syzbot


assert failed: pgrp->pg_jobc] > 0

Status: closed as dup on 2020/05/17 07:50
Reported-by: syzbot+bc3ba465a877bd9a0082@syzkaller.appspotmail.com
First crash: 1650d, last: 1650d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
assert failed: pgrp->pg_jobc > 0 C 1621 1464d 1663d

Sample crash report:
May 16 13:05:47 ci2-netbsd-6 syslogd[46[ 3006.2960599] panic: kernel diagnostic assertion "pgrp->pg_jobc] > 0" failed: file "/syzkaller:/managers/netbsd/kern el/sys/keErn/kern_proc.c", line 1510 
[ 306.3160288] cpu1: Begin traceback...
xiting on signal 15
[ 306.3260227] vpanic() at netbsd:vpanic+0x22e sys/kern/subr_prf.c:290
[ 306.3560015] _GLOBAL__sub_D_65535_0_cpu_configure() at netbsd:_GLOBAL__sub_D_65535_0_cpu_configure
[ 306.3759878] fixjobc() at netbsd:fixjobc+0x307 sys/kern/kern_proc.c:1510
[ 306.4059564] exit1() at netbsd:exit1+0x46f sys/kern/kern_exit.c:428
[ 306.4259407] sigexit() at netbsd:sigexit+0x39e sys/kern/kern_sig.c:2305
[ 306.4459218] sendsig() at netbsd:sendsig
[ 306.4659034] lwp_userret() at netbsd:lwp_userret+0x390 sys/kern/kern_lwp.c:1606
[ 306.4858934] syscall() at netbsd:syscall+0x85e x86_curlwp sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:68 [inline]
[ 306.4858934] syscall() at netbsd:syscall+0x85e KPREEMPT_DISABLE sys/sys/lwp.h:536 [inline]
[ 306.4858934] syscall() at netbsd:syscall+0x85e mi_userret sys/sys/userret.h:97 [inline]
[ 306.4858934] syscall() at netbsd:syscall+0x85e userret sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/userret.h:81 [inline]
[ 306.4858934] syscall() at netbsd:syscall+0x85e sys/arch/x86/x86/syscall.c:166
[ 306.4958845] --- syscall (number 4) ---
[ 306.5058695] netbsd:syscall+0x85e:
[ 306.5058695] cpu1: End traceback...
[ 306.5158614] fatal breakpoint trap in supervisor mode
[ 306.5158614] trap type 1 code 0 rip 0xffffffff802209c5 cs 0x8 rflags 0x282 cr2 0xffffb3016f93cf68 ilevel 0 rsp 0xffffb30189acb910
[ 306.5358416] curlwp 0xffffb30012bfd980 pid 1506.1506 lowest kstack 0xffffb30189ac42c0
Stopped in pid 1506.1506 (syz-executor.5) at    netbsd:breakpoint+0x5:  leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xe9 sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x22e sys/kern/subr_prf.c:290
_GLOBAL__sub_D_65535_0_cpu_configure() at netbsd:_GLOBAL__sub_D_65535_0_cpu_configure
fixjobc() at netbsd:fixjobc+0x307 sys/kern/kern_proc.c:1510
exit1() at netbsd:exit1+0x46f sys/kern/kern_exit.c:428
sigexit() at netbsd:sigexit+0x39e sys/kern/kern_sig.c:2305
sendsig() at netbsd:sendsig
lwp_userret() at netbsd:lwp_userret+0x390 sys/kern/kern_lwp.c:1606
syscall() at netbsd:syscall+0x85e x86_curlwp sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:68 [inline]
syscall() at netbsd:syscall+0x85e KPREEMPT_DISABLE sys/sys/lwp.h:536 [inline]
syscall() at netbsd:syscall+0x85e mi_userret sys/sys/userret.h:97 [inline]
syscall() at netbsd:syscall+0x85e userret sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/userret.h:81 [inline]
syscall() at netbsd:syscall+0x85e sys/arch/x86/x86/syscall.c:166
--- syscall (number 4) ---
netbsd:syscall+0x85e:
ds          d980
es          3380
fs          b8f0
gs          8e35
rdi         ffffffff82bdf900    db_onpanic
rsi         1ffffffff057bf20
rbp         ffffb30189acb910
rbx         ffffb3016e699000
rdx         0
rcx         ffffffff81266869    db_panic+0xd5
rax         ffffb30012bfd980
r8          4
r9          1ffffffff057bf20
r10         ffffffff82bdf903    db_onpanic+0x3
r11         10
r12         ffffb3016e6aa000
r13         ffffffff823097c0    _device_suspensor_drvctl+0x160
r14         ffffb30189acb9a0
r15         ffffb3016e699060
rip         ffffffff802209c5    breakpoint+0x5
cs          8
rflags      282
rsp         ffffb30189acb910
ss          10
netbsd:breakpoint+0x5:  leave
PID    LID S CPU     FLAGS       STRUCT LWP *               NAME WAIT
1376  1376 3   0        80   ffffb30012c6a600               halt nanoslp
977    977 3   0   1000040   ffffb30012cd2340     syz-executor.3 tstile
504    504 2   1   1000000   ffffb30012bcd4c0     syz-executor.5
1506 >1506 7   1   1000000   ffffb30012bfd980     syz-executor.5
827   1437 2   1  11100000   ffffb30012be9940     syz-executor.5
827    827 3   0  11000040   ffffb30012c80200     syz-executor.5 xclocv
1469  1469 2   1   1000000   ffffb30013825980     syz-executor.2
825    825 2   1   1000000   ffffb30012bfd540     syz-executor.2
291    291 2   1   1000000   ffffb30014a5ca80     syz-executor.1
850    850 2   1   1000000   ffffb30014a5c640     syz-executor.1
698    698 3   0   1000040   ffffb30014911540     syz-executor.2 tstile
693    693 3   0   1000040   ffffb30012da9a80     syz-executor.4 tstile
557    557 3   0   1000040   ffffb300147e0940     syz-executor.1 tstile
694    694 3   1   1000040   ffffb300147e0500     syz-executor.0 tstile
681   1079 2   0        40   ffffb300147e00c0         syz-fuzzer
681    691 3   1        c0   ffffb300147bd900         syz-fuzzer parked
681    690 3   0        80   ffffb30012741700         syz-fuzzer parked
681    865 3   0        80   ffffb300147bd4c0         syz-fuzzer parked
681    723 3   1        c0   ffffb300140678c0         syz-fuzzer parked
681    688 3   1        80   ffffb30014067480         syz-fuzzer parked
681    686 3   1        80   ffffb30012c92240         syz-fuzzer parked
681   1277 3   1        c0   ffffb300136f4ac0         syz-fuzzer parked
681    724 2   1        40   ffffb300136f4680         syz-fuzzer
681    684 2   0        40   ffffb30013863b00         syz-fuzzer
681    681 3   1        80   ffffb3001387d300         syz-fuzzer parked
678    678 2   1         0   ffffb30013871700               sshd
719    719 2   0   1000000   ffffb3001384f200              getty
1183  1183 2   0   1000000   ffffb30013843a40              getty
1374  1374 3   0   1000000   ffffb30013843600              getty tstile
668    668 2   0   1000040   ffffb300138319c0              getty
584    584 2   0         0   ffffb30012d1e9c0               sshd
601    601 3   0   1000000   ffffb30012c415c0             powerd tstile
460    460 2   1         0   ffffb30013799700            syslogd
303    303 2   0         0   ffffb30012cd2780             dhcpcd
333  > 333 7   0         0   ffffb30012be90c0             dhcpcd
1        1 2   0         0   ffffb30012932100               init
0      590 3   0       200   ffffb300129859c0            physiod physiod
0      123 3   0       200   ffffb30012992a00          pooldrain pooldrain
0      122 3   0       200   ffffb300129925c0            ioflush syncer
0      121 3   0       240   ffffb30012992180           pgdaemon pgdaemon
0      118 3   0       200   ffffb30012985140               usb0 usbevt
0      117 3   0       200   ffffb30012932980         usbtask-dr usbtsk
0      116 3   0       200   ffffb3000fe5cac0         usbtask-hc usbtsk
0      115 3   0       200   ffffb30012932540            npfgc-0 npfgccv
0      114 3   0       200   ffffb30012923940            rt_free rt_free
0      113 3   1       200   ffffb30012923500              unpgc unpgc
0      112 3   0       200   ffffb300129230c0    key_timehandler key_timehandler
0      111 3   1       200   ffffb30012919900    icmp6_wqinput/1 icmp6_wqinput
0      110 3   0       200   ffffb300129194c0    icmp6_wqinput/0 icmp6_wqinput
0      109 3   0       200   ffffb30012919080          nd6_timer nd6_timer
0      108 3   1       200   ffffb300127698c0    carp6_wqinput/1 carp6_wqinput
0      107 3   0       200   ffffb30012769480    carp6_wqinput/0 carp6_wqinput
0      106 3   1       200   ffffb30012769040     carp_wqinput/1 carp_wqinput
0      105 3   0       200   ffffb30012759bc0     carp_wqinput/0 carp_wqinput
0      104 3   1       200   ffffb30012759780     icmp_wqinput/1 icmp_wqinput
0      103 3   0       200   ffffb30012759340     icmp_wqinput/0 icmp_wqinput
0      102 3   0       200   ffffb30012744b80           rt_timer rt_timer
0      101 3   0       200   ffffb30012744740        vmem_rehash vmem_rehash
0      100 3   0       200   ffffb30012741b40          entbutler entropy
0       27 3   0       200   ffffb3000fe5c680           scsibus0 sccomp
0       26 3   0       200   ffffb3000fe5c240               pms0 pmsreset
0       25 2   1       200   ffffb3000fd9da80            xcall/1
0       24 1   1       200   ffffb3000fd9d640          softser/1
0       23 1   1       200   ffffb3000fd9d200          softclk/1
0       22 1   1       200   ffffb3000fd9ba40          softbio/1
0       21 1   1       200   ffffb3000fd9b600          softnet/1
0       20 1   1       201   ffffb3000fd9b1c0             idle/1
0       19 3   0       200   ffffb3000e80aa00           lnxpwrwq lnxpwrwq
0       18 3   0       200   ffffb3000e80a5c0           lnxlngwq lnxlngwq
0       17 3   0       200   ffffb3000e80a180           lnxsyswq lnxsyswq
0       16 3   0       200   ffffb3000e8049c0           lnxrcugc lnxrcugc
0       15 3   0       200   ffffb3000e804580             sysmon smtaskq
0       14 3   0       200   ffffb3000e804140         pmfsuspend pmfsuspend
0       13 3   0       200   ffffb3000e7ff980           pmfevent pmfevent
0       12 3   0       200   ffffb3000e7ff540         sopendfree sopendfr
0       11 3   1       200   ffffb3000e7ff100            iflnkst iflnkst
0       10 3   0       200   ffffb3000e7f3940           nfssilly nfssilly
0        9 3   0       200   ffffb3000e7f3500             vdrain vdrain
0        8 3   1       200   ffffb3000e7f30c0          modunload mod_unld
0        7 3   0       200   ffffb3000e7e6900            xcall/0 xcall
0        6 1   0       200   ffffb3000e7e64c0          softser/0
0        5 1   0       200   ffffb3000e7e6080          softclk/0
0        4 1   0       200   ffffb3000e7e48c0          softbio/0
0        3 1   0       200   ffffb3000e7e4480          softnet/0
0        2 1   0       201   ffffb3000e7e4040             idle/0
0        0 3   0       200   ffffffff82caa740            swapper uvm
[Locks tracked through LWPs]

****** LWP 977.977 (syz-executor.3) @ 0xffffb30012cd2340, l_stat=3

*** Locks held:

* Lock 0 (initialized at fork1)
lock address : 0xffffb30012bbdf50 type     :     sleep/adaptive
initialized  : 0xffffffff816afae8
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb30012cd2340 last held: 0xffffb30012cd2340
last locked* : 0xffffffff816ac2e4 unlocked : 0xffffffff816a9c07
owner/count  : 0xffffb30012cd2340 flags    : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at uvm_map_setup)
lock address : 0xffffffff82e277e8 type     :     sleep/adaptive
initialized  : 0xffffffff816423e1
shared holds :                  0 exclusive:                  1
shares wanted:                  1 exclusive:                  5
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb30012cd2340 last held: 0xffffb30012cd2340
last locked* : 0xffffffff8163c695 unlocked : 0xffffffff81645b9d
owner/count  : 0x0000000000000020 flags    : 0x0000000000000003
Turnstile:
=> 0 waiting readers:
=> 5 waiting writers: 0xffffb300147e0940 0xffffb30012da9a80 0xffffb30014911540 0xffffb30012cd2340 0xffffb300147e0500

* Lock 2 (initialized at uvm_obj_init)
lock address : 0xffffb30014a29100 type     :     sleep/adaptive
initialized  : 0xffffffff8164f080
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb30012cd2340 last held: 0xffffb30012cd2340
last locked* : 0xffffffff8164262f unlocked : 0xffffffff81628c15
owner/count  : 000000000000000000 flags    : 000000000000000000
Turnstile: no active turnstile for this lock.

* Lock 3 (initialized at pmap_bootstrap)
lock address : 0xffffffff82d9f000 type     :     sleep/adaptive
initialized  : 0xffffffff8086968e
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb30012cd2340 last held: 0xffffb30012cd2340
last locked* : 0xffffffff8086dd97 unlocked : 0xffffffff8086df38
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 504.504 (syz-executor.5) @ 0xffffb30012bcd4c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at fork1)
lock address : 0xffffb30012b187d0 type     :     sleep/adaptive
initialized  : 0xffffffff816afae8
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffb30012bcd4c0 last held: 0xffffb30012bcd4c0
last locked* : 0xffffffff816ac2e4 unlocked : 000000000000000000
owner/count  : 0xffffb30012bcd4c0 flags    : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at amap_ctor)
lock address : 0xffffb30014999480 type     :     sleep/adaptive
initialized  : 0xffffffff81620de3
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffb30012bcd4c0 last held: 0xffffb30012bcd4c0
last locked* : 0xffffffff8162584a unlocked : 0xffffffff8162495b
owner/count  : 0xffffb30012bcd4c0 flags    : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at pool_init)
lock address : 0xffffffff82e25670 type     :     sleep/adaptive
initialized  : 0xffffffff81754cd7
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  2
relevant cpu :                  1 last held:                  0
relevant lwp : 0xffffb30012bcd4c0 last held: 000000000000000000
last locked  : 0xffffffff81757515 unlocked*: 0xffffffff817575dc
owner field  : 000000000000000000 wait/spin:                0/0
Turnstile: no active turnstile for this lock.

****** LWP 1506.1506 (syz-executor.5) @ 0xffffb30012bfd980, l_stat=7

*** Locks held:

* Lock 0 (initialized at fork1)
lock address : 0xffffb30012a0d710 type     :     sleep/adaptive
initialized  : 0xffffffff816afae8
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffb30012bfd980 last held: 0xffffb30012bfd980
last locked* : 0xffffffff816ac2e4 unlocked : 000000000000000000
owner/count  : 0xffffb30012bfd980 flags    : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at procinit)
lock address : 0xffffffff82da1d00 type     :     sleep/adaptive
initialized  : 0xffffffff816d3fe8
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffb30012bfd980 last held: 0xffffb30012bfd980
last locked* : 0xffffffff816ac432 unlocked : 0xffffffff816c04d3
owner field  : 0xffffb30012bfd980 wait/spin:                1/0
Turnstile:
=> 0 waiting readers:
=> 2 waiting writers: 0xffffb30012c415c0 0xffffb30013843600

*** Locks wanted: none

****** LWP 698.698 (syz-executor.2) @ 0xffffb30014911540, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffffffff82e277e8 type     :     sleep/adaptive
initialized  : 0xffffffff816423e1
shared holds :                  0 exclusive:                  1
shares wanted:                  1 exclusive:                  5
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb30014911540 last held: 0xffffb30012cd2340
last locked* : 0xffffffff8163c695 unlocked : 0xffffffff81645b9d
owner/count  : 0x0000000000000020 flags    : 0x0000000000000003
Turnstile:
=> 0 waiting readers:
=> 5 waiting writers: 0xffffb300147e0940 0xffffb30012da9a80 0xffffb30014911540 0xffffb30012cd2340 0xffffb300147e0500

****** LWP 693.693 (syz-executor.4) @ 0xffffb30012da9a80, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffffffff82e277e8 type     :     sleep/adaptive
initialized  : 0xffffffff816423e1
shared holds :                  0 exclusive:                  1
shares wanted:                  1 exclusive:                  5
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb30012da9a80 last held: 0xffffb30012cd2340
last locked* : 0xffffffff8163c695 unlocked : 0xffffffff81645b9d
owner/count  : 0x0000000000000020 flags    : 0x0000000000000003
Turnstile:
=> 0 waiting readers:
=> 5 waiting writers: 0xffffb300147e0940 0xffffb30012da9a80 0xffffb30014911540 0xffffb30012cd2340 0xffffb300147e0500

****** LWP 557.557 (syz-executor.1) @ 0xffffb300147e0940, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffffffff82e277e8 type     :     sleep/adaptive
initialized  : 0xffffffff816423e1
shared holds :                  0 exclusive:                  1
shares wanted:                  1 exclusive:                  5
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb300147e0940 last held: 0xffffb30012cd2340
last locked* : 0xffffffff8163c695 unlocked : 0xffffffff81645b9d
owner/count  : 0x0000000000000020 flags    : 0x0000000000000003
Turnstile:
=> 0 waiting readers:
=> 5 waiting writers: 0xffffb300147e0940 0xffffb30012da9a80 0xffffb30014911540 0xffffb30012cd2340 0xffffb300147e0500

****** LWP 694.694 (syz-executor.0) @ 0xffffb300147e0500, l_stat=3

*** Locks held:

* Lock 0 (initialized at fork1)
lock address : 0xffffb30013876710 type     :     sleep/adaptive
initialized  : 0xffffffff816afae8
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  1 last held:                  1
relevant lwp : 0xffffb300147e0500 last held: 0xffffb300147e0500
last locked* : 0xffffffff816ac2e4 unlocked : 0xffffffff816a9c07
owner/count  : 0xffffb300147e0500 flags    : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffffffff82e277e8 type     :     sleep/adaptive
initialized  : 0xffffffff816423e1
shared holds :                  0 exclusive:                  1
shares wanted:                  1 exclusive:                  5
relevant cpu :                  1 last held:                  0
relevant lwp : 0xffffb300147e0500 last held: 0xffffb30012cd2340
last locked* : 0xffffffff8163c695 unlocked : 0xffffffff81645b9d
owner/count  : 0x0000000000000020 flags    : 0x0000000000000003
Turnstile:
=> 0 waiting readers:
=> 5 waiting writers: 0xffffb300147e0940 0xffffb30012da9a80 0xffffb30014911540 0xffffb30012cd2340 0xffffb300147e0500

****** LWP 681.1079 (syz-fuzzer) @ 0xffffb300147e00c0, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffffffff82e277e8 type     :     sleep/adaptive
initialized  : 0xffffffff816423e1
shared holds :                  0 exclusive:                  1
shares wanted:                  1 exclusive:                  5
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb300147e00c0 last held: 0xffffb30012cd2340
last locked* : 0xffffffff8163c695 unlocked : 0xffffffff81645b9d
owner/count  : 0x0000000000000020 flags    : 0x0000000000000003
Turnstile:
=> 0 waiting readers:
=> 5 waiting writers: 0xffffb300147e0940 0xffffb30012da9a80 0xffffb30014911540 0xffffb30012cd2340 0xffffb300147e0500

****** LWP 1183.1183 (getty) @ 0xffffb30013843a40, l_stat=2

*** Locks held:

* Lock 0 (initialized at fork1)
lock address : 0xffffb300138464d0 type     :     sleep/adaptive
initialized  : 0xffffffff816afae8
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb30013843a40 last held: 0xffffb30013843a40
last locked* : 0xffffffff816ac2e4 unlocked : 0xffffffff816a9c07
owner/count  : 0xffffb30013843a40 flags    : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at amap_ctor)
lock address : 0xffffb3001430d1c0 type     :     sleep/adaptive
initialized  : 0xffffffff81620de3
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
relevant cpu :                  0 last held:                  0
relevant lwp : 0xffffb30013843a40 last held: 0xffffb30013843a40
last locked* : 0xffffffff8162584a unlocked : 0xffffffff8162495b
[ 306.5358416] Skipping crash dump on recursive panic
[ 306.5358416] panic: ASan: Unauthorized Access In 0xffffffff816e7a00: Addr 0xffffb3001430d1c0 [8 bytes, read, PoolUseAfterFree]

[ 306.5358416] cpu1: Begin traceback...
[ 306.5358416] vpanic() at netbsd:vpanic+0x22e sys/kern/subr_prf.c:290
[ 306.5358416] snprintf() at netbsd:snprintf
[ 306.5358416] kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:187 [inline]
[ 306.5358416] kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:197
[ 306.5358416] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_4byte_isvalid sys/kern/subr_asan.c:347 [inline]
[ 306.5358416] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:361 [inline]
[ 306.5358416] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_check sys/kern/subr_asan.c:413 [inline]
[ 306.5358416] __asan_load8() at netbsd:__asan_load8+0x294 sys/kern/subr_asan.c:1210
[ 306.5358416] rw_dump() at netbsd:rw_dump+0x20 sys/kern/kern_rwlock.c:186
[ 306.5358416] lockdebug_dump() at netbsd:lockdebug_dump+0x207 sys/kern/subr_lockdebug.c:759
[ 306.5358416] lockdebug_show_one() at netbsd:lockdebug_show_one+0xb7 sys/kern/subr_lockdebug.c:839
[ 306.5358416] lockdebug_show_all_locks() at netbsd:lockdebug_show_all_locks+0x26b lockdebug_show_all_locks_lwp sys/kern/subr_lockdebug.c:877 [inline]
[ 306.5358416] lockdebug_show_all_locks() at netbsd:lockdebug_show_all_locks+0x26b sys/kern/subr_lockdebug.c:941
[ 306.5358416] db_command() at netbsd:db_command+0x2ad sys/ddb/db_command.c:942
[ 306.5358416] db_command_loop() at netbsd:db_command_loop+0x26c db_execute_commandlist sys/ddb/db_command.c:439 [inline]
[ 306.5358416] db_command_loop() at netbsd:db_command_loop+0x26c sys/ddb/db_command.c:589
[ 306.5358416] db_trap() at netbsd:db_trap+0x206 sys/ddb/db_trap.c:94
[ 306.5358416] kdb_trap() at netbsd:kdb_trap+0x1ce sys/arch/amd64/amd64/db_interface.c:248
[ 306.5358416] trap() at netbsd:trap+0x57e sys/arch/amd64/amd64/trap.c:315
[ 306.5358416] --- trap (number 1) ---
[ 306.5358416] breakpoint() at netbsd:breakpoint+0x5
[ 306.5358416] db_panic() at netbsd:db_panic+0xe9 sys/ddb/db_panic.c:67
[ 306.5358416] vpanic() at netbsd:vpanic+0x22e sys/kern/subr_prf.c:290
[ 306.5358416] _GLOBAL__sub_D_65535_0_cpu_configure() at netbsd:_GLOBAL__sub_D_65535_0_cpu_configure
[ 306.5358416] fixjobc() at netbsd:fixjobc+0x307 sys/kern/kern_proc.c:1510
[ 306.5358416] exit1() at netbsd:exit1+0x46f sys/kern/kern_exit.c:428
[ 306.5358416] sigexit() at netbsd:sigexit+0x39e sys/kern/kern_sig.c:2305
[ 306.5358416] sendsig() at netbsd:sendsig
[ 306.5358416] lwp_userret() at netbsd:lwp_userret+0x390 sys/kern/kern_lwp.c:1606
[ 306.5358416] syscall() at netbsd:syscall+0x85e x86_curlwp sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:68 [inline]
[ 306.5358416] syscall() at netbsd:syscall+0x85e KPREEMPT_DISABLE sys/sys/lwp.h:536 [inline]
[ 306.5358416] syscall() at netbsd:syscall+0x85e mi_userret sys/sys/userret.h:97 [inline]
[ 306.5358416] syscall() at netbsd:syscall+0x85e userret sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/userret.h:81 [inline]
[ 306.5358416] syscall() at netbsd:syscall+0x85e sys/arch/x86/x86/syscall.c:166
[ 306.5358416] --- syscall (number 4) ---
[ 306.5358416] netbsd:syscall+0x85e:
[ 306.5358416] cpu1: End traceback...
[ 306.5358416] fatal breakpoint trap in supervisor mode
[ 306.5358416] trap type 1 code 0 rip 0xffffffff802209c5 cs 0x8 rflags 0x282 cr2 0xffffb3016f93cf68 ilevel 0x8 rsp 0xffffb30189acaeb0
[ 306.5358416] curlwp 0xffffb30012bfd980 pid 1506.1506 lowest kstack 0xffffb30189ac42c0
Stopped in pid 1506.1506 (syz-executor.5) at    netbsd:breakpoint+0x5:  leave

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/16 13:05 netbsd 01f4788ce77f 37bccd4e .config console log report ci2-netbsd
* Struck through repros no longer work on HEAD.