syzbot


assert "refs != ~NUM" failed in kern_synch.c

Status: upstream: reported on 2025/02/08 12:26
Reported-by: syzbot+bee527c059e64ef8bdec@syzkaller.appspotmail.com
First crash: 14d, last: 2h06m

Sample crash report:
panic: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 944
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8343fe55) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833ea525,ffffffff833eea67,3b0,ffffffff833eeaaf) at __assert+0x29
refcnt_finalize(ffff8000fffef988,ffffffff8332f76d) at refcnt_finalize+0x1c8 sys/kern/kern_synch.c:945
pppx_if_destroy(205b9a,ffff8000fffef980) at pppx_if_destroy+0x3d sys/net/if_pppx.c:806
pppxclose(205b9a,1,2000,ffff8000ffff47d8) at pppxclose+0xa0 sys/net/if_pppx.c:553
spec_close(ffff80003a8d4500) at spec_close+0x412
VOP_CLOSE(fffffd806a0f17f0,1,fffffd807f7d2680,ffff8000ffff47d8) at VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806bb46398,ffff8000ffff47d8) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806bb46398,ffff8000ffff47d8) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd806bb46398,ffff8000ffff47d8) at fdrop+0x126 sys/kern/kern_descrip.c:1265
closef(fffffd806bb46398,ffff8000ffff47d8) at closef+0x192 sys/kern/kern_descrip.c:1249
fdfree(ffff8000ffff47d8) at fdfree+0x116 sys/kern/kern_descrip.c:1181
exit1(ffff8000ffff47d8,0,0,1) at exit1+0x58f sys/kern/kern_exit.c:216
sys_exit(ffff8000ffff47d8,ffff80003a8d4870,ffff80003a8d47c0) at sys_exit+0x1a
end trace frame: 0xffff80003a8d4860, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 944
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8343fe55) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833ea525,ffffffff833eea67,3b0,ffffffff833eeaaf) at __assert+0x29
refcnt_finalize(ffff8000fffef988,ffffffff8332f76d) at refcnt_finalize+0x1c8 sys/kern/kern_synch.c:945
pppx_if_destroy(205b9a,ffff8000fffef980) at pppx_if_destroy+0x3d sys/net/if_pppx.c:806
pppxclose(205b9a,1,2000,ffff8000ffff47d8) at pppxclose+0xa0 sys/net/if_pppx.c:553
spec_close(ffff80003a8d4500) at spec_close+0x412
VOP_CLOSE(fffffd806a0f17f0,1,fffffd807f7d2680,ffff8000ffff47d8) at VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806bb46398,ffff8000ffff47d8) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806bb46398,ffff8000ffff47d8) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd806bb46398,ffff8000ffff47d8) at fdrop+0x126 sys/kern/kern_descrip.c:1265
closef(fffffd806bb46398,ffff8000ffff47d8) at closef+0x192 sys/kern/kern_descrip.c:1249
fdfree(ffff8000ffff47d8) at fdfree+0x116 sys/kern/kern_descrip.c:1181
exit1(ffff8000ffff47d8,0,0,1) at exit1+0x58f sys/kern/kern_exit.c:216
sys_exit(ffff8000ffff47d8,ffff80003a8d4870,ffff80003a8d47c0) at sys_exit+0x1a
syscall(ffff80003a8d4870) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003a8d4870) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7e85aef2c250, count: -16
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80003a8d42d0
rbx               0xffffffff837e5dc7    cpu_info_full_primary+0x2dc7
rdx                                0
rcx               0xffff8000ffff47d8
rax               0xffffffff837e4ff0    cpu_info_full_primary+0x1ff0
r8                                 0
r9                0x8080808080808080
r10               0x158e3a95a02894fe
r11               0xe216b6a623d71885
r12               0xffffffff837e5bc8    cpu_info_full_primary+0x2bc8
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff8136a795    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003a8d42c0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=295408 pid=5928 tcnt=0 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    runpri=32, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff8000ffff47d8 scnt=-1 ecnt=1
    forw=0xffffffffffffffff, list=0xffff8000ffff4f88,0xffff8000ffff4d08
    process=0xffff8000ffff04b8 user=0xffff80003a8cf000, vmspace=0xfffffd806be73900
    estcpu=36, cpticks=4, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  3925  146943  95856      0  2           0                syz-executor
  3925  321346  95856      0  3   0x4000000  smrbar        syz-executor
  3925  168714  95856      0  3   0x4000080  fsleep        syz-executor
  3925  160356  95856      0  3   0x4000080  fsleep        syz-executor
 96205   88665   8455      0  2   0x1000000                syz-executor
 96205  500111   8455      0  3   0x5000080  fsleep        syz-executor
 18900   53820  65020      0  2           0                syz-executor
 18900  240256  65020      0  2   0x4000000                syz-executor
 58675  356004  23501      0  2           0                syz-executor
 58675  321394  23501      0  3   0x4000080  fsleep        syz-executor
 58675  206308  23501      0  3   0x4000080  fsleep        syz-executor
 19457  452754      0      0  3     0x14200  acct          acct
  7149   60852      0      0  3     0x14200  bored         sosplice
 23501  274718  21799      0  2       0x482                syz-executor
  8455  200839  21799      0  3        0x82  nanoslp       syz-executor
 96135  140825  21799      0  2       0x482                syz-executor
 46060  370792  21799      0  2         0x2                syz-executor
 65020  470731  21799      0  2       0x482                syz-executor
 89188  391699  21799      0  3        0x82  wait          syz-executor
 82615  309507  21799      0  2       0x482                syz-executor
 95856  483090  21799      0  2       0x482                syz-executor
 21799  511316  96502      0  3        0x82  kqread        syz-executor
 96502  200108  14024      0  3    0x10008a  sigsusp       ksh
 14024  293132  84593      0  3        0x98  kqread        sshd-session
 84593  497668  23138      0  3        0x92  kqread        sshd-session
 74467  253779      1      0  3    0x100083  ttyin         getty
 23138  519768      1      0  3        0x88  kqread        sshd
 64796  274603  70180     74  3   0x1100092  bpf           pflogd
 70180  435821      1      0  3        0x80  sbwait        pflogd
 11346   94133  84418     73  3   0x1100090  kqread        syslogd
 84418  369616      1      0  3    0x100082  sbwait        syslogd
 42228  288267      1      0  3    0x100080  kqread        resolvd
 67696  499200  36133     77  3    0x100092  kqread        dhcpleased
 29944  351095  36133     77  3    0x100092  kqread        dhcpleased
 36133  216391      1      0  3        0x80  kqread        dhcpleased
 30290  407627      0      0  2     0x14200                smr
 97510  305113      0      0  2     0x14200                zerothread
 58978  112749      0      0  3     0x14200  aiodoned      aiodoned
 15340  253152      0      0  3     0x14200  syncer        update
 92924  440260      0      0  3     0x14200  cleaner       cleaner
 62133  381238      0      0  3     0x14200  reaper        reaper
 53797  447896      0      0  3     0x14200  pgdaemon      pagedaemon
 58422  265686      0      0  3     0x14200  bored         viomb
 98958  511865      0      0  3  0x40014200  acpi0         acpi0
  1998  311119      0      0  7  0x40014200                idle1
 38740   24427      0      0  3     0x14200  bored         softnet3
 50961  214434      0      0  3     0x14200  bored         softnet2
 23994  304890      0      0  3     0x14200  bored         softnet1
 35271   52393      0      0  3     0x14200  bored         softnet0
 27893   42285      0      0  3     0x14200  bored         systqmp
 97599   87624      0      0  3     0x14200  bored         systq
 22503  398148      0      0  3     0x14200  tmoslp        softclockmp
 88410  484603      0      0  2  0x40014200                softclock
 89151  369469      0      0  3  0x40014200                idle0
     1  309164      0      0  3     0x80082  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
Process 46060 (syz-executor) thread 0xffff80002a36bc48 (370792)
exclusive rrwlock inode r = 0 (0xfffffd806bdd5ce8)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1155
#1  rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:616
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vget+0x2bd sys/kern/vfs_subr.c:694
#6  ufs_ihashget+0x185 sys/ufs/ufs/ufs_ihash.c:98
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1201
#8  ufs_lookup+0x19f8 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#11 namei+0x7aa sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1866
#13 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0xb08 sys/arch/amd64/amd64/trap.c:577
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806c14e650)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1155
#1  rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:616
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1866
#8  syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb08 sys/arch/amd64/amd64/trap.c:577
#9  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10237  11300K   11473K 166960K     12344        0
            pcb    17     15K      16K 166960K       174        0
         rtable   227      8K       9K 166960K       445        0
             pf    40     18K      25K 166960K        94        0
         ifaddr    44      7K       8K 166960K        73        0
        ifgroup    60      2K       2K 166960K       106        0
         sysctl     4      1K       1K 166960K         4        0
       counters    68     36K      37K 166960K       132        0
       ioctlops     0      0K       4K 166960K      1537        0
            iov     0      0K      16K 166960K        25        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1338     84K      85K 166960K      1732        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        10        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        28        0
        dirhash    12      2K       2K 166960K        27        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      93K 166960K       652        0
          sigio     0      0K       0K 166960K        43        0
           proc    75    103K     140K 166960K       587        0
        subproc    72      4K       4K 166960K        73        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        57        0
       in_multi    95      7K       7K 166960K       125        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     1      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   187    837K     837K 166960K       187        0
           exec     0      0K       1K 166960K       407        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   229     72K      77K 166960K      7579        0
       UVM aobj    85      3K       3K 166960K        88        0
     pinsyscall    42     84K     104K 166960K      1735        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     3      0K       0K 166960K        30        0
            NDP    13      0K       2K 166960K        47        0
           temp    53   8638K    8704K 166960K     30168        0
         kqueue    15     24K      32K 166960K       129        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120       64    0       60     1     0     1     1     0     8    0
rtentry    112      140    0       40     4     0     4     4     0     8    0
unpcb      144      629    0      611     6     2     4     6     0     8    3
syncache   336        5    0        5     2     2     0     1     0     8    0
tcpqe       32        2    0        2     1     1     0     1     0     8    0
tcpcb      808      417    0      409     9     1     8     8     0     8    6
arp        120       24    0        7     1     0     1     1     0     8    0
inpcb      376     1017    0     1005    14     4    10    13     0     8    8
nd6        136       28    0        3     1     0     1     1     0     8    0
pkpcb       40       72    0       72     1     0     1     1     0     8    1
kcovpl      48        8    0        0     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     1     0     1     0     8    0
ppxss      1168      28    0       27     1     0     1     1     0     8    0
pppxif     1472       4    0        3     1     0     1     1     0     8    0
pfstscr     40        2    0        2     1     0     1     1     0     8    1
pffrag     232        3    0        0     1     0     1     1     0   482    0
pffrnode    88        3    0        0     1     0     1     1     0     8    0
pffrent     40        3    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pftag       88        2    0        2     1     1     0     1     0     8    0
pfstitem    24       55    0        3     1     0     1     1     0     8    0
pfstkey    128       58    0        6     2     0     2     2     0     8    0
pfstate    376       56    0        5     6     0     6     6     0     8    0
pfrule     1344      23    0       18     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      575    0      141    30     0    30    30     0     8    2
art_table   32      576    0      141     4     0     4     4     0     8    0
art_node    16      139    0       52     1     0     1     1     0     8    0
sysvmsgpl   40       41    0       39     1     0     1     1     0     8    0
semupl     112        2    0        2     2     2     0     1     0     8    0
semapl     112       25    0       15     1     0     1     1     0     8    0
shmpl      112       85    0        3     3     0     3     3     0     8    0
dirhash    1024      27    0       10     3     0     3     3     0     8    0
dino2pl    256     2535    0     1025    95     0    95    95     0     8    0
ffsino     280     2535    0     1025   109     0   109   109     0     8    0
nchpl      144     3460    0     1766    63     0    63    63     0     8    0
rtmask      32        5    0        5     1     0     1     1     0     8    1
uvmvnodes   80     2812    0        0    58     0    58    58     0     8    0
vnodes     216     2812    0        0   157     0   157   157     0     8    0
namei      1024   11600    0    11600     1     0     1     1     0     8    1
percpumem   16       80    0       32     1     0     1     1     0     8    0
kstatmem   264       58    0       32     3     0     3     3     0     8    1
scxspl     216    10933    0    10933     8     5     3     5     1     8    3
plimitpl   152      250    0      233     1     0     1     1     0     8    0
sigapl     424      955    0      904     7     1     6     7     0     8    0
futexpl     64     8546    0     8541     1     0     1     1     0     8    0
knotepl    120      510    0        0    16     0    16    16     0     8    0
kqueuepl   216      314    0      301     3     0     3     3     0     8    2
pipepl     328      154    0      127     3     0     3     3     0     8    0
fdescpl    504      933    0      902     5     0     5     5     0     8    0
filepl     152     5795    0     5562    16     2    14    16     0     8    3
lockfpl    104      156    0      151     1     0     1     1     0     8    0
lockfspl    48       60    0       56     1     0     1     1     0     8    0
sessionpl  144       23    0       14     1     0     1     1     0     8    0
pgrppl      48       37    0       20     1     0     1     1     0     8    0
ucredpl    104      832    0      819     1     0     1     1     0     8    0
zombiepl   144      907    0      904     1     0     1     1     0     8    0
processpl  1176     955    0      904     5     0     5     5     0     8    0
procpl     656     1844    0     1786     6     0     6     6     0     8    0
sosppl     168        8    0        8     1     0     1     1     0     8    1
sockpl     688     1882    0     1848    19     8    11    16     0     8    6
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     132    0        0    17     0    17    17     0     8    0
mcl2k      2048      24    0        0     3     0     3     3     0     8    0
mtagpl      96      213    0        0     6     0     6     6     0     8    0
mbufpl     256      386    0        0    25     0    25    25     0     8    0
bufpl      280     3414    0      136   235     0   235   235     0     8    0
anonpl      24   140144    0   136706    32     4    28    28     0   184    0
amapchunkpl 152   23867    0    23364    24     0    24    24     0   158    1
amappl16   200     2433    0     2401     5     2     3     5     0     8    0
amappl15   192        7    0        7     1     1     0     1     0     8    0
amappl14   184      112    0       99     1     0     1     1     0     8    0
amappl13   176        5    0        5     2     2     0     1     0     8    0
amappl12   168     1573    0     1542     3     1     2     2     0     8    0
amappl11   160       51    0       37     1     0     1     1     0     8    0
amappl10   152        5    0        5     1     1     0     1     0     8    0
amappl9    144      260    0      259     1     0     1     1     0     8    0
amappl8    136       22    0       20     1     0     1     1     0     8    0
amappl7    128      106    0       94     1     0     1     1     0     8    0
amappl6    120      179    0      175     1     0     1     1     0     8    0
amappl5    112      121    0      111     1     0     1     1     0     8    0
amappl4    104      317    0      298     1     0     1     1     0     8    0
amappl3     96     4698    0     4581     4     0     4     4     0     8    0
amappl2     88      646    0      585     2     0     2     2     0     8    0
amappl1     80     9503    0     8929    15     1    14    14     0     8    0
amappl      88     7182    0     7009     5     0     5     5     0    92    0
dma65536   65536      1    0        1     1     1     0     1     0     8    0
dma8192    8192       2    0        2     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       87    0        3     2     0     2     2     0     8    0
uaddrrnd    24      933    0      902     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      933    0      902     1     0     1     1     0     8    0
vmmpekpl   168     9135    0     9099     3     0     3     3     0     8    0
vmmpepl    168    61586    0    59701    90     1    89    90     0   357    3
vmsppl     456      932    0      902     5     0     5     5     0     8    1
rwobjpl     64    21255    0    17417    63     0    63    63     0     8    0
pdppl      4096    1874    0     1804   100    28    72    86     0     8    2
pvpl        32    11525    0        0    93     0    93    93     0   265    0
pmappl     248      932    0      902     3     0     3     3     0     8    0
extentpl    40       55    0       38     1     0     1     1     0     8    0
phpool     112      300    0       36     8     0     8     8     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8343fe55) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833ea525,ffffffff833eea67,3b0,ffffffff833eeaaf) at __assert+0x29
refcnt_finalize(ffff8000fffef988,ffffffff8332f76d) at refcnt_finalize+0x1c8 sys/kern/kern_synch.c:945
pppx_if_destroy(205b9a,ffff8000fffef980) at pppx_if_destroy+0x3d sys/net/if_pppx.c:806
pppxclose(205b9a,1,2000,ffff8000ffff47d8) at pppxclose+0xa0 sys/net/if_pppx.c:553
spec_close(ffff80003a8d4500) at spec_close+0x412
VOP_CLOSE(fffffd806a0f17f0,1,fffffd807f7d2680,ffff8000ffff47d8) at VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806bb46398,ffff8000ffff47d8) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806bb46398,ffff8000ffff47d8) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd806bb46398,ffff8000ffff47d8) at fdrop+0x126 sys/kern/kern_descrip.c:1265
closef(fffffd806bb46398,ffff8000ffff47d8) at closef+0x192 sys/kern/kern_descrip.c:1249
fdfree(ffff8000ffff47d8) at fdfree+0x116 sys/kern/kern_descrip.c:1181
exit1(ffff8000ffff47d8,0,0,1) at exit1+0x58f sys/kern/kern_exit.c:216
sys_exit(ffff8000ffff47d8,ffff80003a8d4870,ffff80003a8d47c0) at sys_exit+0x1a
syscall(ffff80003a8d4870) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003a8d4870) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7e85aef2c250, count: -16
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff800029aabff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x41e sys/dev/acpi/acpicpu.c:1218
sched_idle(ffff800029aabff0) at sched_idle+0x558 sys/kern/kern_sched.c:182
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff800029aabff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x41e sys/dev/acpi/acpicpu.c:1218
sched_idle(ffff800029aabff0) at sched_idle+0x558 sys/kern/kern_sched.c:182
end trace frame: 0x0, count: -5

Crashes (34):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/22 18:48 openbsd 45a541306066 d34966d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/22 14:15 openbsd 45a541306066 d34966d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/22 13:06 openbsd 45a541306066 d34966d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/22 10:33 openbsd 45a541306066 d34966d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/22 04:59 openbsd 6a403588e274 d34966d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/21 19:47 openbsd 6a403588e274 d34966d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/20 01:32 openbsd 483a78e15aaa 50668798 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/18 15:41 openbsd 6065620d7782 c37c7249 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/18 09:45 openbsd 6065620d7782 c37c7249 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/17 11:12 openbsd c48feb9479a9 4121cf9d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/16 14:26 openbsd a1e112ca8bad 40a34ec9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/16 10:52 openbsd a1e112ca8bad 40a34ec9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/16 03:33 openbsd a1e112ca8bad 40a34ec9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/15 16:42 openbsd 5c4be1f536db 40a34ec9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/15 13:02 openbsd 5c4be1f536db 40a34ec9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/15 05:41 openbsd 8d2464095911 40a34ec9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/15 02:36 openbsd 8d2464095911 40a34ec9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/14 14:24 openbsd 4b5fa14926a1 fe17639f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/13 12:46 openbsd bd92615b0406 7320a65f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/13 04:50 openbsd eb8501b6f1f9 2afad16e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/12 19:32 openbsd 705b70e045d6 b27c2402 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/12 18:34 openbsd 705b70e045d6 b27c2402 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/12 07:25 openbsd d800967ee04b f2baddf5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/12 00:51 openbsd 06a6b4fa55e8 f2baddf5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/11 06:57 openbsd c7df606a226b 43f51a00 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/10 22:58 openbsd 4f6ac7630c0c 43f51a00 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/10 19:01 openbsd 4f6ac7630c0c 43f51a00 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/10 15:35 openbsd 4f6ac7630c0c 43f51a00 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
2025/02/09 10:04 openbsd 2347e6edcd5e ef44b750 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/09 06:58 openbsd 2347e6edcd5e ef44b750 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/08 21:33 openbsd 2347e6edcd5e ef44b750 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/08 17:27 openbsd 2347e6edcd5e ef44b750 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/08 16:05 openbsd 2347e6edcd5e ef44b750 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs != ~NUM" failed in kern_synch.c
2025/02/08 12:25 openbsd 2347e6edcd5e ef44b750 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs != ~NUM" failed in kern_synch.c
* Struck through repros no longer work on HEAD.