 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1344 85K 85K 166960K 1484 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 4 0
VM map 2 1K 1K 166960K 2 0
sem 5 0K 0K 166960K 5 0
dirhash 12 2K 2K 166960K 18 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 17 61K 93K 166960K 246 0
sigio 0 0K 0K 166960K 3 0
proc 61 59K 100K 166960K 478 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 5 0
in_multi 89 6K 7K 166960K 112 0
ether_multi 1 0K 0K 166960K 2 0
mrt 2 0K 0K 166960K 4 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 109 493K 493K 166960K 109 0
exec 0 0K 1K 166960K 369 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 225 150K 160K 166960K 3999 0
UVM aobj 6 4K 4K 166960K 8 0
pinsyscall 38 76K 94K 166960K 1329 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 2 0K 0K 166960K 9 0
NDP 14 0K 2K 166960K 49 0
temp 41 8663K 8727K 166960K 7773 0
kqueue 14 22K 28K 166960K 53 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 39 0 36 1 0 1 1 0 8 0
rtentry 136 124 0 25 4 0 4 4 0 8 0
unpcb 144 74 0 59 1 0 1 1 0 8 0
syncache 336 5 0 5 1 0 1 1 0 8 1
tcpqe 32 2 0 2 1 0 1 1 0 8 1
tcpcb 736 32 0 26 1 0 1 1 0 8 0
arp 96 18 0 2 1 0 1 1 0 8 0
inpcb 328 170 0 159 2 0 2 2 0 8 0
nd6 112 24 0 3 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
ppxss 1072 37 0 32 1 0 1 1 0 8 0
pppxif 1416 11 0 9 1 0 1 1 0 8 0
pfanchor 1288 4 0 0 1 0 1 1 0 8 0
pftag 88 1 0 0 1 0 1 1 0 8 0
pfstitem 24 1 0 0 1 0 1 1 0 8 0
pfstkey 128 1 0 0 1 0 1 1 0 8 0
pfstate 384 1 0 0 1 0 1 1 0 8 0
pfrule 1344 5 0 3 1 0 1 1 0 8 0
rttmr 136 2 0 1 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 562 0 116 30 0 30 30 0 8 1
art_table 40 563 0 116 5 0 5 5 0 8 0
art_node 32 124 0 32 1 0 1 1 0 8 0
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 112 3 0 0 1 0 1 1 0 8 0
shmpl 112 5 0 2 1 0 1 1 0 8 0
dirhash 1024 22 0 5 3 0 3 3 0 8 0
dino2pl 256 1815 0 311 95 0 95 95 0 8 0
ffsino 256 1815 0 311 95 0 95 95 0 8 0
nchpl 144 2122 0 432 64 0 64 64 0 8 0
rtmask 32 11 0 10 1 0 1 1 0 8 0
vnodes 216 1946 0 0 109 0 109 109 0 8 0
namei 1024 6051 0 6050 1 0 1 1 0 8 0
kstatmem 264 66 0 38 3 0 3 3 0 8 1
scsiplug 72 1 0 1 1 0 1 1 0 8 1
scxspl 216 6577 0 6577 2 0 2 2 1 8 2
plimitpl 152 40 0 22 1 0 1 1 0 8 0
sigapl 424 536 0 494 6 0 6 6 0 8 1
knotepl 120 7025 0 6977 17 0 17 17 0 8 15
kqueuepl 184 82 0 71 1 0 1 1 0 8 0
pipepl 304 125 0 98 3 0 3 3 0 8 0
fdescpl 448 523 0 494 5 0 5 5 0 8 1
filepl 120 1966 0 1749 8 0 8 8 0 8 0
lockfpl 104 51 0 49 1 0 1 1 0 8 0
lockfspl 48 25 0 23 1 0 1 1 0 8 0
sessionpl 144 22 0 14 1 0 1 1 0 8 0
pgrppl 48 30 0 14 1 0 1 1 0 8 0
ucredpl 104 187 0 176 1 0 1 1 0 8 0
zombiepl 144 495 0 494 1 0 1 1 0 8 0
processpl 1152 536 0 494 4 0 4 4 0 8 0
procpl 664 666 0 616 5 0 5 5 0 8 0
sosppl 176 13 0 13 1 0 1 1 0 8 1
sockpl 552 283 0 254 3 0 3 3 0 8 0
mcl64k 65536 51 0 51 1 0 1 1 0 8 1
mcl16k 16384 19 0 19 1 0 1 1 0 8 1
mcl12k 12288 11 0 11 1 0 1 1 0 8 1
mcl9k 9216 5 0 5 1 0 1 1 0 8 1
mcl8k 8192 21 0 21 1 0 1 1 0 8 1
mcl4k 4096 2631 0 2575 15 0 15 15 0 8 7
mcl2k 2048 324 0 324 1 0 1 1 0 8 1
mtagpl 96 8 0 5 1 0 1 1 0 8 0
mbufpl 256 6200 0 6049 11 0 11 11 0 8 0
bufpl 280 2457 0 118 168 0 168 168 0 8 0
anonpl 24 96108 0 93035 22 0 22 22 0 187 2
amapchunkpl 152 11222 0 10761 20 0 20 20 0 158 1
amappl16 200 1520 0 1498 5 0 5 5 0 8 3
amappl15 192 2 0 2 1 0 1 1 0 8 1
amappl14 184 4 0 4 1 0 1 1 0 8 1
amappl13 176 405 0 404 1 0 1 1 0 8 0
amappl12 168 870 0 832 2 0 2 2 0 8 0
amappl11 160 3 0 3 1 0 1 1 0 8 1
amappl10 152 41 0 31 1 0 1 1 0 8 0
amappl9 144 277 0 277 1 0 1 1 0 8 1
amappl8 136 20 0 19 1 0 1 1 0 8 0
amappl7 128 78 0 77 1 0 1 1 0 8 0
amappl6 120 260 0 249 1 0 1 1 0 8 0
amappl5 112 69 0 62 1 0 1 1 0 8 0
amappl4 104 378 0 355 1 0 1 1 0 8 0
amappl3 96 1863 0 1779 3 0 3 3 0 8 0
amappl2 88 638 0 571 2 0 2 2 0 8 0
amappl1 80 9522 0 8989 13 0 13 13 0 8 0
amappl 88 3288 0 3131 4 0 4 4 0 92 0
uvmvnodes 80 97 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 2 0 1 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 254 0 254 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 7 0 2 1 0 1 1 0 8 0
uaddrrnd 24 523 0 494 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 523 0 494 1 0 1 1 0 8 0
vmmpekpl 168 5792 0 5765 2 0 2 2 0 8 0
vmmpepl 168 40647 0 38901 82 0 82 82 0 357 3
vmsppl 368 522 0 494 4 0 4 4 0 8 1
rwobjpl 40 13961 0 13048 11 0 11 11 0 8 0
pdppl 4096 1053 0 988 95 28 67 81 0 8 2
pvpl 32 248646 0 239525 84 0 84 84 0 265 4
pmappl 216 522 0 494 3 0 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 364 0 28 10 0 10 10 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83325b9d) at panic+0x1cf sys/kern/subr_prf.c:198
rw_do_enter_read(ffff800001582860,0) at rw_do_enter_read+0x435 sys/kern/kern_rwlock.c:379
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd806c72c000,ffffffff839751a0,0,0,ffff80002a739d60,0) at ip6_output+0x1369 sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff80000159a680,83,0) at mld6_sendpkt+0x364 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff838ddf10) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff8383ff00,ffffffff838ddf10) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: -10
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83325b9d) at panic+0x1cf sys/kern/subr_prf.c:198
rw_do_enter_read(ffff800001582860,0) at rw_do_enter_read+0x435 sys/kern/kern_rwlock.c:379
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd806c72c0f0,ffff800001582800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd806c72c000,ffffffff839751a0,0,0,ffff80002a739d60,0) at ip6_output+0x1369 sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff80000159a680,83,0) at mld6_sendpkt+0x364 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff838ddf10) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff8383ff00,ffffffff838ddf10) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a72d758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: -10
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages