panic: kernel diagnostic assertion "!ISSET(rt->rt_flags, RTF_LOCAL)" failed: file "/syzkaller/managers/setuid/kernel/sys/netinet6/nd6.c", line 704
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834b7e06) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834f9ca4,ffffffff8351242e,2c0,ffffffff834fd69b) at __assert+0x29 sys/kern/subr_prf.c:-1
nd6_free(fffff8806b439440,ffff8000015ee800,0) at nd6_free+0x2bd
nd6_purge(ffff8000015ee800) at nd6_purge+0x16b sys/netinet6/nd6.c:521
in6_ifdetach(ffff8000015ee800) at in6_ifdetach+0x106 sys/netinet6/in6_ifattach.c:426
if_detach(ffff8000015ee800) at if_detach+0x30f sys/net/if.c:1314
tun_clone_destroy(ffff8000015ee800) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80003939d730) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d07,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80003939d7f0) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff88072f29a48,7,fffff880097fd820,ffff800045fee2b0) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff8806d1c47c0,ffff800045fee2b0) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff8806d1c47c0,ffff800045fee2b0) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff8806d1c47c0,ffff800045fee2b0) at fdrop+0x121 sys/kern/kern_descrip.c:1281
end trace frame: 0xffff80003939d970, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: kernel diagnostic assertion "!ISSET(rt->rt_flags, RTF_LOCAL)" failed: file "/syzkaller/managers/setuid/kernel/sys/netinet6/nd6.c", line 704
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834b7e06) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834f9ca4,ffffffff8351242e,2c0,ffffffff834fd69b) at __assert+0x29 sys/kern/subr_prf.c:-1
nd6_free(fffff8806b439440,ffff8000015ee800,0) at nd6_free+0x2bd
nd6_purge(ffff8000015ee800) at nd6_purge+0x16b sys/netinet6/nd6.c:521
in6_ifdetach(ffff8000015ee800) at in6_ifdetach+0x106 sys/netinet6/in6_ifattach.c:426
if_detach(ffff8000015ee800) at if_detach+0x30f sys/net/if.c:1314
tun_clone_destroy(ffff8000015ee800) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80003939d730) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d07,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80003939d7f0) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff88072f29a48,7,fffff880097fd820,ffff800045fee2b0) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff8806d1c47c0,ffff800045fee2b0) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff8806d1c47c0,ffff800045fee2b0) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff8806d1c47c0,ffff800045fee2b0) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff8806d1c47c0,ffff800045fee2b0) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045fee2b0) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045fee2b0,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045fee2b0,ffff80003939db60,ffff80003939dab0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003939db60) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003939db60) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x799a4adb9830, count: -20
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff80003939d3e0
rbx 0xffffffff8398ce07 cpu_info_full_primary+0x2e07
rdx 0
rcx 0xffff800045fee2b0
rax 0xffffffff8398bff0 cpu_info_full_primary+0x1ff0
r8 0x101010101010101
r9 0x8080808080808080
r10 0x393d919ff62d181f
r11 0xccf16a0d33600708
r12 0xffffffff8398cc08 cpu_info_full_primary+0x2c08
r13 0
r14 0
r15 0x1
rip 0xffffffff832fc1c5 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80003939d3d0
ss 0
db_enter+0x25: addq $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=515304 pid=14458 tcnt=0 stat=onproc
flags process=18<EXITING,SUGID> proc=2000<WEXIT>
runpri=32, usrpri=64, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1
forw=0xffffffffffffffff, list=0xffff800045fee018,0xffff800045fef780
process=0xffff800032b7d358 user=0xffff800039398000, vmspace=0xfffff8806d1e1208
estcpu=14, cpticks=7, pctcpu=0.2, user=0, sys=1, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
42484 173525 60274 32767 3 0x10 0x80 nanoslp syz-executor
27742 468424 28100 32767 3 0x10 0x80 nanoslp syz-executor
27937 136194 69529 32767 3 0x10 0x80 wait syz-executor
58962 410875 24837 32767 3 0x10 0x80 nanoslp syz-executor
43418 350349 75334 0 3 0x2 0x80 wait syz-executor
73327 438273 75334 0 3 0x2 0x80 wait syz-executor
28100 507674 75334 0 3 0x2 0x80 wait syz-executor
52353 487204 75334 0 3 0x2 0x80 wait syz-executor
8194 440026 75334 0 3 0x2 0x80 wait syz-executor
60274 165386 75334 0 3 0x2 0x80 wait syz-executor
24837 291962 75334 0 3 0x2 0x80 wait syz-executor
69529 80055 75334 0 3 0x2 0x80 wait syz-executor
75334 345305 86254 0 3 0x2 0x80 kqread syz-executor
86254 483378 4379 0 3 0x100002 0x88 sigsusp ksh
4379 85098 66210 0 3 0x10 0x88 kqread sshd-session
66210 196223 45336 0 3 0x12 0x80 kqread sshd-session
64566 81481 1 0 3 0x100003 0x80 ttyin getty
45336 96159 1 0 3 0 0x88 kqread sshd
39383 77873 40995 73 3 0x1100010 0x80 kqread syslogd
40995 390501 1 0 3 0x100002 0x80 sbwait syslogd
87520 268888 1 0 3 0x100000 0x80 kqread resolvd
22070 34619 74773 77 3 0x100012 0x80 kqread dhcpleased
94972 99999 74773 77 3 0x100012 0x80 kqread dhcpleased
74773 480345 1 0 3 0 0x80 kqread dhcpleased
67333 56521 0 0 3 0x14000 0x200 bored smr
87596 84926 0 0 3 0x14000 0x200 pgzero zerothread
19983 116615 0 0 3 0x14000 0x200 aiodoned aiodoned
38648 252196 0 0 3 0x14000 0x200 syncer update
59290 421900 0 0 3 0x14000 0x200 cleaner cleaner
30209 47529 0 0 3 0x14000 0x200 reaper reaper
31487 38091 0 0 3 0x14000 0x200 pgdaemon pagedaemon
21185 266982 0 0 3 0x14000 0x200 bored viomb
36152 424663 0 0 3 0x14000 0x40000200 acpi0 acpi0
79993 519447 0 0 7 0x14000 0x40000200 idle1
29083 186059 0 0 3 0x14000 0x200 bored softnet1
8198 330076 0 0 3 0x14000 0x200 bored softnet0
26593 522011 0 0 3 0x14000 0x200 smrbar systqmp
81571 380250 0 0 3 0x14000 0x200 bored systq
66236 283514 0 0 3 0x14000 0x200 tmoslp softclockmp
89241 201558 0 0 3 0x14000 0x40000200 tmoslp softclock
25813 449580 0 0 3 0x14000 0x40000200 idle0
1 340049 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
Process 26593 (systqmp) thread 0xffff800045ffe000 (522011)
shared rwlock systqmp r = 0 (0xffffffff8396e978)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x12a sys/kern/kern_task.c:442
#2 proc_trampoline+0x10
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11059 12019K 12034K 166960K 12151 0
pcb 17 12K 12K 166960K 17 0
rtable 235 6K 7K 166960K 433 0
pf 31 16K 16K 166960K 31 0
ifaddr 41 7K 7K 166960K 44 0
ifgroup 50 2K 2K 166960K 50 0
sysctl 3 1K 9K 166960K 7 0
counters 70 37K 37K 166960K 70 0
ioctlops 0 0K 4K 166960K 42 0
iov 0 0K 12K 166960K 12 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1287 81K 81K 166960K 1365 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 9K 166960K 9 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 16 0
dirhash 12 2K 2K 166960K 15 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 22 81K 129K 166960K 383 0
sigio 0 0K 0K 166960K 5 0
proc 64 131K 147K 166960K 547 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 63 0
in_multi 88 6K 7K 166960K 114 0
ether_multi 1 0K 0K 166960K 3 0
mrt 1 0K 0K 166960K 6 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 121 546K 546K 166960K 121 0
exec 0 0K 1K 166960K 399 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 222 159K 177K 166960K 5299 0
UVM aobj 13 2K 2K 166960K 15 0
pinsyscall 43 86K 112K 166960K 1503 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 39 0
NDP 11 0K 2K 166960K 27 0
temp 40 9115K 9131K 166960K 4321 0
kqueue 13 20K 35K 166960K 87 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 55 0 51 1 0 1 1 0 8 0
rtentry 176 114 0 5 6 0 6 6 0 8 0
unpcb 144 500 0 485 4 0 4 4 0 8 3
syncache 336 8 0 8 1 0 1 1 0 8 1
tcpcb 736 110 0 106 2 0 2 2 0 8 1
arp 136 18 0 2 1 0 1 1 0 8 0
ipq 40 1 0 0 1 0 1 1 0 8 0
ipqe 40 1 0 0 1 0 1 1 0 8 0
inpcb 328 297 0 289 2 0 2 2 0 8 0
ip6q 72 1 0 1 1 0 1 1 0 8 1
ip6af 40 2 0 2 1 0 1 1 0 8 1
nd6 152 27 0 0 2 0 2 2 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 478 0 0 30 0 30 30 0 8 0
art_table 40 479 0 0 5 0 5 5 0 8 0
art_node 32 114 0 11 1 0 1 1 0 8 0
sysvmsgpl 40 11 0 8 1 0 1 1 0 8 0
semupl 112 2 0 2 1 0 1 1 0 8 1
semapl 72 13 0 3 1 0 1 1 0 8 0
shmpl 112 12 0 2 1 0 1 1 0 8 0
dirhash 1024 19 0 2 3 0 3 3 0 8 0
dino2pl 256 1899 0 429 93 0 93 93 0 8 0
ffsino 296 1901 0 431 114 0 114 114 0 8 0
nchpl 144 2435 0 748 63 0 63 63 0 8 0
vnodes 216 1982 0 0 111 0 111 111 0 8 0
namei 1024 7636 0 7636 2 0 2 2 0 8 2
percpumem 16 51 0 0 1 0 1 1 0 8 0
kstatmem 264 25 0 0 2 0 2 2 0 8 0
scxspl 216 8350 0 8350 11 3 8 8 1 8 8
plimitpl 152 145 0 121 2 0 2 2 0 8 1
sigapl 424 686 0 636 7 0 7 7 0 8 0
knotepl 120 152 0 0 5 0 5 5 0 8 0
kqueuepl 224 129 0 120 3 0 3 3 0 8 2
pipepl 344 181 0 154 6 0 6 6 0 8 3
fdescpl 528 670 0 636 4 0 4 4 0 8 0
filepl 160 3295 0 3078 16 0 16 16 0 8 5
lockfpl 104 67 0 65 1 0 1 1 0 8 0
lockfspl 48 24 0 22 1 0 1 1 0 8 0
sessionpl 144 35 0 18 1 0 1 1 0 8 0
pgrppl 48 45 0 20 1 0 1 1 0 8 0
ucredpl 104 476 0 457 1 0 1 1 0 8 0
zombiepl 144 644 0 636 1 0 1 1 0 8 0
processpl 1232 686 0 636 5 0 5 5 0 8 0
procpl 664 1107 0 1057 7 0 7 7 0 8 0
sockpl 752 855 0 828 11 0 11 11 0 8 7
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 3 0 0 1 0 1 1 0 8 0
mcl4k 4096 116 0 0 15 0 15 15 0 8 0
mcl2k 2048 15 0 0 2 0 2 2 0 8 0
mextrefs 64 14 0 0 1 0 1 1 0 8 0
mtagpl 96 1 0 0 1 0 1 1 0 8 0
mbufpl 256 192 0 0 12 0 12 12 0 8 0
bufpl 272 2585 0 102 166 0 166 166 0 8 0
anonpl 32 5496 0 0 45 0 45 45 0 247 0
amapchunkpl 152 15869 0 15405 32 0 32 32 0 158 7
amappl16 200 1414 0 1396 4 2 2 4 0 8 0
amappl15 192 5 0 5 1 1 0 1 0 8 0
amappl14 184 417 0 416 1 0 1 1 0 8 0
amappl13 176 116 0 106 1 0 1 1 0 8 0
amappl12 168 906 0 873 2 0 2 2 0 8 0
amappl11 160 36 0 36 1 1 0 1 0 8 0
amappl10 152 57 0 47 1 0 1 1 0 8 0
amappl9 144 278 0 277 2 1 1 1 0 8 0
amappl8 136 93 0 91 1 0 1 1 0 8 0
amappl7 128 144 0 133 1 0 1 1 0 8 0
amappl6 120 149 0 148 1 0 1 1 0 8 0
amappl5 112 94 0 86 1 0 1 1 0 8 0
amappl4 104 268 0 252 1 0 1 1 0 8 0
amappl3 96 3058 0 2946 5 1 4 4 0 8 0
amappl2 88 547 0 493 2 0 2 2 0 8 0
amappl1 80 11712 0 11142 16 0 16 16 0 8 2
amappl 88 4549 0 4390 5 0 5 5 0 92 0
uvmvnodes 80 111 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 14 0 2 1 0 1 1 0 8 0
uaddrrnd 24 670 0 636 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 670 0 636 1 0 1 1 0 8 0
vmmpekpl 168 7497 0 7464 2 0 2 2 0 8 0
vmmpepl 168 50848 0 48952 105 0 105 105 0 357 12
vmsppl 488 669 0 636 7 1 6 6 0 8 1
rwobjpl 80 16876 0 15937 25 0 25 25 0 8 4
pdppl 4096 1347 0 1272 113 30 83 99 0 8 8
pvpl 32 13893 0 0 113 0 113 113 0 265 0
pmappl 256 669 0 636 4 1 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 449 0 33 12 0 12 12 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834b7e06) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834f9ca4,ffffffff8351242e,2c0,ffffffff834fd69b) at __assert+0x29 sys/kern/subr_prf.c:-1
nd6_free(fffff8806b439440,ffff8000015ee800,0) at nd6_free+0x2bd
nd6_purge(ffff8000015ee800) at nd6_purge+0x16b sys/netinet6/nd6.c:521
in6_ifdetach(ffff8000015ee800) at in6_ifdetach+0x106 sys/netinet6/in6_ifattach.c:426
if_detach(ffff8000015ee800) at if_detach+0x30f sys/net/if.c:1314
tun_clone_destroy(ffff8000015ee800) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80003939d730) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d07,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80003939d7f0) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff88072f29a48,7,fffff880097fd820,ffff800045fee2b0) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff8806d1c47c0,ffff800045fee2b0) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff8806d1c47c0,ffff800045fee2b0) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff8806d1c47c0,ffff800045fee2b0) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff8806d1c47c0,ffff800045fee2b0) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045fee2b0) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045fee2b0,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045fee2b0,ffff80003939db60,ffff80003939dab0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003939db60) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003939db60) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x799a4adb9830, count: -20
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x27: addq $0x8,%rsp
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff80002999dff0) at sched_idle+0x371 sys/kern/kern_sched.c:192
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff80002999dff0) at sched_idle+0x371 sys/kern/kern_sched.c:192
end trace frame: 0x0, count: -5