syzbot


assert "suser(curproc) == NUM" failed in dt_dev.c

Status: fixed on 2021/12/21 03:12
Reported-by: syzbot+90e094f33d329fb2c3ab@syzkaller.appspotmail.com
Fix commit: cf997a482905 Remove useless suser assert from dt(4). The ioctl(2) path checks the user anyway and close(2) may crash after setuid(2). Reported-by: syzbot+90e094f33d329fb2c3ab@syzkaller.appspotmail.com OK deraadt@
First crash: 1070d, last: 1069d

Sample crash report:
login: panic: kernel diagnostic assertion "suser(curproc) == 0" failed: file "/syzkaller/managers/main/kernel/sys/dev/dt/dt_dev.c", line 431
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff824292db) at panic+0x161 sys/kern/subr_prf.c:202 sys/kern/subr_prf.c:202
__assert(ffffffff8249abe3,ffffffff824b8dae,1af,ffffffff8246aab5) at __assert+0x25 sys/kern/subr_prf.c:161 sys/kern/subr_prf.c:161
dt_ioctl_record_stop(ffff800000b2f300) at dt_ioctl_record_stop+0x165 sys/dev/dt/dt_dev.c:431 sys/dev/dt/dt_dev.c:431
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline] dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline]
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 sys/dev/dt/dt_dev.c:204 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline]
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline] sys/dev/dt/dt_dev.c:204
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 sys/dev/dt/dt_dev.c:204 sys/dev/dt/dt_dev.c:204
spec_close(ffff80002167da60) at spec_close+0x363 sys/kern/spec_vnops.c:572 sys/kern/spec_vnops.c:572
VOP_CLOSE(fffffd806d2e4bd0,1,fffffd807f7d8b40,ffff80002165f7b0) at VOP_CLOSE+0xde sys/kern/vfs_vops.c:156 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:624 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] sys/kern/vfs_vnops.c:624
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:624 sys/kern/vfs_vnops.c:624
fdrop(fffffd806f9b0690,ffff80002165f7b0) at fdrop+0xc7 sys/kern/kern_descrip.c:1279 sys/kern/kern_descrip.c:1279
closef(fffffd806f9b0690,ffff80002165f7b0) at closef+0x117 sys/kern/kern_descrip.c:1263 sys/kern/kern_descrip.c:1263
fdfree(ffff80002165f7b0) at fdfree+0xf3 sys/kern/kern_descrip.c:1195 sys/kern/kern_descrip.c:1195
exit1(ffff80002165f7b0,0,0,1) at exit1+0x35d sys/kern/kern_exit.c:202 sys/kern/kern_exit.c:202
sys_exit(ffff80002165f7b0,ffff80002167dcf0,ffff80002167dd50) at sys_exit+0x16 sys/kern/kern_exit.c:95 sys/kern/kern_exit.c:95
syscall(ffff80002167ddc0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585 sys/arch/amd64/amd64/trap.c:585
end trace frame: 0xffff80002167de40, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: kernel diagnostic assertion "suser(curproc) == 0" failed: file "/syzkaller/managers/main/kernel/sys/dev/dt/dt_dev.c", line 431
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff824292db) at panic+0x161 sys/kern/subr_prf.c:202 sys/kern/subr_prf.c:202
__assert(ffffffff8249abe3,ffffffff824b8dae,1af,ffffffff8246aab5) at __assert+0x25 sys/kern/subr_prf.c:161 sys/kern/subr_prf.c:161
dt_ioctl_record_stop(ffff800000b2f300) at dt_ioctl_record_stop+0x165 sys/dev/dt/dt_dev.c:431 sys/dev/dt/dt_dev.c:431
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline] dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline]
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 sys/dev/dt/dt_dev.c:204 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline]
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline] sys/dev/dt/dt_dev.c:204
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 sys/dev/dt/dt_dev.c:204 sys/dev/dt/dt_dev.c:204
spec_close(ffff80002167da60) at spec_close+0x363 sys/kern/spec_vnops.c:572 sys/kern/spec_vnops.c:572
VOP_CLOSE(fffffd806d2e4bd0,1,fffffd807f7d8b40,ffff80002165f7b0) at VOP_CLOSE+0xde sys/kern/vfs_vops.c:156 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:624 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] sys/kern/vfs_vnops.c:624
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:624 sys/kern/vfs_vnops.c:624
fdrop(fffffd806f9b0690,ffff80002165f7b0) at fdrop+0xc7 sys/kern/kern_descrip.c:1279 sys/kern/kern_descrip.c:1279
closef(fffffd806f9b0690,ffff80002165f7b0) at closef+0x117 sys/kern/kern_descrip.c:1263 sys/kern/kern_descrip.c:1263
fdfree(ffff80002165f7b0) at fdfree+0xf3 sys/kern/kern_descrip.c:1195 sys/kern/kern_descrip.c:1195
exit1(ffff80002165f7b0,0,0,1) at exit1+0x35d sys/kern/kern_exit.c:202 sys/kern/kern_exit.c:202
sys_exit(ffff80002165f7b0,ffff80002167dcf0,ffff80002167dd50) at sys_exit+0x16 sys/kern/kern_exit.c:95 sys/kern/kern_exit.c:95
syscall(ffff80002167ddc0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff5e00, count: -15
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002167d880
rbx                                0
rdx                            0x3fd
rcx                                0
rax                             0x86
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x200f5057a89bfd5b
r11               0x3c53bd8ed4d6d543
r12                                0
r13               0xffff800000b2f300
r14                                0
r15                              0x1
rip               0xffffffff8103e808    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80002167d870
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor2570) pid=386896 stat=onproc
    flags process=1a<EXEC,EXITING,SUGID> proc=2000<WEXIT>
    pri=17, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff80002165e010,0xffffffff828bf260
    process=0xffff800021641b68 user=0xffff800021678000, vmspace=0xfffffd807f018440
    estcpu=0, cpticks=2, pctcpu=0.0
    user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 66453  478579  27393      0  3    0x10008a  sigsusp       ksh
 27393   78882  59754      0  3        0x9a  poll          sshd
 41640   91748      1      0  3    0x100083  ttyin         getty
 59754  163893      1      0  3        0x88  poll          sshd
 18670    3786  91641     73  3    0x100090  kqread        syslogd
 91641   39602      1      0  3    0x100082  netio         syslogd
 56594  144647      1      0  3    0x100080  kqread        resolvd
 42690  252612  82229     77  3    0x100092  kqread        dhcpleased
 61486    2371  82229     77  3    0x100092  kqread        dhcpleased
 82229  424365      1      0  3        0x80  kqread        dhcpleased
  7835  202407      0      0  3     0x14200  bored         smr
 37462  304189      0      0  3     0x14200  pgzero        zerothread
 18110  321069      0      0  3     0x14200  aiodoned      aiodoned
 56990  313875      0      0  3     0x14200  syncer        update
 17164   96094      0      0  3     0x14200  cleaner       cleaner
 60282  260613      0      0  3     0x14200  reaper        reaper
 61124  457483      0      0  3     0x14200  pgdaemon      pagedaemon
 29391  513652      0      0  3     0x14200  bored         viomb
 14153  193038      0      0  3  0x40014200  acpi0         acpi0
 68093   81652      0      0  3     0x14200  bored         softnet
 77816  126918      0      0  3     0x14200  bored         systqmp
 49320   45478      0      0  3     0x14200  bored         systq
 11986   44948      0      0  3  0x40014200  bored         softclock
 35603  473638      0      0  3  0x40014200                idle0
     1  154136      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10101   6390K    6409K  78643K     11191        0
            pcb    13      8K       8K  78643K        13        0
         rtable    62      2K       2K  78643K       112        0
         ifaddr    24      7K       7K  78643K        24        0
       counters    19     16K      16K  78643K        19        0
       ioctlops     0      0K       2K  78643K        25        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1181     74K      74K  78643K      1186        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      0K       0K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12598        0
      file desc     1      0K       0K  78643K         1        0
           proc    56     54K      55K  78643K       227        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    11      0K       0K  78643K        11        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    25    122K     122K  78643K        25        0
           exec     0      0K       2K  78643K       321        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    73      3K       4K  78643K      1479        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     3      0K       0K  78643K         3        0
           temp    19   4178K    4241K  78643K      2847        0
         kqueue     9     12K      12K  78643K         9        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       19    0       16     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      128       33    0       20     1     0     1     1     0     8    0
syncache   296        5    0        5     1     0     1     1     0     8    1
tcpcb      736        8    0        5     1     0     1     1     0     8    0
arp         88        2    0        0     1     0     1     1     0     8    0
inpcb      304       25    0       19     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       96    0        0     6     0     6     6     0     8    0
art_table   32       97    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1402    0       23    87     0    87    87     0     8    0
ffsino     240     1402    0       23    82     0    82    82     0     8    0
nchpl      144     1575    0       38    57     0    57    57     0     8    0
uvmvnodes   80     1412    0        0    29     0    29    29     0     8    0
vnodes     224     1412    0        0    84     0    84    84     0     8    0
namei      1024    3893    0     3893     1     0     1     1     0     8    1
scxspl     216     3329    0     3329     2     1     1     2     0     8    1
plimitpl   152       15    0        9     1     0     1     1     0     8    0
sigapl     424      232    0      206     4     0     4     4     0     8    0
knotepl    112      125    0      102     1     0     1     1     0     8    0
kqueuepl   184        5    0        0     1     0     1     1     0     8    0
pipepl     304       64    0       61     1     0     1     1     0     8    0
fdescpl    432      219    0      206     2     0     2     2     0     8    0
filepl     120      962    0      908     2     0     2     2     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       17    0        9     1     0     1     1     0     8    0
pgrppl      48       17    0        9     1     0     1     1     0     8    0
ucredpl     96       65    0       54     1     0     1     1     0     8    0
zombiepl   144      207    0      206     1     0     1     1     0     8    0
processpl  1000     232    0      206     4     0     4     4     0     8    0
procpl     672      232    0      206     3     0     3     3     0     8    0
sockpl     448       77    0       55     3     0     3     3     0     8    0
mcl8k      8192       9    0        9     1     0     1     1     0     8    1
mcl4k      4096       5    0        5     1     0     1     1     0     8    1
mcl2k      2048    5610    0     5581     6     0     6     6     0     8    2
mtagpl      96        4    0        4     1     1     0     1     0     8    0
mbufpl     256    10227    0    10159     6     0     6     6     0     8    1
bufpl      288     1894    0       83   130     0   130   130     0     8    0
anonpl      24    32667    0    30613    15     1    14    15     0   188    1
amapchunkpl 152    2786    0     2659     7     1     6     7     0   158    0
amappl16   200       26    0       25     2     1     1     1     0     8    0
amappl15   192       60    0       56     1     0     1     1     0     8    0
amappl13   176       17    0       16     1     0     1     1     0     8    0
amappl12   168       27    0       24     1     0     1     1     0     8    0
amappl11   160       44    0       34     1     0     1     1     0     8    0
amappl10   152        7    0        7     1     1     0     1     0     8    0
amappl9    144      439    0      437     1     0     1     1     0     8    0
amappl8    136      247    0      247     1     0     1     1     0     8    1
amappl7    128       45    0       42     1     0     1     1     0     8    0
amappl6    120       93    0       83     1     0     1     1     0     8    0
amappl5    112      174    0      163     1     0     1     1     0     8    0
amappl4    104      482    0      462     1     0     1     1     0     8    0
amappl3     96      133    0      117     1     0     1     1     0     8    0
amappl2     88      297    0      266     1     0     1     1     0     8    0
amappl1     80     7339    0     6987     9     0     9     9     0     8    1
amappl      88     1254    0     1197     2     0     2     2     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      219    0      206     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      219    0      206     1     0     1     1     0     8    0
vmmpekpl   168     5687    0     5673     1     0     1     1     0     8    0
vmmpepl    168    21825    0    21060    38     0    38    38     0   357    3
vmsppl     272      218    0      206     2     1     1     2     0     8    0
rwobjpl     24     8452    0     6530    12     0    12    12     0     8    0
pdppl      4096     444    0      412    50    18    32    38     0     8    0
pvpl        32   104651    0   100882    34     0    34    34     0   265    2
pmappl     216      218    0      206     1     0     1     1     0     8    0
extentpl    40       57    0       38     1     0     1     1     0     8    0
phpool     112      383    0       21    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff824292db) at panic+0x161 sys/kern/subr_prf.c:202 sys/kern/subr_prf.c:202
__assert(ffffffff8249abe3,ffffffff824b8dae,1af,ffffffff8246aab5) at __assert+0x25 sys/kern/subr_prf.c:161 sys/kern/subr_prf.c:161
dt_ioctl_record_stop(ffff800000b2f300) at dt_ioctl_record_stop+0x165 sys/dev/dt/dt_dev.c:431 sys/dev/dt/dt_dev.c:431
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline] dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline]
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 sys/dev/dt/dt_dev.c:204 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline]
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline] sys/dev/dt/dt_dev.c:204
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 sys/dev/dt/dt_dev.c:204 sys/dev/dt/dt_dev.c:204
spec_close(ffff80002167da60) at spec_close+0x363 sys/kern/spec_vnops.c:572 sys/kern/spec_vnops.c:572
VOP_CLOSE(fffffd806d2e4bd0,1,fffffd807f7d8b40,ffff80002165f7b0) at VOP_CLOSE+0xde sys/kern/vfs_vops.c:156 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:624 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] sys/kern/vfs_vnops.c:624
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:624 sys/kern/vfs_vnops.c:624
fdrop(fffffd806f9b0690,ffff80002165f7b0) at fdrop+0xc7 sys/kern/kern_descrip.c:1279 sys/kern/kern_descrip.c:1279
closef(fffffd806f9b0690,ffff80002165f7b0) at closef+0x117 sys/kern/kern_descrip.c:1263 sys/kern/kern_descrip.c:1263
fdfree(ffff80002165f7b0) at fdfree+0xf3 sys/kern/kern_descrip.c:1195 sys/kern/kern_descrip.c:1195
exit1(ffff80002165f7b0,0,0,1) at exit1+0x35d sys/kern/kern_exit.c:202 sys/kern/kern_exit.c:202
sys_exit(ffff80002165f7b0,ffff80002167dcf0,ffff80002167dd50) at sys_exit+0x16 sys/kern/kern_exit.c:95 sys/kern/kern_exit.c:95
syscall(ffff80002167ddc0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff5e00, count: -15
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff824292db) at panic+0x161 sys/kern/subr_prf.c:202 sys/kern/subr_prf.c:202
__assert(ffffffff8249abe3,ffffffff824b8dae,1af,ffffffff8246aab5) at __assert+0x25 sys/kern/subr_prf.c:161 sys/kern/subr_prf.c:161
dt_ioctl_record_stop(ffff800000b2f300) at dt_ioctl_record_stop+0x165 sys/dev/dt/dt_dev.c:431 sys/dev/dt/dt_dev.c:431
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline] dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline]
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 sys/dev/dt/dt_dev.c:204 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline]
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 dt_pcb_purge sys/dev/dt/dt_dev.c:582 [inline] sys/dev/dt/dt_dev.c:204
dtclose(11e6e,1,2000,ffff80002165f7b0) at dtclose+0xc2 sys/dev/dt/dt_dev.c:204 sys/dev/dt/dt_dev.c:204
spec_close(ffff80002167da60) at spec_close+0x363 sys/kern/spec_vnops.c:572 sys/kern/spec_vnops.c:572
VOP_CLOSE(fffffd806d2e4bd0,1,fffffd807f7d8b40,ffff80002165f7b0) at VOP_CLOSE+0xde sys/kern/vfs_vops.c:156 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:624 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] sys/kern/vfs_vnops.c:624
vn_closefile(fffffd806f9b0690,ffff80002165f7b0) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:624 sys/kern/vfs_vnops.c:624
fdrop(fffffd806f9b0690,ffff80002165f7b0) at fdrop+0xc7 sys/kern/kern_descrip.c:1279 sys/kern/kern_descrip.c:1279
closef(fffffd806f9b0690,ffff80002165f7b0) at closef+0x117 sys/kern/kern_descrip.c:1263 sys/kern/kern_descrip.c:1263
fdfree(ffff80002165f7b0) at fdfree+0xf3 sys/kern/kern_descrip.c:1195 sys/kern/kern_descrip.c:1195
exit1(ffff80002165f7b0,0,0,1) at exit1+0x35d sys/kern/kern_exit.c:202 sys/kern/kern_exit.c:202
sys_exit(ffff80002165f7b0,ffff80002167dcf0,ffff80002167dd50) at sys_exit+0x16 sys/kern/kern_exit.c:95 sys/kern/kern_exit.c:95
syscall(ffff80002167ddc0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7fffff5e00, count: -15
ddb> 

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/20 15:48 openbsd 5387241f8527 62bd192b .config console log report syz C ci-openbsd-main assert "suser(curproc) == NUM" failed in dt_dev.c
2021/12/20 15:38 openbsd 5387241f8527 62bd192b .config console log report syz C ci-openbsd-multicore assert "suser(curproc) == NUM" failed in dt_dev.c
2021/12/20 23:57 openbsd 5387241f8527 62bd192b .config console log report ci-openbsd-main assert "suser(curproc) == NUM" failed in dt_dev.c
2021/12/20 21:27 openbsd 5387241f8527 62bd192b .config console log report ci-openbsd-main assert "suser(curproc) == NUM" failed in dt_dev.c
2021/12/20 20:42 openbsd 5387241f8527 62bd192b .config console log report ci-openbsd-multicore assert "suser(curproc) == NUM" failed in dt_dev.c
2021/12/20 15:36 openbsd 5387241f8527 62bd192b .config console log report ci-openbsd-main assert "suser(curproc) == NUM" failed in dt_dev.c
2021/12/20 15:20 openbsd 5387241f8527 62bd192b .config console log report ci-openbsd-multicore assert "suser(curproc) == NUM" failed in dt_dev.c
* Struck through repros no longer work on HEAD.