panic: Caught invalid memory access at ffff800045ff7d38 size 8 op 0
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
467644 83592 0 0 0 0 syz-executor
*102877 20848 0 0 0x4000000 1 syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84631de8) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ff7d38) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ff7d38) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
rw_status(ffff800045ff7d38) at rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
rw_status(ffff800045ff7d38) at rw_status+0x27 sys/kern/kern_rwlock.c:517
KQRELE(ffff8000017d09a0) at KQRELE+0x77 sys/kern/kern_event.c:244
kqueue_close(ffff8000017dc788,ffff800045ffcfa8) at kqueue_close+0x70 sys/kern/kern_event.c:1956
fdrop(ffff8000017dc788,ffff800045ffcfa8) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
fd_iterfile(ffff8000017dc788,ffff800045ffcfa8) at fd_iterfile+0x162 sys/kern/kern_descrip.c:222
sysctl_file(ffff8000299a3de8,4,200000000040,ffff8000299a3dc0,ffff800045ffcfa8) at sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(49,ffff8000299a3de8,4,200000000040,ffff8000299a3dc0,200000000440,4,1ffff00005334734) at kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
kern_sysctl(ffff8000299a3de4,5,200000000040,ffff8000299a3dc0,200000000440,fe6,ffff8000299a4030) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ffcfa8,ffff8000299a4030,ffff8000299a3fa0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000299a4030) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299a4030) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9db248627b0, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffff800045ff7d38 size 8 op 0
ddb{1}> show kasan
KASAN: invalid read of 8 bytes at 0xffff800045ff7d38 from pc 0xffffffff817932a7
KASAN: first bad byte at 0xffff800045ff7d38 (+0); shadow 0xfd: pool use-after-free (or unallocated item)
KASAN: 0xffff800045ff7d38 is 72 bytes inside the 528-byte item [0xffff800045ff7cf0..0xffff800045ff7f00) in pool 'fdescpl'
KASAN: allocated at:
#0 pool_get+0x770 sys/kern/subr_pool.c:733
#1 fdcopy+0x55 fdinit sys/kern/kern_descrip.c:1070 [inline]
#1 fdcopy+0x55 sys/kern/kern_descrip.c:1109
#2 process_new+0x601 sys/kern/kern_fork.c:277
#3 fork1+0x533 sys/kern/kern_fork.c:408
#4 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#5 Xsyscall+0x128
KASAN: freed at:
#0 pool_put+0x79 sys/kern/subr_pool.c:918
#1 exit1+0x81e sys/kern/kern_exit.c:215
#2 sys_exit+0x4a
#3 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#4 Xsyscall+0x128
KASAN: pc: rw_status+0x27
KASAN: call trace:
#0 __asan_load8_noabort+0xbd kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 __asan_load8_noabort+0xbd sys/kern/subr_kasan.c:1099
#1 rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
#1 rw_status+0x27 sys/kern/kern_rwlock.c:517
#2 KQRELE+0x77 sys/kern/kern_event.c:244
#3 kqueue_close+0x70 sys/kern/kern_event.c:1956
#4 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#5 fd_iterfile+0x162 sys/kern/kern_descrip.c:222
#6 sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
#7 kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
#8 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#9 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
KASAN: shadow of 0xffff800045ff7c00..0xffff800045ff7e80 (1 cell = 8 bytes):
0xffff800045ff7c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0xffff800045ff7c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd 08 08
>0xffff800045ff7d00: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
0xffff800045ff7d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0xffff800045ff7e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84631de8) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ff7d38) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ff7d38) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
rw_status(ffff800045ff7d38) at rw_status+0x27 atomic_load_long sys/sys/atomic.h:213 [inline]
rw_status(ffff800045ff7d38) at rw_status+0x27 sys/kern/kern_rwlock.c:517
KQRELE(ffff8000017d09a0) at KQRELE+0x77 sys/kern/kern_event.c:244
kqueue_close(ffff8000017dc788,ffff800045ffcfa8) at kqueue_close+0x70 sys/kern/kern_event.c:1956
fdrop(ffff8000017dc788,ffff800045ffcfa8) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
fd_iterfile(ffff8000017dc788,ffff800045ffcfa8) at fd_iterfile+0x162 sys/kern/kern_descrip.c:222
sysctl_file(ffff8000299a3de8,4,200000000040,ffff8000299a3dc0,ffff800045ffcfa8) at sysctl_file+0x312f sys/kern/kern_sysctl.c:-1
kern_sysctl_dirs(49,ffff8000299a3de8,4,200000000040,ffff8000299a3dc0,200000000440,4,1ffff00005334734) at kern_sysctl_dirs+0x265 sys/kern/kern_sysctl.c:415
kern_sysctl(ffff8000299a3de4,5,200000000040,ffff8000299a3dc0,200000000440,fe6,ffff8000299a4030) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800045ffcfa8,ffff8000299a4030,ffff8000299a3fa0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000299a4030) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299a4030) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9db248627b0, count: -14
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff8000299a3230
rbx 0xffff8000299a32a0
rdx 0
rcx 0xffff800028ff3ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff8000299a3018
r11 0xffffffff82744c00 x86_bus_space_io_read_1
r12 0xffffffff84631de8 ucc_ca+0x9ab48
r13 0xffff800028ff4c08
r14 0xffff800028ff4e07
r15 0x1
rip 0xffffffff81a97a67 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff8000299a3230
ss 0x10
db_enter+0x17: popq %rbp
ddb{1}> show proc
PROC (syz-executor) tid=102877 pid=20848 tcnt=4 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=86, usrpri=83, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800045ffc7e0,0xffff8000298a5ca0
process=0xffff800045ff39e0 user=0xffff800029999000, vmspace=0xffff800001c3d5d0
estcpu=33, cpticks=33, pctcpu=0.18, user=0, sys=33, intr=0
ddb{1}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
83592 467644 68699 0 7 0 0 syz-executor
83592 85825 68699 0 2 0 0x4000080 syz-executor
33582 488622 40196 0 2 0 0 syz-executor
34437 114620 1 0 3 0x2 0x80 nanoslp getty
95221 103903 9164 0 2 0x10 0xc80 syz-executor
95221 76993 9164 0 3 0x10 0x4000080 kqpoll syz-executor
95221 487586 9164 0 3 0x10 0x4000080 fsleep syz-executor
20848 390180 22985 0 2 0 0xc80 syz-executor
*20848 102877 22985 0 7 0 0x4000000 syz-executor
20848 183279 22985 0 3 0 0x4000080 fsleep syz-executor
20848 523695 22985 0 3 0 0x4000080 fsleep syz-executor
56848 141082 99543 0 2 0 0xc80 syz-executor
56848 417742 99543 0 3 0 0x4000080 bell syz-executor
56848 43145 99543 0 3 0 0x4000080 fsleep syz-executor
56848 264860 99543 0 3 0 0x4000080 fsleep syz-executor
5877 110070 62933 0 3 0x1010 0x2000 suspend syz-executor
5877 329629 62933 0 2 0x1010 0x4080080 syz-executor
5877 292232 62933 0 2 0x1010 0x4080080 syz-executor
76593 330471 0 0 3 0x14000 0x280 nfsidl nfsio
81947 262045 0 0 3 0x14000 0x280 nfsidl nfsio
96651 149875 0 0 3 0x14000 0x280 nfsidl nfsio
3268 54910 0 0 3 0x14000 0x280 nfsidl nfsio
73745 468409 0 0 3 0x14000 0x280 nfsidl nfsio
62487 217326 0 0 3 0x14000 0x280 nfsidl nfsio
95250 479135 0 0 3 0x14000 0x280 nfsidl nfsio
24987 163280 0 0 3 0x14000 0x280 nfsidl nfsio
21203 481615 0 0 3 0x14000 0x280 nfsidl nfsio
29101 325231 0 0 3 0x14000 0x280 nfsidl nfsio
6555 119514 0 0 3 0x14000 0x280 nfsidl nfsio
80866 365130 0 0 3 0x14000 0x280 nfsidl nfsio
91652 16122 0 0 3 0x14000 0x280 nfsidl nfsio
68666 347760 0 0 3 0x14000 0x280 nfsidl nfsio
95331 284160 0 0 3 0x14000 0x280 nfsidl nfsio
44277 230385 0 0 3 0x14000 0x280 nfsidl nfsio
46414 498044 0 0 3 0x14000 0x280 nfsidl nfsio
34619 205723 0 0 3 0x14000 0x280 nfsidl nfsio
34388 223826 0 0 3 0x14000 0x280 nfsidl nfsio
96863 357386 0 0 3 0x14000 0x280 nfsidl nfsio
59115 410936 10887 0 2 0x2 0 syz-executor
40196 185588 10887 0 2 0x2 0xc80 syz-executor
99543 160992 10887 0 2 0x2 0xc80 syz-executor
39123 218020 10887 0 3 0x2 0 getblk syz-executor
22985 309123 10887 0 2 0x2 0xc80 syz-executor
68699 252342 10887 0 2 0x2 0 syz-executor
62933 367436 10887 0 2 0x2 0xc80 syz-executor
9164 263627 10887 0 2 0x2 0xc80 syz-executor
10887 373536 1 0 3 0x2 0x80 kqread syz-executor
56601 121328 0 0 3 0x14000 0x200 bored smr
40902 139904 0 0 2 0x14000 0x200 zerothread
71477 490934 0 0 3 0x14000 0x200 aiodoned aiodoned
50098 281661 0 0 3 0x14000 0x200 syncer update
39115 398519 0 0 3 0x14000 0x200 cleaner cleaner
37097 478541 0 0 3 0x14000 0x200 reaper reaper
47026 370450 0 0 3 0x14000 0x200 pgdaemon pagedaemon
85393 65920 0 0 3 0x14000 0x200 bored viomb
95489 313845 0 0 3 0x14000 0x40000200 acpi0 acpi0
28863 354295 0 0 3 0x14000 0x40000200 idle1
99232 411708 0 0 3 0x14000 0x200 bored softnet1
19129 134719 0 0 2 0x14000 0x200 softnet0
71683 261127 0 0 3 0x14000 0x200 bored systqmp
97995 181488 0 0 3 0x14000 0x200 bored systq
26991 283882 0 0 3 0x14000 0x200 tmoslp softclockmp
3704 514113 0 0 3 0x14000 0x40000200 tmoslp softclock
60492 346101 0 0 3 0x14000 0x40000200 idle0
1 394377 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{1}> show all locks
Process 59115 (syz-executor) thread 0xffff800045ffc548 (410936)
exclusive rrwlock inode r = 0 (0xffff800001a276c8)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4 vn_lock+0xca sys/kern/vfs_vnops.c:576
#5 vget+0x321 sys/kern/vfs_subr.c:694
#6 ufs_ihashget+0x233 sys/ufs/ufs/ufs_ihash.c:98
#7