syzbot


assert "kq->kq_nknotes == NUM" failed in kern_event.c

Status: upstream: reported on 2024/07/22 08:08
Reported-by: syzbot+1b35a23cd1d8f7460ee5@syzkaller.appspotmail.com
First crash: 47d, last: 47d

Sample crash report:
panic: kernel diagnostic assertion "kq->kq_nknotes == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c", line 214
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 368110  49945      0     0x14000      0x200    0  reaper
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff830d7f0b) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8308b262,ffffffff830abac4,d6,ffffffff8300d45b) at __assert+0x29
KQRELE(fffffd8071c47e78) at KQRELE+0x30c klist_free sys/kern/kern_event.c:2098 [inline]
KQRELE(fffffd8071c47e78) at KQRELE+0x30c sys/kern/kern_event.c:219
kqueue_close(fffffd8079f6fee0,ffff8000345f6a60) at kqueue_close+0x6a sys/kern/kern_event.c:1669
fdrop(fffffd8079f6fee0,ffff8000345f6a60) at fdrop+0x126 sys/kern/kern_descrip.c:1274
closef(fffffd8079f6fee0,ffff8000345f6a60) at closef+0x192 sys/kern/kern_descrip.c:1258
fdfree(ffff8000345f6a60) at fdfree+0x116 sys/kern/kern_descrip.c:1190
exit1(ffff8000345f6a60,0,0,1) at exit1+0x71b sys/kern/kern_exit.c:221
sys_exit(ffff8000345f6a60,ffff80002a11ebd0,ffff80002a11eb20) at sys_exit+0x1a
syscall(ffff80002a11ebd0) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a11ebd0) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74f12697cd10, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "kq->kq_nknotes == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c", line 214
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff830d7f0b) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8308b262,ffffffff830abac4,d6,ffffffff8300d45b) at __assert+0x29
KQRELE(fffffd8071c47e78) at KQRELE+0x30c klist_free sys/kern/kern_event.c:2098 [inline]
KQRELE(fffffd8071c47e78) at KQRELE+0x30c sys/kern/kern_event.c:219
kqueue_close(fffffd8079f6fee0,ffff8000345f6a60) at kqueue_close+0x6a sys/kern/kern_event.c:1669
fdrop(fffffd8079f6fee0,ffff8000345f6a60) at fdrop+0x126 sys/kern/kern_descrip.c:1274
closef(fffffd8079f6fee0,ffff8000345f6a60) at closef+0x192 sys/kern/kern_descrip.c:1258
fdfree(ffff8000345f6a60) at fdfree+0x116 sys/kern/kern_descrip.c:1190
exit1(ffff8000345f6a60,0,0,1) at exit1+0x71b sys/kern/kern_exit.c:221
sys_exit(ffff8000345f6a60,ffff80002a11ebd0,ffff80002a11eb20) at sys_exit+0x1a
syscall(ffff80002a11ebd0) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a11ebd0) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74f12697cd10, count: -12
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a11e7c0
rbx               0xffff800029b7cd87
rdx                                0
rcx               0xffff8000345f6a60
rax               0xffff800029b7bff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x6a94aa55fc5bc984
r11               0x41a0e769379371eb
r12               0xffff800029b7cb88
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff81c6f655    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a11e7b0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=300778 pid=67984 tcnt=0 stat=onproc
    flags process=8001008<EXITING,SINGLEEXIT,PIN> proc=2000<WEXIT>
    runpri=32, usrpri=83, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff8000345f6a60 scnt=-1 ecnt=1
    forw=0xffffffffffffffff, list=0xffff800034b9aa48,0xffff8000345f6050
    process=0xffff800034a97ab0 user=0xffff80002a119000, vmspace=0xfffffd806c4b38b0
    estcpu=33, cpticks=2, pctcpu=0.10, user=0, sys=2, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 95869  292164  84138      0  2   0x8000000                syz-executor
 95869  450630  84138      0  3   0xc000080  fsleep        syz-executor
 29967  151055  63719      0  2   0x8000000                syz-executor
 29967  482185  63719      0  3   0xc000080  fsleep        syz-executor
 87229   72675  18978      0  2   0x8000000                syz-executor
 87229  356288  18978      0  3   0xc000080  fsleep        syz-executor
 87229  430651  18978      0  3   0xc000080  sbwait        syz-executor
  3979  164570  38208      0  2   0x8000000                syz-executor
  3979  472865  38208      0  3   0xc000080  kqpoll        syz-executor
  3979  132144  38208      0  3   0xc000080  kqpoll        syz-executor
  3979  454610  38208      0  3   0xc000080  fsleep        syz-executor
 84693  282391      0      0  3     0x14200  acct          acct
 84138   36904  70410      0  3   0x8000082  nanoslp       syz-executor
 18978  206725  70410      0  3   0x8000082  nanoslp       syz-executor
 38208  397443  70410      0  2   0x8000482                syz-executor
 63719  303109  70410      0  3   0x8000082  nanoslp       syz-executor
 64362  294291  70410      0  2   0x8000002                syz-executor
 23379  297528  70410      0  3   0x8000002  biowait       syz-executor
 87171   56585  70410      0  3   0x8000082  nanoslp       syz-executor
 72023  403576      1      0  3  0x18100083  ttyin         getty
 29461   69155      0      0  3     0x14200  bored         sosplice
 70410  417022  60533      0  2   0x8000002                syz-executor
 60533  223886  46879      0  3   0x810008a  sigsusp       ksh
 46879  409605   8298      0  3  0x18000098  kqread        sshd-session
  8298  344959  47917      0  3  0x18000092  kqread        sshd-session
 47917   51141      1      0  3  0x18000088  kqread        sshd
  1405  100774  85402     74  3  0x19100092  bpf           pflogd
 85402  240475      1      0  3  0x18000080  sbwait        pflogd
 68006  512812  34494     73  3  0x19100010  ffs_fsync     syslogd
 34494  276894      1      0  3  0x18100082  sbwait        syslogd
 94472  512364      1      0  3  0x18100080  kqread        resolvd
  9579   64396  31237     77  3  0x18100092  kqread        dhcpleased
 27094  360119  31237     77  3  0x18100092  kqread        dhcpleased
 31237  241345      1      0  3  0x18000080  kqread        dhcpleased
 72344  106203      0      0  3     0x14200  bored         smr
 66013  279951      0      0  2     0x14200                zerothread
 62416  491015      0      0  3     0x14200  aiodoned      aiodoned
 75810  233242      0      0  3     0x14200  syncer        update
 23139  274874      0      0  3     0x14200  cleaner       cleaner
 49945  368110      0      0  7     0x14200                reaper
 88971  508783      0      0  3     0x14200  pgdaemon      pagedaemon
 42571  174996      0      0  3     0x14200  bored         viomb
 75058  187718      0      0  3  0x40014200  acpi0         acpi0
 64614  288986      0      0  3  0x40014200                idle1
  6007  217926      0      0  3     0x14200  bored         softnet3
 22968  404934      0      0  3     0x14200  bored         softnet2
  9575  175131      0      0  3     0x14200  bored         softnet1
 54737  177140      0      0  2     0x14200                softnet0
 64666   78951      0      0  3     0x14200  bored         systqmp
 92316  325969      0      0  3     0x14200  bored         systq
 10726  363508      0      0  3     0x14200  tmoslp        softclockmp
 26588  310540      0      0  3  0x40014200  tmoslp        softclock
 66248   82802      0      0  3  0x40014200                idle0
     1  451349      0      0  3   0x8080082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
CPU 0:
exclusive mutex &(curpg)->mdpage.pv_mtx r = 0 (0xfffffd800812a3f8)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  mtx_enter_try+0x178
#2  mtx_enter+0x60 sys/kern/kern_lock.c:239
#3  pmap_remove_ptes+0x297 sys/arch/amd64/amd64/pmap.c:1702
#4  pmap_do_remove+0x533 sys/arch/amd64/amd64/pmap.c:1909
#5  uvm_unmap_kill_entry_withlock+0x274 sys/uvm/uvm_map.c:1883
#6  uvm_map_teardown+0x267 sys/uvm/uvm_map.c:2520
#7  uvmspace_free+0xe8 sys/uvm/uvm_map.c:3447
#8  reaper+0x25b sys/kern/kern_exit.c:480
#9  proc_trampoline+0x10
exclusive mutex &pmap->pm_mtx r = 0 (0xfffffd806a014308)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  mtx_enter_try+0x178
#2  mtx_enter+0x60 sys/kern/kern_lock.c:239
#3  pmap_do_remove+0xa9 rcr3 machine/cpufunc.h:139 [inline]
#3  pmap_do_remove+0xa9 pmap_map_ptes sys/arch/amd64/amd64/pmap.c:430 [inline]
#3  pmap_do_remove+0xa9 sys/arch/amd64/amd64/pmap.c:1813
#4  uvm_unmap_kill_entry_withlock+0x274 sys/uvm/uvm_map.c:1883
#5  uvm_map_teardown+0x267 sys/uvm/uvm_map.c:2520
#6  uvmspace_free+0xe8 sys/uvm/uvm_map.c:3447
#7  reaper+0x25b sys/kern/kern_exit.c:480
#8  proc_trampoline+0x10
Process 23379 (syz-executor) thread 0xffff8000345f4cf8 (297528)
exclusive rrwlock inode r = 0 (0xfffffd80779da818)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  ufs_ihashget+0x171 sys/ufs/ufs/ufs_ihash.c:95
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1201
#8  ufs_lookup+0x19f8 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#11 namei+0x7aa sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#13 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#13 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd80779dad68)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  cache_lookup+0x36e sys/kern/vfs_cache.c:222
#7  ufs_lookup+0x218 sys/ufs/ufs/ufs_lookup.c:160
#8  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#9  vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#10 namei+0x7aa sys/kern/vfs_lookup.c:250
#11 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#12 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#12 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#13 Xsyscall+0x128
Process 68006 (syslogd) thread 0xffff8000ffffdbe8 (512812)
exclusive rrwlock inode r = 0 (0xfffffd806e4b11b0)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  sys_fsync+0x152 sys/kern/vfs_syscalls.c:2927
#6  syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#6  syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#7  Xsyscall+0x128
Process 49945 (reaper) thread 0xffff800029fd9448 (368110)
exclusive rwlock vmmaplk r = 0 (0xfffffd8077361b50)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  vm_map_lock_ln+0x143 sys/uvm/uvm_map.c:5277
#3  uvm_map_teardown+0x104 sys/uvm/uvm_map.c:2488
#4  uvmspace_free+0xe8 sys/uvm/uvm_map.c:3447
#5  reaper+0x25b sys/kern/kern_exit.c:480
#6  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10250  10261K   10775K 166960K     18192        0
            pcb    17     17K      19K 166960K       697        0
         rtable   213     16K      18K 166960K      5764        0
             pf    42     19K      23K 166960K       650        0
         ifaddr    41      8K       9K 166960K       772        0
        ifgroup    64      2K       3K 166960K       850        0
         sysctl     3      0K       1K 166960K         9        0
       counters    68     36K      37K 166960K       488        0
       ioctlops     0      0K       8K 166960K      2208        0
            iov     1      2K      25K 166960K       408        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1644    103K     104K 166960K      7814        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        81        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       358        0
        dirhash    15      2K       3K 166960K       129        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    14     49K      89K 166960K      5692        0
          sigio     0      0K       0K 166960K        79        0
           proc    70     91K     128K 166960K      5444        0
        subproc    91      5K       7K 166960K      2262        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       786        0
       in_multi    79      5K       7K 166960K      2009        0
    ether_multi     1      0K       0K 166960K        16        0
            mrt     1      0K       0K 166960K         7        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   313   1394K    1394K 166960K       313        0
           exec     0      0K       1K 166960K      3258        0
     pfkey data     0      0K       0K 166960K         5        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   231     85K     115K 166960K     46259        0
       UVM aobj   115      8K       8K 166960K       120        0
     pinsyscall    39     78K     101K 166960K     11089        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       168        0
            NDP    14      0K       2K 166960K       572        0
           temp    77   6816K    6944K 166960K    221141        0
         kqueue    16     22K      30K 166960K       534        0
      SYN cache     2      8K      16K 166960K         3        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      783    0      780     4     3     1     3     0     8    0
rtentry    112     2055    0     1966     6     3     3     4     0     8    0
unpcb      144     4790    0     4636    50    44     6     6     0     8    0
syncache   336        9    0        9     6     6     0     1     0     8    0
tcpcb      808     1912    0     1904    80    75     5    14     0     8    4
arp        120      366    0      351     1     0     1     1     0     8    0
ipq         40        2    0        2     2     2     0     1     0     8    0
ipqe        40        6    0        6     2     2     0     1     0     8    0
inpcb      336     6449    0     6435    92    85     7    14     0     8    5
nd6        136      571    0      549     3     2     1     2     0     8    0
pkpcb       40       20    0       20     9     8     1     1     0     8    1
kcovpl      48      174    0      167     1     0     1     1     0     8    0
ppxss      1168      34    0       34    10    10     0     1     0     8    0
pfstscr     40        1    0        0     1     0     1     1     0     8    0
pffrag     232       39    0       34     2     1     1     1     0   482    0
pffrnode    88       39    0       34     2     1     1     1     0     8    0
pffrent     40      234    0      229     2     1     1     1     0     8    0
pfosfp      40     1439    0     1435     5     4     1     5     0     8    0
pfosfpen   112     1439    0     1430    21    20     1    21     0     8    0
pfrktable  1344      31    0       27     5     4     1     1     0     8    0
pfanchor   1288       9    0        7     4     3     1     1     0     8    0
pftag       88       14    0       13     4     3     1     1     0     8    0
pfqueue    264        2    0        1     2     1     1     1     0     8    0
pfstitem    24      364    0      337     1     0     1     1     0     8    0
pfstkey    128      367    0      339     2     0     2     2     0     8    0
pfstate    376      363    0      337     9     5     4     5     0     8    0
pfrule     1344      72    0       64     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     8091    0     7705    53    25    28    30     0     8    0
art_table   32     8092    0     7705     5     1     4     4     0     8    0
art_node    16     2043    0     1965     1     0     1     1     0     8    0
sysvmsgpl   40       13    0        6     1     0     1     1     0     8    0
semapl     112      355    0      345     1     0     1     1     0     8    0
shmpl      112      117    0        5     4     0     4     4     0     8    0
dirhash    1024      98    0       78     4     1     3     4     0     8    0
dino2pl    256     8605    0     6766   117     1   116   116     0     8    0
ffsino     272     8605    0     6766   124     0   124   124     0     8    0
nchpl      144    13841    0    11927    73     1    72    72     0     8    0
uvmvnodes   80     8741    0        0   179     0   179   179     0     8    0
vnodes     216     8741    0        0   486     0   486   486     0     8    0
namei      1024   71879    0    71879    12    11     1     2     0     8    1
percpumem   16      258    0      210     1     0     1     1     0     8    0
vcpupl     3904       6    0        2     1     0     1     1     0     8    0
vmpool     696       19    0       15     1     0     1     1     0     8    0
pfiaddrpl  120        9    0        7     4     3     1     1     0     8    0
kstatmem   264      448    0      420     6     3     3     3     0     8    0
scsiplug    72       10    0       10     8     7     1     1     0     8    1
scxspl     216   113672    0   113670    20    19     1     8     1     8    0
plimitpl   152     1828    0     1811     1     0     1     1     0     8    0
sigapl     424     5684    0     5635    13     6     7     9     0     8    1
futexpl     64    69256    0    69252    16    15     1     1     0     8    0
knotepl    120      735    0        0    18     0    18    18     0     8    0
kqueuepl   216     1828    0     1815    31    29     2     8     0     8    0
pipepl     320     1287    0     1260    17    13     4     8     0     8    1
fdescpl    496     5643    0     5615     7     2     5     5     0     8    0
filepl     152    43763    0    43397    98    83    15    23     0     8    0
lockfpl    104     1814    0     1812     3     2     1     2     0     8    0
lockfspl    48      663    0      661     1     0     1     1     0     8    0
sessionpl  144      191    0      182     1     0     1     1     0     8    0
pgrppl      48      422    0      405     1     0     1     1     0     8    0
ucredpl    104     7343    0     7330     1     0     1     1     0     8    0
zombiepl   144     5637    0     5635     2     1     1     1     0     8    0
processpl  1152    5684    0     5635     7     3     4     6     0     8    0
procpl     648    11574    0    11515    12     5     7     9     0     8    1
srpgc       96       33    0       33    12    11     1     1     0     8    1
sosppl     168       20    0       20    10     9     1     1     0     8    1
sockpl     664    12193    0    12022   153   138    15    20     0     8    0
mcl64k     65536      8    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192      13    0        0     2     0     2     2     0     8    0
mcl4k      4096       6    0        0     1     0     1     1     0     8    0
mcl2k      2048     351    0        0    29     1    28    29     0     8    0
mtagpl      96       95    0        0     2     0     2     2     0     8    0
mbufpl     256      765    0        0    38     0    38    38     0     8    0
bufpl      280    17851    0     9110   625     0   625   625     0     8    0
anonpl      24   740753    0   732200   152    69    83    83     0   185    4
amapchunkpl 152  146658    0   146128    77    41    36    37     0   158   11
amappl16   200    12277    0    12026   116    89    27    27     0     8    0
amappl15   192       13    0       13     1     1     0     1     0     8    0
amappl14   184      452    0      440     1     0     1     1     0     8    0
amappl13   176       12    0       12     2     2     0     1     0     8    0
amappl12   168     8920    0     8892     4     2     2     3     0     8    0
amappl11   160       74    0       60     1     0     1     1     0     8    0
amappl10   152       12    0       12     1     1     0     1     0     8    0
amappl9    144      132    0      132     1     1     0     1     0     8    0
amappl8    136       23    0       20     1     0     1     1     0     8    0
amappl7    128      444    0      431     1     0     1     1     0     8    0
amappl6    120     1821    0     1819     1     0     1     1     0     8    0
amappl5    112      812    0      799     1     0     1     1     0     8    0
amappl4    104      855    0      834     1     0     1     1     0     8    0
amappl3     96    28969    0    28865     5     1     4     4     0     8    0
amappl2     88     2960    0     2892     2     0     2     2     0     8    0
amappl1     80    34498    0    33929    15     1    14    14     0     8    0
amappl      88    44441    0    44276     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        7    0        7     2     2     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      119    0        5     3     0     3     3     0     8    0
uaddrrnd    24     5662    0     5630     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     5662    0     5630     1     0     1     1     0     8    0
vmmpekpl   168    49001    0    48942     4     0     4     4     0     8    0
vmmpepl    168   354662    0   352642   170    67   103   107     0   357    0
vmsppl     440     5661    0     5629     7     2     5     5     0     8    0
rwobjpl     56   100946    0    90931   154    11   143   143     0     8    1
pdppl      4096   11331    0    11262   328   252    76    85     0     8    7
pvpl        32    34680    0        0   276     1   275   275     0   265    0
pmappl     248     5661    0     5629     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      903    0      470    14     1    13    13     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff8344dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x1c kd_curproc sys/dev/kcov.c:588 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x1c sys/dev/kcov.c:158
__mp_lock(ffffffff835687c0) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835687c0) at __mp_lock+0x1a3 sys/kern/kern_lock.c:144
uvm_unmap_detach(ffff800029fe5080,1) at uvm_unmap_detach+0x16e sys/uvm/uvm_map.c:1371
uvm_map_teardown(fffffd8077361a60) at uvm_map_teardown+0x3f7 sys/uvm/uvm_map.c:2540
uvmspace_free(fffffd8077361a60) at uvmspace_free+0xe8 sys/uvm/uvm_map.c:3447
reaper(ffff800029fd9448) at reaper+0x25b sys/kern/kern_exit.c:480
end trace frame: 0x0, count: 6
ddb{0}> trace
x86_ipi_db(ffffffff8344dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x1c kd_curproc sys/dev/kcov.c:588 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x1c sys/dev/kcov.c:158
__mp_lock(ffffffff835687c0) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835687c0) at __mp_lock+0x1a3 sys/kern/kern_lock.c:144
uvm_unmap_detach(ffff800029fe5080,1) at uvm_unmap_detach+0x16e sys/uvm/uvm_map.c:1371
uvm_map_teardown(fffffd8077361a60) at uvm_map_teardown+0x3f7 sys/uvm/uvm_map.c:2540
uvmspace_free(fffffd8077361a60) at uvmspace_free+0xe8 sys/uvm/uvm_map.c:3447
reaper(ffff800029fd9448) at reaper+0x25b sys/kern/kern_exit.c:480
end trace frame: 0x0, count: -9
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff830d7f0b) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8308b262,ffffffff830abac4,d6,ffffffff8300d45b) at __assert+0x29
KQRELE(fffffd8071c47e78) at KQRELE+0x30c klist_free sys/kern/kern_event.c:2098 [inline]
KQRELE(fffffd8071c47e78) at KQRELE+0x30c sys/kern/kern_event.c:219
kqueue_close(fffffd8079f6fee0,ffff8000345f6a60) at kqueue_close+0x6a sys/kern/kern_event.c:1669
fdrop(fffffd8079f6fee0,ffff8000345f6a60) at fdrop+0x126 sys/kern/kern_descrip.c:1274
closef(fffffd8079f6fee0,ffff8000345f6a60) at closef+0x192 sys/kern/kern_descrip.c:1258
fdfree(ffff8000345f6a60) at fdfree+0x116 sys/kern/kern_descrip.c:1190
exit1(ffff8000345f6a60,0,0,1) at exit1+0x71b sys/kern/kern_exit.c:221
sys_exit(ffff8000345f6a60,ffff80002a11ebd0,ffff80002a11eb20) at sys_exit+0x1a
syscall(ffff80002a11ebd0) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a11ebd0) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74f12697cd10, count: 3
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff830d7f0b) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8308b262,ffffffff830abac4,d6,ffffffff8300d45b) at __assert+0x29
KQRELE(fffffd8071c47e78) at KQRELE+0x30c klist_free sys/kern/kern_event.c:2098 [inline]
KQRELE(fffffd8071c47e78) at KQRELE+0x30c sys/kern/kern_event.c:219
kqueue_close(fffffd8079f6fee0,ffff8000345f6a60) at kqueue_close+0x6a sys/kern/kern_event.c:1669
fdrop(fffffd8079f6fee0,ffff8000345f6a60) at fdrop+0x126 sys/kern/kern_descrip.c:1274
closef(fffffd8079f6fee0,ffff8000345f6a60) at closef+0x192 sys/kern/kern_descrip.c:1258
fdfree(ffff8000345f6a60) at fdfree+0x116 sys/kern/kern_descrip.c:1190
exit1(ffff8000345f6a60,0,0,1) at exit1+0x71b sys/kern/kern_exit.c:221
sys_exit(ffff8000345f6a60,ffff80002a11ebd0,ffff80002a11eb20) at sys_exit+0x1a
syscall(ffff80002a11ebd0) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a11ebd0) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74f12697cd10, count: -12

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/22 08:07 openbsd 134de7a21601 b88348e9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "kq->kq_nknotes == NUM" failed in kern_event.c
* Struck through repros no longer work on HEAD.