panic: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/main/kernel/sys/kern/kern_synch.c", line 953
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8333d998) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff833797c0,ffffffff833d8140,3b9,ffffffff833b1e8c) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_finalize(ffff80002a89f618,ffffffff833310e8) at refcnt_finalize+0x1c8 sys/kern/kern_synch.c:954
pppx_if_destroy(205b9c,ffff80002a89f610) at pppx_if_destroy+0x3d sys/net/if_pppx.c:794
pppxclose(205b9c,1,2000,ffff800031503ca8) at pppxclose+0xa0 sys/net/if_pppx.c:541
spec_close(ffff80003c96d900) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd805eacf638,1,fffffd8007bfb7b8,ffff800031503ca8) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806b7f1e18,ffff800031503ca8) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806b7f1e18,ffff800031503ca8) at vn_closefile+0x11d sys/kern/vfs_vnops.c:615
fdrop(fffffd806b7f1e18,ffff800031503ca8) at fdrop+0x121 sys/kern/kern_descrip.c:1280
closef(fffffd806b7f1e18,ffff800031503ca8) at closef+0x190 sys/kern/kern_descrip.c:1264
fdfree(ffff800031503ca8) at fdfree+0x115 sys/kern/kern_descrip.c:1195
exit1(ffff800031503ca8,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff800031503ca8,ffff80003c96dc60,ffff80003c96dbb0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
end trace frame: 0xffff80003c96dc50, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/main/kernel/sys/kern/kern_synch.c", line 953
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8333d998) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff833797c0,ffffffff833d8140,3b9,ffffffff833b1e8c) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_finalize(ffff80002a89f618,ffffffff833310e8) at refcnt_finalize+0x1c8 sys/kern/kern_synch.c:954
pppx_if_destroy(205b9c,ffff80002a89f610) at pppx_if_destroy+0x3d sys/net/if_pppx.c:794
pppxclose(205b9c,1,2000,ffff800031503ca8) at pppxclose+0xa0 sys/net/if_pppx.c:541
spec_close(ffff80003c96d900) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd805eacf638,1,fffffd8007bfb7b8,ffff800031503ca8) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806b7f1e18,ffff800031503ca8) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806b7f1e18,ffff800031503ca8) at vn_closefile+0x11d sys/kern/vfs_vnops.c:615
fdrop(fffffd806b7f1e18,ffff800031503ca8) at fdrop+0x121 sys/kern/kern_descrip.c:1280
closef(fffffd806b7f1e18,ffff800031503ca8) at closef+0x190 sys/kern/kern_descrip.c:1264
fdfree(ffff800031503ca8) at fdfree+0x115 sys/kern/kern_descrip.c:1195
exit1(ffff800031503ca8,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff800031503ca8,ffff80003c96dc60,ffff80003c96dbb0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c96dc60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c96dc60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:746
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7781f4771060, count: -16
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff80003c96d6e0
rbx 0
rdx 0
rcx 0
rax 0xffff800031503ca8
r8 0x101010101010101
r9 0x8080808080808080
r10 0x25b3f9742396371d
r11 0x2594c87aa57c579c
r12 0
r13 0
r14 0
r15 0x1
rip 0xffffffff814b3b15 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80003c96d6d0
ss 0x10
db_enter+0x25: addq $0x8,%rsp
ddb> show proc
PROC (syz-executor) tid=208171 pid=27565 tcnt=0 stat=onproc
flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
runpri=32, usrpri=84, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0xffff800031503ca8 scnt=-1 ecnt=1
forw=0xffffffffffffffff, list=0xffff80002a7aa7f8,0xffff80002a7ab500
process=0xffff8000ffff9f98 user=0xffff80003c968000, vmspace=0xfffffd806ba15a20
estcpu=34, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
45817 468954 74983 0 2 0 syz-executor
45817 398336 74983 0 2 0x4000000 syz-executor
2214 500564 66739 0 2 0 syz-executor
2214 17445 66739 0 3 0x4000080 fsleep syz-executor
55413 361440 44331 0 2 0 syz-executor
55413 279845 44331 0 3 0x4000080 fsleep syz-executor
86577 463283 73388 0 2 0 syz-executor
86577 61443 73388 0 2 0x4000000 syz-executor
50031 314019 0 0 3 0x14200 acct acct
51344 322848 59203 0 3 0x82 wait syz-executor
73388 513450 59203 0 2 0xc82 syz-executor
74983 72016 59203 0 2 0xc82 syz-executor
73975 149249 0 0 3 0x14200 bored sosplice
66739 21996 59203 0 3 0x82 nanoslp syz-executor
21308 508869 59203 0 3 0x82 wait syz-executor
4793 467336 59203 0 2 0xc82 syz-executor
22902 124341 59203 0 2 0x2 syz-executor
44331 219325 59203 0 3 0x82 nanoslp syz-executor
59203 257921 36590 0 3 0x82 kqread syz-executor
36590 146955 12010 0 3 0x10008a sigsusp ksh
12010 82174 344 0 3 0x98 kqread sshd-session
344 252105 69123 0 3 0x92 kqread sshd-session
8524 508127 1 0 3 0x100083 ttyin getty
69123 311666 1 0 3 0x88 kqread sshd
33016 477193 71431 73 3 0x1100090 kqread syslogd
71431 281941 1 0 3 0x100082 sbwait syslogd
90054 118987 1 0 3 0x100080 kqread resolvd
88762 477966 433 77 2 0x100012 dhcpleased
75267 175930 433 77 3 0x100092 kqread dhcpleased
433 125784 1 0 3 0x80 kqread dhcpleased
74277 431503 0 0 3 0x14200 bored smr
31393 169197 0 0 2 0x14200 zerothread
18579 268928 0 0 3 0x14200 aiodoned aiodoned
3160 230173 0 0 3 0x14200 syncer update
13778 333449 0 0 3 0x14200 cleaner cleaner
106 432560 0 0 3 0x14200 reaper reaper
31530 352793 0 0 3 0x14200 pgdaemon pagedaemon
97623 474855 0 0 3 0x14200 bored viomb
97277 308566 0 0 3 0x40014200 acpi0 acpi0
38967 334781 0 0 3 0x14200 tqbarend softnet0
24970 64738 0 0 3 0x14200 smrbar systqmp
7497 231747 0 0 3 0x14200 bored systq
57378 261089 0 0 3 0x40014200 tmoslp softclock
58282 89582 0 0 3 0x40014200 idle0
1 251553 0 0 3 0x82 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10186 11053K 12187K 166960K 13478 0
pcb 18 16K 18K 166960K 623 0
rtable 185 9K 10K 166960K 511 0
pf 34 13K 16K 166960K 205 0
ifaddr 34 6K 8K 166960K 137 0
ifgroup 48 2K 2K 166960K 223 0
sysctl 4 1K 9K 166960K 92 0
counters 33 17K 18K 166960K 166 0
ioctlops 0 0K 4K 166960K 562 0
iov 0 0K 24K 166960K 150 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1520 96K 97K 166960K 3032 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 2K 5K 166960K 8 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 0K 166960K 148 0
dirhash 12 2K 2K 166960K 30 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 17 61K 240K 166960K 1663 0
sigio 0 0K 0K 166960K 98 0
proc 60 59K 100K 166960K 693 0
subproc 72 4K 4K 166960K 99 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 417 0
in_multi 68 5K 7K 166960K 199 0
ether_multi 1 0K 0K 166960K 14 0
mrt 0 0K 0K 166960K 9 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 115 519K 519K 166960K 115 0
exec 0 0K 1K 166960K 572 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 5 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 225 155K 172K 166960K 15851 0
UVM aobj 101 7K 7K 166960K 104 0
pinsyscall 38 76K 90K 166960K 2726 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 128 0
NDP 11 0K 1K 166960K 96 0
temp 75 8648K 8772K 166960K 74861 0
kqueue 14 22K 31K 166960K 375 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 301 0 298 3 0 3 3 0 8 2
rtentry 136 165 0 98 4 0 4 4 0 8 0
unpcb 144 1548 0 1530 11 3 8 8 0 8 6
syncache 336 4 0 4 2 1 1 1 0 8 1
tcpqe 32 1 0 1 1 0 1 1 0 8 1
tcpcb 736 627 0 622 7 0 7 7 0 8 6
arp 96 21 0 8 1 0 1 1 0 8 0
ipq 40 8 0 2 1 0 1 1 0 8 0
ipqe 40 48 0 41 1 0 1 1 0 8 0
inpcb 328 2001 0 1989 16 7 9 10 0 8 6
ip6q 72 8 0 7 2 1 1 1 0 8 0
ip6af 40 16 0 15 2 1 1 1 0 8 0
nd6 112 31 0 18 1 0 1 1 0 8 0
pkpcb 40 17 0 17 1 0 1 1 0 8 1
kcovpl 48 11 0 3 1 0 1 1 0 8 0
mppekey 1024 3 0 3 1 0 1 1 0 8 1
ppxss 1072 116 0 114 2 1 1 1 0 8 0
pppxif 1384 11 0 10 1 0 1 1 0 8 0
pfstscr 40 4 0 4 1 0 1 1 0 8 1
pfrktable 1344 2 0 2 1 0 1 1 0 8 1
pftag 88 3 0 0 1 0 1 1 0 8 0
pfstitem 24 3 0 0 1 0 1 1 0 8 0
pfstkey 128 9 0 6 1 0 1 1 0 8 0
pfstate 384 6 0 4 1 0 1 1 0 8 0
pfrule 1344 8 0 8 2 1 1 1 0 8 1
art_heap8 4096 3 0 0 3 0 3 3 0 8 0
art_heap4 256 777 0 452 30 4 26 30 0 8 3
art_table 40 780 0 452 5 0 5 5 0 8 0
art_node 32 163 0 101 1 0 1 1 0 8 0
sysvmsgpl 40 57 0 52 1 0 1 1 0 8 0
semapl 112 146 0 136 1 0 1 1 0 8 0
shmpl 112 101 0 3 3 0 3 3 0 8 0
dirhash 1024 29 0 12 3 0 3 3 0 8 0
dino2pl 256 4562 0 3062 95 0 95 95 0 8 0
ffsino 256 4562 0 3062 95 0 95 95 0 8 0
nchpl 144 6882 0 5191 63 0 63 63 0 8 0
rtmask 32 18 0 18 2 1 1 1 0 8 1
uvmvnodes 80 5591 0 0 115 0 115 115 0 8 0
vnodes 216 5591 0 0 311 0 311 311 0 8 0
namei 1024 25734 0 25734 3 1 2 2 0 8 2
kstatmem 264 148 0 125 3 0 3 3 0 8 1
scsiplug 72 8 0 8 1 0 1 1 0 8 1
scxspl 216 31091 0 31091 15 7 8 8 1 8 8
plimitpl 152 725 0 709 1 0 1 1 0 8 0
sigapl 424 1891 0 1847 7 1 6 6 0 8 0
knotepl 120 59599 0 59550 28 16 12 16 0 8 8
kqueuepl 184 964 0 953 4 0 4 4 0 8 3
pipepl 304 300 0 273 5 0 5 5 0 8 2
fdescpl 448 1870 0 1841 4 0 4 4 0 8 0
filepl 120 14754 0 14537 18 4 14 14 0 8 4
lockfpl 104 753 0 751 2 0 2 2 0 8 1
lockfspl 48 241 0 239 1 0 1 1 0 8 0
sessionpl 144 25 0 17 1 0 1 1 0 8 0
pgrppl 48 58 0 42 1 0 1 1 0 8 0
ucredpl 104 2268 0 2257 1 0 1 1 0 8 0
zombiepl 144 1850 0 1847 1 0 1 1 0 8 0
processpl 1152 1891 0 1847 4 0 4 4 0 8 0
procpl 664 4095 0 4047 7 1 6 6 0 8 0
sosppl 168 4 0 4 1 0 1 1 0 8 1
sockpl 552 4051 0 4018 24 13 11 17 0 8 6
mcl64k 65536 233 0 232 2 1 1 1 0 8 0
mcl12k 12288 1 0 1 1 0 1 1 0 8 1
mcl9k 9216 33 0 33 1 0 1 1 0 8 1
mcl8k 8192 47 0 47 4 1 3 3 0 8 3
mcl4k 4096 4382 0 4326 15 6 9 14 0 8 1
mcl2k 2048 2149 0 2140 4 2 2 3 0 8 0
mtagpl 96 43 0 39 2 1 1 1 0 8 0
mbufpl 256 21376 0 21204 37 17 20 27 0 8 8
bufpl 280 14292 0 8064 446 0 446 446 0 8 0
anonpl 24 282870 0 279630 91 22 69 69 0 187 35
amapchunkpl 152 52965 0 52501 40 5 35 35 0 158 13
amappl16 200 6363 0 6328 57 42 15 28 0 8 9
amappl15 192 29 0 29 1 1 0 1 0 8 0
amappl14 184 114 0 104 1 0 1 1 0 8 0
amappl13 176 7 0 7 2 1 1 1 0 8 1
amappl12 168 2534 0 2505 2 0 2 2 0 8 0
amappl11 160 46 0 36 1 0 1 1 0 8 0
amappl10 152 42 0 42 1 1 0 1 0 8 0
amappl9 144 253 0 253 1 1 0 1 0 8 0
amappl8 136 20 0 19 1 0 1 1 0 8 0
amappl7 128 108 0 97 1 0 1 1 0 8 0
amappl6 120 200 0 196 1 0 1 1 0 8 0
amappl5 112 123 0 116 1 0 1 1 0 8 0
amappl4 104 277 0 260 1 0 1 1 0 8 0
amappl3 96 9357 0 9268 3 0 3 3 0 8 0
amappl2 88 2127 0 2051 2 0 2 2 0 8 0
amappl1 80 14667 0 14114 15 1 14 14 0 8 0
amappl 88 14847 0 14687 5 0 5 5 0 92 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma512 512 1 0 1 1 0 1 1 0 8 1
dma256 256 8 0 8 2 1 1 1 0 8 1
dma128 128 256 0 256 2 1 1 1 0 8 1
dma64 64 9 0 9 2 1 1 1 0 8 1
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 19 0 18 1 0 1 1 0 8 0
aobjpl 72 103 0 3 2 0 2 2 0 8 0
uaddrrnd 24 1870 0 1841 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1870 0 1841 1 0 1 1 0 8 0
vmmpekpl 168 14946 0 14899 3 0 3 3 0 8 0
vmmpepl 168 120861 0 118977 111 10 101 101 0 357 11
vmsppl 368 1869 0 1841 4 1 3 4 0 8 0
rwobjpl 40 37111 0 30565 71 2 69 69 0 8 2
pdppl 4096 3747 0 3682 121 54 67 77 0 8 2
pvpl 32 816325 0 807606 180 36 144 144 0 265 49
pmappl 216 1869 0 1841 2 0 2 2 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 435 0 90 10 0 10 10 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8333d998) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff833797c0,ffffffff833d8140,3b9,ffffffff833b1e8c) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_finalize(ffff80002a89f618,ffffffff833310e8) at refcnt_finalize+0x1c8 sys/kern/kern_synch.c:954
pppx_if_destroy(205b9c,ffff80002a89f610) at pppx_if_destroy+0x3d sys/net/if_pppx.c:794
pppxclose(205b9c,1,2000,ffff800031503ca8) at pppxclose+0xa0 sys/net/if_pppx.c:541
spec_close(ffff80003c96d900) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd805eacf638,1,fffffd8007bfb7b8,ffff800031503ca8) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806b7f1e18,ffff800031503ca8) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806b7f1e18,ffff800031503ca8) at vn_closefile+0x11d sys/kern/vfs_vnops.c:615
fdrop(fffffd806b7f1e18,ffff800031503ca8) at fdrop+0x121 sys/kern/kern_descrip.c:1280
closef(fffffd806b7f1e18,ffff800031503ca8) at closef+0x190 sys/kern/kern_descrip.c:1264
fdfree(ffff800031503ca8) at fdfree+0x115 sys/kern/kern_descrip.c:1195
exit1(ffff800031503ca8,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff800031503ca8,ffff80003c96dc60,ffff80003c96dbb0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c96dc60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c96dc60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:746
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7781f4771060, count: -16
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8333d998) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff833797c0,ffffffff833d8140,3b9,ffffffff833b1e8c) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_finalize(ffff80002a89f618,ffffffff833310e8) at refcnt_finalize+0x1c8 sys/kern/kern_synch.c:954
pppx_if_destroy(205b9c,ffff80002a89f610) at pppx_if_destroy+0x3d sys/net/if_pppx.c:794
pppxclose(205b9c,1,2000,ffff800031503ca8) at pppxclose+0xa0 sys/net/if_pppx.c:541
spec_close(ffff80003c96d900) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd805eacf638,1,fffffd8007bfb7b8,ffff800031503ca8) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806b7f1e18,ffff800031503ca8) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806b7f1e18,ffff800031503ca8) at vn_closefile+0x11d sys/kern/vfs_vnops.c:615
fdrop(fffffd806b7f1e18,ffff800031503ca8) at fdrop+0x121 sys/kern/kern_descrip.c:1280
closef(fffffd806b7f1e18,ffff800031503ca8) at closef+0x190 sys/kern/kern_descrip.c:1264
fdfree(ffff800031503ca8) at fdfree+0x115 sys/kern/kern_descrip.c:1195
exit1(ffff800031503ca8,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff800031503ca8,ffff80003c96dc60,ffff80003c96dbb0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c96dc60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c96dc60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:746
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7781f4771060, count: -16