assert "nlevel >= IPL_NONE" failed in intr.c
6 views
Skip to first unread message
syzbot
Sep 4, 2023, 6:54:48 PM9/4/23
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: e36cf0cab4c6 rework DESCRIPTION for readability. put the B..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11e7c5f0680000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=38efb425eada701ca8bb
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/79a0cb974316/disk-e36cf0ca.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/a90f8ce66b4f/bsd-e36cf0ca.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2bffc76d7b08/kernel-e36cf0ca.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+38efb4...@syzkaller.appspotmail.com
panic: kernel diagnostic assertion "nlevel >= IPL_NONE" failed: file "/syzkaller/managers/setuid/kernel/sys/arch/amd64/amd64/intr.c", line 699
Stopped at db_enter+0x1c: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
337727 58262 32767 0x10 0x4000000 0 syz-executor.5
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8279eeb4) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff82820513,ffffffff8283fa89,2bb,ffffffff827a57e4) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(adde91d9) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806f1d4af8) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806f1d4af8) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002121a800,fffffd806f1d4af8,fffffd806f1d4b80,6,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002121a800,6) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002121a800) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002121a800,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002121a800,ffff80002e401990,ffff80002e4019e0) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff80002e401a60) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e401a60) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73f9ddad0060, count: 2
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "nlevel >= IPL_NONE" failed: file "/syzkaller/managers/setuid/kernel/sys/arch/amd64/amd64/intr.c", line 699
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8279eeb4) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff82820513,ffffffff8283fa89,2bb,ffffffff827a57e4) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(adde91d9) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806f1d4af8) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806f1d4af8) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002121a800,fffffd806f1d4af8,fffffd806f1d4b80,6,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002121a800,6) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002121a800) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002121a800,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002121a800,ffff80002e401990,ffff80002e4019e0) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff80002e401a60) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e401a60) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73f9ddad0060, count: -13
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff80002e4015d0
rbx 0xffff800020d59b9f
rdx 0
rcx 0xffff80002121a800
rax 0xffff800020d58ff0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x582891c1823d043d
r11 0x61f7a4b2c16ff37e
r12 0xffff800020d599a0
r13 0
r14 0
r15 0x1
rip 0xffffffff8266b7ec db_enter+0x1c
cs 0x8
rflags 0x246
rsp 0xffff80002e4015c0
ss 0x10
db_enter+0x1c: addq $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.3) pid=342349 stat=onproc
flags process=1018<EXITING,SUGID,SINGLEEXIT> proc=2000<WEXIT>
pri=0, usrpri=81, nice=20
forw=0xffffffffffffffff, list=0xffff80002121b548,0xffff80002121a2c0
process=0xffff800029fa2198 user=0xffff80002e3fc000, vmspace=0xfffffd8065f65cd8
estcpu=36, cpticks=2, pctcpu=0.0
user=0, sys=1, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
58262 40719 55351 32767 2 0x10 syz-executor.5
58262 337727 55351 32767 7 0x4000010 syz-executor.5
58262 297321 55351 32767 3 0x4000090 fsleep syz-executor.5
52597 509540 55818 32767 2 0x10 syz-executor.2
52597 122325 55818 32767 3 0x4000090 fsleep syz-executor.2
28495 113928 71345 32767 2 0x10 syz-executor.6
28495 210692 71345 32767 3 0x4000090 fsleep syz-executor.6
44777 479718 69576 32767 2 0x10 syz-executor.4
44777 318231 69576 32767 3 0x4000090 fsleep syz-executor.4
44777 85566 69576 32767 3 0x4000090 fsleep syz-executor.4
42455 173076 85935 32767 2 0x10 syz-executor.0
42455 319673 85935 32767 3 0x4000090 fsleep syz-executor.0
55351 401145 1337 32767 3 0x90 nanoslp syz-executor.5
1337 45683 66074 0 3 0x82 wait syz-executor.5
71345 64275 74222 32767 3 0x90 nanoslp syz-executor.6
74222 451439 66074 0 3 0x82 wait syz-executor.6
51921 280088 72992 32767 3 0x90 nanoslp syz-executor.1
72992 186808 66074 0 3 0x82 wait syz-executor.1
85935 276360 76686 32767 3 0x90 nanoslp syz-executor.0
76686 139672 66074 0 3 0x82 wait syz-executor.0
97826 282671 54163 32767 3 0x90 nanoslp syz-executor.3
54163 15702 66074 0 3 0x82 wait syz-executor.3
64647 198159 0 0 3 0x14200 bored sosplice
58406 165816 68028 32767 3 0x10 biowait syz-executor.7
68028 303035 66074 0 3 0x82 wait syz-executor.7
55818 157835 93622 32767 3 0x90 nanoslp syz-executor.2
69576 414001 56674 32767 3 0x90 nanoslp syz-executor.4
56674 451280 66074 0 3 0x82 wait syz-executor.4
93622 92669 66074 0 3 0x82 wait syz-executor.2
66074 485197 95855 0 3 0x2000082 thrsleep syz-fuzzer
66074 369830 95855 0 3 0x6000082 nanoslp syz-fuzzer
66074 457663 95855 0 3 0x6000082 wait syz-fuzzer
66074 48091 95855 0 3 0x6000082 wait syz-fuzzer
66074 407681 95855 0 3 0x6000082 wait syz-fuzzer
66074 363732 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 234721 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 452321 95855 0 3 0x6000082 wait syz-fuzzer
66074 275377 95855 0 3 0x6000082 wait syz-fuzzer
66074 193084 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 439083 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 469262 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 437846 95855 0 3 0x6000082 wait syz-fuzzer
66074 504869 95855 0 3 0x6000082 wait syz-fuzzer
66074 60831 95855 0 3 0x6000082 kqread syz-fuzzer
66074 85426 95855 0 3 0x6000082 wait syz-fuzzer
95855 158127 7530 0 3 0x10008a sigsusp ksh
7530 22353 74209 0 3 0x9a kqread sshd
40748 232957 1 0 3 0x100083 ttyin getty
74209 495378 1 0 3 0x88 kqread sshd
43006 146099 6822 73 3 0x1100090 kqread syslogd
6822 137369 1 0 3 0x100082 netio syslogd
50736 151273 1 0 3 0x100080 kqread resolvd
75793 65769 6549 77 3 0x100092 kqread dhcpleased
43517 38038 6549 77 3 0x100092 kqread dhcpleased
6549 150010 1 0 3 0x80 kqread dhcpleased
60450 301128 0 0 3 0x14200 bored smr
42520 464808 0 0 2 0x14200 zerothread
23323 333520 0 0 3 0x14200 aiodoned aiodoned
26659 198342 0 0 3 0x14200 syncer update
52915 249730 0 0 3 0x14200 cleaner cleaner
3565 194553 0 0 2 0x14200 reaper
10524 15876 0 0 3 0x14200 pgdaemon pagedaemon
53005 504174 0 0 3 0x14200 bored viomb
83854 488270 0 0 3 0x40014200 acpi0 acpi0
52954 261870 0 0 3 0x40014200 idle1
11163 437792 0 0 3 0x14200 bored softnet3
99737 516663 0 0 3 0x14200 bored softnet2
840 82916 0 0 3 0x14200 bored softnet1
80512 430989 0 0 3 0x14200 bored softnet0
60575 280724 0 0 3 0x14200 bored systqmp
70954 361732 0 0 3 0x14200 bored systq
74089 254322 0 0 3 0x40014200 bored softclock
41232 507270 0 0 3 0x40014200 idle0
1 6707 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
CPU 0:
exclusive sched_lock &sched_lock r = 0 (0xffffffff82cdefb0)
#0 witness_lock+0x447
#1 sleep_finish+0x142 sys/kern/kern_synch.c:398
#2 rwsleep+0xab sys/kern/kern_synch.c:300
#3 futex_wait+0x13d sys/kern/sys_futex.c:250
#4 sys_futex+0xfc sys/kern/sys_futex.c:101
#5 syscall+0x606 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#5 syscall+0x606 sys/arch/amd64/amd64/trap.c:623
#6 Xsyscall+0x128
Process 58406 (syz-executor.7) thread 0xffff8000212807f8 (165816)
exclusive rrwlock inode r = 0 (0xfffffd8070642d60)
#0 witness_lock+0x447
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vget+0x200 sys/kern/vfs_subr.c:676
#6 ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119
#7 ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1314
#8 ufs_lookup+0x13ba sys/ufs/ufs/ufs_lookup.c:487
#9 VOP_LOOKUP+0x5c sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x6e2 sys/kern/vfs_lookup.c:566
#11 namei+0x55a sys/kern/vfs_lookup.c:250
#12 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1847
#13 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#13 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8065c70a38)
#0 witness_lock+0x447
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6 namei+0x55a sys/kern/vfs_lookup.c:250
#7 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1847
#8 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10208 6411K 6420K 78643K 11350 0
pcb 13 10K 12K 78643K 15 0
rtable 246 7K 7K 78643K 1725 0
pf 29 8K 8K 78643K 71 0
ifaddr 44 15K 16K 78643K 134 0
ifgroup 50 2K 2K 78643K 134 0
sysctl 3 1K 3K 78643K 45 0
counters 60 35K 35K 78643K 102 0
ioctlops 0 0K 2K 78643K 69 0
iov 0 0K 28K 78643K 1111 0
mount 1 1K 1K 78643K 1 0
log 0 0K 0K 78643K 4 0
vnodes 1279 80K 80K 78643K 3149 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 25K 78643K 159 0
VM map 2 1K 1K 78643K 2 0
sem 12 0K 1K 78643K 2651 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1697 195K 286K 78643K 12548 0
file desc 24 89K 117K 78643K 16242 0
sigio 0 0K 0K 78643K 129 0
proc 56 78K 115K 78643K 1604 0
subproc 104 6K 6K 78643K 377 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 901 0
in_multi 99 7K 7K 78643K 547 0
ether_multi 1 0K 0K 78643K 28 0
mrt 1 0K 0K 78643K 1 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 187 837K 837K 78643K 187 0
exec 0 0K 1K 78643K 2741 0
tdb 3 0K 0K 78643K 3 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 8 62K 64K 78643K 10 0
UVM amap 474 99K 113K 78643K 157609 0
UVM aobj 131 4K 4K 78643K 131 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 370 0
NDP 11 0K 2K 78643K 90 0
temp 74 5920K 6000K 78643K 46856 0
kqueue 12 18K 28K 78643K 2039 0
SYN cache 2 16K 16K 78643K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 22 0 0 1 0 1 1 0 8 0
rtpcb 120 764 0 761 6 5 1 3 0 8 0
rtentry 112 364 0 248 4 0 4 4 0 8 0
unpcb 144 8893 0 8878 84 83 1 10 0 8 0
syncache 304 304 0 304 24 23 1 1 0 8 1
tcpqe 32 572 0 572 19 18 1 1 0 8 1
tcpcb 808 6204 0 6184 124 121 3 16 0 8 1
arp 120 65 0 46 1 0 1 1 0 8 0
ipq 40 36 0 35 11 10 1 1 0 8 0
ipqe 40 143 0 142 11 10 1 1 0 8 0
inpcb 368 11176 0 11152 138 135 3 14 0 8 0
nd6 136 104 0 75 3 1 2 2 0 8 0
kcovpl 48 29 0 21 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 1457 0 978 32 2 30 32 0 8 0
art_table 32 1458 0 978 5 1 4 5 0 8 0
art_node 16 363 0 257 1 0 1 1 0 8 0
sysvmsgpl 40 46 0 21 1 0 1 1 0 8 0
semupl 112 10 0 10 1 1 0 1 0 8 0
semapl 112 2639 0 2629 1 0 1 1 0 8 0
shmpl 112 128 0 0 4 0 4 4 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 22769 0 21318 92 0 92 92 0 8 0
ffsino 272 22769 0 21318 98 0 98 98 0 8 0
nchpl 144 44657 0 43013 63 0 63 63 0 8 0
uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0
vnodes 216 5926 0 0 330 0 330 330 0 8 0
namei 1024 142995 0 142995 7 6 1 2 0 8 1
percpumem 16 64 0 21 1 0 1 1 0 8 0
kstatmem 264 64 0 42 2 0 2 2 0 8 0
scxspl 216 331860 0 331859 68 62 6 8 1 8 5
plimitpl 152 1917 0 1894 20 19 1 2 0 8 0
sigapl 424 16496 0 16442 7 0 7 7 0 8 0
futexpl 64 131504 0 131498 5 4 1 1 0 8 0
knotepl 120 1290 0 0 25 5 20 25 0 8 0
kqueuepl 216 3255 0 3247 39 36 3 6 0 8 2
pipepl 320 2457 0 2429 64 58 6 8 0 8 3
fdescpl 496 16478 0 16443 7 2 5 6 0 8 0
filepl 152 90887 0 90646 125 111 14 19 0 8 4
lockfpl 104 2050 0 2048 1 0 1 1 0 8 0
lockfspl 48 613 0 611 1 0 1 1 0 8 0
sessionpl 144 44 0 28 1 0 1 1 0 8 0
pgrppl 48 358 0 342 1 0 1 1 0 8 0
ucredpl 104 11085 0 11067 1 0 1 1 0 8 0
zombiepl 144 16444 0 16442 1 0 1 1 0 8 0
processpl 1072 16496 0 16442 4 0 4 4 0 8 0
procpl 680 43579 0 43502 37 29 8 8 0 8 1
sosppl 168 1150 0 1148 13 12 1 2 0 8 0
sockpl 488 21171 0 21131 363 354 9 34 0 8 3
mcl64k 65536 33 0 0 4 1 3 3 0 8 0
mcl16k 16384 16 0 0 2 0 2 2 0 8 0
mcl12k 12288 24 0 0 2 0 2 2 0 8 0
mcl9k 9216 10 0 0 1 0 1 1 0 8 0
mcl8k 8192 34 0 0 4 2 2 3 0 8 0
mcl4k 4096 89 0 0 9 5 4 7 0 8 0
mcl2k2 2112 12 0 0 1 0 1 1 0 8 0
mcl2k 2048 691 0 0 35 19 16 33 0 8 0
mtagpl 96 17 0 0 1 0 1 1 0 8 0
mbufpl 256 2416 0 0 111 0 111 111 0 8 0
bufpl 288 119546 0 113215 453 0 453 453 0 8 0
anonpl 24 2017114 0 2006086 219 137 82 107 0 186 0
amapchunkpl 152 494322 0 493406 131 92 39 45 0 158 1
amappl16 200 61040 0 60768 225 208 17 37 0 8 0
amappl15 192 30 0 29 1 0 1 1 0 8 0
amappl14 184 226 0 211 2 1 1 2 0 8 0
amappl13 176 31 0 31 6 6 0 1 0 8 0
amappl12 168 17435 0 17395 2 0 2 2 0 8 0
amappl11 160 51 0 41 1 0 1 1 0 8 0
amappl10 152 63 0 44 1 0 1 1 0 8 0
amappl9 144 287 0 285 1 0 1 1 0 8 0
amappl8 136 852 0 677 7 0 7 7 0 8 0
amappl7 128 120 0 104 2 0 2 2 0 8 0
amappl6 120 488 0 463 2 1 1 2 0 8 0
amappl5 112 536 0 527 1 0 1 1 0 8 0
amappl4 104 987 0 936 3 0 3 3 0 8 0
amappl3 96 98007 0 97902 6 3 3 4 0 8 0
amappl2 88 17317 0 17242 3 1 2 3 0 8 0
amappl1 80 65766 0 65232 22 9 13 22 0 8 0
amappl 88 156388 0 156101 8 1 7 7 0 92 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 130 0 0 3 0 3 3 0 8 0
uaddrrnd 24 16478 0 16443 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 16478 0 16443 1 0 1 1 0 8 0
vmmpekpl 168 122225 0 122154 4 0 4 4 0 8 0
vmmpepl 168 972978 0 970461 308 187 121 137 0 357 4
vmsppl 464 16477 0 16443 7 2 5 6 0 8 0
rwobjpl 56 260528 0 253043 132 24 108 111 0 8 0
pdppl 4096 32964 0 32886 600 518 82 92 0 8 4
pvpl 32 5484889 0 5467446 510 349 161 364 0 265 0
pmappl 248 16477 0 16443 4 1 3 3 0 8 0
extentpl 40 56 0 38 1 0 1 1 0 8 0
phpool 112 1753 0 840 28 0 28 28 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x1e: addq $0x8,%rsp
x86_ipi_db(ffffffff82bffff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 sys/kern/kern_lock.c:147
intr_handler(ffff80002e44cfa0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 sys/kern/kern_lock.c:147
syscall(ffff80002e44d170) at syscall+0x5cd mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e44d170) at syscall+0x5cd sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x84be13443c0, count: 6
ddb{0}> trace
x86_ipi_db(ffffffff82bffff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 sys/kern/kern_lock.c:147
intr_handler(ffff80002e44cfa0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 sys/kern/kern_lock.c:147
syscall(ffff80002e44d170) at syscall+0x5cd mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e44d170) at syscall+0x5cd sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x84be13443c0, count: -9
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x1c: addq $0x8,%rsp
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8279eeb4) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff82820513,ffffffff8283fa89,2bb,ffffffff827a57e4) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(adde91d9) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806f1d4af8) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806f1d4af8) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002121a800,fffffd806f1d4af8,fffffd806f1d4b80,6,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002121a800,6) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002121a800) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002121a800,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002121a800,ffff80002e401990,ffff80002e4019e0) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff80002e401a60) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e401a60) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73f9ddad0060, count: 2
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8279eeb4) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff82820513,ffffffff8283fa89,2bb,ffffffff827a57e4) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(adde91d9) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806f1d4af8) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806f1d4af8) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002121a800,fffffd806f1d4af8,fffffd806f1d4b80,6,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002121a800,6) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002121a800) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002121a800,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002121a800,ffff80002e401990,ffff80002e4019e0) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff80002e401a60) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e401a60) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73f9ddad0060, count: -13
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: e36cf0cab4c6 rework DESCRIPTION for readability. put the B..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11e7c5f0680000
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=38efb425eada701ca8bb
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/79a0cb974316/disk-e36cf0ca.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/a90f8ce66b4f/bsd-e36cf0ca.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2bffc76d7b08/kernel-e36cf0ca.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+38efb4...@syzkaller.appspotmail.com
panic: kernel diagnostic assertion "nlevel >= IPL_NONE" failed: file "/syzkaller/managers/setuid/kernel/sys/arch/amd64/amd64/intr.c", line 699
Stopped at db_enter+0x1c: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
337727 58262 32767 0x10 0x4000000 0 syz-executor.5
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8279eeb4) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff82820513,ffffffff8283fa89,2bb,ffffffff827a57e4) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(adde91d9) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806f1d4af8) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806f1d4af8) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002121a800,fffffd806f1d4af8,fffffd806f1d4b80,6,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002121a800,6) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002121a800) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002121a800,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002121a800,ffff80002e401990,ffff80002e4019e0) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff80002e401a60) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e401a60) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73f9ddad0060, count: 2
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "nlevel >= IPL_NONE" failed: file "/syzkaller/managers/setuid/kernel/sys/arch/amd64/amd64/intr.c", line 699
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8279eeb4) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff82820513,ffffffff8283fa89,2bb,ffffffff827a57e4) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(adde91d9) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806f1d4af8) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806f1d4af8) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002121a800,fffffd806f1d4af8,fffffd806f1d4b80,6,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002121a800,6) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002121a800) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002121a800,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002121a800,ffff80002e401990,ffff80002e4019e0) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff80002e401a60) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e401a60) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73f9ddad0060, count: -13
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff80002e4015d0
rbx 0xffff800020d59b9f
rdx 0
rcx 0xffff80002121a800
rax 0xffff800020d58ff0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x582891c1823d043d
r11 0x61f7a4b2c16ff37e
r12 0xffff800020d599a0
r13 0
r14 0
r15 0x1
rip 0xffffffff8266b7ec db_enter+0x1c
cs 0x8
rflags 0x246
rsp 0xffff80002e4015c0
ss 0x10
db_enter+0x1c: addq $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.3) pid=342349 stat=onproc
flags process=1018<EXITING,SUGID,SINGLEEXIT> proc=2000<WEXIT>
pri=0, usrpri=81, nice=20
forw=0xffffffffffffffff, list=0xffff80002121b548,0xffff80002121a2c0
process=0xffff800029fa2198 user=0xffff80002e3fc000, vmspace=0xfffffd8065f65cd8
estcpu=36, cpticks=2, pctcpu=0.0
user=0, sys=1, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
58262 40719 55351 32767 2 0x10 syz-executor.5
58262 337727 55351 32767 7 0x4000010 syz-executor.5
58262 297321 55351 32767 3 0x4000090 fsleep syz-executor.5
52597 509540 55818 32767 2 0x10 syz-executor.2
52597 122325 55818 32767 3 0x4000090 fsleep syz-executor.2
28495 113928 71345 32767 2 0x10 syz-executor.6
28495 210692 71345 32767 3 0x4000090 fsleep syz-executor.6
44777 479718 69576 32767 2 0x10 syz-executor.4
44777 318231 69576 32767 3 0x4000090 fsleep syz-executor.4
44777 85566 69576 32767 3 0x4000090 fsleep syz-executor.4
42455 173076 85935 32767 2 0x10 syz-executor.0
42455 319673 85935 32767 3 0x4000090 fsleep syz-executor.0
55351 401145 1337 32767 3 0x90 nanoslp syz-executor.5
1337 45683 66074 0 3 0x82 wait syz-executor.5
71345 64275 74222 32767 3 0x90 nanoslp syz-executor.6
74222 451439 66074 0 3 0x82 wait syz-executor.6
51921 280088 72992 32767 3 0x90 nanoslp syz-executor.1
72992 186808 66074 0 3 0x82 wait syz-executor.1
85935 276360 76686 32767 3 0x90 nanoslp syz-executor.0
76686 139672 66074 0 3 0x82 wait syz-executor.0
97826 282671 54163 32767 3 0x90 nanoslp syz-executor.3
54163 15702 66074 0 3 0x82 wait syz-executor.3
64647 198159 0 0 3 0x14200 bored sosplice
58406 165816 68028 32767 3 0x10 biowait syz-executor.7
68028 303035 66074 0 3 0x82 wait syz-executor.7
55818 157835 93622 32767 3 0x90 nanoslp syz-executor.2
69576 414001 56674 32767 3 0x90 nanoslp syz-executor.4
56674 451280 66074 0 3 0x82 wait syz-executor.4
93622 92669 66074 0 3 0x82 wait syz-executor.2
66074 485197 95855 0 3 0x2000082 thrsleep syz-fuzzer
66074 369830 95855 0 3 0x6000082 nanoslp syz-fuzzer
66074 457663 95855 0 3 0x6000082 wait syz-fuzzer
66074 48091 95855 0 3 0x6000082 wait syz-fuzzer
66074 407681 95855 0 3 0x6000082 wait syz-fuzzer
66074 363732 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 234721 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 452321 95855 0 3 0x6000082 wait syz-fuzzer
66074 275377 95855 0 3 0x6000082 wait syz-fuzzer
66074 193084 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 439083 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 469262 95855 0 3 0x6000082 thrsleep syz-fuzzer
66074 437846 95855 0 3 0x6000082 wait syz-fuzzer
66074 504869 95855 0 3 0x6000082 wait syz-fuzzer
66074 60831 95855 0 3 0x6000082 kqread syz-fuzzer
66074 85426 95855 0 3 0x6000082 wait syz-fuzzer
95855 158127 7530 0 3 0x10008a sigsusp ksh
7530 22353 74209 0 3 0x9a kqread sshd
40748 232957 1 0 3 0x100083 ttyin getty
74209 495378 1 0 3 0x88 kqread sshd
43006 146099 6822 73 3 0x1100090 kqread syslogd
6822 137369 1 0 3 0x100082 netio syslogd
50736 151273 1 0 3 0x100080 kqread resolvd
75793 65769 6549 77 3 0x100092 kqread dhcpleased
43517 38038 6549 77 3 0x100092 kqread dhcpleased
6549 150010 1 0 3 0x80 kqread dhcpleased
60450 301128 0 0 3 0x14200 bored smr
42520 464808 0 0 2 0x14200 zerothread
23323 333520 0 0 3 0x14200 aiodoned aiodoned
26659 198342 0 0 3 0x14200 syncer update
52915 249730 0 0 3 0x14200 cleaner cleaner
3565 194553 0 0 2 0x14200 reaper
10524 15876 0 0 3 0x14200 pgdaemon pagedaemon
53005 504174 0 0 3 0x14200 bored viomb
83854 488270 0 0 3 0x40014200 acpi0 acpi0
52954 261870 0 0 3 0x40014200 idle1
11163 437792 0 0 3 0x14200 bored softnet3
99737 516663 0 0 3 0x14200 bored softnet2
840 82916 0 0 3 0x14200 bored softnet1
80512 430989 0 0 3 0x14200 bored softnet0
60575 280724 0 0 3 0x14200 bored systqmp
70954 361732 0 0 3 0x14200 bored systq
74089 254322 0 0 3 0x40014200 bored softclock
41232 507270 0 0 3 0x40014200 idle0
1 6707 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
CPU 0:
exclusive sched_lock &sched_lock r = 0 (0xffffffff82cdefb0)
#0 witness_lock+0x447
#1 sleep_finish+0x142 sys/kern/kern_synch.c:398
#2 rwsleep+0xab sys/kern/kern_synch.c:300
#3 futex_wait+0x13d sys/kern/sys_futex.c:250
#4 sys_futex+0xfc sys/kern/sys_futex.c:101
#5 syscall+0x606 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#5 syscall+0x606 sys/arch/amd64/amd64/trap.c:623
#6 Xsyscall+0x128
Process 58406 (syz-executor.7) thread 0xffff8000212807f8 (165816)
exclusive rrwlock inode r = 0 (0xfffffd8070642d60)
#0 witness_lock+0x447
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vget+0x200 sys/kern/vfs_subr.c:676
#6 ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119
#7 ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1314
#8 ufs_lookup+0x13ba sys/ufs/ufs/ufs_lookup.c:487
#9 VOP_LOOKUP+0x5c sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x6e2 sys/kern/vfs_lookup.c:566
#11 namei+0x55a sys/kern/vfs_lookup.c:250
#12 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1847
#13 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#13 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8065c70a38)
#0 witness_lock+0x447
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6 namei+0x55a sys/kern/vfs_lookup.c:250
#7 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1847
#8 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10208 6411K 6420K 78643K 11350 0
pcb 13 10K 12K 78643K 15 0
rtable 246 7K 7K 78643K 1725 0
pf 29 8K 8K 78643K 71 0
ifaddr 44 15K 16K 78643K 134 0
ifgroup 50 2K 2K 78643K 134 0
sysctl 3 1K 3K 78643K 45 0
counters 60 35K 35K 78643K 102 0
ioctlops 0 0K 2K 78643K 69 0
iov 0 0K 28K 78643K 1111 0
mount 1 1K 1K 78643K 1 0
log 0 0K 0K 78643K 4 0
vnodes 1279 80K 80K 78643K 3149 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 25K 78643K 159 0
VM map 2 1K 1K 78643K 2 0
sem 12 0K 1K 78643K 2651 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1697 195K 286K 78643K 12548 0
file desc 24 89K 117K 78643K 16242 0
sigio 0 0K 0K 78643K 129 0
proc 56 78K 115K 78643K 1604 0
subproc 104 6K 6K 78643K 377 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
ip_moptions 0 0K 0K 78643K 901 0
in_multi 99 7K 7K 78643K 547 0
ether_multi 1 0K 0K 78643K 28 0
mrt 1 0K 0K 78643K 1 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 187 837K 837K 78643K 187 0
exec 0 0K 1K 78643K 2741 0
tdb 3 0K 0K 78643K 3 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 8 62K 64K 78643K 10 0
UVM amap 474 99K 113K 78643K 157609 0
UVM aobj 131 4K 4K 78643K 131 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
ip6_options 0 0K 0K 78643K 370 0
NDP 11 0K 2K 78643K 90 0
temp 74 5920K 6000K 78643K 46856 0
kqueue 12 18K 28K 78643K 2039 0
SYN cache 2 16K 16K 78643K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 22 0 0 1 0 1 1 0 8 0
rtpcb 120 764 0 761 6 5 1 3 0 8 0
rtentry 112 364 0 248 4 0 4 4 0 8 0
unpcb 144 8893 0 8878 84 83 1 10 0 8 0
syncache 304 304 0 304 24 23 1 1 0 8 1
tcpqe 32 572 0 572 19 18 1 1 0 8 1
tcpcb 808 6204 0 6184 124 121 3 16 0 8 1
arp 120 65 0 46 1 0 1 1 0 8 0
ipq 40 36 0 35 11 10 1 1 0 8 0
ipqe 40 143 0 142 11 10 1 1 0 8 0
inpcb 368 11176 0 11152 138 135 3 14 0 8 0
nd6 136 104 0 75 3 1 2 2 0 8 0
kcovpl 48 29 0 21 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 1457 0 978 32 2 30 32 0 8 0
art_table 32 1458 0 978 5 1 4 5 0 8 0
art_node 16 363 0 257 1 0 1 1 0 8 0
sysvmsgpl 40 46 0 21 1 0 1 1 0 8 0
semupl 112 10 0 10 1 1 0 1 0 8 0
semapl 112 2639 0 2629 1 0 1 1 0 8 0
shmpl 112 128 0 0 4 0 4 4 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 22769 0 21318 92 0 92 92 0 8 0
ffsino 272 22769 0 21318 98 0 98 98 0 8 0
nchpl 144 44657 0 43013 63 0 63 63 0 8 0
uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0
vnodes 216 5926 0 0 330 0 330 330 0 8 0
namei 1024 142995 0 142995 7 6 1 2 0 8 1
percpumem 16 64 0 21 1 0 1 1 0 8 0
kstatmem 264 64 0 42 2 0 2 2 0 8 0
scxspl 216 331860 0 331859 68 62 6 8 1 8 5
plimitpl 152 1917 0 1894 20 19 1 2 0 8 0
sigapl 424 16496 0 16442 7 0 7 7 0 8 0
futexpl 64 131504 0 131498 5 4 1 1 0 8 0
knotepl 120 1290 0 0 25 5 20 25 0 8 0
kqueuepl 216 3255 0 3247 39 36 3 6 0 8 2
pipepl 320 2457 0 2429 64 58 6 8 0 8 3
fdescpl 496 16478 0 16443 7 2 5 6 0 8 0
filepl 152 90887 0 90646 125 111 14 19 0 8 4
lockfpl 104 2050 0 2048 1 0 1 1 0 8 0
lockfspl 48 613 0 611 1 0 1 1 0 8 0
sessionpl 144 44 0 28 1 0 1 1 0 8 0
pgrppl 48 358 0 342 1 0 1 1 0 8 0
ucredpl 104 11085 0 11067 1 0 1 1 0 8 0
zombiepl 144 16444 0 16442 1 0 1 1 0 8 0
processpl 1072 16496 0 16442 4 0 4 4 0 8 0
procpl 680 43579 0 43502 37 29 8 8 0 8 1
sosppl 168 1150 0 1148 13 12 1 2 0 8 0
sockpl 488 21171 0 21131 363 354 9 34 0 8 3
mcl64k 65536 33 0 0 4 1 3 3 0 8 0
mcl16k 16384 16 0 0 2 0 2 2 0 8 0
mcl12k 12288 24 0 0 2 0 2 2 0 8 0
mcl9k 9216 10 0 0 1 0 1 1 0 8 0
mcl8k 8192 34 0 0 4 2 2 3 0 8 0
mcl4k 4096 89 0 0 9 5 4 7 0 8 0
mcl2k2 2112 12 0 0 1 0 1 1 0 8 0
mcl2k 2048 691 0 0 35 19 16 33 0 8 0
mtagpl 96 17 0 0 1 0 1 1 0 8 0
mbufpl 256 2416 0 0 111 0 111 111 0 8 0
bufpl 288 119546 0 113215 453 0 453 453 0 8 0
anonpl 24 2017114 0 2006086 219 137 82 107 0 186 0
amapchunkpl 152 494322 0 493406 131 92 39 45 0 158 1
amappl16 200 61040 0 60768 225 208 17 37 0 8 0
amappl15 192 30 0 29 1 0 1 1 0 8 0
amappl14 184 226 0 211 2 1 1 2 0 8 0
amappl13 176 31 0 31 6 6 0 1 0 8 0
amappl12 168 17435 0 17395 2 0 2 2 0 8 0
amappl11 160 51 0 41 1 0 1 1 0 8 0
amappl10 152 63 0 44 1 0 1 1 0 8 0
amappl9 144 287 0 285 1 0 1 1 0 8 0
amappl8 136 852 0 677 7 0 7 7 0 8 0
amappl7 128 120 0 104 2 0 2 2 0 8 0
amappl6 120 488 0 463 2 1 1 2 0 8 0
amappl5 112 536 0 527 1 0 1 1 0 8 0
amappl4 104 987 0 936 3 0 3 3 0 8 0
amappl3 96 98007 0 97902 6 3 3 4 0 8 0
amappl2 88 17317 0 17242 3 1 2 3 0 8 0
amappl1 80 65766 0 65232 22 9 13 22 0 8 0
amappl 88 156388 0 156101 8 1 7 7 0 92 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 130 0 0 3 0 3 3 0 8 0
uaddrrnd 24 16478 0 16443 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 16478 0 16443 1 0 1 1 0 8 0
vmmpekpl 168 122225 0 122154 4 0 4 4 0 8 0
vmmpepl 168 972978 0 970461 308 187 121 137 0 357 4
vmsppl 464 16477 0 16443 7 2 5 6 0 8 0
rwobjpl 56 260528 0 253043 132 24 108 111 0 8 0
pdppl 4096 32964 0 32886 600 518 82 92 0 8 4
pvpl 32 5484889 0 5467446 510 349 161 364 0 265 0
pmappl 248 16477 0 16443 4 1 3 3 0 8 0
extentpl 40 56 0 38 1 0 1 1 0 8 0
phpool 112 1753 0 840 28 0 28 28 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x1e: addq $0x8,%rsp
x86_ipi_db(ffffffff82bffff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 sys/kern/kern_lock.c:147
intr_handler(ffff80002e44cfa0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 sys/kern/kern_lock.c:147
syscall(ffff80002e44d170) at syscall+0x5cd mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e44d170) at syscall+0x5cd sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x84be13443c0, count: 6
ddb{0}> trace
x86_ipi_db(ffffffff82bffff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 sys/kern/kern_lock.c:147
intr_handler(ffff80002e44cfa0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82cd6528) at __mp_lock+0x122 sys/kern/kern_lock.c:147
syscall(ffff80002e44d170) at syscall+0x5cd mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e44d170) at syscall+0x5cd sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x84be13443c0, count: -9
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x1c: addq $0x8,%rsp
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8279eeb4) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff82820513,ffffffff8283fa89,2bb,ffffffff827a57e4) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(adde91d9) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806f1d4af8) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806f1d4af8) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002121a800,fffffd806f1d4af8,fffffd806f1d4b80,6,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002121a800,6) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002121a800) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002121a800,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002121a800,ffff80002e401990,ffff80002e4019e0) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff80002e401a60) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e401a60) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73f9ddad0060, count: 2
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8279eeb4) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff82820513,ffffffff8283fa89,2bb,ffffffff827a57e4) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(adde91d9) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806f1d4af8) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806f1d4af8) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002121a800,fffffd806f1d4af8,fffffd806f1d4b80,6,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002121a800,6) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002121a800) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002121a800,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002121a800,ffff80002e401990,ffff80002e4019e0) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff80002e401a60) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff80002e401a60) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73f9ddad0060, count: -13
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Sep 4, 2023, 7:28:46 PM9/4/23
to syzkaller-o...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: e36cf0cab4c6 rework DESCRIPTION for readability. put the B..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1599842ba80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=168fea00680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/18b3692b41c5/disk-e36cf0ca.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/f11fcb36cb2e/bsd-e36cf0ca.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cde3f5cf4ea4/kernel-e36cf0ca.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+38efb4...@syzkaller.appspotmail.com
panic: kernel diagnostic assertion "nlevel >= IPL_NONE" failed: file "/syzkaller/managers/multicore/kernel/sys/arch/amd64/amd64/intr.c", line 699
__assert(ffffffff8281ff28,ffffffff827abaa9,2bb,ffffffff827a3b15) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(bced0db3) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806ef64438) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806ef64438) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002127f540,fffffd806ef64438,fffffd806ef644c0,3,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002127f540,3) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002127f540) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002127f540,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002127f540,ffff800021295700,ffff800021295750) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff8000212957d0) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff8000212957d0) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
__assert(ffffffff8281ff28,ffffffff827abaa9,2bb,ffffffff827a3b15) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(bced0db3) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806ef64438) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806ef64438) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002127f540,fffffd806ef64438,fffffd806ef644c0,3,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002127f540,3) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002127f540) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002127f540,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002127f540,ffff800021295700,ffff800021295750) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff8000212957d0) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff8000212957d0) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
rbx 0xffff800020d59b9f
rdx 0x3fd
rcx 0
rax 0x92
r8 0x101010101010101
r9 0x8080808080808080
r10 0x602749be0eb3aab2
r11 0x457343b1872fcbdb
cs 0x8
rflags 0x246
rsp 0xffff800021295330
flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
pri=0, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff80002121ed68,0xffff80002127f000
process=0xffff800021281938 user=0xffff800021290000, vmspace=0xfffffd806c354cc8
estcpu=36, cpticks=3, pctcpu=0.0
9393 232192 26094 0 3 0x80 nanoslp syz-executor1939936622
18323 208810 26094 0 3 0x80 nanoslp syz-executor1939936622
7623 140577 26094 0 3 0x80 nanoslp syz-executor1939936622
5302 158487 26094 0 3 0x80 nanoslp syz-executor1939936622
83458 245869 26094 0 3 0 biowait syz-executor1939936622
53047 460281 26094 0 3 0 biowait syz-executor1939936622
72187 179165 26094 0 3 0x80 nanoslp syz-executor1939936622
31386 158288 26094 0 3 0x80 nanoslp syz-executor1939936622
26094 19033 15343 0 3 0x82 nanoslp syz-executor1939936622
15343 450019 9600 0 3 0x10008a sigsusp ksh
9600 294331 93249 0 3 0x9a kqread sshd
58881 384116 1 0 3 0x100083 ttyin getty
93249 459860 1 0 3 0x88 kqread sshd
92793 400348 96648 74 3 0x1100092 bpf pflogd
96648 423173 1 0 3 0x80 netio pflogd
78502 443824 27205 73 3 0x1100090 kqread syslogd
27205 424038 1 0 3 0x100082 netio syslogd
1503 239974 1 0 3 0x100080 kqread resolvd
90195 29210 81537 77 3 0x100092 kqread dhcpleased
17646 397778 81537 77 3 0x100092 kqread dhcpleased
81537 219229 1 0 3 0x80 kqread dhcpleased
9258 73019 0 0 3 0x14200 bored smr
66580 444555 0 0 2 0x14200 zerothread
90080 42370 0 0 3 0x14200 aiodoned aiodoned
69076 307453 0 0 3 0x14200 syncer update
89517 135563 0 0 3 0x14200 cleaner cleaner
61786 312322 0 0 2 0x14200 reaper
15572 178064 0 0 3 0x14200 pgdaemon pagedaemon
62141 238846 0 0 3 0x14200 bored viomb
33971 497886 0 0 3 0x40014200 acpi0 acpi0
14254 41796 0 0 3 0x40014200 idle1
18599 106199 0 0 3 0x14200 bored softnet3
3595 514003 0 0 3 0x14200 bored softnet2
97211 8019 0 0 3 0x14200 bored softnet1
96772 58440 0 0 3 0x14200 bored softnet0
75428 377162 0 0 3 0x14200 bored systqmp
99864 299884 0 0 3 0x14200 bored systq
87589 150150 0 0 3 0x40014200 bored softclock
91492 55871 0 0 3 0x40014200 idle0
1 253978 0 0 3 0x82 wait init
exclusive rrwlock inode r = 0 (0xfffffd806c90b0a0)
#5 ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1343
#6 ffs_inode_alloc+0x1c2 sys/ufs/ffs/ffs_alloc.c:394
#7 ufs_mkdir+0xf8 sys/ufs/ufs/ufs_vnops.c:1149
#8 VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388
#9 domkdirat+0x125 sys/kern/vfs_syscalls.c:3073
#10 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#10 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806cffeb38)
exclusive rrwlock inode r = 0 (0xfffffd806c90b3d0)
pcb 13 8K 8K 78643K 13 0
rtable 58 1K 2K 78643K 114 0
pf 15 6K 10K 78643K 26 0
ifaddr 13 9K 9K 78643K 13 0
ifgroup 22 1K 1K 78643K 22 0
counters 44 33K 33K 78643K 44 0
ioctlops 0 0K 4K 78643K 1475 0
proc 67 91K 91K 78643K 302 0
ether_multi 1 0K 0K 78643K 1 0
exec 0 0K 1K 78643K 269 0
UVM aobj 3 2K 2K 78643K 3 0
temp 1 5904K 5968K 78643K 4692 0
kqueue 11 16K 24K 78643K 812 0
rtentry 112 23 0 1 1 0 1 1 0 8 0
unpcb 144 35 0 20 1 0 1 1 0 8 0
syncache 304 5 0 5 2 1 1 1 0 8 1
tcpqe 32 151 0 151 1 1 0 1 0 8 0
tcpcb 808 797 0 790 2 0 2 2 0 8 1
arp 120 2 0 0 1 0 1 1 0 8 0
inpcb 368 1611 0 1603 2 0 2 2 0 8 1
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 9 0 2 1 0 1 1 0 8 0
pfstkey 128 9 0 2 1 0 1 1 0 8 0
pfstate 376 9 0 2 1 0 1 1 0 8 0
pfrule 1344 21 0 16 2 1 1 2 0 8 0
art_table 32 98 0 0 1 0 1 1 0 8 0
art_node 16 22 0 2 1 0 1 1 0 8 0
ffsino 272 2231 0 821 95 0 95 95 0 8 0
nchpl 144 4785 0 3190 60 0 60 60 0 8 0
uvmvnodes 80 2245 0 0 46 0 46 46 0 8 0
vnodes 216 2245 0 0 125 0 125 125 0 8 0
namei 1024 9311 0 9310 3 1 2 2 0 8 1
percpumem 16 35 0 0 1 0 1 1 0 8 0
kstatmem 264 8 0 0 1 0 1 1 0 8 0
scxspl 216 9942 0 9940 10 6 4 8 1 8 3
plimitpl 152 25 0 10 1 0 1 1 0 8 0
sigapl 424 1135 0 1089 7 1 6 6 0 8 0
futexpl 64 4265 0 4265 1 0 1 1 0 8 1
knotepl 120 50 0 0 2 0 2 2 0 8 0
kqueuepl 216 809 0 802 1 0 1 1 0 8 0
pipepl 320 94 0 91 2 1 1 1 0 8 0
fdescpl 496 1118 0 1093 4 0 4 4 0 8 0
filepl 152 5215 0 5155 3 0 3 3 0 8 0
lockfpl 104 6 0 4 1 0 1 1 0 8 0
lockfspl 48 4 0 2 1 0 1 1 0 8 0
sessionpl 144 18 0 9 1 0 1 1 0 8 0
pgrppl 48 18 0 9 1 0 1 1 0 8 0
ucredpl 104 71 0 59 1 0 1 1 0 8 0
zombiepl 144 1094 0 1089 2 1 1 1 0 8 0
processpl 1072 1135 0 1089 4 0 4 4 0 8 0
procpl 680 2313 0 2266 6 1 5 5 0 8 0
sockpl 488 1666 0 1640 6 1 5 5 0 8 1
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 3 0 0 1 0 1 1 0 8 0
mcl2k 2048 248 0 0 31 0 31 31 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 273 0 0 18 0 18 18 0 8 0
bufpl 288 3373 0 90 235 0 235 235 0 8 0
anonpl 24 228526 0 226259 28 12 16 25 0 186 0
amapchunkpl 152 30457 0 30190 18 1 17 17 0 158 3
amappl16 200 6179 0 6170 6 5 1 5 0 8 0
amappl15 192 6 0 5 1 0 1 1 0 8 0
amappl14 184 109 0 98 1 0 1 1 0 8 0
amappl13 176 17 0 17 1 1 0 1 0 8 0
amappl12 168 1662 0 1637 3 1 2 2 0 8 0
amappl11 160 59 0 45 1 0 1 1 0 8 0
amappl10 152 21 0 21 2 2 0 1 0 8 0
amappl9 144 186 0 186 2 2 0 1 0 8 0
amappl8 136 28 0 26 1 0 1 1 0 8 0
amappl7 128 820 0 808 1 0 1 1 0 8 0
amappl6 120 158 0 143 1 0 1 1 0 8 0
amappl5 112 128 0 117 1 0 1 1 0 8 0
amappl4 104 467 0 434 1 0 1 1 0 8 0
amappl3 96 6934 0 6877 4 1 3 3 0 8 1
amappl2 88 1289 0 1237 2 0 2 2 0 8 0
amappl1 80 12624 0 12123 17 5 12 12 0 8 1
amappl 88 8870 0 8770 4 0 4 4 0 92 0
uaddrrnd 24 1118 0 1093 1 0 1 1 0 8 0
vmmpekpl 168 11531 0 11510 2 0 2 2 0 8 0
vmmpepl 168 68961 0 67638 77 8 69 69 0 357 5
vmsppl 464 1117 0 1093 4 0 4 4 0 8 0
rwobjpl 56 29069 0 26094 45 2 43 43 0 8 0
pdppl 4096 2244 0 2186 92 22 70 70 0 8 12
pvpl 32 399058 0 393516 64 14 50 57 0 265 1
pmappl 248 1117 0 1093 2 0 2 2 0 8 0
intr_handler(ffff8000212cb5e0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__sanitizer_cov_trace_const_cmp4(ffff8000212cb770,ffff8000212cb770) at __sanitizer_cov_trace_const_cmp4+0x3c sys/dev/kcov.c:236
ddb{0}> trace
x86_ipi_db(ffffffff82bf2ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
intr_handler(ffff8000212cb5e0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__sanitizer_cov_trace_const_cmp4(ffff8000212cb770,ffff8000212cb770) at __sanitizer_cov_trace_const_cmp4+0x3c sys/dev/kcov.c:236
__assert(ffffffff8281ff28,ffffffff827abaa9,2bb,ffffffff827a3b15) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(bced0db3) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806ef64438) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806ef64438) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002127f540,fffffd806ef64438,fffffd806ef644c0,3,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002127f540,3) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002127f540) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002127f540,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002127f540,ffff800021295700,ffff800021295750) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff8000212957d0) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff8000212957d0) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
__assert(ffffffff8281ff28,ffffffff827abaa9,2bb,ffffffff827a3b15) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(bced0db3) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806ef64438) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806ef64438) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002127f540,fffffd806ef64438,fffffd806ef644c0,3,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002127f540,3) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002127f540) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002127f540,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002127f540,ffff800021295700,ffff800021295750) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff8000212957d0) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff8000212957d0) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
ddb{1}>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: e36cf0cab4c6 rework DESCRIPTION for readability. put the B..
git tree: openbsd
kernel config: https://syzkaller.appspot.com/x/.config?x=7058272de1526588
dashboard link: https://syzkaller.appspot.com/bug?extid=38efb425eada701ca8bb
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17260198680000
dashboard link: https://syzkaller.appspot.com/bug?extid=38efb425eada701ca8bb
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=168fea00680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/18b3692b41c5/disk-e36cf0ca.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/f11fcb36cb2e/bsd-e36cf0ca.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cde3f5cf4ea4/kernel-e36cf0ca.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+38efb4...@syzkaller.appspotmail.com
Stopped at db_enter+0x1c: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
518339 29373 0 0 0 0 syz-executor1939936622
TID PID UID PRFLAGS PFLAGS CPU COMMAND
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827a15bc) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff8281ff28,ffffffff827abaa9,2bb,ffffffff827a3b15) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(bced0db3) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806ef64438) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806ef64438) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002127f540,fffffd806ef64438,fffffd806ef644c0,3,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002127f540,3) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002127f540) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002127f540,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002127f540,ffff800021295700,ffff800021295750) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff8000212957d0) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff8000212957d0) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fb7d1a8320, count: 2
end of kernel
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "nlevel >= IPL_NONE" failed: file "/syzkaller/managers/multicore/kernel/sys/arch/amd64/amd64/intr.c", line 699
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827a15bc) at panic+0x17b sys/kern/subr_prf.c:198
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
__assert(ffffffff8281ff28,ffffffff827abaa9,2bb,ffffffff827a3b15) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(bced0db3) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806ef64438) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806ef64438) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002127f540,fffffd806ef64438,fffffd806ef644c0,3,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002127f540,3) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002127f540) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002127f540,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002127f540,ffff800021295700,ffff800021295750) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff8000212957d0) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff8000212957d0) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fb7d1a8320, count: -13
end of kernel
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800021295340
rdi 0
rsi 0x1
rbx 0xffff800020d59b9f
rdx 0x3fd
rcx 0
rax 0x92
r8 0x101010101010101
r9 0x8080808080808080
r10 0x602749be0eb3aab2
r11 0x457343b1872fcbdb
r12 0xffff800020d599a0
r13 0
r14 0
r15 0x1
rip 0xffffffff81508bec db_enter+0x1c
r13 0
r14 0
r15 0x1
cs 0x8
rflags 0x246
rsp 0xffff800021295330
ss 0x10
db_enter+0x1c: addq $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor1939936622) pid=98160 stat=onproc
db_enter+0x1c: addq $0x8,%rsp
ddb{1}> show proc
flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
pri=0, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff80002121ed68,0xffff80002127f000
process=0xffff800021281938 user=0xffff800021290000, vmspace=0xfffffd806c354cc8
estcpu=36, cpticks=3, pctcpu=0.0
user=0, sys=1, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
29373 518339 31386 0 7 0 syz-executor1939936622
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
9393 232192 26094 0 3 0x80 nanoslp syz-executor1939936622
18323 208810 26094 0 3 0x80 nanoslp syz-executor1939936622
7623 140577 26094 0 3 0x80 nanoslp syz-executor1939936622
5302 158487 26094 0 3 0x80 nanoslp syz-executor1939936622
83458 245869 26094 0 3 0 biowait syz-executor1939936622
53047 460281 26094 0 3 0 biowait syz-executor1939936622
72187 179165 26094 0 3 0x80 nanoslp syz-executor1939936622
31386 158288 26094 0 3 0x80 nanoslp syz-executor1939936622
26094 19033 15343 0 3 0x82 nanoslp syz-executor1939936622
15343 450019 9600 0 3 0x10008a sigsusp ksh
9600 294331 93249 0 3 0x9a kqread sshd
58881 384116 1 0 3 0x100083 ttyin getty
93249 459860 1 0 3 0x88 kqread sshd
92793 400348 96648 74 3 0x1100092 bpf pflogd
96648 423173 1 0 3 0x80 netio pflogd
78502 443824 27205 73 3 0x1100090 kqread syslogd
27205 424038 1 0 3 0x100082 netio syslogd
1503 239974 1 0 3 0x100080 kqread resolvd
90195 29210 81537 77 3 0x100092 kqread dhcpleased
17646 397778 81537 77 3 0x100092 kqread dhcpleased
81537 219229 1 0 3 0x80 kqread dhcpleased
9258 73019 0 0 3 0x14200 bored smr
66580 444555 0 0 2 0x14200 zerothread
90080 42370 0 0 3 0x14200 aiodoned aiodoned
69076 307453 0 0 3 0x14200 syncer update
89517 135563 0 0 3 0x14200 cleaner cleaner
61786 312322 0 0 2 0x14200 reaper
15572 178064 0 0 3 0x14200 pgdaemon pagedaemon
62141 238846 0 0 3 0x14200 bored viomb
33971 497886 0 0 3 0x40014200 acpi0 acpi0
14254 41796 0 0 3 0x40014200 idle1
18599 106199 0 0 3 0x14200 bored softnet3
3595 514003 0 0 3 0x14200 bored softnet2
97211 8019 0 0 3 0x14200 bored softnet1
96772 58440 0 0 3 0x14200 bored softnet0
75428 377162 0 0 3 0x14200 bored systqmp
99864 299884 0 0 3 0x14200 bored systq
87589 150150 0 0 3 0x40014200 bored softclock
91492 55871 0 0 3 0x40014200 idle0
1 253978 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
Process 83458 (syz-executor1939936622) thread 0xffff8000211b2ff8 (245869)
ddb{1}> show all locks
exclusive rrwlock inode r = 0 (0xfffffd806c90b0a0)
#0 witness_lock+0x447
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 ufs_ihashins+0x46 sys/ufs/ufs/ufs_ihash.c:140
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#5 ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1343
#6 ffs_inode_alloc+0x1c2 sys/ufs/ffs/ffs_alloc.c:394
#7 ufs_mkdir+0xf8 sys/ufs/ufs/ufs_vnops.c:1149
#8 VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388
#9 domkdirat+0x125 sys/kern/vfs_syscalls.c:3073
#10 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#10 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806cffeb38)
#0 witness_lock+0x447
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6 namei+0x55a sys/kern/vfs_lookup.c:250
#7 domkdirat+0x79 sys/kern/vfs_syscalls.c:3058
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6 namei+0x55a sys/kern/vfs_lookup.c:250
#8 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9 Xsyscall+0x128
Process 53047 (syz-executor1939936622) thread 0xffff8000211b3d40 (460281)
#8 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806c90b3d0)
#0 witness_lock+0x447
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vget+0x200 sys/kern/vfs_subr.c:676
#6 ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119
#7 ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1314
#8 ufs_lookup+0x13ba sys/ufs/ufs/ufs_lookup.c:487
#9 VOP_LOOKUP+0x5c sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x6e2 sys/kern/vfs_lookup.c:566
#11 namei+0x55a sys/kern/vfs_lookup.c:250
#12 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1847
#13 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#13 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806cffe6f8)
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vget+0x200 sys/kern/vfs_subr.c:676
#6 ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119
#7 ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1314
#8 ufs_lookup+0x13ba sys/ufs/ufs/ufs_lookup.c:487
#9 VOP_LOOKUP+0x5c sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x6e2 sys/kern/vfs_lookup.c:566
#11 namei+0x55a sys/kern/vfs_lookup.c:250
#12 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1847
#13 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#13 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#14 Xsyscall+0x128
#0 witness_lock+0x447
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6 namei+0x55a sys/kern/vfs_lookup.c:250
#7 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1847
#8 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10162 6455K 6456K 78643K 11240 0
#1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2 rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3 VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4 vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5 vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6 namei+0x55a sys/kern/vfs_lookup.c:250
#7 dounlinkat+0x9d sys/kern/vfs_syscalls.c:1847
#8 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
pcb 13 8K 8K 78643K 13 0
rtable 58 1K 2K 78643K 114 0
pf 15 6K 10K 78643K 26 0
ifaddr 13 9K 9K 78643K 13 0
ifgroup 22 1K 1K 78643K 22 0
counters 44 33K 33K 78643K 44 0
ioctlops 0 0K 4K 78643K 1475 0
mount 1 1K 1K 78643K 1 0
log 0 0K 0K 78643K 4 0
vnodes 1176 74K 74K 78643K 1192 0
log 0 0K 0K 78643K 4 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 1K 78643K 2 0
UFS mount 5 36K 36K 78643K 5 0
VM map 2 1K 1K 78643K 2 0
sem 2 0K 0K 78643K 2 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1697 195K 286K 78643K 12548 0
file desc 1 0K 0K 78643K 1 0
ACPI 1697 195K 286K 78643K 12548 0
proc 67 91K 91K 78643K 302 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
in_multi 11 0K 0K 78643K 11 0
NFS daemon 1 16K 16K 78643K 1 0
ether_multi 1 0K 0K 78643K 1 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 25 122K 122K 78643K 25 0
MSDOSFS mount 1 16K 16K 78643K 1 0
exec 0 0K 1K 78643K 269 0
tdb 3 0K 0K 78643K 3 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 8 62K 64K 78643K 10 0
UVM amap 156 70K 72K 78643K 9186 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 8 62K 64K 78643K 10 0
UVM aobj 3 2K 2K 78643K 3 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
NDP 4 0K 0K 78643K 4 0
crypto data 1 1K 1K 78643K 1 0
temp 1 5904K 5968K 78643K 4692 0
kqueue 11 16K 24K 78643K 812 0
SYN cache 2 16K 16K 78643K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 22 0 0 1 0 1 1 0 8 0
rtpcb 120 20 0 17 1 0 1 1 0 8 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 22 0 0 1 0 1 1 0 8 0
rtentry 112 23 0 1 1 0 1 1 0 8 0
unpcb 144 35 0 20 1 0 1 1 0 8 0
syncache 304 5 0 5 2 1 1 1 0 8 1
tcpqe 32 151 0 151 1 1 0 1 0 8 0
tcpcb 808 797 0 790 2 0 2 2 0 8 1
arp 120 2 0 0 1 0 1 1 0 8 0
inpcb 368 1611 0 1603 2 0 2 2 0 8 1
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 9 0 2 1 0 1 1 0 8 0
pfstkey 128 9 0 2 1 0 1 1 0 8 0
pfstate 376 9 0 2 1 0 1 1 0 8 0
pfrule 1344 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 97 0 0 7 0 7 7 0 8 0
art_table 32 98 0 0 1 0 1 1 0 8 0
art_node 16 22 0 2 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 2231 0 821 89 0 89 89 0 8 0
ffsino 272 2231 0 821 95 0 95 95 0 8 0
nchpl 144 4785 0 3190 60 0 60 60 0 8 0
uvmvnodes 80 2245 0 0 46 0 46 46 0 8 0
vnodes 216 2245 0 0 125 0 125 125 0 8 0
namei 1024 9311 0 9310 3 1 2 2 0 8 1
percpumem 16 35 0 0 1 0 1 1 0 8 0
kstatmem 264 8 0 0 1 0 1 1 0 8 0
scxspl 216 9942 0 9940 10 6 4 8 1 8 3
plimitpl 152 25 0 10 1 0 1 1 0 8 0
sigapl 424 1135 0 1089 7 1 6 6 0 8 0
futexpl 64 4265 0 4265 1 0 1 1 0 8 1
knotepl 120 50 0 0 2 0 2 2 0 8 0
kqueuepl 216 809 0 802 1 0 1 1 0 8 0
pipepl 320 94 0 91 2 1 1 1 0 8 0
fdescpl 496 1118 0 1093 4 0 4 4 0 8 0
filepl 152 5215 0 5155 3 0 3 3 0 8 0
lockfpl 104 6 0 4 1 0 1 1 0 8 0
lockfspl 48 4 0 2 1 0 1 1 0 8 0
sessionpl 144 18 0 9 1 0 1 1 0 8 0
pgrppl 48 18 0 9 1 0 1 1 0 8 0
ucredpl 104 71 0 59 1 0 1 1 0 8 0
zombiepl 144 1094 0 1089 2 1 1 1 0 8 0
processpl 1072 1135 0 1089 4 0 4 4 0 8 0
procpl 680 2313 0 2266 6 1 5 5 0 8 0
sockpl 488 1666 0 1640 6 1 5 5 0 8 1
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 3 0 0 1 0 1 1 0 8 0
mcl2k 2048 248 0 0 31 0 31 31 0 8 0
mtagpl 96 3 0 0 1 0 1 1 0 8 0
mbufpl 256 273 0 0 18 0 18 18 0 8 0
bufpl 288 3373 0 90 235 0 235 235 0 8 0
anonpl 24 228526 0 226259 28 12 16 25 0 186 0
amapchunkpl 152 30457 0 30190 18 1 17 17 0 158 3
amappl16 200 6179 0 6170 6 5 1 5 0 8 0
amappl15 192 6 0 5 1 0 1 1 0 8 0
amappl14 184 109 0 98 1 0 1 1 0 8 0
amappl13 176 17 0 17 1 1 0 1 0 8 0
amappl12 168 1662 0 1637 3 1 2 2 0 8 0
amappl11 160 59 0 45 1 0 1 1 0 8 0
amappl10 152 21 0 21 2 2 0 1 0 8 0
amappl9 144 186 0 186 2 2 0 1 0 8 0
amappl8 136 28 0 26 1 0 1 1 0 8 0
amappl7 128 820 0 808 1 0 1 1 0 8 0
amappl6 120 158 0 143 1 0 1 1 0 8 0
amappl5 112 128 0 117 1 0 1 1 0 8 0
amappl4 104 467 0 434 1 0 1 1 0 8 0
amappl3 96 6934 0 6877 4 1 3 3 0 8 1
amappl2 88 1289 0 1237 2 0 2 2 0 8 0
amappl1 80 12624 0 12123 17 5 12 12 0 8 1
amappl 88 8870 0 8770 4 0 4 4 0 92 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 2 0 0 1 0 1 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
uaddrrnd 24 1118 0 1093 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1118 0 1093 1 0 1 1 0 8 0
vmmpekpl 168 11531 0 11510 2 0 2 2 0 8 0
vmmpepl 168 68961 0 67638 77 8 69 69 0 357 5
vmsppl 464 1117 0 1093 4 0 4 4 0 8 0
rwobjpl 56 29069 0 26094 45 2 43 43 0 8 0
pdppl 4096 2244 0 2186 92 22 70 70 0 8 12
pvpl 32 399058 0 393516 64 14 50 57 0 265 1
pmappl 248 1117 0 1093 2 0 2 2 0 8 0
extentpl 40 56 0 38 1 0 1 1 0 8 0
phpool 112 589 0 26 17 0 17 17 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x1e: addq $0x8,%rsp
x86_ipi_db(ffffffff82bf2ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
Stopped at x86_ipi_db+0x1e: addq $0x8,%rsp
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
intr_handler(ffff8000212cb5e0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__sanitizer_cov_trace_const_cmp4(ffff8000212cb770,ffff8000212cb770) at __sanitizer_cov_trace_const_cmp4+0x3c sys/dev/kcov.c:236
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fb7d1a81a0, count: 7
end of kernel
ddb{0}> trace
x86_ipi_db(ffffffff82bf2ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
intr_handler(ffff8000212cb5e0,ffff80000006bc00) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__sanitizer_cov_trace_const_cmp4(ffff8000212cb770,ffff8000212cb770) at __sanitizer_cov_trace_const_cmp4+0x3c sys/dev/kcov.c:236
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fb7d1a81a0, count: -8
end of kernel
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x1c: addq $0x8,%rsp
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827a15bc) at panic+0x17b sys/kern/subr_prf.c:198
Stopped at db_enter+0x1c: addq $0x8,%rsp
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
__assert(ffffffff8281ff28,ffffffff827abaa9,2bb,ffffffff827a3b15) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(bced0db3) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806ef64438) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806ef64438) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002127f540,fffffd806ef64438,fffffd806ef644c0,3,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002127f540,3) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002127f540) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002127f540,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002127f540,ffff800021295700,ffff800021295750) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff8000212957d0) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff8000212957d0) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fb7d1a8320, count: 2
end of kernel
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827a15bc) at panic+0x17b sys/kern/subr_prf.c:198
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
__assert(ffffffff8281ff28,ffffffff827abaa9,2bb,ffffffff827a3b15) at __assert+0x29 sys/kern/subr_prf.c:157
splraise(bced0db3) at splraise+0xb4 sys/arch/amd64/amd64/intr.c:699
mtx_enter_try(fffffd806ef64438) at mtx_enter_try+0x73 sys/kern/kern_lock.c:291
mtx_enter(fffffd806ef64438) at mtx_enter+0x4f sys/kern/kern_lock.c:266
knote_remove(ffff80002127f540,fffffd806ef64438,fffffd806ef644c0,3,0) at knote_remove+0x20d sys/kern/kern_event.c:1881
knote_fdclose(ffff80002127f540,3) at knote_fdclose+0xae sys/kern/kern_event.c:1934
fdfree(ffff80002127f540) at fdfree+0xdf sys/kern/kern_descrip.c:1196
exit1(ffff80002127f540,0,0,1) at exit1+0x3ff sys/kern/kern_exit.c:206
sys_exit(ffff80002127f540,ffff800021295700,ffff800021295750) at sys_exit+0x1a sys/kern/kern_exit.c:89
syscall(ffff8000212957d0) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff8000212957d0) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fb7d1a8320, count: -13
end of kernel
ddb{1}>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages