login: panic: kernel diagnostic assertion "tname->un_flags & UNVEIL_USERSET" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_unveil.c", line 879
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
371041 49759 0 0x2 0 1 syz-executor0238
*293533 49759 0 0x2 0x4000000 0K syz-executor0238
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x174 sys/kern/subr_prf.c:208
__assert(ffffffff81f7c61c,ffffffff81f2d7dd,36f,ffffffff81f8730a) at __assert+0x2e sys/kern/subr_prf.c:155
unveil_check_final(ffff800020b76e20,ffff800020bad5d0) at unveil_check_final+0x81d sys/kern/kern_unveil.c:879
namei(ffff800020bad5d0) at namei+0x88b sys/kern/vfs_lookup.c:232
vn_open(ffff800020bad5d0,301,8) at vn_open+0x157 sys/kern/vfs_vnops.c:103
doopenat(ffff800020b76e20,ffffff9c,20000040,300,8,ffff800020bad810) at doopenat+0x2ca sys/kern/vfs_syscalls.c:1045
syscall(ffff800020bad8c0) at syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(ffff800020bad8c0) at syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
Xsyscall(6,0,e62185fc0b8,0,e62185fc098,e62185fc090) at Xsyscall+0x128
end of kernel
end trace frame: 0xe64520022b0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel diagnostic assertion "tname->un_flags & UNVEIL_USERSET" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_unveil.c", line 879
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x174 sys/kern/subr_prf.c:208
__assert(ffffffff81f7c61c,ffffffff81f2d7dd,36f,ffffffff81f8730a) at __assert+0x2e sys/kern/subr_prf.c:155
unveil_check_final(ffff800020b76e20,ffff800020bad5d0) at unveil_check_final+0x81d sys/kern/kern_unveil.c:879
namei(ffff800020bad5d0) at namei+0x88b sys/kern/vfs_lookup.c:232
vn_open(ffff800020bad5d0,301,8) at vn_open+0x157 sys/kern/vfs_vnops.c:103
doopenat(ffff800020b76e20,ffffff9c,20000040,300,8,ffff800020bad810) at doopenat+0x2ca sys/kern/vfs_syscalls.c:1045
syscall(ffff800020bad8c0) at syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(ffff800020bad8c0) at syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
Xsyscall(6,0,e62185fc0b8,0,e62185fc098,e62185fc090) at Xsyscall+0x128
end of kernel
end trace frame: 0xe64520022b0, count: -9
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800020bad210
rbx 0xffff800020bad2c0
rdx 0xffffffff81f1e360 cmd0646_9_tim_udma+0x129e0
rcx 0x201
rax 0x1
r8 0xffffffff813481d3 kprintf+0x183
r9 0x1
r10 0x9384988be87b58b8
r11 0x9a1406abeb0817fb
r12 0x3000000008
r13 0xffff800020bad220
r14 0x100
r15 0x1
rip 0xffffffff81266358 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020bad200
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor0238) pid=293533 stat=onproc
flags process=2<EXEC> proc=4000000<THREAD>
pri=53, usrpri=53, nice=20
forw=0xffffffffffffffff, list=0xffff800020b76268,0xffffffff8235ec20
process=0xffff800020b8c018 user=0xffff800020ba8000, vmspace=0xfffffd806e925878
estcpu=3, cpticks=2, pctcpu=0.0
user=0, sys=2, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
49759 371041 20172 0 7 0x2 syz-executor0238
*49759 293533 20172 0 7 0x4000002 syz-executor0238
20172 305691 16563 0 3 0x10008a pause ksh
16563 16616 30439 0 3 0x92 select sshd
98805 293041 1 0 3 0x100083 ttyin getty
30439 334772 1 0 3 0x80 select sshd
63940 40723 88043 73 3 0x100090 kqread syslogd
88043 80378 1 0 3 0x100082 netio syslogd
86107 219449 1 77 3 0x100090 poll dhclient
66941 18773 1 0 3 0x80 poll dhclient
3753 390690 0 0 3 0x14200 pgzero zerothread
91846 464741 0 0 3 0x14200 aiodoned aiodoned
568 129049 0 0 3 0x14200 syncer update
38238 324806 0 0 3 0x14200 cleaner cleaner
78522 414163 0 0 3 0x14200 reaper reaper
25622 15426 0 0 3 0x14200 pgdaemon pagedaemon
39551 361601 0 0 3 0x14200 bored crynlk
70461 344421 0 0 3 0x14200 bored crypto
43225 437047 0 0 3 0x40014200 acpi0 acpi0
94810 247283 0 0 3 0x40014200 idle1
26003 189499 0 0 3 0x14200 bored softnet
62181 425613 0 0 3 0x14200 bored systqmp
78639 426484 0 0 3 0x14200 bored systq
83314 274981 0 0 2 0x40014200 softclock
56662 26786 0 0 3 0x40014200 idle0
12282 377489 0 0 3 0x14200 bored smr
1 393400 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 49759 (syz-executor0238) thread 0xffff800020b76e20 (293533)
exclusive rrwlock inode r = 0 (0xfffffd806ee1b2c8) locked @ /syzkaller/managers/setuid/kernel/sys/ufs/ufs/ufs_vnops.c:1547
#0 witness_lock+0x594 sys/kern/subr_witness.c:1201
#1 _rw_enter+0x45d sys/kern/kern_rwlock.c:280
#2 _rrw_enter+0x60 sys/kern/kern_rwlock.c:410
#3 VOP_LOCK+0x57 sys/kern/vfs_vops.c:602
#4 vn_lock+0x6e sys/kern/vfs_vnops.c:549
#5 vfs_lookup+0xf5 sys/kern/vfs_lookup.c:387
#6 namei+0x4b2 sys/kern/vfs_lookup.c:224
#7 vn_open+0x157 sys/kern/vfs_vnops.c:103
#8 doopenat+0x2ca sys/kern/vfs_syscalls.c:1045
#9 syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#9 syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
#10 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82397440) locked @ /syzkaller/managers/setuid/kernel/sys/sys/syscall_mi.h:90
#0 witness_lock+0x594 sys/kern/subr_witness.c:1201
#1 syscall+0x48b mi_syscall sys/sys/syscall_mi.h:91 [inline]
#1 syscall+0x48b sys/arch/amd64/amd64/trap.c:574
#2 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9442 6315K 6316K 78643K 10529 0 0
pcb 23 9K 9K 78643K 55 0 0
rtable 61 2K 2K 78643K 115 0 0
ifaddr 21 7K 7K 78643K 21 0 0
counters 39 33K 33K 78643K 39 0 0
ioctlops 0 0K 2K 78643K 13 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1166 73K 73K 78643K 1171 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 1K 78643K 2 0 0
VM map 2 1K 1K 78643K 2 0 0
sem 2 0K 0K 78643K 2 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1808 196K 290K 78643K 12628 0 0
file desc 1 0K 0K 78643K 1 0 0
proc 43 50K 58K 78643K 211 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
in_multi 11 0K 0K 78643K 11 0 0
ether_multi 1 0K 0K 78643K 1 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 18 79K 79K 78643K 18 0 0
exec 0 0K 1K 78643K 152 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 49 2K 3K 78643K 661 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
NDP 3 0K 0K 78643K 3 0 0
temp 30 2359K 2423K 78643K 1718 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 2 0 0 1 0 1 1 0 8 0
inpcbpl 280 22 0 16 1 0 1 1 0 8 0
plimitpl 152 13 0 8 1 0 1 1 0 8 0
plcache 128 20 0 0 1 0 1 1 0 8 0
rtentry 112 23 0 1 1 0 1 1 0 8 0
syncache 264 5 0 5 1 0 1 1 0 8 1
tcpcb 544 8 0 5 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 95 0 0 6 0 6 6 0 8 0
art_table 32 96 0 0 1 0 1 1 0 8 0
art_node 16 22 0 2 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino1pl 128 1381 0 16 45 0 45 45 0 8 0
ffsino 272 1381 0 16 91 0 91 91 0 8 0
nchpl 144 1555 0 30 57 0 57 57 0 8 0
uvmvnodes 72 1390 0 0 26 0 26 26 0 8 0
vnodes 200 1390 0 0 74 0 74 74 0 8 0
namei 1024 3286 0 3285 2 1 1 1 0 8 0
percpumem 16 30 0 0 1 0 1 1 0 8 0
scxspl 192 2379 0 2379 8 2 6 6 0 8 6
sigapl 432 176 0 166 2 0 2 2 0 8 0
futexpl 56 1 0 1 1 0 1 1 0 8 1
knotepl 112 5 0 0 1 0 1 1 0 8 0
kqueuepl 104 1 0 0 1 0 1 1 0 8 0
pipepl 112 118 0 111 2 1 1 1 0 8 0
fdescpl 488 177 0 166 2 0 2 2 0 8 0
filepl 152 819 0 776 2 0 2 2 0 8 0
lockfpl 104 6 0 6 1 1 0 1 0 8 0
lockfspl 32 3 0 3 1 1 0 1 0 8 0
sessionpl 112 17 0 9 1 0 1 1 0 8 0
pgrppl 48 17 0 9 1 0 1 1 0 8 0
ucredpl 96 47 0 40 1 0 1 1 0 8 0
zombiepl 144 166 0 166 2 1 1 1 0 8 1
processpl 840 192 0 166 4 0 4 4 0 8 0
procpl 600 193 0 166 3 0 3 3 0 8 0
sockpl 384 64 0 48 2 0 2 2 0 8 0
mcl4k 4096 2 0 0 1 0 1 1 0 8 0
mcl2k 2048 70 0 0 9 0 9 9 0 8 0
mtagpl 80 1 0 0 1 0 1 1 0 8 0
mbufpl 256 89 0 0 6 0 6 6 0 8 0
bufpl 256 2063 0 254 114 0 114 114 0 8 0
anonpl 16 17096 0 15961 6 1 5 6 0 125 0
amapchunkpl 152 493 0 456 2 0 2 2 0 158 0
amappl16 192 32 0 30 1 0 1 1 0 8 0
amappl15 184 44 0 40 1 0 1 1 0 8 0
amappl14 176 14 0 13 2 1 1 1 0 8 0
amappl13 168 22 0 19 1 0 1 1 0 8 0
amappl12 160 8 0 8 1 0 1 1 0 8 1
amappl11 152 18 0 7 1 0 1 1 0 8 0
amappl10 144 48 0 48 2 1 1 1 0 8 1
amappl9 136 368 0 367 1 0 1 1 0 8 0
amappl8 128 87 0 82 1 0 1 1 0 8 0
amappl7 120 11 0 10 1 0 1 1 0 8 0
amappl6 112 42 0 38 1 0 1 1 0 8 0
amappl5 104 164 0 154 1 0 1 1 0 8 0
amappl4 96 369 0 346 1 0 1 1 0 8 0
amappl3 88 106 0 100 1 0 1 1 0 8 0
amappl2 80 570 0 527 1 0 1 1 0 8 0
amappl1 72 11828 0 11432 14 4 10 14 0 8 0
amappl 72 370 0 350 1 0 1 1 0 75 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma64 64 259 0 259 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 17 0 17 1 1 0 1 0 8 0
aobjpl 64 1 0 0 1 0 1 1 0 8 0
uaddrrnd 24 177 0 166 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 177 0 166 1 0 1 1 0 8 0
vmmpekpl 168 5257 0 5238 1 0 1 1 0 8 0
vmmpepl 168 23693 0 22958 50 16 34 43 0 357 2
vmsppl 360 176 0 166 2 0 2 2 0 8 0
pdppl 4096 362 0 332 5 0 5 5 0 8 0
pvpl 32 72225 0 69359 32 5 27 27 0 265 3
pmappl 224 176 0 166 1 0 1 1 0 8 0
extentpl 40 39 0 25 1 0 1 1 0 8 0
phpool 112 241 0 3 7 0 7 7 0 8 0
ddb{0}>