syzbot


pool: free list modified: phpool

Status: fixed on 2020/08/05 06:16
Reported-by: syzbot+02f2e07964a89ab65ea4@syzkaller.appspotmail.com
Fix commit: efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
First crash: 1626d, last: 1626d

Sample crash report:
panic: pool_do_get: phpool free list modified: page 0xfffffd8053eb8000; item addr 0xfffffd8053eb8000; offset 0x0=0x0 != 0xc9b7687d4a0ab64c
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*208285  36082      0           0  0x4000000    0  syz-executor.1
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8246a6bd) at panic+0x15c sys/kern/subr_prf.c:207
pool_do_get(ffffffff82817f28,2,ffff80001d7ac238) at pool_do_get+0x42a sys/kern/subr_pool.c:738
pool_get(ffffffff82817f28,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
pool_p_alloc(ffffffff82821c58,2,ffff80001d7ac408) at pool_p_alloc+0xd6 sys/kern/subr_pool.c:927
pool_do_get(ffffffff82821c58,2,ffff80001d7ac408) at pool_do_get+0x10c sys/kern/subr_pool.c:704
pool_get(ffffffff82821c58,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
m_get(2,1) at m_get+0x4c sys/kern/uipc_mbuf.c:250
ip6_output(fffffd80060e2d00,ffffffff8278bdd0,0,1,ffff80001d7ac658,0) at ip6_output+0x203 sys/netinet6/ip6_output.c:198
mld6_sendpkt(ffff800000ad6d00,83,0) at mld6_sendpkt+0x2b5 sys/netinet6/mld6.c:465
mld6_start_listening(ffff800000ad6d00) at mld6_start_listening+0x8e sys/netinet6/mld6.c:136
in6_addmulti(ffff80001d7ac9c0,ffff800000ad4000,ffff80001d7aca48) at in6_addmulti+0x25e sys/netinet6/in6.c:1073
in6_update_ifa(ffff800000ad4000,ffff80001d7acab0,0) at in6_update_ifa+0x1540 in6_joingroup sys/netinet6/in6.c:1142 [inline]
in6_update_ifa(ffff800000ad4000,ffff80001d7acab0,0) at in6_update_ifa+0x1540 sys/netinet6/in6.c:764
in6_ifattach_linklocal(ffff800000ad4000,0) at in6_ifattach_linklocal+0x2a2 sys/netinet6/in6_ifattach.c:281
end trace frame: 0xffff80001d7acbc0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
pool_do_get: phpool free list modified: page 0xfffffd8053eb8000; item addr 0xfffffd8053eb8000; offset 0x0=0x0 != 0xc9b7687d4a0ab64c
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8246a6bd) at panic+0x15c sys/kern/subr_prf.c:207
pool_do_get(ffffffff82817f28,2,ffff80001d7ac238) at pool_do_get+0x42a sys/kern/subr_pool.c:738
pool_get(ffffffff82817f28,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
pool_p_alloc(ffffffff82821c58,2,ffff80001d7ac408) at pool_p_alloc+0xd6 sys/kern/subr_pool.c:927
pool_do_get(ffffffff82821c58,2,ffff80001d7ac408) at pool_do_get+0x10c sys/kern/subr_pool.c:704
pool_get(ffffffff82821c58,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
m_get(2,1) at m_get+0x4c sys/kern/uipc_mbuf.c:250
ip6_output(fffffd80060e2d00,ffffffff8278bdd0,0,1,ffff80001d7ac658,0) at ip6_output+0x203 sys/netinet6/ip6_output.c:198
mld6_sendpkt(ffff800000ad6d00,83,0) at mld6_sendpkt+0x2b5 sys/netinet6/mld6.c:465
mld6_start_listening(ffff800000ad6d00) at mld6_start_listening+0x8e sys/netinet6/mld6.c:136
in6_addmulti(ffff80001d7ac9c0,ffff800000ad4000,ffff80001d7aca48) at in6_addmulti+0x25e sys/netinet6/in6.c:1073
in6_update_ifa(ffff800000ad4000,ffff80001d7acab0,0) at in6_update_ifa+0x1540 in6_joingroup sys/netinet6/in6.c:1142 [inline]
in6_update_ifa(ffff800000ad4000,ffff80001d7acab0,0) at in6_update_ifa+0x1540 sys/netinet6/in6.c:764
in6_ifattach_linklocal(ffff800000ad4000,0) at in6_ifattach_linklocal+0x2a2 sys/netinet6/in6_ifattach.c:281
in6_ifattach(ffff800000ad4000) at in6_ifattach+0x1b8 sys/netinet6/in6_ifattach.c:401
ifnewlladdr(ffff800000ad4000) at ifnewlladdr+0x119 sys/net/if.c:3120
ifioctl(fffffd806aaff1a0,8020691f,ffff80001d7acd00,ffff80001d6c2d58) at ifioctl+0x1b2e sys/net/if.c:2196
sys_ioctl(ffff80001d6c2d58,ffff80001d7ace18,ffff80001d7ace60) at sys_ioctl+0x4a1
syscall(ffff80001d7acee0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x21b66827510, count: -20
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80001d7ac0a0
rbx               0xffff80001d7ac150
rdx                              0x2
rcx                                0
rax                              0x1
r8                0xffffffff81843c1f    kprintf+0x15f
r9                               0x1
r10                              0x2
r11               0x97c0431fc34aa095
r12                     0x3000000008
r13               0xffff80001d7ac0b0
r14                            0x100
r15                              0x1
rip               0xffffffff8234ada8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80001d7ac090
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor.1) pid=208285 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=32, usrpri=63, nice=20
    forw=0xffffffffffffffff, list=0xffff80001d6c1c48,0xffff80001d6c1298
    process=0xffff8000ffff95a8 user=0xffff80001d7a7000, vmspace=0xfffffd80060dc890
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
   197  403523  62537      0  3        0x80  nanosleep     syz-executor.0
   197  118643  62537      0  3   0x4000080  netcon        syz-executor.0
   197  138540  62537      0  3   0x4000080  fsleep        syz-executor.0
 36082  178122  49289      0  2           0                syz-executor.1
*36082  208285  49289      0  7   0x4000000                syz-executor.1
 36082  447805  49289      0  3   0x4000080  fsleep        syz-executor.1
 10694  320948      0      0  3     0x14200  bored         sosplice
 62537   62777  58155      0  3        0x82  nanosleep     syz-executor.0
 49289  498371  58155      0  3        0x82  nanosleep     syz-executor.1
 58155  276887  84186      0  3        0x82  thrsleep      syz-fuzzer
 58155  427604  84186      0  3   0x4000082  thrsleep      syz-fuzzer
 58155  511150  84186      0  3   0x4000082  kqread        syz-fuzzer
 58155  416667  84186      0  3   0x4000082  thrsleep      syz-fuzzer
 58155  516153  84186      0  3   0x4000082  thrsleep      syz-fuzzer
 58155  248122  84186      0  3   0x4000082  thrsleep      syz-fuzzer
 58155  382800  84186      0  3   0x4000082  thrsleep      syz-fuzzer
 58155  372126  84186      0  3   0x4000082  thrsleep      syz-fuzzer
 84186   85509  14343      0  3    0x10008a  pause         ksh
 14343  488345  77799      0  3        0x92  select        sshd
 34954  213193      1      0  3    0x100083  ttyin         getty
 77799  494409      1      0  3        0x80  select        sshd
 49793   51211  59340     73  3    0x100090  kqread        syslogd
 59340   98561      1      0  3    0x100082  netio         syslogd
 46753   63253      1     77  3    0x100090  poll          dhclient
 54386  371096      1      0  3        0x80  poll          dhclient
 49937   31472      0      0  3     0x14200  bored         smr
 82601  456202      0      0  2     0x14200                zerothread
 67576  376512      0      0  3     0x14200  aiodoned      aiodoned
 59710  275357      0      0  3     0x14200  syncer        update
  7369  394175      0      0  3     0x14200  cleaner       cleaner
 24171  464272      0      0  3     0x14200  reaper        reaper
  2892  227413      0      0  3     0x14200  pgdaemon      pagedaemon
 52965  449358      0      0  3     0x14200  bored         crynlk
 34073  258338      0      0  3     0x14200  bored         crypto
 70502  362051      0      0  3  0x40014200  acpi0         acpi0
 45567  223655      0      0  3     0x14200  bored         softnet
 17605   96339      0      0  2     0x14200                systqmp
  1811   19352      0      0  3     0x14200  bored         systq
 61543  330498      0      0  3  0x40014200  bored         softclock
 38452  494663      0      0  3  0x40014200                idle0
     1  160664      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9474   6329K    6981K  78643K     11104        0
            pcb    13      8K       8K  78643K        76        0
         rtable   102     11K      12K  78643K       318        0
         ifaddr    54     12K      12K  78643K        89        0
       counters    21     16K      16K  78643K        22        0
       ioctlops     0      0K       4K  78643K        29        0
            iov     0      0K      16K  78643K        20        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1222     77K      77K  78643K      1355        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         3        0
         VM map     2      0K       0K  78643K         2        0
            sem    12      0K       1K  78643K        20        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1809    195K     288K  78643K     12938        0
      file desc     6     17K      25K  78643K       174        0
           proc    49     38K      54K  78643K       377        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K         5        0
       in_multi    34      2K       2K  78643K        70        0
    ether_multi     1      0K       0K  78643K         2        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    43    201K     201K  78643K        43        0
           exec     0      0K       1K  78643K       201        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   125     23K      39K  78643K      1265        0
       UVM aobj     7      2K       2K  78643K         8        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        16        0
            NDP     8      0K       0K  78643K        17        0
           temp    90   3855K    3919K  78643K      4120        0
         kqueue     3      4K       8K  78643K        12        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        8    0        1     1     0     1     1     0     8    0
rtpcb       80       36    0       34     1     0     1     1     0     8    0
rtentry    112       64    0       25     2     0     2     2     0     8    0
unpcb      120       87    0       79     1     0     1     1     0     8    0
syncache   264        4    0        4     1     1     0     1     0     8    0
sackhl      24        1    0        1     1     0     1     1     0     8    1
tcpqe       32       99    0       99     1     1     0     1     0     8    0
tcpcb      544       68    0       62     1     0     1     1     0     8    0
inpcb      296      267    0      252     2     0     2     2     0     8    0
nd6         48       13    0        9     1     0     1     1     0     8    0
pfrktable  1344      20    0       20     1     0     1     1     0     8    1
pftag       88        4    0        4     1     0     1     1     0     8    1
pfrule     1360       4    0        4     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      269    0       67    13     0    13    13     0     8    0
art_table   32      270    0       67     2     0     2     2     0     8    0
art_node    16       63    0       23     1     0     1     1     0     8    0
sysvmsgpl   40        5    0        3     2     1     1     1     0     8    0
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl     112       14    0        4     1     0     1     1     0     8    0
shmpl      112        6    0        1     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1616    0      221    88     0    88    88     0     8    0
ffsino     240     1616    0      221    83     0    83    83     0     8    0
nchpl      144     2025    0      422    60     0    60    60     0     8    0
uvmvnodes   72     1775    0        0    33     0    33    33     0     8    0
vnodes     208     1775    0        0    94     0    94    94     0     8    0
namei      1024    5270    0     5270     1     0     1     1     0     8    1
vcpupl     1984       2    0        0     1     0     1     1     0     8    0
vmpool     528        6    0        4     2     1     1     1     0     8    0
pfiaddrpl  120        6    0        6     1     0     1     1     0     8    1
scxspl     192     5992    0     5992     1     0     1     1     0     8    1
plimitpl   152       28    0       21     1     0     1     1     0     8    0
sigapl     424      361    0      331     4     0     4     4     0     8    0
futexpl     56     3313    0     3311     1     0     1     1     0     8    0
knotepl    112       69    0       50     1     0     1     1     0     8    0
kqueuepl   144       29    0       24     1     0     1     1     0     8    0
pipelkpl    16       92    0       82     1     0     1     1     0     8    0
pipepl     120      184    0      165     1     0     1     1     0     8    0
fdescpl    432      346    0      331     2     0     2     2     0     8    0
filepl     120     1959    0     1852     4     0     4     4     0     8    0
lockfpl    104       31    0       30     1     0     1     1     0     8    0
lockfspl    48       14    0       13     1     0     1     1     0     8    0
sessionpl  112       17    0        7     1     0     1     1     0     8    0
pgrppl      48       17    0        7     1     0     1     1     0     8    0
ucredpl     96      170    0      163     1     0     1     1     0     8    0
zombiepl   144      331    0      331     1     0     1     1     0     8    1
processpl  920      361    0      331     4     0     4     4     0     8    0
procpl     624      557    0      516     4     0     4     4     0     8    0
sosppl     128        2    0        2     1     1     0     1     0     8    0
sockpl     400      393    0      368     3     0     3     3     0     8    0
mcl64k     65536    517    0      517    65     9    56    65     0     8   56
mcl12k     12288      7    0        7     2     1     1     1     0     8    1
mcl9k      9216       1    0        1     1     0     1     1     0     8    1
mcl8k      8192       6    0        6     2     1     1     1     0     8    1
mcl4k      4096      19    0       19     2     1     1     1     0     8    1
mcl2k2     2112       1    0        1     1     1     0     1     0     8    0
mcl2k      2048   71430    0    71377    18    10     8    15     0     8    0
mtagpl      96       78    0        2     3     1     2     2     0     8    0
mbufpl     256   114999    0   114663    47    26    21    39     0     8    0
bufpl      280     3539    0      128   244     0   244   244     0     8    0
anonpl      16    54236    0    38466    80     2    78    78     0   107   13
amapchunkpl 152    1347    0     1208     7     0     7     7     0   158    0
amappl16   192     2059    0     1198    58     7    51    54     0     8    7
amappl15   184       71    0       68     1     0     1     1     0     8    0
amappl14   176       24    0       19     1     0     1     1     0     8    0
amappl13   168       28    0       25     1     0     1     1     0     8    0
amappl12   160       10    0       10     1     1     0     1     0     8    0
amappl11   152      115    0      104     1     0     1     1     0     8    0
amappl10   144       87    0       79     1     0     1     1     0     8    0
amappl9    136      364    0      363     1     0     1     1     0     8    0
amappl8    128      322    0      284     2     0     2     2     0     8    0
amappl7    120      181    0      166     1     0     1     1     0     8    0
amappl6    112       95    0       87     1     0     1     1     0     8    0
amappl5    104      231    0      220     1     0     1     1     0     8    0
amappl4     96      487    0      460     1     0     1     1     0     8    0
amappl3     88      111    0      106     1     0     1     1     0     8    0
amappl2     80     1948    0     1872     2     0     2     2     0     8    0
amappl1     72    15971    0    15528    23    14     9    17     0     8    0
amappl      80      785    0      740     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        7    0        1     1     0     1     1     0     8    0
uaddrrnd    24      352    0      335     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      352    0      335     1     0     1     1     0     8    0
vmmpekpl   168     6359    0     6332     2     0     2     2     0     8    0
vmmpepl    168    49019    0    46948   149    12   137   144     0   357   46
vmsppl     272      351    0      335     3     1     2     2     0     8    0
pdppl      4096     710    0      672     6     1     5     6     0     8    0
pvpl        32   165116    0   146152   188     2   186   188     0   265   33
pmappl     200      351    0      335     1     0     1     1     0     8    0
extentpl    40       53    0       36     1     0     1     1     0     8    0
phpool     112      343    0       51    10     0    10    10     0     8    0
phpool: pool(0xffffffff82817f28:phpool): free list modified: page 0xfffffd8053eb8000; item ordinal 0; addr 0xfffffd8053eb8000 (p 0xfffffd8053eb8000); offset 0x0=0x0
pool(phpool): free list modified: page 0xfffffd8053eb8000; item ordinal 0; addr 0xfffffd8053eb8000 (p 0xfffffd8053eb8000); offset 0x0=0x0
phpool: pool(0xffffffff82817f28:phpool): page inconsistency: page 0xfffffd8053eb8000; item ordinal 1; addr 0x951a51c53b0da1
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8246a6bd) at panic+0x15c sys/kern/subr_prf.c:207
pool_do_get(ffffffff82817f28,2,ffff80001d7ac238) at pool_do_get+0x42a sys/kern/subr_pool.c:738
pool_get(ffffffff82817f28,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
pool_p_alloc(ffffffff82821c58,2,ffff80001d7ac408) at pool_p_alloc+0xd6 sys/kern/subr_pool.c:927
pool_do_get(ffffffff82821c58,2,ffff80001d7ac408) at pool_do_get+0x10c sys/kern/subr_pool.c:704
pool_get(ffffffff82821c58,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
m_get(2,1) at m_get+0x4c sys/kern/uipc_mbuf.c:250
ip6_output(fffffd80060e2d00,ffffffff8278bdd0,0,1,ffff80001d7ac658,0) at ip6_output+0x203 sys/netinet6/ip6_output.c:198
mld6_sendpkt(ffff800000ad6d00,83,0) at mld6_sendpkt+0x2b5 sys/netinet6/mld6.c:465
mld6_start_listening(ffff800000ad6d00) at mld6_start_listening+0x8e sys/netinet6/mld6.c:136
in6_addmulti(ffff80001d7ac9c0,ffff800000ad4000,ffff80001d7aca48) at in6_addmulti+0x25e sys/netinet6/in6.c:1073
in6_update_ifa(ffff800000ad4000,ffff80001d7acab0,0) at in6_update_ifa+0x1540 in6_joingroup sys/netinet6/in6.c:1142 [inline]
in6_update_ifa(ffff800000ad4000,ffff80001d7acab0,0) at in6_update_ifa+0x1540 sys/netinet6/in6.c:764
in6_ifattach_linklocal(ffff800000ad4000,0) at in6_ifattach_linklocal+0x2a2 sys/netinet6/in6_ifattach.c:281
in6_ifattach(ffff800000ad4000) at in6_ifattach+0x1b8 sys/netinet6/in6_ifattach.c:401
ifnewlladdr(ffff800000ad4000) at ifnewlladdr+0x119 sys/net/if.c:3120
ifioctl(fffffd806aaff1a0,8020691f,ffff80001d7acd00,ffff80001d6c2d58) at ifioctl+0x1b2e sys/net/if.c:2196
sys_ioctl(ffff80001d6c2d58,ffff80001d7ace18,ffff80001d7ace60) at sys_ioctl+0x4a1
syscall(ffff80001d7acee0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x21b66827510, count: -20
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8246a6bd) at panic+0x15c sys/kern/subr_prf.c:207
pool_do_get(ffffffff82817f28,2,ffff80001d7ac238) at pool_do_get+0x42a sys/kern/subr_pool.c:738
pool_get(ffffffff82817f28,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
pool_p_alloc(ffffffff82821c58,2,ffff80001d7ac408) at pool_p_alloc+0xd6 sys/kern/subr_pool.c:927
pool_do_get(ffffffff82821c58,2,ffff80001d7ac408) at pool_do_get+0x10c sys/kern/subr_pool.c:704
pool_get(ffffffff82821c58,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
m_get(2,1) at m_get+0x4c sys/kern/uipc_mbuf.c:250
ip6_output(fffffd80060e2d00,ffffffff8278bdd0,0,1,ffff80001d7ac658,0) at ip6_output+0x203 sys/netinet6/ip6_output.c:198
mld6_sendpkt(ffff800000ad6d00,83,0) at mld6_sendpkt+0x2b5 sys/netinet6/mld6.c:465
mld6_start_listening(ffff800000ad6d00) at mld6_start_listening+0x8e sys/netinet6/mld6.c:136
in6_addmulti(ffff80001d7ac9c0,ffff800000ad4000,ffff80001d7aca48) at in6_addmulti+0x25e sys/netinet6/in6.c:1073
in6_update_ifa(ffff800000ad4000,ffff80001d7acab0,0) at in6_update_ifa+0x1540 in6_joingroup sys/netinet6/in6.c:1142 [inline]
in6_update_ifa(ffff800000ad4000,ffff80001d7acab0,0) at in6_update_ifa+0x1540 sys/netinet6/in6.c:764
in6_ifattach_linklocal(ffff800000ad4000,0) at in6_ifattach_linklocal+0x2a2 sys/netinet6/in6_ifattach.c:281
in6_ifattach(ffff800000ad4000) at in6_ifattach+0x1b8 sys/netinet6/in6_ifattach.c:401
ifnewlladdr(ffff800000ad4000) at ifnewlladdr+0x119 sys/net/if.c:3120
ifioctl(fffffd806aaff1a0,8020691f,ffff80001d7acd00,ffff80001d6c2d58) at ifioctl+0x1b2e sys/net/if.c:2196
sys_ioctl(ffff80001d6c2d58,ffff80001d7ace18,ffff80001d7ace60) at sys_ioctl+0x4a1
syscall(ffff80001d7acee0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x21b66827510, count: -20

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/24 18:26 openbsd e9c5ed46e587 41694dbf .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.