panic: kernel diagnostic assertion "kd_lookup(kd->kd_unit) == NULL" failed: file "/syzkaller/managers/setuid/kernel/sys/dev/kcov.c", line 306
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*146137 82133 0 0x2 0 0K syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834bf028) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834ff269,ffffffff834d581a,132,ffffffff83568e1b) at __assert+0x29 sys/kern/subr_prf.c:-1
kcovopen(11300,3,2000,ffff80002a222fa0) at kcovopen+0x14f kd_lookup sys/dev/kcov.c:478 [inline]
kcovopen(11300,3,2000,ffff80002a222fa0) at kcovopen+0x14f sys/dev/kcov.c:306
spec_open_clone(ffff80003c417458) at spec_open_clone+0x277 sys/kern/spec_vnops.c:722
spec_open(ffff80003c417458) at spec_open+0x319 sys/kern/spec_vnops.c:148
VOP_OPEN(fffff50078d230d8,3,fffff500097fd4e0,ffff80002a222fa0) at VOP_OPEN+0x8b sys/kern/vfs_vops.c:138
vn_open(ffff80003c4176a8,3,0) at vn_open+0x7a5 sys/kern/vfs_vnops.c:183
doopenat(ffff80002a222fa0,ffffff9c,e750ab094e1,2,0,0,9936f146be93f615) at doopenat+0x35b sys/kern/vfs_syscalls.c:1163
sys_open(ffff80002a222fa0,ffff80003c417960,ffff80003c4178b0) at sys_open+0x59 sys/kern/vfs_syscalls.c:1065
syscall(ffff80003c417960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c417960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79f7e81b0d40, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: kernel diagnostic assertion "kd_lookup(kd->kd_unit) == NULL" failed: file "/syzkaller/managers/setuid/kernel/sys/dev/kcov.c", line 306
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834bf028) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834ff269,ffffffff834d581a,132,ffffffff83568e1b) at __assert+0x29 sys/kern/subr_prf.c:-1
kcovopen(11300,3,2000,ffff80002a222fa0) at kcovopen+0x14f kd_lookup sys/dev/kcov.c:478 [inline]
kcovopen(11300,3,2000,ffff80002a222fa0) at kcovopen+0x14f sys/dev/kcov.c:306
spec_open_clone(ffff80003c417458) at spec_open_clone+0x277 sys/kern/spec_vnops.c:722
spec_open(ffff80003c417458) at spec_open+0x319 sys/kern/spec_vnops.c:148
VOP_OPEN(fffff50078d230d8,3,fffff500097fd4e0,ffff80002a222fa0) at VOP_OPEN+0x8b sys/kern/vfs_vops.c:138
vn_open(ffff80003c4176a8,3,0) at vn_open+0x7a5 sys/kern/vfs_vnops.c:183
doopenat(ffff80002a222fa0,ffffff9c,e750ab094e1,2,0,0,9936f146be93f615) at doopenat+0x35b sys/kern/vfs_syscalls.c:1163
sys_open(ffff80002a222fa0,ffff80003c417960,ffff80003c4178b0) at sys_open+0x59 sys/kern/vfs_syscalls.c:1065
syscall(ffff80003c417960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c417960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79f7e81b0d40, count: -12
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff80003c417230
rbx 0xffffffff83934e07 cpu_info_full_primary+0x2e07
rdx 0
rcx 0xffff80002a222fa0
rax 0xffffffff83933ff0 cpu_info_full_primary+0x1ff0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x2bec3d8b2fc1891
r11 0xac501bee7e635b2f
r12 0xffffffff83934c08 cpu_info_full_primary+0x2c08
r13 0
r14 0
r15 0x1
rip 0xffffffff814c8705 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80003c417220
ss 0x10
db_enter+0x25: addq $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=146137 pid=82133 tcnt=1 stat=onproc
flags process=2<EXEC> proc=0
runpri=17, usrpri=50, slppri=17, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800037bb9a10,0xffffffff83a0c500
process=0xffff800037bd6b70 user=0xffff80003c412000, vmspace=0xfffff5000b1cb5b8
estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
*82133 146137 70677 0 7 0x2 0 syz-executor
68767 83318 86710 32767 3 0x10 0x80 piperd syz-executor
86710 94933 70677 0 3 0x2 0x80 wait syz-executor
25752 125271 30898 32767 3 0x10 0x80 piperd syz-executor
30898 264476 70677 0 3 0x2 0x80 wait syz-executor
87074 130841 47803 32767 3 0x10 0x80 piperd syz-executor
47803 72680 70677 0 3 0x2 0x80 wait syz-executor
45777 302333 70677 0 3 0x2 0x80 wait syz-executor
7920 29361 59161 32767 3 0x10 0x80 piperd syz-executor
59161 301394 70677 0 3 0x2 0x80 wait syz-executor
70677 154062 93539 0 3 0x2 0x80 nanoslp syz-executor
93539 401967 3078 0 3 0x100002 0x88 sigsusp ksh
3078 150559 2208 0 3 0x10 0x88 kqread sshd-session
2208 84600 59146 0 3 0x12 0x80 kqread sshd-session
26588 163941 1 0 3 0x100003 0x80 ttyin getty
59146 273696 1 0 3 0 0x88 kqread sshd
31960 369823 53000 73 3 0x1100010 0x80 kqread syslogd
53000 274155 1 0 3 0x100002 0x80 sbwait syslogd
4715 10325 1 0 3 0x100000 0x80 kqread resolvd
44864 345724 2329 77 3 0x100012 0x80 kqread dhcpleased
92279 514508 2329 77 3 0x100012 0x80 kqread dhcpleased
2329 283783 1 0 3 0 0x80 kqread dhcpleased
97803 290782 0 0 3 0x14000 0x200 bored smr
5727 171577 0 0 3 0x14000 0x200 pgzero zerothread
75986 356592 0 0 3 0x14000 0x200 aiodoned aiodoned
48206 107100 0 0 3 0x14000 0x200 syncer update
80641 218257 0 0 3 0x14000 0x200 cleaner cleaner
47578 243538 0 0 3 0x14000 0x200 reaper reaper
44760 194883 0 0 3 0x14000 0x200 pgdaemon pagedaemon
2979 167312 0 0 3 0x14000 0x200 bored viomb
56009 486200 0 0 3 0x14000 0x40000200 acpi0 acpi0
61966 236679 0 0 7 0x14000 0x40000200 idle1
55642 39270 0 0 3 0x14000 0x200 bored softnet1
53656 482299 0 0 3 0x14000 0x200 bored softnet0
56629 430209 0 0 3 0x14000 0x200 smrbar systqmp
35473 206554 0 0 3 0x14000 0x200 bored systq
87482 418643 0 0 3 0x14000 0x200 tmoslp softclockmp
35027 22241 0 0 3 0x14000 0x40000200 tmoslp softclock
58414 286571 0 0 3 0x14000 0x40000200 idle0
1 124026 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex /syzkaller/managers/setuid/kernel/sys/dev/kcov.c:129 r = 0 (0xffffffff8398c540)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2 kcovopen+0x63 sys/dev/kcov.c:306
#3 spec_open_clone+0x277 sys/kern/spec_vnops.c:722
#4 spec_open+0x319 sys/kern/spec_vnops.c:148
#5 VOP_OPEN+0x8b sys/kern/vfs_vops.c:138
#6 vn_open+0x7a5 sys/kern/vfs_vnops.c:183
#7 doopenat+0x35b sys/kern/vfs_syscalls.c:1163
#8 sys_open+0x59 sys/kern/vfs_syscalls.c:1065
#9 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#9 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#10 Xsyscall+0x128
Process 82133 (syz-executor) thread 0xffff80002a222fa0 (146137)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a1f7c0)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 doopenat+0x340 sys/kern/vfs_syscalls.c:1163
#2 sys_open+0x59 sys/kern/vfs_syscalls.c:1065
#3 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#4 Xsyscall+0x128
exclusive mutex /syzkaller/managers/setuid/kernel/sys/dev/kcov.c:129 r = 0 (0xffffffff8398c540)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2 kcovopen+0x63 sys/dev/kcov.c:306
#3 spec_open_clone+0x277 sys/kern/spec_vnops.c:722
#4 spec_open+0x319 sys/kern/spec_vnops.c:148
#5 VOP_OPEN+0x8b sys/kern/vfs_vops.c:138
#6 vn_open+0x7a5 sys/kern/vfs_vnops.c:183
#7 doopenat+0x35b sys/kern/vfs_syscalls.c:1163
#8 sys_open+0x59 sys/kern/vfs_syscalls.c:1065
#9 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#9 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#10 Xsyscall+0x128
Process 56629 (systqmp) thread 0xffff800045ffe7c8 (430209)
shared rwlock systqmp r = 0 (0xffffffff8399a6f8)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x12a sys/kern/kern_task.c:442
#2 proc_trampoline+0x10
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11042 12011K 12034K 166960K 12187 0
pcb 17 12K 12K 166960K 17 0
rtable 171 4K 7K 166960K 844 0
pf 25 16K 16K 166960K 61 0
ifaddr 30 5K 7K 166960K 106 0
ifgroup 38 1K 2K 166960K 110 0
sysctl 1 1K 9K 166960K 7 0
counters 64 36K 37K 166960K 100 0
ioctlops 0 0K 4K 166960K 113 0
iov 0 0K 2K 166960K 3 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1288 81K 81K 166960K 1756 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 8 0
VM map 2 1K 1K 166960K 2 0
sem 16 1K 2K 166960K 19 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 13 45K 125K 166960K 638 0
sigio 0 0K 0K 166960K 3 0
proc 58 99K 163K 166960K 945 0
subproc 46 2K 4K 166960K 469 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 228 0
in_multi 66 4K 6K 166960K 273 0
ether_multi 1 0K 0K 166960K 4 0
mrt 0 0K 0K 166960K 8 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 67 307K 307K 166960K 67 0
exec 0 0K 1K 166960K 607 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 163 133K 193K 166960K 5989 0
UVM aobj 107 3K 3K 166960K 108 0
pinsyscall 34 68K 114K 166960K 2143 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 7 0
NDP 16 1K 2K 166960K 72 0
temp 61 9127K 9147K 166960K 6813 0
kqueue 13 20K 29K 166960K 67 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 75 0 72 1 0 1 1 0 8 0
rtentry 176 276 0 199 6 0 6 6 0 8 2
unpcb 144 251 0 236 6 0 6 6 0 8 5
syncache 336 8 0 8 1 0 1 1 0 8 1
tcpcb 736 159 0 155 7 0 7 7 0 8 6
arp 136 48 0 35 1 0 1 1 0 8 0
inpcb 328 416 0 409 7 0 7 7 0 8 6
ip6q 80 7 0 0 1 0 1 1 0 8 0
ip6af 40 7 0 0 1 0 1 1 0 8 0
nd6 152 69 0 54 1 0 1 1 0 8 0
kcovpl 48 52 0 47 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 1119 0 751 29 4 25 29 0 8 2
art_table 40 1120 0 751 5 0 5 5 0 8 1
art_node 32 276 0 196 1 0 1 1 0 8 0
sysvmsgpl 40 2 0 2 1 0 1 1 0 8 1
semapl 72 14 0 0 1 0 1 1 0 8 0
shmpl 112 105 0 1 3 0 3 3 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1809 0 274 97 0 97 97 0 8 0
ffsino 296 1809 0 274 119 0 119 119 0 8 0
nchpl 144 2204 0 431 66 0 66 66 0 8 0
vnodes 216 2287 0 0 128 0 128 128 0 8 0
namei 1024 9630 0 9630 3 0 3 3 0 8 3
percpumem 16 66 0 18 1 0 1 1 0 8 0
kstatmem 264 55 0 36 2 0 2 2 0 8 0
scxspl 216 7553 0 7553 4 3 1 3 1 8 1
plimitpl 152 202 0 182 2 0 2 2 0 8 0
sigapl 424 849 0 807 7 0 7 7 0 8 0
knotepl 120 291 0 0 9 0 9 9 0 8 0
kqueuepl 224 66 0 57 1 0 1 1 0 8 0
pipepl 344 268 0 241 4 0 4 4 0 8 0
fdescpl 528 833 0 808 4 0 4 4 0 8 1
filepl 160 3588 0 3420 18 1 17 18 0 8 8
lockfpl 104 31 0 29 1 0 1 1 0 8 0
lockfspl 48 15 0 13 1 0 1 1 0 8 0
sessionpl 144 71 0 58 1 0 1 1 0 8 0
pgrppl 48 125 0 105 1 0 1 1 0 8 0
ucredpl 104 278 0 262 1 0 1 1 0 8 0
zombiepl 144 809 0 807 1 0 1 1 0 8 0
processpl 1232 849 0 807 5 0 5 5 0 8 0
procpl 664 1106 0 1064 6 0 6 6 0 8 1
sockpl 752 743 0 718 23 12 11 23 0 8 8
mcl64k 65536 3 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl12k 12288 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 3 0 0 1 0 1 1 0 8 0
mcl4k 4096 120 0 0 15 0 15 15 0 8 0
mcl2k 2048 31 0 0 4 0 4 4 0 8 0
mextrefs 64 30 0 0 1 0 1 1 0 8 0
mtagpl 96 1 0 0 1 0 1 1 0 8 0
mbufpl 256 327 0 0 21 0 21 21 0 8 0
bufpl 272 2582 0 102 166 0 166 166 0 8 0
anonpl 32 9424 0 0 76 0 76 76 0 247 0
amapchunkpl 152 17274 0 16978 32 0 32 32 0 158 12
amappl16 200 1969 0 1960 14 5 9 14 0 8 7
amappl15 192 3 0 3 1 1 0 1 0 8 0
amappl14 184 586 0 585 1 0 1 1 0 8 0
amappl13 176 149 0 139 1 0 1 1 0 8 0
amappl12 168 1134 0 1110 2 0 2 2 0 8 0
amappl11 160 11 0 11 1 1 0 1 0 8 0
amappl10 152 84 0 74 1 0 1 1 0 8 0
amappl9 144 274 0 273 1 0 1 1 0 8 0
amappl8 136 153 0 152 1 0 1 1 0 8 0
amappl7 128 175 0 164 1 0 1 1 0 8 0
amappl6 120 296 0 295 1 0 1 1 0 8 0
amappl5 112 99 0 91 1 0 1 1 0 8 0
amappl4 104 315 0 300 1 0 1 1 0 8 0
amappl3 96 2924 0 2866 4 1 3 3 0 8 0
amappl2 88 919 0 850 2 0 2 2 0 8 0
amappl1 80 13809 0 13287 16 0 16 16 0 8 3
amappl 88 4968 0 4865 5 0 5 5 0 92 1
uvmvnodes 80 100 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 107 0 1 2 0 2 2 0 8 0
uaddrrnd 24 833 0 808 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 833 0 808 1 0 1 1 0 8 0
vmmpekpl 168 9265 0 9206 3 0 3 3 0 8 0
vmmpepl 168 62705 0 61232 101 0 101 101 0 357 20
vmsppl 488 832 0 808 6 0 6 6 0 8 1
rwobjpl 80 20479 0 19556 25 0 25 25 0 8 3
pdppl 4096 1673 0 1616 121 42 79 97 0 8 22
pvpl 32 17782 0 0 145 1 144 145 0 265 0
pmappl 256 832 0 808 3 0 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 477 0 48 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834bf028) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834ff269,ffffffff834d581a,132,ffffffff83568e1b) at __assert+0x29 sys/kern/subr_prf.c:-1
kcovopen(11300,3,2000,ffff80002a222fa0) at kcovopen+0x14f kd_lookup sys/dev/kcov.c:478 [inline]
kcovopen(11300,3,2000,ffff80002a222fa0) at kcovopen+0x14f sys/dev/kcov.c:306
spec_open_clone(ffff80003c417458) at spec_open_clone+0x277 sys/kern/spec_vnops.c:722
spec_open(ffff80003c417458) at spec_open+0x319 sys/kern/spec_vnops.c:148
VOP_OPEN(fffff50078d230d8,3,fffff500097fd4e0,ffff80002a222fa0) at VOP_OPEN+0x8b sys/kern/vfs_vops.c:138
vn_open(ffff80003c4176a8,3,0) at vn_open+0x7a5 sys/kern/vfs_vnops.c:183
doopenat(ffff80002a222fa0,ffffff9c,e750ab094e1,2,0,0,9936f146be93f615) at doopenat+0x35b sys/kern/vfs_syscalls.c:1163
sys_open(ffff80002a222fa0,ffff80003c417960,ffff80003c4178b0) at sys_open+0x59 sys/kern/vfs_syscalls.c:1065
syscall(ffff80003c417960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c417960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79f7e81b0d40, count: -12
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x27: addq $0x8,%rsp
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff80002999dff0) at sched_idle+0x371 sys/kern/kern_sched.c:192
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff80002999dff0) at sched_idle+0x371 sys/kern/kern_sched.c:192
end trace frame: 0x0, count: -5