syzbot


panic: vref used where vget required (4)

Status: upstream: reported on 2024/04/10 17:23
Reported-by: syzbot+9591948825036c029128@syzkaller.appspotmail.com
First crash: 20d, last: 10d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: vref used where vget required 1 1702d 1702d 0/3 auto-closed as invalid on 2019/12/01 17:58
openbsd panic: vref used where vget required (2) 2 1452d 1455d 0/3 auto-closed as invalid on 2020/08/08 03:01
openbsd panic: vref used where vget required (3) 1 855d 855d 0/3 auto-closed as invalid on 2022/03/27 19:54

Sample crash report:
panic: vref used where vget required
Stopped at      db_enter+0x1c:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 67426  66213      0   0x8000002          0    0  syz-executor.7
 117445  79029      0  0x1a000002  0x4000000    1  syz-fuzzer
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff828d2a8c) at panic+0x17b sys/kern/subr_prf.c:198
vref(fffffd8066417640) at vref+0xc7 sys/kern/vfs_subr.c:698
namei(ffff800031150c68) at namei+0x3b2 sys/kern/vfs_lookup.c:221
vn_open(ffff800031150c68,30001,0) at vn_open+0x101 sys/kern/vfs_vnops.c:140
doopenat(ffff80002a20e540,ffffff9c,73544240d850,30000,0,ffff800031150e10) at doopenat+0x269 sys/kern/vfs_syscalls.c:1126
syscall(ffff800031150ec0) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff800031150ec0) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73544240d350, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: vref used where vget required
ddb{0}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff828d2a8c) at panic+0x17b sys/kern/subr_prf.c:198
vref(fffffd8066417640) at vref+0xc7 sys/kern/vfs_subr.c:698
namei(ffff800031150c68) at namei+0x3b2 sys/kern/vfs_lookup.c:221
vn_open(ffff800031150c68,30001,0) at vn_open+0x101 sys/kern/vfs_vnops.c:140
doopenat(ffff80002a20e540,ffffff9c,73544240d850,30000,0,ffff800031150e10) at doopenat+0x269 sys/kern/vfs_syscalls.c:1126
syscall(ffff800031150ec0) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff800031150ec0) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73544240d350, count: -8
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800031150900
rbx               0xffffffff82c9bcdf    cpu_info_full_primary+0x2cdf
rdx                                0
rcx               0xffff80002a20e540
rax               0xffffffff82c9aff0    cpu_info_full_primary+0x1ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10                0xd17ebd474ac2dfa
r11               0x3ea4dfabad6dbb99
r12               0xffffffff82c9bae0    cpu_info_full_primary+0x2ae0
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff815a061c    db_enter+0x1c
cs                               0x8
rflags                         0x246
rsp               0xffff8000311508f0
ss                              0x10
db_enter+0x1c:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor.7) tid=67426 pid=66213 tcnt=1 stat=onproc
    flags process=8000002<EXEC> proc=0
    runpri=32, usrpri=83, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0
    forw=0xffffffffffffffff, list=0xffff8000ffffcce0,0xffff8000373af240
    process=0xffff800030d19ad0 user=0xffff80003114b000, vmspace=0xfffffd806ca16a68
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 96203   41689  83621      0  2   0x8000000                syz-executor.3
 96203   48138  83621      0  2   0xc000000                syz-executor.3
 49213   62419  13381      0  2   0x8000000                syz-executor.5
 49213  306448  13381      0  3   0xc000080  fsleep        syz-executor.5
 10879  292744  16573      0  2   0x8000000                syz-executor.2
 10879    2376  16573      0  3   0xc000080  ttyin         syz-executor.2
 99592  418649  77801      0  2   0x8000480                syz-executor.4
 99592  457454  77801      0  3   0xc000080  sbwait        syz-executor.4
 99592  344018  77801      0  3   0xc000000  smrbar        syz-executor.4
*66213   67426  79029      0  7   0x8000002                syz-executor.7
 77801   25043  79029      0  2   0x8000002                syz-executor.4
 46224  252682  79029      0  2   0x8000002                syz-executor.6
 83621  259041  79029      0  3   0x8000082  nanoslp       syz-executor.3
 54338  421729      0      0  3     0x14200  acct          acct
 82128   21403  79029      0  2   0x8000002                syz-executor.0
 13381  504867  79029      0  3   0x8000082  nanoslp       syz-executor.5
 42113  462223      0      0  3     0x14280  nfsidl        nfsio
 93878  426366      0      0  3     0x14280  nfsidl        nfsio
  9923  292950      0      0  3     0x14280  nfsidl        nfsio
 75102   60978      0      0  3     0x14280  nfsidl        nfsio
 55958  257489      0      0  3     0x14280  nfsidl        nfsio
 40072  474707      0      0  3     0x14280  nfsidl        nfsio
 29710  308490      0      0  3     0x14280  nfsidl        nfsio
 68112  258655      0      0  3     0x14280  nfsidl        nfsio
 10550  499761      0      0  3     0x14280  nfsidl        nfsio
 13082   98482      0      0  3     0x14280  nfsidl        nfsio
 25751  404453      0      0  3     0x14280  nfsidl        nfsio
 34128  208919      0      0  3     0x14280  nfsidl        nfsio
 81628  120228      0      0  3     0x14280  nfsidl        nfsio
 62868  212601      0      0  3     0x14280  nfsidl        nfsio
 88276    3779      0      0  3     0x14280  nfsidl        nfsio
 82827  410055      0      0  3     0x14280  nfsidl        nfsio
 84395  255436      0      0  3     0x14280  nfsidl        nfsio
  6624   86228      0      0  3     0x14280  nfsidl        nfsio
 83688  150650      0      0  3     0x14280  nfsidl        nfsio
  3307  276199      0      0  3     0x14280  nfsidl        nfsio
 16573  249762  79029      0  3   0x8000082  nanoslp       syz-executor.2
 17467  492266  79029      0  2   0x8000002                syz-executor.1
 96585  308579      0      0  3     0x14200  bored         sosplice
 79029  232103  66243      0  3  0x1a000082  thrsleep      syz-fuzzer
 79029  363892  66243      0  2  0x1e000482                syz-fuzzer
 79029  407789  66243      0  3  0x1e000082  thrsleep      syz-fuzzer
 79029  155918  66243      0  3  0x1e000082  thrsleep      syz-fuzzer
 79029  199913  66243      0  3  0x1e000082  wait          syz-fuzzer
 79029  117445  66243      0  7  0x1e000002                syz-fuzzer
 79029  458504  66243      0  3  0x1e000082  wait          syz-fuzzer
 79029  502825  66243      0  3  0x1e000082  wait          syz-fuzzer
 79029   46892  66243      0  3  0x1e000082  wait          syz-fuzzer
 79029  469544  66243      0  3  0x1e000082  wait          syz-fuzzer
 79029  314753  66243      0  3  0x1e000082  thrsleep      syz-fuzzer
 79029  517166  66243      0  2  0x1e000082                syz-fuzzer
 79029  164281  66243      0  3  0x1e000082  wait          syz-fuzzer
 79029  515505  66243      0  3  0x1e000082  wait          syz-fuzzer
 79029   54792  66243      0  3  0x1e000082  wait          syz-fuzzer
 79029  440907  66243      0  3  0x1e000082  thrsleep      syz-fuzzer
 66243  293559  93507      0  3   0x810008a  sigsusp       ksh
 93507  147476  81564      0  3  0x1800009a  kqread        sshd
  4975  502651      1      0  3  0x18100083  ttyin         getty
 81564  177475      1      0  3  0x18000088  kqread        sshd
 96407  443208  19401     74  3  0x19100092  bpf           pflogd
 19401   92915      1      0  3  0x18000080  sbwait        pflogd
 91650  470070  34777     73  3  0x19100090  kqread        syslogd
 34777  171286      1      0  3  0x18100082  sbwait        syslogd
 10891  461471      1      0  3  0x18100080  kqread        resolvd
 20515  394075  71669     77  3  0x18100092  kqread        dhcpleased
  3652   50831  71669     77  3  0x18100092  kqread        dhcpleased
 71669  401608      1      0  3  0x18000080  kqread        dhcpleased
 45868  160674      0      0  3     0x14200  bored         smr
 71502  467632      0      0  2     0x14200                zerothread
  9105  416304      0      0  3     0x14200  aiodoned      aiodoned
 49731  364339      0      0  3     0x14200  syncer        update
 58421  195855      0      0  3     0x14200  cleaner       cleaner
 38852  215929      0      0  3     0x14200  reaper        reaper
 95580  232833      0      0  3     0x14200  pgdaemon      pagedaemon
 66024   10481      0      0  3     0x14200  bored         viomb
 82733  337577      0      0  3  0x40014200  acpi0         acpi0
 31984   69277      0      0  3  0x40014200                idle1
 88982  131783      0      0  3     0x14200  bored         softnet3
 10190   30792      0      0  3     0x14200  bored         softnet2
 73237    2196      0      0  3     0x14200  bored         softnet1
 72415  338466      0      0  2     0x14200                softnet0
 36362  458582      0      0  3     0x14200  bored         systqmp
 98914   89534      0      0  3     0x14200  bored         systq
 84304  504632      0      0  3     0x14200  tmoslp        softclockmp
 88742  146922      0      0  3  0x40014200  tmoslp        softclock
 44235  404181      0      0  3  0x40014200                idle0
     1  510995      0      0  3   0x8080082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 99592 (syz-executor.4) thread 0xffff8000ffff39c8 (457454)
exclusive rrwlock inode r = 0 (0xfffffd806e1caf80)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1187
#1  rw_enter+0x32d sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x91 sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  ufs_ihashins+0x46
#5  ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1230
#6  ufs_lookup+0x1113 sys/ufs/ufs/ufs_lookup.c:573
#7  VOP_LOOKUP+0x5c sys/kern/vfs_vops.c:85
#8  vfs_lookup+0x6f8 sys/kern/vfs_lookup.c:566
#9  namei+0x56a sys/kern/vfs_lookup.c:250
#10 vn_open+0x101 sys/kern/vfs_vnops.c:140
#11 vndioctl+0x988 sys/dev/vnd.c:457
#12 VOP_IOCTL+0x9a sys/kern/vfs_vops.c:264
#13 vn_ioctl+0xc0 sys/kern/vfs_vnops.c:525
#14 sys_ioctl+0x4a9
#15 syscall+0x8cf mi_syscall sys/sys/syscall_mi.h:180 [inline]
#15 syscall+0x8cf sys/arch/amd64/amd64/trap.c:577
#16 Xsyscall+0x128
Process 99592 (syz-executor.4) thread 0xffff8000ffff3738 (344018)
exclusive rwlock clonelk r = 0 (0xffffffff82d416f0)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1187
#1  if_clone_destroy+0x4d sys/net/if.c:1367
#2  tun_dev_close+0x141 sys/net/if_tun.c:521
#3  spec_close+0x2d4 sys/kern/spec_vnops.c:538
#4  VOP_CLOSE+0xeb sys/kern/vfs_vops.c:156
#5  vn_close+0x76 sys/kern/vfs_vnops.c:292
#6  sys_ktrace+0xf6 sys/kern/kern_ktrace.c:552
#7  syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
#7  syscall+0x854 sys/arch/amd64/amd64/trap.c:577
#8  Xsyscall+0x128
Process 66213 (syz-executor.7) thread 0xffff80002a20e540 (67426)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82db4508)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1187
#1  syscall+0x83b mi_syscall sys/sys/syscall_mi.h:180 [inline]
#1  syscall+0x83b sys/arch/amd64/amd64/trap.c:577
#2  Xsyscall+0x128
Process 17467 (syz-executor.1) thread 0xffff8000ffff27d8 (492266)
exclusive rrwlock inode r = 0 (0xfffffd806d2e5928)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1187
#1  rw_enter+0x32d sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x91 sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  ufs_ihashins+0x46
#5  ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1230
#6  ffs_inode_alloc+0x1e4 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_mkdir+0xe6 sys/ufs/ufs/ufs_vnops.c:1117
#8  VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388
#9  domkdirat+0x125 sys/kern/vfs_syscalls.c:3077
#10 syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
#10 syscall+0x854 sys/arch/amd64/amd64/trap.c:577
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8069022e68)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1187
#1  rw_enter+0x32d sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x91 sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  vn_lock+0x85 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0xd3 sys/kern/vfs_lookup.c:418
#6  namei+0x56a sys/kern/vfs_lookup.c:250
#7  domkdirat+0x79 sys/kern/vfs_syscalls.c:3062
#8  syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
#8  syscall+0x854 sys/arch/amd64/amd64/trap.c:577
#9  Xsyscall+0x128
Process 79029 (syz-fuzzer) thread 0xffff80002a1487b8 (117445)
exclusive rwlock pipelk r = 0 (0xfffffd806f908c60)
#0  witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x446 sys/kern/subr_witness.c:1187
#1  filt_pipeprocess+0x3b knote_process sys/sys/event.h:356 [inline]
#1  filt_pipeprocess+0x3b sys/kern/sys_pipe.c:986
#2  kqueue_scan+0x6e7 sys/kern/kern_event.c:1494
#3  sys_kevent+0x567 sys/kern/kern_event.c:1062
#4  syscall+0x8cf mi_syscall sys/sys/syscall_mi.h:180 [inline]
#4  syscall+0x8cf sys/arch/amd64/amd64/trap.c:577
#5  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10207   6521K    6960K 166960K     14005        0
            pcb    17     12K      12K 166960K       491        0
         rtable   209      7K       9K 166960K      1444        0
             pf    41     11K      11K 166960K       206        0
         ifaddr    45     15K      17K 166960K       204        0
        ifgroup    72      3K       3K 166960K       342        0
         sysctl     4      1K       1K 166960K        14        0
       counters    72     37K      37K 166960K       202        0
       ioctlops     0      0K       4K 166960K      1670        0
            iov     0      0K      28K 166960K       212        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1450     91K      91K 166960K      3252        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        72        0
         VM map     2      1K       1K 166960K         2        0
            sem    17      1K       1K 166960K        73        0
        dirhash    12      2K       2K 166960K        75        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    14     49K      93K 166960K      3493        0
          sigio     0      0K       0K 166960K        84        0
           proc    70     91K     152K 166960K      1546        0
        subproc   104      6K       8K 166960K       444        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       490        0
       in_multi    86      6K       7K 166960K       507        0
    ether_multi     1      0K       0K 166960K        20        0
            mrt     1      0K       0K 166960K        11        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    97    440K     440K 166960K        97        0
           exec     0      0K       1K 166960K      1155        0
     pfkey data     0      0K       0K 166960K         9        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   299    182K     182K 166960K     32257        0
       UVM aobj   110      3K       4K 166960K       130        0
     pinsyscall    38     76K     108K 166960K      5364        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       305        0
            NDP    16      0K       2K 166960K       149        0
           temp    76   6816K    7320K 166960K     90195        0
         kqueue    12     18K      28K 166960K       531        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      370    0      367     1     0     1     1     0     8    0
rtentry    112      483    0      389     5     1     4     4     0     8    0
unpcb      144     2856    0     2839    19    18     1     6     0     8    0
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpqe       32      107    0      107     1     1     0     1     0     8    0
tcpcb      808     1195    0     1190    30    25     5    14     0     8    4
arp        120       98    0       80     1     0     1     1     0     8    0
inpcb      384     3769    0     3761    40    35     5    15     0     8    4
nd6        136      121    0      100     2     0     2     2     0     8    0
pkpcb       40       23    0       23     8     7     1     1     0     8    1
kcovpl      48       34    0       26     1     0     1     1     0     8    0
ppxss      1168       9    0        9     7     7     0     1     0     8    0
pffrag     232       29    0       24     1     0     1     1     0   482    0
pffrnode    88       27    0       23     1     0     1     1     0     8    0
pffrent     40      267    0      262     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24      296    0      225     1     0     1     1     0     8    0
pfstkey    128      296    0      225     3     0     3     3     0     8    0
pfstate    376      296    0      225     9     0     9     9     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1761    0     1352    40     8    32    33     0     8    0
art_table   32     1762    0     1352     5     0     5     5     0     8    0
art_node    16      477    0      391     1     0     1     1     0     8    0
sysvmsgpl   40       25    0       20     2     1     1     1     0     8    0
semupl     112        5    0        5     1     1     0     1     0     8    0
semapl     112       66    0       51     1     0     1     1     0     8    0
shmpl      112      127    0       20     4     0     4     4     0     8    0
dirhash    1024      59    0       42     3     0     3     3     0     8    0
dino2pl    256     6876    0     5351    96     0    96    96     0     8    0
ffsino     272     6876    0     5351   103     0   103   103     0     8    0
nchpl      144    12189    0    10462    67     0    67    67     0     8    0
uvmvnodes   80     8091    0        0   166     0   166   166     0     8    0
vnodes     216     8091    0        0   450     0   450   450     0     8    0
vnodes: pool(0xffffffff82d8e1d0:vnodes): page inconsistency: page 0x0; at page head addr 0xfffffd8066417f90 (p 0xfffffd8066417000)
namei      1024   41675    0    41673     5     4     1     2     0     8    0
percpumem   16      115    0       65     1     0     1     1     0     8    0
vcpupl     3904      19    0        3     2     0     2     2     0     8    0
vmpool     696       22    0        6     3     1     2     2     0     8    0
kstatmem   264      162    0      130     5     2     3     3     0     8    0
scsiplug    72        3    0        3     3     3     0     1     0     8    0
scxspl     216    64469    0    64469    23    22     1     8     1     8    1
plimitpl   152      480    0      463     1     0     1     1     0     8    0
sigapl     424     3779    0     3711    12     3     9     9     0     8    0
futexpl     64    51573    0    51572     3     2     1     1     0     8    0
knotepl    120      627    0        0    19     0    19    19     0     8    0
kqueuepl   216      984    0      976     1     0     1     1     0     8    0
pipepl     320      763    0      735     5     2     3     4     0     8    0
fdescpl    496     3737    0     3710     9     4     5     5     0     8    0
filepl     152    24194    0    23948    30    18    12    15     0     8    0
lockfpl    104     1027    0     1025     2     1     1     2     0     8    0
lockfspl    48      436    0      434     1     0     1     1     0     8    0
sessionpl  144       50    0       33     1     0     1     1     0     8    0
pgrppl      48      123    0      106     1     0     1     1     0     8    0
ucredpl    104     3860    0     3847     1     0     1     1     0     8    0
zombiepl   144     3712    0     3711     2     1     1     1     0     8    0
processpl  1136    3779    0     3711     7     1     6     6     0     8    0
procpl     656     7626    0     7538    11     2     9     9     0     8    0
srpgc       96        8    0        8     2     2     0     1     0     8    0
sosppl     168       61    0       61    11    10     1     1     0     8    1
sockpl     664     7065    0     7037    53    46     7    14     0     8    4
mcl64k     65536      7    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192      10    0        0     2     0     2     2     0     8    0
mcl4k      4096       7    0        0     1     0     1     1     0     8    0
mcl2k      2048     423    0        0    42     0    42    42     0     8    0
mtagpl      96       30    0        0     1     0     1     1     0     8    0
mbufpl     256     1204    0        0    63     0    63    63     0     8    0
bufpl      280    14925    0     6834   579     0   579   579     0     8    0
anonpl      24   553042    0   546810   113    48    65    77     0   186    0
amapchunkpl 152  104707    0   104057    74    41    33    41     0   158    0
amappl16   200    12502    0    12368    80    67    13    22     0     8    0
amappl15   192       22    0       22     3     3     0     1     0     8    0
amappl14   184      239    0      224     2     1     1     2     0     8    0
amappl13   176        7    0        7     1     1     0     1     0     8    0
amappl12   168     4817    0     4788     3     1     2     2     0     8    0
amappl11   160       73    0       59     1     0     1     1     0     8    0
amappl10   152       95    0       84     1     0     1     1     0     8    0
amappl9    144      246    0      246     2     2     0     1     0     8    0
amappl8    136      187    0      148     2     0     2     2     0     8    0
amappl7    128       59    0       41     1     0     1     1     0     8    0
amappl6    120      732    0      712     2     0     2     2     0     8    0
amappl5    112      288    0      273     1     0     1     1     0     8    0
amappl4    104      817    0      779     2     0     2     2     0     8    0
amappl3     96    19825    0    19747     3     0     3     3     0     8    0
amappl2     88     4195    0     4121     4     2     2     4     0     8    0
amappl1     80    21577    0    21037    23     9    14    23     0     8    0
amappl      88    31288    0    31095     7     1     6     6     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      129    0       20     2     0     2     2     0     8    0
uaddrrnd    24     3759    0     3716     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3759    0     3716     1     0     1     1     0     8    0
vmmpekpl   168    29540    0    29480     4     0     4     4     0     8    0
vmmpepl    168   240943    0   239032   160    59   101   118     0   357    0
vmsppl     440     3758    0     3716    11     5     6     6     0     8    0
rwobjpl     56    68301    0    58929   137     4   133   133     0     8    0
pdppl      4096    7525    0     7448   216   132    84    86     0     8    7
pvpl        32    45846    0        0   370     0   370   370     0   265    0
pmappl     248     3758    0     3716     4     1     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      615    0      179    13     0    13    13     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff828d2a8c) at panic+0x17b sys/kern/subr_prf.c:198
vref(fffffd8066417640) at vref+0xc7 sys/kern/vfs_subr.c:698
namei(ffff800031150c68) at namei+0x3b2 sys/kern/vfs_lookup.c:221
vn_open(ffff800031150c68,30001,0) at vn_open+0x101 sys/kern/vfs_vnops.c:140
doopenat(ffff80002a20e540,ffffff9c,73544240d850,30000,0,ffff800031150e10) at doopenat+0x269 sys/kern/vfs_syscalls.c:1126
syscall(ffff800031150ec0) at syscall+0x854 mi_syscall sys/sys/syscall_mi.h:180 [inline]
syscall(ffff800031150ec0) at syscall+0x854 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73544240d350, count: -8
ddb{0}> machine ddbcpu 1

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/20 11:57 openbsd 55906bae5af5 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: vref used where vget required
2024/04/10 17:22 openbsd ffe6655cba7d 7d74efd0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: vref used where vget required
* Struck through repros no longer work on HEAD.