syzbot


panic: vrele: v_writecount != NUM

Status: upstream: reported on 2025/04/16 22:28
Reported-by: syzbot+72972f7c1381c2bce38a@syzkaller.appspotmail.com
First crash: 88d, last: 35d

Sample crash report:
panic: vrele: v_writecount != 0
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 65669  39063      0      0x1004          0    1K syz-executor
  55892  64128      0     0x14000 0x40000200    0  softclock
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8344bdd9) at panic+0x1e5 sys/kern/subr_prf.c:198
vrele(fffffd806d4f62b8) at vrele+0x274 sys/kern/vfs_subr.c:831
uvn_detach(fffffd806d479980) at uvn_detach+0x1b7 sys/uvm/uvm_vnode.c:391
uvm_unmap_detach(ffff80002a329c98,0) at uvm_unmap_detach+0x15e sys/uvm/uvm_map.c:1364
uvmspace_exec(ffff80002a2aaf78,1000,7f7fffffc000) at uvmspace_exec+0x3b7 sys/uvm/uvm_map.c:3393
sys_execve(ffff80002a2aaf78,ffff80002a32a330,ffff80002a32a280) at sys_execve+0xae0 sys/kern/kern_exec.c:453
syscall(ffff80002a32a330) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a32a330) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70b67a34c350, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: vrele: v_writecount != 0
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8344bdd9) at panic+0x1e5 sys/kern/subr_prf.c:198
vrele(fffffd806d4f62b8) at vrele+0x274 sys/kern/vfs_subr.c:831
uvn_detach(fffffd806d479980) at uvn_detach+0x1b7 sys/uvm/uvm_vnode.c:391
uvm_unmap_detach(ffff80002a329c98,0) at uvm_unmap_detach+0x15e sys/uvm/uvm_map.c:1364
uvmspace_exec(ffff80002a2aaf78,1000,7f7fffffc000) at uvmspace_exec+0x3b7 sys/uvm/uvm_map.c:3393
sys_execve(ffff80002a2aaf78,ffff80002a32a330,ffff80002a32a280) at sys_execve+0xae0 sys/kern/kern_exec.c:453
syscall(ffff80002a32a330) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a32a330) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70b67a34c350, count: -9
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a329ae0
rbx               0xffff8000299dedd7
rdx                                0
rcx               0xffff80002a2aaf78
rax               0xffff8000299ddff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x2a9e606f7557bff6
r11                0x5ce548479013f41
r12               0xffff8000299debd8
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff81ba9385    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a329ad0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=65669 pid=39063 tcnt=1 stat=onproc
    flags process=1004<INEXEC,SINGLEEXIT> proc=0
    runpri=50, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff80002a2aaf78 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a2aa018,0xffff80002a2abc58
    process=0xffff8000ffff66c8 user=0xffff80002a325000, vmspace=0xfffffd806c176990
    estcpu=36, cpticks=3, pctcpu=0.0, user=0, sys=3, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 73826  112612  56188  32767  2        0x10                syz-executor
*39063   65669  40719      0  7      0x1004                syz-executor
 24527  306236  50066  32767  2        0x10                syz-executor
 24527  403540  50066  32767  3   0x4000010  getblk        syz-executor
 24527  396024  50066  32767  3   0x4000090  fsleep        syz-executor
 89211  183229  32015  32767  3        0x90  piperd        syz-executor
 32015  326166  40719      0  3        0x82  wait          syz-executor
 21801  123954      0      0  3     0x14200  bored         sosplice
 43827  400440  11762      0  3        0x82  sbwait        sshd-session
 44896  483938  80170  32767  3        0x90  piperd        syz-executor
 61289  415189  17582  32767  3        0x90  piperd        syz-executor
 17405   70883  76673  32767  2        0x10                syz-executor
 56188  336069  77045  32767  3        0x90  nanoslp       syz-executor
 50066   35637  92125  32767  3        0x90  nanoslp       syz-executor
 80170  331389  40719      0  3        0x82  wait          syz-executor
 76673  255244  40719      0  3        0x82  wait          syz-executor
 17582  392189  40719      0  3        0x82  wait          syz-executor
 77045  417181  40719      0  3        0x82  wait          syz-executor
 92125   47294  40719      0  3        0x82  wait          syz-executor
 40719  227308  74095      0  3        0x82  nanoslp       syz-executor
 74095  429576  88227      0  3    0x10008a  sigsusp       ksh
 88227  446266  24928      0  3        0x98  kqread        sshd-session
 24928  415620  11762      0  3        0x92  kqread        sshd-session
 70218  159780      1      0  3    0x100083  ttyin         getty
 11762  510164      1      0  3        0x88  kqread        sshd
 36830  188808  38676     73  3   0x1100090  kqread        syslogd
 38676  180742      1      0  3    0x100082  sbwait        syslogd
 96072  338009      1      0  3    0x100080  kqread        resolvd
 68418  132739  64363     77  3    0x100092  kqread        dhcpleased
 13575  420014  64363     77  3    0x100092  kqread        dhcpleased
 64363  232418      1      0  3        0x80  kqread        dhcpleased
 24038  214766      0      0  3     0x14200  bored         smr
 41420   56118      0      0  2     0x14200                zerothread
  6273   32380      0      0  3     0x14200  aiodoned      aiodoned
 45828  261806      0      0  3     0x14200  syncer        update
 10650  200428      0      0  3     0x14200  cleaner       cleaner
 20008  378146      0      0  3     0x14200  reaper        reaper
 39240  265200      0      0  3     0x14200  pgdaemon      pagedaemon
 82090  290324      0      0  3     0x14200  bored         viomb
 76751  152672      0      0  3  0x40014200  acpi0         acpi0
 15850  380759      0      0  3  0x40014200                idle1
 81127  347123      0      0  3     0x14200  bored         softnet3
    74  343612      0      0  3     0x14200  bored         softnet2
 45963  325104      0      0  3     0x14200  bored         softnet1
 60540  514432      0      0  3     0x14200  bored         softnet0
 29049   83003      0      0  3     0x14200  bored         systqmp
 46429   44689      0      0  3     0x14200  bored         systq
 15236   65395      0      0  3     0x14200  tmoslp        softclockmp
 64128   55892      0      0  7  0x40014200                softclock
  6991  453980      0      0  3  0x40014200                idle0
     1    8915      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 39063 (syz-executor) thread 0xffff80002a2aaf78 (65669)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff839628a8)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  syscall+0xae6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#1  syscall+0xae6 sys/arch/amd64/amd64/trap.c:579
#2  Xsyscall+0x128
Process 24527 (syz-executor) thread 0xffff80002a2aa2a8 (403540)
exclusive rrwlock inode r = 0 (0xfffffd806dea5c08)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vget+0x2bd sys/kern/vfs_subr.c:693
#6  ffs_sync_vnode+0x1aa sys/ufs/ffs/ffs_vfsops.c:1076
#7  vfs_mount_foreach_vnode+0x65 sys/kern/vfs_subr.c:-1
#8  ffs_sync+0x146 sys/ufs/ffs/ffs_vfsops.c:1131
#9  sys_sync+0x104 sys/kern/vfs_syscalls.c:535
#10 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#11 Xsyscall+0x128
shared rwlock vfslock r = 0 (0xffff800000b49860)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x36e sys/kern/kern_rwlock.c:397
#2  vfs_busy+0x94 sys/kern/vfs_subr.c:246
#3  sys_sync+0x5d sys/kern/vfs_syscalls.c:528
#4  syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#5  Xsyscall+0x128
Process 17405 (syz-executor) thread 0xffff8000ffff1210 (70883)
exclusive rrwlock inode r = 0 (0xfffffd8067b20528)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4  ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:159
#5  ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1230
#6  ffs_inode_alloc+0x283 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_mkdir+0x113 sys/ufs/ufs/ufs_vnops.c:1112
#8  VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
#9  domkdirat+0x179 sys/kern/vfs_syscalls.c:3109
#10 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806cc1d8b8)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  domkdirat+0x8b sys/kern/vfs_syscalls.c:3094
#8  syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#9  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10210  10954K   10966K 166960K     11298        0
            pcb    17     14K      16K 166960K        19        0
         rtable   194      5K       7K 166960K       480        0
             pf    27     16K      16K 166960K        33        0
         ifaddr    34      6K       7K 166960K        48        0
        ifgroup    42      1K       2K 166960K        54        0
         sysctl     4      1K       9K 166960K         9        0
       counters    64     36K      36K 166960K        70        0
       ioctlops     0      0K       2K 166960K        43        0
            iov     0      0K      24K 166960K        28        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1334     84K      84K 166960K      1683        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        12        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        40        0
        dirhash    12      2K       2K 166960K        33        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     58K     121K 166960K       664        0
          sigio     0      0K       0K 166960K         6        0
           proc    58     79K     115K 166960K       575        0
        subproc    54      3K       4K 166960K       315        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        80        0
       in_multi    77      5K       7K 166960K       127        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     1      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   223    996K     996K 166960K       223        0
           exec     1      0K       1K 166960K       426        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   194    150K     190K 166960K      7187        0
       UVM aobj    18      2K       2K 166960K        18        0
     pinsyscall    41     82K     112K 166960K      1759        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        31        0
            NDP    11      0K       2K 166960K        30        0
           temp    58   8685K    8809K 166960K      6491        0
         kqueue    13     20K      29K 166960K       106        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120       84    0       81     1     0     1     1     0     8    0
rtentry    176      129    0       39     6     0     6     6     0     8    0
unpcb      144      503    0      486     4     3     1     4     0     8    0
syncache   336       16    0       16     1     0     1     1     0     8    1
tcpqe       32        2    0        2     1     0     1     1     0     8    1
tcpcb      808      316    0      309     8     6     2     8     0     8    1
arp        128       20    0        6     1     0     1     1     0     8    0
ipq         40        2    0        1     1     0     1     1     0     8    0
ipqe        40        4    0        3     1     0     1     1     0     8    0
inpcb      328      850    0      839    16     8     8    16     0     8    6
nd6        144       34    0       14     2     0     2     2     0     8    1
kcovpl      48       35    0       29     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      515    0      145    30     1    29    30     0     8    5
art_table   32      516    0      145     4     0     4     4     0     8    0
art_node    16      128    0       46     1     0     1     1     0     8    0
sysvmsgpl   40       12    0        9     1     0     1     1     0     8    0
semapl     112       38    0       28     1     0     1     1     0     8    0
shmpl      112       15    0        0     1     0     1     1     0     8    0
dirhash    1024      31    0       14     3     0     3     3     0     8    0
dino2pl    256     2292    0      751    97     0    97    97     0     8    0
ffsino     288     2292    0      751   111     0   111   111     0     8    0
nchpl      144     3082    0     1379    64     0    64    64     0     8    0
uvmvnodes   80     2616    0        0    54     0    54    54     0     8    0
vnodes     216     2616    0        0   146     0   146   146     0     8    0
namei      1024   10345    0    10343     1     0     1     1     0     8    0
percpumem   16       50    0        3     1     0     1     1     0     8    0
kstatmem   264       26    0        6     2     0     2     2     0     8    0
scxspl     216    10454    0    10451    10     8     2     8     1     8    1
plimitpl   152      196    0      176     2     0     2     2     0     8    1
sigapl     424      897    0      848     7     0     7     7     0     8    0
knotepl    120      388    0        0    12     0    12    12     0     8    0
kqueuepl   224      169    0      160     2     1     1     2     0     8    0
pipepl     336      254    0      227     6     3     3     6     0     8    0
fdescpl    520      878    0      848     3     0     3     3     0     8    0
filepl     160     5283    0     5097    17     1    16    17     0     8    6
lockfpl    104      100    0       98     1     0     1     1     0     8    0
lockfspl    48       46    0       44     1     0     1     1     0     8    0
sessionpl  144       61    0       46     1     0     1     1     0     8    0
pgrppl      48      103    0       81     1     0     1     1     0     8    0
ucredpl    104      852    0      835     1     0     1     1     0     8    0
zombiepl   144      848    0      848     1     0     1     1     0     8    1
processpl  1240     897    0      848     5     0     5     5     0     8    0
procpl     656     1639    0     1588     7     0     7     7     0     8    1
sosppl     168        4    0        4     1     0     1     1     0     8    1
sockpl     728     1448    0     1403    20     8    12    20     0     8    7
mcl64k     65536      6    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     128    0        0    16     0    16    16     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      21    0        0     3     0     3     3     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      337    0        0    22     0    22    22     0     8    0
bufpl      280     3121    0      113   215     0   215   215     0     8    0
anonpl      32     5815    0        0    47     0    47    47     0   246    0
amapchunkpl 152   23827    0    23463    45     2    43    45     0   158   22
amappl16   200     2519    0     2501     7     2     5     5     0     8    3
amappl15   192        4    0        4     1     1     0     1     0     8    0
amappl14   184      168    0      157     1     0     1     1     0     8    0
amappl13   176        7    0        7     1     1     0     1     0     8    0
amappl12   168     1507    0     1478     2     0     2     2     0     8    0
amappl11   160       43    0       33     1     0     1     1     0     8    0
amappl10   152        5    0        5     1     1     0     1     0     8    0
amappl9    144      267    0      267     1     1     0     1     0     8    0
amappl8    136       31    0       29     1     0     1     1     0     8    0
amappl7    128      109    0       98     1     0     1     1     0     8    0
amappl6    120      197    0      192     1     0     1     1     0     8    0
amappl5    112      114    0      108     1     0     1     1     0     8    0
amappl4    104      332    0      316     1     0     1     1     0     8    0
amappl3     96     4184    0     4099     4     0     4     4     0     8    0
amappl2     88      734    0      673     2     0     2     2     0     8    0
amappl1     80    12899    0    12268    17     0    17    17     0     8    0
amappl      88     6375    0     6249     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       17    0        0     1     0     1     1     0     8    0
uaddrrnd    24      878    0      848     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      878    0      848     1     0     1     1     0     8    0
vmmpekpl   168    10378    0    10331     3     0     3     3     0     8    0
vmmpepl    168    64884    0    63041   112     2   110   112     0   357    9
vmsppl     480      877    0      848     7     1     6     6     0     8    0
rwobjpl     72    22854    0    19361    67     0    67    67     0     8    2
pdppl      4096    1764    0     1696   118    40    78    96     0     8   10
pvpl        32    15031    0        0   122     0   122   122     0   265    0
pmappl     256      877    0      848     4     1     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      427    0       53    12     0    12    12     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff837f0ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839626a0) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:129 [inline]
__mp_lock(ffffffff839626a0) at __mp_lock+0x199 sys/kern/kern_lock.c:160
intr_handler(ffff80002a1f89b0,ffff800000079f00) at intr_handler+0xe1 sys/arch/amd64/amd64/intr.c:559
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 sys/dev/kcov.c:153
__mp_lock(ffffffff839626a0) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:129 [inline]
__mp_lock(ffffffff839626a0) at __mp_lock+0x1a3 sys/kern/kern_lock.c:160
__mp_acquire_count(ffffffff839626a0,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2da sys/kern/kern_synch.c:366
softclock_thread_run(ffffffff83864478) at softclock_thread_run+0x79 sys/kern/kern_timeout.c:845
softclock_thread(ffff8000fffff480) at softclock_thread+0x10a sys/kern/kern_timeout.c:867
end trace frame: 0x0, count: 3
ddb{0}> trace
x86_ipi_db(ffffffff837f0ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839626a0) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:129 [inline]
__mp_lock(ffffffff839626a0) at __mp_lock+0x199 sys/kern/kern_lock.c:160
intr_handler(ffff80002a1f89b0,ffff800000079f00) at intr_handler+0xe1 sys/arch/amd64/amd64/intr.c:559
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 sys/dev/kcov.c:153
__mp_lock(ffffffff839626a0) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:129 [inline]
__mp_lock(ffffffff839626a0) at __mp_lock+0x1a3 sys/kern/kern_lock.c:160
__mp_acquire_count(ffffffff839626a0,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2da sys/kern/kern_synch.c:366
softclock_thread_run(ffffffff83864478) at softclock_thread_run+0x79 sys/kern/kern_timeout.c:845
softclock_thread(ffff8000fffff480) at softclock_thread+0x10a sys/kern/kern_timeout.c:867
end trace frame: 0x0, count: -12
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8344bdd9) at panic+0x1e5 sys/kern/subr_prf.c:198
vrele(fffffd806d4f62b8) at vrele+0x274 sys/kern/vfs_subr.c:831
uvn_detach(fffffd806d479980) at uvn_detach+0x1b7 sys/uvm/uvm_vnode.c:391
uvm_unmap_detach(ffff80002a329c98,0) at uvm_unmap_detach+0x15e sys/uvm/uvm_map.c:1364
uvmspace_exec(ffff80002a2aaf78,1000,7f7fffffc000) at uvmspace_exec+0x3b7 sys/uvm/uvm_map.c:3393
sys_execve(ffff80002a2aaf78,ffff80002a32a330,ffff80002a32a280) at sys_execve+0xae0 sys/kern/kern_exec.c:453
syscall(ffff80002a32a330) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a32a330) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70b67a34c350, count: 6
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8344bdd9) at panic+0x1e5 sys/kern/subr_prf.c:198
vrele(fffffd806d4f62b8) at vrele+0x274 sys/kern/vfs_subr.c:831
uvn_detach(fffffd806d479980) at uvn_detach+0x1b7 sys/uvm/uvm_vnode.c:391
uvm_unmap_detach(ffff80002a329c98,0) at uvm_unmap_detach+0x15e sys/uvm/uvm_map.c:1364
uvmspace_exec(ffff80002a2aaf78,1000,7f7fffffc000) at uvmspace_exec+0x3b7 sys/uvm/uvm_map.c:3393
sys_execve(ffff80002a2aaf78,ffff80002a32a330,ffff80002a32a280) at sys_execve+0xae0 sys/kern/kern_exec.c:453
syscall(ffff80002a32a330) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a32a330) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70b67a34c350, count: -9

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/08 23:19 openbsd 394c376d8c51 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: vrele: v_writecount != NUM
2025/04/16 22:27 openbsd 4c8bb6464990 a95239b1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: vrele: v_writecount != NUM
* Struck through repros no longer work on HEAD.