syzbot


panic: ffs_blkfree: freeing free frag

Status: upstream: reported on 2024/09/25 07:53
Reported-by: syzbot+8c1a9ad3a38157ba876e@syzkaller.appspotmail.com
First crash: 3d16h, last: 3d16h

Sample crash report:
panic: ffs_blkfree: freeing free frag
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*161095  34647      0         0x2          0    1K syz-executor
 379162  96142      0         0x2          0    0  syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8309eb83) at panic+0x1e5 sys/kern/subr_prf.c:198
ffs_blkfree(fffffd8076bc0780,505e3,800) at ffs_blkfree+0xcc9 sys/ufs/ffs/ffs_alloc.c:1259
ffs_truncate(fffffd8076bc0780,0,4,fffffd807f7d3068) at ffs_truncate+0x139f sys/ufs/ffs/ffs_inode.c:325
ufs_rmdir(ffff80002a13e3b8) at ufs_rmdir+0x374 sys/ufs/ufs/ufs_vnops.c:1265
VOP_RMDIR(fffffd806bc4e980,fffffd8078e47030,ffff80002a13e498) at VOP_RMDIR+0x19a sys/kern/vfs_vops.c:413
dounlinkat(ffff80002a038020,ffffff9c,7190809396b0,8) at dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1885
syscall(ffff80002a13e610) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a13e610) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7190809396a0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: ffs_blkfree: freeing free frag
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8309eb83) at panic+0x1e5 sys/kern/subr_prf.c:198
ffs_blkfree(fffffd8076bc0780,505e3,800) at ffs_blkfree+0xcc9 sys/ufs/ffs/ffs_alloc.c:1259
ffs_truncate(fffffd8076bc0780,0,4,fffffd807f7d3068) at ffs_truncate+0x139f sys/ufs/ffs/ffs_inode.c:325
ufs_rmdir(ffff80002a13e3b8) at ufs_rmdir+0x374 sys/ufs/ufs/ufs_vnops.c:1265
VOP_RMDIR(fffffd806bc4e980,fffffd8078e47030,ffff80002a13e498) at VOP_RMDIR+0x19a sys/kern/vfs_vops.c:413
dounlinkat(ffff80002a038020,ffffff9c,7190809396b0,8) at dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1885
syscall(ffff80002a13e610) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a13e610) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7190809396a0, count: -9
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a13dfb0
rbx               0xffff800029b7cd87
rdx                                0
rcx               0xffff80002a038020
rax               0xffff800029b7bff0
r8                 0x101010101010101
r9                0x8080808080808080
r10                0x7faafe67fd58f10
r11                 0x324223e87932e4
r12               0xffff800029b7cb88
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff826b1a55    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a13dfa0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=161095 pid=34647 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=0
    runpri=17, usrpri=79, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a038530,0xffff80002a0382b8
    process=0xffff800034992460 user=0xffff80002a139000, vmspace=0xfffffd806bc1e370
    estcpu=36, cpticks=0, pctcpu=0.1, user=1, sys=3, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 27214   94895  93938      0  3        0x80  nanoslp       syz-executor
 27214  186252  93938      0  3   0x4000080  kqpoll        syz-executor
 27214  451532  93938      0  3   0x4000080  fsleep        syz-executor
 27214  494565  93938      0  3   0x4000080  fsleep        syz-executor
 93756  262628  14872      0  3        0x82  netio         sshd-session
*34647  161095   1375      0  7         0x2                syz-executor
 93938  216477   1375      0  3        0x82  nanoslp       syz-executor
 30373   88262   1375      0  2         0x2                syz-executor
 80395    7138   1375      0  3        0x82  wait          syz-executor
 55236  494657   1375      0  3        0x82  nanoslp       syz-executor
 96142  379162   1375      0  7         0x2                syz-executor
  1375  323330  14155      0  3        0x82  wait          syz-executor
 14155   59695  37920      0  3    0x10008a  sigsusp       ksh
 37920  244247  77915      0  3        0x98  kqread        sshd-session
 77915  208445  14872      0  3        0x92  kqread        sshd-session
 90965  394373      1      0  3    0x100083  ttyin         getty
 14872  476811      1      0  3        0x88  kqread        sshd
 25347  513120  52385     74  3   0x1100092  bpf           pflogd
 52385  220622      1      0  3        0x80  sbwait        pflogd
 25840  252738  71287     73  3   0x1100090  kqread        syslogd
 71287  365658      1      0  3    0x100082  sbwait        syslogd
 38832   83534      1      0  3    0x100080  kqread        resolvd
 74636   75330  95748     77  3    0x100092  kqread        dhcpleased
 39649    1459  95748     77  3    0x100092  kqread        dhcpleased
 95748   71415      1      0  3        0x80  kqread        dhcpleased
 36107   91533      0      0  3     0x14200  bored         smr
 54348  457151      0      0  3     0x14200  pgzero        zerothread
 51275  182954      0      0  3     0x14200  aiodoned      aiodoned
 63626  125469      0      0  3     0x14200  syncer        update
 78895  461130      0      0  3     0x14200  cleaner       cleaner
 92234  242328      0      0  3     0x14200  reaper        reaper
 19202  263281      0      0  3     0x14200  pgdaemon      pagedaemon
 77113   65413      0      0  3     0x14200  bored         viomb
 73405  356272      0      0  3  0x40014200  acpi0         acpi0
 70761  251972      0      0  3  0x40014200                idle1
 71116  360670      0      0  3     0x14200  bored         softnet3
 43631  159268      0      0  3     0x14200  bored         softnet2
   201  380960      0      0  3     0x14200  bored         softnet1
  4447  400968      0      0  3     0x14200  bored         softnet0
 51434  386111      0      0  3     0x14200  bored         systqmp
 36358  231132      0      0  3     0x14200  bored         systq
 63405  129079      0      0  3     0x14200  tmoslp        softclockmp
 11498  343541      0      0  3  0x40014200  tmoslp        softclock
 35044   77170      0      0  3  0x40014200                idle0
     1  288969      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 34647 (syz-executor) thread 0xffff80002a038020 (161095)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff835a3c08)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  __mp_acquire_count+0x58
#2  mi_switch+0x658 sys/kern/sched_bsd.c:460
#3  sleep_finish+0x219 sys/kern/kern_synch.c:416
#4  biowait+0xc1 sys/kern/vfs_bio.c:1254
#5  ffs_blkfree+0x16e ffs_cgread sys/ufs/ffs/ffs_alloc.c:850 [inline]
#5  ffs_blkfree+0x16e sys/ufs/ffs/ffs_alloc.c:1272
#6  ffs_truncate+0x139f sys/ufs/ffs/ffs_inode.c:325
#7  ufs_rmdir+0x374 sys/ufs/ufs/ufs_vnops.c:1265
#8  VOP_RMDIR+0x19a sys/kern/vfs_vops.c:413
#9  dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1885
#10 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#10 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8076bc0818)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  ufs_ihashget+0x192 sys/ufs/ufs/ufs_ihash.c:98
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1201
#8  ufs_lookup+0x19f8 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#11 namei+0x7aa sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#13 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#13 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8076bc05f8)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#8  syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#8  syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#9  Xsyscall+0x128
Process 30373 (syz-executor) thread 0xffff80002a038a40 (88262)
exclusive rrwlock inode r = 0 (0xfffffd8076bc0e78)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  ufs_ihashget+0x192 sys/ufs/ufs/ufs_ihash.c:98
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1201
#8  ufs_lookup+0x19f8 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#11 namei+0x7aa sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#13 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#13 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806058ee70)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#8  syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#8  syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#9  Xsyscall+0x128
Process 96142 (syz-executor) thread 0xffff8000ffffdbe8 (379162)
exclusive rrwlock inode r = 0 (0xfffffd8076bc0c58)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  ufs_ihashget+0x192 sys/ufs/ufs/ufs_ihash.c:98
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1201
#8  ufs_lookup+0x19f8 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#11 namei+0x7aa sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#13 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#13 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8076bc02c8)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  cache_lookup+0x36e sys/kern/vfs_cache.c:222
#7  ufs_lookup+0x218 sys/ufs/ufs/ufs_lookup.c:160
#8  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#9  vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#10 namei+0x7aa sys/kern/vfs_lookup.c:250
#11 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#12 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#12 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#13 Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10192  14186K   14584K 166960K     11414        0
            pcb    17     12K      12K 166960K        33        0
         rtable   234      6K       6K 166960K       572        0
             pf    35     17K      18K 166960K        67        0
         ifaddr    43      7K       7K 166960K        78        0
        ifgroup    55      2K       2K 166960K        89        0
       counters    64     36K      36K 166960K        82        0
       ioctlops     0      0K       4K 166960K      1504        0
            iov     0      0K      16K 166960K         5        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1370     86K      86K 166960K      1555        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         4        0
         VM map     2      1K       1K 166960K         2        0
            sem     6      0K       0K 166960K         6        0
        dirhash    12      2K       2K 166960K        15        0
           ACPI  1690    195K     286K 166960K     12418        0
      file desc    13     45K      97K 166960K       345        0
          sigio     0      0K       0K 166960K         3        0
           proc    72     91K     128K 166960K       737        0
        subproc   104      6K       6K 166960K       195        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         9        0
       in_multi    99      7K       7K 166960K       180        0
    ether_multi     1      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    61    281K     281K 166960K        61        0
           exec     0      0K       1K 166960K       464        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   214     76K      78K 166960K      4134        0
       UVM aobj     8      2K       2K 166960K         9        0
     pinsyscall    40     80K     104K 166960K      1601        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         6        0
            NDP    12      0K       2K 166960K        52        0
           temp    37   6811K    6877K 166960K      5512        0
         kqueue    14     22K      24K 166960K        41        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120       55    0       51     1     0     1     1     0     8    0
rtentry    112      192    0       82     4     0     4     4     0     8    0
unpcb      144       98    0       73     1     0     1     1     0     8    0
syncache   336        4    0        4     2     1     1     1     0     8    1
tcpcb      808       46    0       38     2     0     2     2     0     8    1
arp        120       33    0       15     1     0     1     1     0     8    0
inpcb      336      216    0      204     5     3     2     4     0     8    0
nd6        136       45    0       21     1     0     1     1     0     8    0
kcovpl      48       15    0        7     1     0     1     1     0     8    0
ppxss      1168       1    0        1     1     1     0     1     0     8    0
pfstscr     40        2    0        2     1     0     1     1     0     8    1
pffrag     232        1    0        1     1     0     1     1     0   482    1
pffrnode    88        1    0        1     1     0     1     1     0     8    1
pffrent     40        2    0        2     1     0     1     1     0     8    1
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       28    0        4     1     0     1     1     0     8    0
pfstkey    128       30    0        6     1     0     1     1     0     8    0
pfstate    376       29    0        5     3     0     3     3     0     8    0
pfrule     1344      22    0       16     2     0     2     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      796    0      339    31     0    31    31     0     8    1
art_table   32      797    0      339     4     0     4     4     0     8    0
art_node    16      191    0       91     1     0     1     1     0     8    0
sysvmsgpl   40        4    0        3     1     0     1     1     0     8    0
semapl     112        4    0        0     1     0     1     1     0     8    0
shmpl      112        6    0        1     1     0     1     1     0     8    0
dirhash    1024      19    0        2     3     0     3     3     0     8    0
dino2pl    256     1741    0      223    96     0    96    96     0     8    0
ffsino     272     1741    0      223   102     0   102   102     0     8    0
nchpl      144     2074    0      382    63     0    63    63     0     8    0
uvmvnodes   80     2000    0        0    41     0    41    41     0     8    0
vnodes     216     2000    0        0   112     0   112   112     0     8    0
namei      1024    7141    0     7141     2     1     1     2     0     8    1
percpumem   16       55    0        9     1     0     1     1     0     8    0
kstatmem   264       42    0       18     2     0     2     2     0     8    0
scxspl     216     8585    0     8585     4     3     1     2     1     8    1
plimitpl   152       50    0       33     1     0     1     1     0     8    0
sigapl     424      630    0      584     8     1     7     7     0     8    1
futexpl     64     1788    0     1786     2     1     1     1     0     8    0
knotepl    120      321    0        0    10     0    10    10     0     8    0
kqueuepl   216       46    0       36     1     0     1     1     0     8    0
pipepl     320      147    0      119     3     0     3     3     0     8    0
fdescpl    496      612    0      584     6     1     5     6     0     8    0
filepl     152     2296    0     2035    12     1    11    11     0     8    0
lockfpl    104       28    0       26     1     0     1     1     0     8    0
lockfspl    48       15    0       13     1     0     1     1     0     8    0
sessionpl  144       30    0       20     1     0     1     1     0     8    0
pgrppl      48       46    0       28     1     0     1     1     0     8    0
ucredpl    104      198    0      184     1     0     1     1     0     8    0
zombiepl   144      588    0      584     1     0     1     1     0     8    0
processpl  1160     630    0      584     5     1     4     5     0     8    0
procpl     648      808    0      759     8     2     6     6     0     8    0
srpgc       96        1    0        1     1     1     0     1     0     8    0
sockpl     664      370    0      329     7     3     4     6     0     8    0
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096       3    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     155    0        0    20     0    20    20     0     8    0
mtagpl      96        8    0        0     1     0     1     1     0     8    0
mbufpl     256      221    0        0    15     1    14    14     0     8    0
bufpl      280     4891    0       97   343     0   343   343     0     8    0
anonpl      24    61288    0    57890    51     1    50    50     0   185   27
amapchunkpl 152   11365    0    10959    30     1    29    29     0   158    8
amappl16   200      169    0      154     2     0     2     2     0     8    0
amappl15   192        1    0        1     1     1     0     1     0     8    0
amappl14   184      121    0      108     1     0     1     1     0     8    0
amappl12   168     1397    0     1368     4     1     3     3     0     8    1
amappl11   160       46    0       32     1     0     1     1     0     8    0
amappl10   152        4    0        2     1     0     1     1     0     8    0
amappl9    144       17    0       17     1     1     0     1     0     8    0
amappl8    136       14    0       12     1     0     1     1     0     8    0
amappl7    128      112    0       99     1     0     1     1     0     8    0
amappl6    120      225    0      224     1     0     1     1     0     8    0
amappl5    112      153    0      141     1     0     1     1     0     8    0
amappl4    104      325    0      305     1     0     1     1     0     8    0
amappl3     96     3065    0     2974     4     0     4     4     0     8    1
amappl2     88      774    0      699     2     0     2     2     0     8    0
amappl1     80     8794    0     8157    14     0    14    14     0     8    0
amappl      88     3704    0     3558     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma512     512        1    0        1     1     0     1     1     0     8    1
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        8    0        1     1     0     1     1     0     8    0
uaddrrnd    24      612    0      584     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      612    0      584     1     0     1     1     0     8    0
vmmpekpl   168     6564    0     6505     3     0     3     3     0     8    0
vmmpepl    168    42435    0    40657    92     2    90    90     0   357    2
vmsppl     440      611    0      584     6     1     5     5     0     8    1
rwobjpl     56    15527    0    12531    43     0    43    43     0     8    0
pdppl      4096    1231    0     1168   111    38    73    87     0     8   10
pvpl        32    26686    0        0   216     0   216   216     0   265    0
pmappl     248      611    0      584     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      398    0       47    11     0    11    11     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83472ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2c kd_curproc sys/dev/kcov.c:589 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2c sys/dev/kcov.c:158
__mp_lock(ffffffff835a3a00) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835a3a00) at __mp_lock+0x1a3 sys/kern/kern_lock.c:144
__mp_acquire_count(ffffffff835a3a00,1) at __mp_acquire_count+0x58
mi_switch() at mi_switch+0x658 sys/kern/sched_bsd.c:460
sleep_finish(0,1) at sleep_finish+0x219 sys/kern/kern_synch.c:416
getblk(fffffd807e82a510,12fcc0,4000,0,ffffffffffffffff) at getblk+0x197 sys/kern/vfs_bio.c:1025
bread(fffffd807e82a510,12fcc0,4000,ffff80002a0bc678) at bread+0x47 bio_doread sys/kern/vfs_bio.c:430 [inline]
bread(fffffd807e82a510,12fcc0,4000,ffff80002a0bc678) at bread+0x47 sys/kern/vfs_bio.c:475
ffs_freefile(fffffd8076bc0bc0,135a6,2000) at ffs_freefile+0xbe ffs_cgread sys/ufs/ffs/ffs_alloc.c:850 [inline]
ffs_freefile(fffffd8076bc0bc0,135a6,2000) at ffs_freefile+0xbe sys/ufs/ffs/ffs_alloc.c:1377
ffs_inode_free(fffffd8076bc0bc0,135a6,2000) at ffs_inode_free+0x44 sys/ufs/ffs/ffs_alloc.c:1355
ufs_inactive(ffff80002a0bc7d8) at ufs_inactive+0x29d sys/ufs/ufs/ufs_inode.c:94
VOP_INACTIVE(fffffd806ba15e90,ffff8000ffffdbe8) at VOP_INACTIVE+0x107 sys/kern/vfs_vops.c:495
end trace frame: 0xffff80002a0bc860, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff83472ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2c kd_curproc sys/dev/kcov.c:589 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2c sys/dev/kcov.c:158
__mp_lock(ffffffff835a3a00) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835a3a00) at __mp_lock+0x1a3 sys/kern/kern_lock.c:144
__mp_acquire_count(ffffffff835a3a00,1) at __mp_acquire_count+0x58
mi_switch() at mi_switch+0x658 sys/kern/sched_bsd.c:460
sleep_finish(0,1) at sleep_finish+0x219 sys/kern/kern_synch.c:416
getblk(fffffd807e82a510,12fcc0,4000,0,ffffffffffffffff) at getblk+0x197 sys/kern/vfs_bio.c:1025
bread(fffffd807e82a510,12fcc0,4000,ffff80002a0bc678) at bread+0x47 bio_doread sys/kern/vfs_bio.c:430 [inline]
bread(fffffd807e82a510,12fcc0,4000,ffff80002a0bc678) at bread+0x47 sys/kern/vfs_bio.c:475
ffs_freefile(fffffd8076bc0bc0,135a6,2000) at ffs_freefile+0xbe ffs_cgread sys/ufs/ffs/ffs_alloc.c:850 [inline]
ffs_freefile(fffffd8076bc0bc0,135a6,2000) at ffs_freefile+0xbe sys/ufs/ffs/ffs_alloc.c:1377
ffs_inode_free(fffffd8076bc0bc0,135a6,2000) at ffs_inode_free+0x44 sys/ufs/ffs/ffs_alloc.c:1355
ufs_inactive(ffff80002a0bc7d8) at ufs_inactive+0x29d sys/ufs/ufs/ufs_inode.c:94
VOP_INACTIVE(fffffd806ba15e90,ffff8000ffffdbe8) at VOP_INACTIVE+0x107 sys/kern/vfs_vops.c:495
vput(fffffd806ba15e90) at vput+0xe5 sys/kern/vfs_subr.c:779
VOP_REMOVE(fffffd8078e47a50,fffffd806ba15e90,ffff80002a0bc958) at VOP_REMOVE+0x19d sys/kern/vfs_vops.c:336
dounlinkat(ffff8000ffffdbe8,ffffff9c,7b8b901f3a30,0) at dounlinkat+0x177 sys/kern/vfs_syscalls.c:1888
syscall(ffff80002a0bcad0) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a0bcad0) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b8b901f3ee0, count: -19
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8309eb83) at panic+0x1e5 sys/kern/subr_prf.c:198
ffs_blkfree(fffffd8076bc0780,505e3,800) at ffs_blkfree+0xcc9 sys/ufs/ffs/ffs_alloc.c:1259
ffs_truncate(fffffd8076bc0780,0,4,fffffd807f7d3068) at ffs_truncate+0x139f sys/ufs/ffs/ffs_inode.c:325
ufs_rmdir(ffff80002a13e3b8) at ufs_rmdir+0x374 sys/ufs/ufs/ufs_vnops.c:1265
VOP_RMDIR(fffffd806bc4e980,fffffd8078e47030,ffff80002a13e498) at VOP_RMDIR+0x19a sys/kern/vfs_vops.c:413
dounlinkat(ffff80002a038020,ffffff9c,7190809396b0,8) at dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1885
syscall(ffff80002a13e610) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a13e610) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7190809396a0, count: 6
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff8309eb83) at panic+0x1e5 sys/kern/subr_prf.c:198
ffs_blkfree(fffffd8076bc0780,505e3,800) at ffs_blkfree+0xcc9 sys/ufs/ffs/ffs_alloc.c:1259
ffs_truncate(fffffd8076bc0780,0,4,fffffd807f7d3068) at ffs_truncate+0x139f sys/ufs/ffs/ffs_inode.c:325
ufs_rmdir(ffff80002a13e3b8) at ufs_rmdir+0x374 sys/ufs/ufs/ufs_vnops.c:1265
VOP_RMDIR(fffffd806bc4e980,fffffd8078e47030,ffff80002a13e498) at VOP_RMDIR+0x19a sys/kern/vfs_vops.c:413
dounlinkat(ffff80002a038020,ffffff9c,7190809396b0,8) at dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1885
syscall(ffff80002a13e610) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a13e610) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7190809396a0, count: -9

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/25 07:52 openbsd 208893442c38 349a68c4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: ffs_blkfree: freeing free frag
* Struck through repros no longer work on HEAD.