syzbot

 sign-in | mailing list | source | docs
🐞 Open [178]
🐞 Fixed [300]
🐞 Invalid [1015]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

assert "sc->sc_dev == NUM" failed in if_tun.c (6)

Status: upstream: reported on 2025/02/10 06:39
Reported-by: syzbot+171f3fbee35ba6030ee9@syzkaller.appspotmail.com
First crash: 424d, last: 2d07h
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c -1 24 1515d 1547d 3/3 fixed on 2022/02/16 17:50
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (2) -1 1 1511d 1511d 3/3 fixed on 2022/02/26 07:36
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (5) -1 358 507d 777d 0/3 auto-obsoleted due to no activity on 2025/01/08 15:50
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (3) -1 68 1014d 1503d 0/3 auto-obsoleted due to no activity on 2023/09/29 16:10
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (4) -1 1 914d 914d 0/3 auto-obsoleted due to no activity on 2024/01/09 18:17

Sample crash report:
login: panic: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/main/kernel/sys/net/if_tun.c", line 323
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834133ec) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff83452c1c,ffffffff83390225,143,ffffffff8339a0ca) at __assert+0x29 sys/kern/subr_prf.c:-1
tun_clone_destroy(ffff8000015b6800) at tun_clone_destroy+0x32d
if_clone_destroy(ffff800035cd2e50) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d4a,43) at tun_dev_close+0x1d9 sys/net/if_tun.c:530
spec_close(ffff800035cd2f10) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd806df38948,43,fffffd8007ffd8f0,ffff80003c90ad18) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffffd807013a618,ffff80003c90ad18) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd807013a618,ffff80003c90ad18) at vn_closefile+0x11d sys/kern/vfs_vnops.c:615
fdrop(fffffd807013a618,ffff80003c90ad18) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffd807013a618,ffff80003c90ad18) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80003c90ad18) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80003c90ad18,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff80003c90ad18,ffff800035cd3270,ffff800035cd31c0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
end trace frame: 0xffff800035cd3260, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/main/kernel/sys/net/if_tun.c", line 323
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834133ec) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff83452c1c,ffffffff83390225,143,ffffffff8339a0ca) at __assert+0x29 sys/kern/subr_prf.c:-1
tun_clone_destroy(ffff8000015b6800) at tun_clone_destroy+0x32d
if_clone_destroy(ffff800035cd2e50) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d4a,43) at tun_dev_close+0x1d9 sys/net/if_tun.c:530
spec_close(ffff800035cd2f10) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd806df38948,43,fffffd8007ffd8f0,ffff80003c90ad18) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffffd807013a618,ffff80003c90ad18) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd807013a618,ffff80003c90ad18) at vn_closefile+0x11d sys/kern/vfs_vnops.c:615
fdrop(fffffd807013a618,ffff80003c90ad18) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffd807013a618,ffff80003c90ad18) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80003c90ad18) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80003c90ad18,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff80003c90ad18,ffff800035cd3270,ffff800035cd31c0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800035cd3270) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff800035cd3270) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7e79cb1e8130, count: -16
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800035cd2ce0
rbx                                0
rdx                                0
rcx                                0
rax               0xffff80003c90ad18
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x1c02a8810ac9ddfc
r11               0x27918cb80ecc7c26
r12                                0
r13               0xffffffff838da000    tap_cloner
r14                                0
r15                              0x1
rip               0xffffffff8314dd95    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff800035cd2cd0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor) tid=414749 pid=81514 tcnt=0 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    runpri=8, usrpri=86, slppri=8, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff80003c90ad18 scnt=-1 ecnt=1
    forw=0xffffffffffffffff, list=0xffff80003c90a7e8,0xffff80002a777778
    process=0xffff8000ffff8918 user=0xffff800035cce000, vmspace=0xfffffd807ece18a0
    estcpu=36, cpticks=3, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 21780  287701  21590      0  3        0x80  nanoslp       syz-executor
 21780  241495  21590      0  3   0x4000080  bpf           syz-executor
 21780  417785  21590      0  3   0x4000000  clonelk       syz-executor
 91824   90407  57747      0  3        0x80  nanoslp       syz-executor
 91824   87521  57747      0  2   0x4000000                syz-executor
 79442  346064  25004      0  3        0x80  nanoslp       syz-executor
 79442  136291  25004      0  3   0x4000080  pipewr        syz-executor
 79442  312044  25004      0  3   0x4000080  pipewr        syz-executor
 79442  288298  25004      0  3   0x4000080  fsleep        syz-executor
 89339  144371      1      0  3    0x100083  ttyin         getty
 57747   41208  34951      0  2       0xc82                syz-executor
 38445  233492  34951      0  2       0xc82                syz-executor
 36159  193266  34951      0  2         0x2                syz-executor
 64979  282906  34951      0  2       0xc82                syz-executor
 97542   14951  34951      0  2         0x2                syz-executor
 25004  157443  34951      0  2       0xc82                syz-executor
 21590   88516  34951      0  2       0xc82                syz-executor
  3042  450443  34951      0  3        0x82  wait          syz-executor
 34951  380445      1      0  3        0x82  kqread        syz-executor
 10820  467766      1     73  3   0x1100090  kqread        syslogd
 16782  186325      0      0  3     0x14200  bored         smr
 62467  493273      0      0  2     0x14200                zerothread
 18539   99508      0      0  3     0x14200  aiodoned      aiodoned
  2491  490745      0      0  3     0x14200  syncer        update
 12254  402812      0      0  3     0x14200  cleaner       cleaner
  1428  156414      0      0  3     0x14200  reaper        reaper
  2291  209493      0      0  3     0x14200  pgdaemon      pagedaemon
 65662  278500      0      0  3     0x14200  bored         viomb
 20483  150227      0      0  3  0x40014200  acpi0         acpi0
 19497   99193      0      0  3     0x14200  bored         softnet0
 79970  105202      0      0  3     0x14200  bored         systqmp
 29137   77210      0      0  3     0x14200  bored         systq
 50026  354683      0      0  3  0x40014200  tmoslp        softclock
 48749  262718      0      0  3  0x40014200                idle0
     1  363854      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb>

Crashes (116):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/08 16:47 openbsd 15cb22fda4ec 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "sc->sc_dev == NUM" failed in if_tun.c
2026/03/24 12:24 openbsd 7348976a6ac6 74e70d19 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2026/03/23 03:11 openbsd 33c7e43e4e2f 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2026/03/21 05:52 openbsd a71bcab410b6 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2026/03/17 14:07 openbsd 7b59c65f5490 0737c18f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2026/02/01 20:57 openbsd 455fdbe5e703 6b8752f2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2026/01/30 08:29 openbsd b822cddf2b35 bfa73b7b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2026/01/24 10:40 openbsd 652212f689da 40acda8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "sc->sc_dev == NUM" failed in if_tun.c
2026/01/15 05:08 openbsd ac9e191703f1 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2026/01/10 20:57 openbsd 7ae91379da7d 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/12/28 09:21 openbsd d9ef728109ec 5dc09de1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "sc->sc_dev == NUM" failed in if_tun.c
2025/11/15 20:50 openbsd 42d4ce758e42 f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/11/15 07:01 openbsd 56163c0cd41e f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/11/15 05:56 openbsd 56163c0cd41e f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/11/15 03:40 openbsd 56163c0cd41e f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/13 22:48 openbsd 13656af3a292 b6605ba8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/13 21:46 openbsd 13656af3a292 b6605ba8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/12 18:37 openbsd d388a6109664 ff1712fe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/11 07:28 openbsd 4cb29f8dafd8 ff1712fe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/11 06:10 openbsd 4cb29f8dafd8 ff1712fe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/11 03:18 openbsd 4cb29f8dafd8 ff1712fe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/10 07:34 openbsd f02b280c025a ff1712fe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/10 01:07 openbsd f02b280c025a ff1712fe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/09 09:32 openbsd 42468faed836 7e2882b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/09 02:01 openbsd 42468faed836 7e2882b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/06 21:51 openbsd f4db8a7c3d37 8ef35d49 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/06 20:21 openbsd 005f30971033 91305dbe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/06 19:01 openbsd 005f30971033 91305dbe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/06 15:56 openbsd 005f30971033 91305dbe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/06 11:50 openbsd 005f30971033 91305dbe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/06 10:32 openbsd 005f30971033 91305dbe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/06 09:13 openbsd 005f30971033 91305dbe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/05 17:40 openbsd f5a48fab3694 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/05 16:07 openbsd f5a48fab3694 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/04 21:11 openbsd cda73d07f20e 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/04 17:26 openbsd cda73d07f20e 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/04 14:50 openbsd cda73d07f20e 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/04 05:04 openbsd 467d022937bc 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/04 01:26 openbsd 467d022937bc 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/03 16:10 openbsd c4a497a8c849 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/10/03 14:16 openbsd c4a497a8c849 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/09/29 23:30 openbsd 33176f4338fa 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/09/29 21:25 openbsd 33176f4338fa 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/09/29 14:43 openbsd 33176f4338fa 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/09/29 13:08 openbsd 33176f4338fa 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/09/29 11:31 openbsd 33176f4338fa 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/09/28 21:35 openbsd 60d0eea3175a 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/09/28 17:38 openbsd 60d0eea3175a 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/02/10 06:38 openbsd 275cd30cffcd ef44b750 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
* Struck through repros no longer work on HEAD.