panic: Data modified on freelist: word 6 of object 0xffff8000015e5540 size 0x30 previous type proc (0x0 != 0xdeafbead)
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*199065 52289 0 0x2 0 0 syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83454f5f) at panic+0x1cf sys/kern/subr_prf.c:198
malloc(30,7f,9) at malloc+0xdb6 sys/kern/kern_malloc.c:357
dopselect(ffff80002a7607d8,35,78fdbc67d1e0,0,0,ffff80002a7bf600,7ac71704e2df14e4,ffff80002a7bf690) at dopselect+0xe4 sys/kern/sys_generic.c:619
sys_pselect(ffff80002a7607d8,ffff80002a7bf740,ffff80002a7bf690) at sys_pselect+0x25a sys/kern/sys_generic.c:593
syscall(ffff80002a7bf740) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7bf740) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fdbc67d190, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: Data modified on freelist: word 6 of object 0xffff8000015e5540 size 0x30 previous type proc (0x0 != 0xdeafbead)
ddb> show kasan
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83454f5f) at panic+0x1cf sys/kern/subr_prf.c:198
malloc(30,7f,9) at malloc+0xdb6 sys/kern/kern_malloc.c:357
dopselect(ffff80002a7607d8,35,78fdbc67d1e0,0,0,ffff80002a7bf600,7ac71704e2df14e4,ffff80002a7bf690) at dopselect+0xe4 sys/kern/sys_generic.c:619
sys_pselect(ffff80002a7607d8,ffff80002a7bf740,ffff80002a7bf690) at sys_pselect+0x25a sys/kern/sys_generic.c:593
syscall(ffff80002a7bf740) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7bf740) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fdbc67d190, count: -7
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff80002a7bf130
rbx 0xffff8000015e5540
rdx 0
rcx 0
rax 0xffff80002a7607d8
r8 0x101010101010101
r9 0x8080808080808080
r10 0xc9126d04d997788e
r11 0xda94a97233f284e3
r12 0
r13 0xffffffff83af2b40 kmemstats+0x1fc0
r14 0
r15 0x1
rip 0xffffffff8252c7b5 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80002a7bf120
ss 0x10
db_enter+0x25: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor) tid=199065 pid=52289 tcnt=1 stat=onproc
flags process=2<EXEC> proc=0
runpri=24, usrpri=50, slppri=24, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a761a00,0xffff80002a760550
process=0xffff80002a77d210 user=0xffff80002a7ba000, vmspace=0xffffee007f226000
estcpu=36, cpticks=6, pctcpu=0.0, user=0, sys=5, intr=1
ddb> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
54877 137062 53442 0 2 0 0 syz-executor
14921 72807 4812 0 3 0 0 kernel: protection fault trap, code=0
Faulted in DDB; continuing...
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11037 12106K 12349K 166960K 12468 0
pcb 18 12K 12K 166960K 57 0
rtable 237 6K 8K 166960K 558 0
pf 31 13K 20K 166960K 92 0
ifaddr 43 7K 8K 166960K 72 0
ifgroup 47 1K 2K 166960K 86 0
sysctl 1 1K 9K 166960K 5 0
counters 33 17K 17K 166960K 43 0
ioctlops 0 0K 4K 166960K 127 0
iov 0 0K 14K 166960K 18 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1302 82K 82K 166960K 1678 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 6 0
VM map 2 1K 1K 166960K 2 0
sem 27 1K 1K 166960K 35 0
dirhash 12 2K 2K 166960K 18 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 17 61K 106K 166960K 487 0
sigio 0 0K 0K 166960K 3 0
proc 60 59K 124K 166960K 648 0
subproc 72 4K 4K 166960K 117 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 30 0
in_multi 103 6K 6K 166960K 162 0
ether_multi 1 0K 0K 166960K 3 0
mrt 0 0K 0K 166960K 9 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 73 334K 334K 166960K 73 0
exec 0 0K 1K 166960K 442 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 236 160K 164K 166960K 5565 0
UVM aobj 11 2K 2K 166960K 12 0
pinsyscall 38 76K 98K 166960K 1713 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 25 0
NDP 13 0K 2K 166960K 47 0
temp 36 9106K 9170K 166960K 5686 0
kqueue 15 24K 26K 166960K 58 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 61 0 57 1 0 1 1 0 8 0
rtentry 136 183 0 74 4 0 4 4 0 8 0
unpcb 144 132 0 108 1 0 1 1 0 8 0
syncache 336 8 0 8 1 0 1 1 0 8 1
tcpcb 736 96 0 88 1 0 1 1 0 8 0
arp 96 35 0 17 1 0 1 1 0 8 0
ipq 40 1 0 0 1 0 1 1 0 8 0
ipqe 40 1 0 0 1 0 1 1 0 8 0
inpcb 328 264 0 251 2 0 2 2 0 8 0
nd6 112 42 0 16 1 0 1 1 0 8 0
pkpcb 40 35 0 35 1 0 1 1 0 8 1
kcovpl 48 13 0 5 1 0 1 1 0 8 0
ppxss 1072 3 0 3 1 0 1 1 0 8 1
pfstscr 40 2 0 2 1 0 1 1 0 8 1
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 1 0 0 1 0 1 1 0 8 0
pfrktable 1344 3 0 3 1 0 1 1 0 8 1
pfanchor 1288 7 0 2 1 0 1 1 0 8 0
pftag 88 1 0 0 1 0 1 1 0 8 0
pfqueue 320 1 0 1 1 0 1 1 0 8 1
pfstkey 128 2 0 2 1 0 1 1 0 8 1
pfstate 384 1 0 1 1 0 1 1 0 8 1
pfrule 1360 4 0 4 1 0 1 1 0 8 1
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 691 0 235 32 0 32 32 0 8 3
art_table 40 692 0 235 6 0 6 6 0 8 0
art_node 32 183 0 87 1 0 1 1 0 8 0
sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1
semupl 112 7 0 7 1 0 1 1 0 8 1
semapl 72 32 0 7 1 0 1 1 0 8 0
shmpl 112 9 0 1 1 0 1 1 0 8 0
dirhash 1024 21 0 4 3 0 3 3 0 8 0
dino2pl 256 2079 0 609 93 0 93 93 0 8 1
ffsino 256 2079 0 609 93 0 93 93 0 8 1
nchpl 144 2608 0 887 64 0 64 64 0 8 0
vnodes 216 2362 0 0 132 0 132 132 0 8 0
namei 1024 8982 0 8982 4 0 4 4 0 8 4
pfiaddrpl 120 1 0 1 1 0 1 1 0 8 1
kstatmem 264 43 0 20 2 0 2 2 0 8 0
scsiplug 72 2 0 2 1 0 1 1 0 8 1
scxspl 216 9840 0 9839 4 0 4 4 1 8 3
plimitpl 152 53 0 37 1 0 1 1 0 8 0
sigapl 424 762 0 719 6 0 6 6 0 8 0
knotepl 120 12347 0 12043 10 0 10 10 0 8 0
kqueuepl 184 90 0 79 1 0 1 1 0 8 0
pipepl 304 153 0 126 3 0 3 3 0 8 0
fdescpl 448 748 0 719 5 0 5 5 0 8 1
filepl 120 2970 0 2737 8 0 8 8 0 8 0
lockfpl 104 131 0 127 1 0 1 1 0 8 0
lockfspl 48 62 0 59 1 0 1 1 0 8 0
sessionpl 144 47 0 36 1 0 1 1 0 8 0
pgrppl 48 63 0 44 1 0 1 1 0 8 0
ucredpl 104 306 0 295 1 0 1 1 0 8 0
zombiepl 144 720 0 719 1 0 1 1 0 8 0
processpl 1152 762 0 719 4 0 4 4 0 8 0
procpl 664 1123 0 1066 6 0 6 6 0 8 0
sosppl 176 4 0 4 1 0 1 1 0 8 1
sockpl 552 499 0 456 5 0 5 5 0 8 1
mcl64k 65536 70 0 69 1 0 1 1 0 8 0
mcl16k 16384 46 0 44 1 0 1 1 0 8 0
mcl12k 12288 11 0 11 1 0 1 1 0 8 1
mcl9k128 9344 2 0 2 1 0 1 1 0 8 1
mcl8k 8192 33 0 33 1 0 1 1 0 8 1
mcl4k 4096 2976 0 2926 13 0 13 13 0 8 6
mcl2k2 2112 1 0 1 1 0 1 1 0 8 1
mcl2k 2048 407 0 405 1 0 1 1 0 8 0
mextrefs 64 306 0 304 1 0 1 1 0 8 0
mtagpl 96 6 0 6 1 0 1 1 0 8 1
mbufpl 256 7684 0 7522 12 0 12 12 0 8 0
bufpl 272 3161 0 107 204 0 204 204 0 8 0
anonpl 24 122789 0 116524 47 0 47 47 0 187 3
amapchunkpl 152 17121 0 16522 27 0 27 27 0 158 1
amappl16 200 2328 0 2143 15 1 14 14 0 8 0
amappl15 192 5 0 5 1 0 1 1 0 8 1
amappl14 184 513 0 512 1 0 1 1 0 8 0
amappl13 176 137 0 127 1 0 1 1 0 8 0
amappl12 168 1004 0 977 2 0 2 2 0 8 0
amappl11 160 4 0 4 1 0 1 1 0 8 1
amappl10 152 57 0 46 1 0 1 1 0 8 0
amappl9 144 272 0 272 1 0 1 1 0 8 1
amappl8 136 114 0 113 1 0 1 1 0 8 0
amappl7 128 155 0 144 1 0 1 1 0 8 0
amappl6 120 199 0 198 1 0 1 1 0 8 0
amappl5 112 105 0 98 1 0 1 1 0 8 0
amappl4 104 280 0 261 1 0 1 1 0 8 0
amappl3 96 3024 0 2929 3 0 3 3 0 8 0
amappl2 88 848 0 779 2 0 2 2 0 8 0
amappl1 80 11832 0 11286 13 0 13 13 0 8 1
amappl 88 4753 0 4580 5 0 5 5 0 92 0
uvmvnodes 80 110 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 253 0 253 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 11 0 1 1 0 1 1 0 8 0
uaddrrnd 24 748 0 719 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 748 0 719 1 0 1 1 0 8 0
vmmpekpl 168 7382 0 7337 3 0 3 3 0 8 0
vmmpepl 168 57601 0 55646 91 0 91 91 0 357 2
vmsppl 368 747 0 719 4 0 4 4 0 8 1
rwobjpl 40 18364 0 17229 13 0 13 13 0 8 0
pdppl 4096 1502 0 1438 100 32 68 82 0 8 4
pvpl 32 354683 0 340403 131 0 131 131 0 265 12
pmappl 216 747 0 719 3 0 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 574 0 32 16 0 16 16 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83454f5f) at panic+0x1cf sys/kern/subr_prf.c:198
malloc(30,7f,9) at malloc+0xdb6 sys/kern/kern_malloc.c:357
dopselect(ffff80002a7607d8,35,78fdbc67d1e0,0,0,ffff80002a7bf600,7ac71704e2df14e4,ffff80002a7bf690) at dopselect+0xe4 sys/kern/sys_generic.c:619
sys_pselect(ffff80002a7607d8,ffff80002a7bf740,ffff80002a7bf690) at sys_pselect+0x25a sys/kern/sys_generic.c:593
syscall(ffff80002a7bf740) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7bf740) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fdbc67d190, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83454f5f) at panic+0x1cf sys/kern/subr_prf.c:198
malloc(30,7f,9) at malloc+0xdb6 sys/kern/kern_malloc.c:357
dopselect(ffff80002a7607d8,35,78fdbc67d1e0,0,0,ffff80002a7bf600,7ac71704e2df14e4,ffff80002a7bf690) at dopselect+0xe4 sys/kern/sys_generic.c:619
sys_pselect(ffff80002a7607d8,ffff80002a7bf740,ffff80002a7bf690) at sys_pselect+0x25a sys/kern/sys_generic.c:593
syscall(ffff80002a7bf740) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7bf740) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78fdbc67d190, count: -7