syzbot


pool: free list modified: mbufpl (2)

Status: closed as dup on 2020/05/08 06:40
Reported-by: syzbot+c97ce78c14fc8ef266f9@syzkaller.appspotmail.com
First crash: 1898d, last: 1570d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
pool: cpu free list modified: mbufpl syz 15863 1570d 1856d
Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
panic(ADDR) at panic+0x15c (2) 25 1582d 1659d 0/3 closed as dup on 2020/05/07 11:46
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: mbufpl (3) 1 398d 398d 0/3 auto-obsoleted due to no activity on 2024/01/18 14:10
openbsd pool: free list modified: mbufpl (4) 1 203d 203d 0/3 auto-obsoleted due to no activity on 2024/07/31 23:52
openbsd pool: free list modified: mbufpl syz 13 2165d 2179d 3/3 fixed on 2019/01/06 10:35

Sample crash report:
login: panic: pool_do_get: mbufpl free list modified: page 0xfffffd807f00d000; item addr 0xfffffd807f00d200; offset 0x0=0x0 != 0xcd54101a19e27cf9
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 158854  48056      0         0x2  0x4000480    1  syz-execprog
*250030  96076      0     0x14000 0x40000200    0K softclock
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8249cdc0) at panic+0x164 sys/kern/subr_prf.c:218
pool_do_get(ffffffff828ecef0,2,ffff800020d97568) at pool_do_get+0x439 sys/kern/subr_pool.c:738
pool_get(ffffffff828ecef0,2) at pool_get+0xeb sys/kern/subr_pool.c:581
m_gethdr(2,1) at m_gethdr+0x4c sys/kern/uipc_mbuf.c:283
rtm_msg1(14,ffff800020d97678) at rtm_msg1+0x6e sys/net/rtsock.c:1534
rtm_addr(14,ffff800000aa0500) at rtm_addr+0x9b sys/net/rtsock.c:1740
nd6_dad_timer(ffff800000aa0500) at nd6_dad_timer+0x2f9 sys/netinet6/nd6_nbr.c:1244
timeout_run(ffff800000aed630) at timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:185 [inline]
timeout_run(ffff800000aed630) at timeout_run+0xc4 sys/kern/kern_timeout.c:496
softclock_thread(ffff800020d88ea0) at softclock_thread+0x16a sys/kern/kern_timeout.c:592
end trace frame: 0x0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
pool_do_get: mbufpl free list modified: page 0xfffffd807f00d000; item addr 0xfffffd807f00d200; offset 0x0=0x0 != 0xcd54101a19e27cf9
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8249cdc0) at panic+0x164 sys/kern/subr_prf.c:218
pool_do_get(ffffffff828ecef0,2,ffff800020d97568) at pool_do_get+0x439 sys/kern/subr_pool.c:738
pool_get(ffffffff828ecef0,2) at pool_get+0xeb sys/kern/subr_pool.c:581
m_gethdr(2,1) at m_gethdr+0x4c sys/kern/uipc_mbuf.c:283
rtm_msg1(14,ffff800020d97678) at rtm_msg1+0x6e sys/net/rtsock.c:1534
rtm_addr(14,ffff800000aa0500) at rtm_addr+0x9b sys/net/rtsock.c:1740
nd6_dad_timer(ffff800000aa0500) at nd6_dad_timer+0x2f9 sys/netinet6/nd6_nbr.c:1244
timeout_run(ffff800000aed630) at timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:185 [inline]
timeout_run(ffff800000aed630) at timeout_run+0xc4 sys/kern/kern_timeout.c:496
softclock_thread(ffff800020d88ea0) at softclock_thread+0x16a sys/kern/kern_timeout.c:592
end trace frame: 0x0, count: -10
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020d973b0
rbx               0xffff800020d97460
rdx                             0x8b
rcx                              0x2
rax                              0x1
r8                0xffffffff823bfbdf    kprintf+0x16f
r9                               0x1
r10                              0x2
r11               0x30f090498183f225
r12                     0x3000000008
r13               0xffff800020d973c0
r14                            0x100
r15                              0x1
rip               0xffffffff8236cd38    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020d973a0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (softclock) pid=250030 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
    pri=0, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800020d89110,0xffff800020d88760
    process=0xffff800020d8aba0 user=0xffff800020d92000, vmspace=0xffffffff828c0680
    estcpu=0, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 10544  203015  48056      0  2       0x482                syz-executor.0
 48056  103771  93271      0  3        0x82  thrsleep      syz-execprog
 48056  158854  93271      0  7   0x4000482                syz-execprog
 48056  219758  93271      0  3   0x4000082  thrsleep      syz-execprog
 48056  332107  93271      0  3   0x4000082  thrsleep      syz-execprog
 48056  120287  93271      0  3   0x4000082  thrsleep      syz-execprog
 48056  278648  93271      0  3   0x4000082  thrsleep      syz-execprog
 48056  443588  93271      0  3   0x4000082  kqread        syz-execprog
 48056  373997  93271      0  3   0x4000082  thrsleep      syz-execprog
 93271  518336  12078      0  3    0x10008a  pause         ksh
 12078  210459   1116      0  3        0x92  select        sshd
 14551  477182      1      0  3    0x100083  ttyin         getty
  1116  158312      1      0  3        0x80  select        sshd
 52658  352326  24888     74  3    0x100092  bpf           pflogd
 24888   96102      1      0  3        0x80  netio         pflogd
 26074   22281  39733     73  3    0x100090  kqread        syslogd
 39733  483057      1      0  3    0x100082  netio         syslogd
 73603  295468      1     77  3    0x100090  poll          dhclient
 89783  347753      1      0  3        0x80  poll          dhclient
 48439  255123      0      0  3     0x14200  bored         smr
 26912  212055      0      0  3     0x14200  pgzero        zerothread
 47242  376505      0      0  3     0x14200  aiodoned      aiodoned
 24698  414392      0      0  3     0x14200  syncer        update
 11949  488939      0      0  3     0x14200  cleaner       cleaner
 99491     855      0      0  3     0x14200  reaper        reaper
 95990   16959      0      0  3     0x14200  pgdaemon      pagedaemon
 60971  363638      0      0  3     0x14200  bored         crynlk
 90327   42697      0      0  3     0x14200  bored         crypto
 50037  164417      0      0  3  0x40014200  acpi0         acpi0
 81656  190680      0      0  3  0x40014200                idle1
 39571  507541      0      0  3     0x14200  bored         softnet
 52643  334219      0      0  3     0x14200  bored         systqmp
 63421   86418      0      0  3     0x14200  bored         systq
*96076  250030      0      0  7  0x40014200                softclock
 62561   23940      0      0  3  0x40014200                idle0
     1   30486      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex mbufpl r = 0 (0xffffffff828ecf00)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  mtx_enter_try+0x102
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  pool_get+0xbf sys/kern/subr_pool.c:578
#4  m_gethdr+0x4c sys/kern/uipc_mbuf.c:283
#5  rtm_msg1+0x6e sys/net/rtsock.c:1534
#6  rtm_addr+0x9b sys/net/rtsock.c:1740
#7  nd6_dad_timer+0x2f9 sys/netinet6/nd6_nbr.c:1244
#8  timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:185 [inline]
#8  timeout_run+0xc4 sys/kern/kern_timeout.c:496
#9  softclock_thread+0x16a sys/kern/kern_timeout.c:592
#10 proc_trampoline+0x1c
Process 96076 (softclock) thread 0xffff800020d88ea0 (250030)
exclusive rwlock netlock r = 0 (0xffffffff827b4428)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  nd6_dad_timer+0x34 sys/netinet6/nd6_nbr.c:1170
#2  timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:185 [inline]
#2  timeout_run+0xc4 sys/kern/kern_timeout.c:496
#3  softclock_thread+0x16a sys/kern/kern_timeout.c:592
#4  proc_trampoline+0x1c
shared rwlock timeout r = 0 (0xffffffff82793fe8)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  timeout_run+0xb9 sys/kern/kern_timeout.c:495
#2  softclock_thread+0x16a sys/kern/kern_timeout.c:592
#3  proc_trampoline+0x1c
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff828dc730)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  __mp_acquire_count+0x51 sys/kern/kern_lock.c:227
#2  mi_switch+0x392 sys/kern/sched_bsd.c:435
#3  sleep_finish+0x113 sys/kern/kern_synch.c:418
#4  softclock_thread+0x103 sys/kern/kern_timeout.c:587
#5  proc_trampoline+0x1c
exclusive mutex mbufpl r = 0 (0xffffffff828ecf00)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  mtx_enter_try+0x102
#2  mtx_enter+0x4b sys/kern/kern_lock.c:266
#3  pool_get+0xbf sys/kern/subr_pool.c:578
#4  m_gethdr+0x4c sys/kern/uipc_mbuf.c:283
#5  rtm_msg1+0x6e sys/net/rtsock.c:1534
#6  rtm_addr+0x9b sys/net/rtsock.c:1740
#7  nd6_dad_timer+0x2f9 sys/netinet6/nd6_nbr.c:1244
#8  timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:185 [inline]
#8  timeout_run+0xc4 sys/kern/kern_timeout.c:496
#9  softclock_thread+0x16a sys/kern/kern_timeout.c:592
#10 proc_trampoline+0x1c
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9464   6394K    6394K  78643K     10557        0
            pcb    13      8K       8K  78643K        13        0
         rtable    83      2K       2K  78643K       163        0
         ifaddr    37      9K       9K  78643K        78        0
       counters    41     33K      33K  78643K        41        0
       ioctlops     0      0K       4K  78643K      1468        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1183     74K      75K  78643K      1188        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      1K       1K  78643K         2        0
            sem     2      0K       0K  78643K         2        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1824    197K     290K  78643K     13058        0
      file desc     2      4K      12K  78643K        57        0
           proc    59     63K      83K  78643K       398        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    22      1K       1K  78643K        22        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    19     95K      95K  78643K        19        0
           exec     0      0K       1K  78643K       197        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap    89     12K      13K  78643K      1000        0
       UVM aobj     3      2K       2K  78643K         3        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
            NDP     6      0K       0K  78643K         7        0
           temp    29   3849K    3913K  78643K      1948        0
         kqueue     3      4K       4K  78643K         3        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        4    0        0     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       17    0       15     1     0     1     1     0     8    0
rtentry    112       34    0        1     1     0     1     1     0     8    0
unpcb      120       29    0       19     1     0     1     1     0     8    0
syncache   264        5    0        5     2     1     1     1     0     8    1
tcpcb      544        8    0        5     1     0     1     1     0     8    0
inpcb      296       73    0       67     1     0     1     1     0     8    0
nd6         48        3    0        0     1     0     1     1     0     8    0
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       11    0        2     1     0     1     1     0     8    0
pfstkey    112       11    0        2     1     0     1     1     0     8    0
pfstate    328       11    0        2     1     0     1     1     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      144    0        0     9     0     9     9     0     8    0
art_table   32      145    0        0     2     0     2     2     0     8    0
art_node    16       33    0        3     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1461    0       61    88     0    88    88     0     8    0
ffsino     272     1461    0       61    94     0    94    94     0     8    0
nchpl      144     1718    0      117    61     1    60    60     0     8    0
uvmvnodes   72     1471    0        0    27     0    27    27     0     8    0
vnodes     208     1471    0        0    78     0    78    78     0     8    0
namei      1024    4382    0     4382     2     1     1     1     0     8    1
percpumem   16       31    0        0     1     0     1     1     0     8    0
scxspl     192     4807    0     4807     9     3     6     7     0     8    6
plimitpl   152       15    0        8     1     0     1     1     0     8    0
sigapl     424      280    0      251     4     0     4     4     0     8    0
knotepl    112       48    0       36     1     0     1     1     0     8    0
kqueuepl   144        2    0        0     1     0     1     1     0     8    0
pipepl     304       78    0       70     2     1     1     1     0     8    0
fdescpl    496      265    0      251     3     0     3     3     0     8    0
filepl     152     1192    0     1132     3     0     3     3     0     8    0
lockfpl    104        5    0        4     1     0     1     1     0     8    0
lockfspl    48        3    0        2     1     0     1     1     0     8    0
sessionpl  112       19    0        9     1     0     1     1     0     8    0
pgrppl      48       19    0        9     1     0     1     1     0     8    0
ucredpl     96       62    0       53     1     0     1     1     0     8    0
zombiepl   144      251    0      250     2     1     1     1     0     8    0
processpl  992      280    0      250     5     0     5     5     0     8    1
procpl     624      287    0      250     3     0     3     3     0     8    0
sockpl     400      119    0      101     2     0     2     2     0     8    0
mcl4k      4096       3    0        0     1     0     1     1     0     8    0
mcl2k      2048      56    0        0     7     0     7     7     0     8    0
mtagpl      96        1    0        0     1     0     1     1     0     8    0
mbufpl     256       91    0        0     5     0     5     5     0     8    0
mbufpl: pool(0xffffffff828ecef0:mbufpl): free list modified: page 0xfffffd807f00d000; item ordinal 0; addr 0xfffffd807f00d200 (p 0xfffffd807f7c4000); offset 0x0=0x0
pool(mbufpl): free list modified: page 0xfffffd807f00d000; item ordinal 0; addr 0xfffffd807f00d200 (p 0xfffffd807f7c4000); offset 0x0=0x0
mbufpl: pool(0xffffffff828ecef0:mbufpl): page inconsistency: page 0xfffffd807f00d000; item ordinal 1; addr 0x6818f5e432de9fdb
bufpl      280     3026    0      127   208     0   208   208     0     8    0
anonpl      16    23325    0    21580    14     2    12    12     0   124    4
amapchunkpl 152     922    0      817     5     0     5     5     0   158    0
amappl16   192      288    0      255     2     0     2     2     0     8    0
amappl15   184        1    0        0     1     0     1     1     0     8    0
amappl14   176       44    0       42     1     0     1     1     0     8    0
amappl13   168       23    0       20     2     1     1     1     0     8    0
amappl12   160       22    0       19     1     0     1     1     0     8    0
amappl11   152       53    0       38     1     0     1     1     0     8    0
amappl10   144       24    0       21     1     0     1     1     0     8    0
amappl9    136      222    0      219     1     0     1     1     0     8    0
amappl8    128      283    0      264     1     0     1     1     0     8    0
amappl7    120      108    0      100     1     0     1     1     0     8    0
amappl6    112       28    0       25     1     0     1     1     0     8    0
amappl5    104      170    0      155     1     0     1     1     0     8    0
amappl4     96      501    0      475     1     0     1     1     0     8    0
amappl3     88      165    0      157     1     0     1     1     0     8    0
amappl2     80      982    0      924     3     1     2     2     0     8    0
amappl1     72    15858    0    15438    23     5    18    18     0     8    8
amappl      80      524    0      489     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      265    0      251     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      265    0      251     1     0     1     1     0     8    0
vmmpekpl   168     6474    0     6446     2     0     2     2     0     8    0
vmmpepl    168    34523    0    33572    85    12    73    73     0   357   29
vmsppl     368      264    0      251     2     0     2     2     0     8    0
pdppl      4096     537    0      502     6     0     6     6     0     8    1
pvpl        32   117904    0   113838   110     6   104   104     0   265   69
pmappl     232      264    0      251     1     0     1     1     0     8    0
extentpl    40       53    0       36     1     0     1     1     0     8    0
phpool     112      228    0        4     7     0     7     7     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8249cdc0) at panic+0x164 sys/kern/subr_prf.c:218
pool_do_get(ffffffff828ecef0,2,ffff800020d97568) at pool_do_get+0x439 sys/kern/subr_pool.c:738
pool_get(ffffffff828ecef0,2) at pool_get+0xeb sys/kern/subr_pool.c:581
m_gethdr(2,1) at m_gethdr+0x4c sys/kern/uipc_mbuf.c:283
rtm_msg1(14,ffff800020d97678) at rtm_msg1+0x6e sys/net/rtsock.c:1534
rtm_addr(14,ffff800000aa0500) at rtm_addr+0x9b sys/net/rtsock.c:1740
nd6_dad_timer(ffff800000aa0500) at nd6_dad_timer+0x2f9 sys/netinet6/nd6_nbr.c:1244
timeout_run(ffff800000aed630) at timeout_run+0xc4 timeout_sync_leave sys/kern/kern_timeout.c:185 [inline]
timeout_run(ffff800000aed630) at timeout_run+0xc4 sys/kern/kern_timeout.c:496
softclock_thread(ffff800020d88ea0) at softclock_thread+0x16a sys/kern/kern_timeout.c:592
end trace frame: 0x0, count: -10
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffff800020d70ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__sanitizer_cov_trace_cmp4(ffffffff828dc528,ffffffff828dc528) at __sanitizer_cov_trace_cmp4+0xb sys/dev/kcov.c:134
__mp_acquire_count(ffffffff828dc528,1) at __mp_acquire_count+0x51 sys/kern/kern_lock.c:227
mi_switch() at mi_switch+0x392 sys/kern/sched_bsd.c:435
sleep_finish(ffff800020e7c190,1) at sleep_finish+0x113 sys/kern/kern_synch.c:418
sleep_finish_all(ffff800020e7c190,1) at sleep_finish_all+0x32 sleep_finish_timeout sys/kern/kern_synch.c:447 [inline]
sleep_finish_all(ffff800020e7c190,1) at sleep_finish_all+0x32 sys/kern/kern_synch.c:393
tsleep(ffffffff827ea6d8,120,ffffffff823fab70,2) at tsleep+0x1cc sys/kern/kern_synch.c:155
sys_nanosleep(ffff800020e40600,ffff800020e7c2c0,ffff800020e7c310) at sys_nanosleep+0x205 sys/kern/kern_time.c:297
syscall(ffff800020e7c390) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020e7c390) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc000041f20, count: 3
ddb{1}> trace
x86_ipi_db(ffff800020d70ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352
x86_ipi_handler() at x86_ipi_handler+0xc6 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__sanitizer_cov_trace_cmp4(ffffffff828dc528,ffffffff828dc528) at __sanitizer_cov_trace_cmp4+0xb sys/dev/kcov.c:134
__mp_acquire_count(ffffffff828dc528,1) at __mp_acquire_count+0x51 sys/kern/kern_lock.c:227
mi_switch() at mi_switch+0x392 sys/kern/sched_bsd.c:435
sleep_finish(ffff800020e7c190,1) at sleep_finish+0x113 sys/kern/kern_synch.c:418
sleep_finish_all(ffff800020e7c190,1) at sleep_finish_all+0x32 sleep_finish_timeout sys/kern/kern_synch.c:447 [inline]
sleep_finish_all(ffff800020e7c190,1) at sleep_finish_all+0x32 sys/kern/kern_synch.c:393
tsleep(ffffffff827ea6d8,120,ffffffff823fab70,2) at tsleep+0x1cc sys/kern/kern_synch.c:155
sys_nanosleep(ffff800020e40600,ffff800020e7c2c0,ffff800020e7c310) at sys_nanosleep+0x205 sys/kern/kern_time.c:297
syscall(ffff800020e7c390) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020e7c390) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc000041f20, count: -12
ddb{1}> 

Crashes (1781):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/31 13:59 openbsd b767a9add6bd 8df85ed9 .config console log report syz ci-openbsd-multicore
2020/07/31 00:00 openbsd 0a287e03b198 8df85ed9 .config console log report syz ci-openbsd-multicore
2020/07/25 12:53 openbsd df3b6e8e927c 1f7cc1ca .config console log report syz ci-openbsd-multicore
2020/07/24 21:37 openbsd 6e780b9a59f4 554af388 .config console log report syz ci-openbsd-multicore
2020/07/20 01:49 openbsd 5cb69e53a7eb 9c812472 .config console log report syz ci-openbsd-multicore
2020/07/18 07:44 openbsd a44bf07fbdaa 9c812472 .config console log report syz ci-openbsd-multicore
2020/07/17 16:12 openbsd 452daaedc6a4 9c812472 .config console log report syz ci-openbsd-multicore
2020/07/15 11:10 openbsd b536459a84b7 ada108d0 .config console log report syz ci-openbsd-multicore
2020/07/12 02:14 openbsd a8ec3f05749f 7ba05d2d .config console log report syz ci-openbsd-multicore
2020/07/11 14:22 openbsd b1f788244d72 7ba05d2d .config console log report syz ci-openbsd-multicore
2020/07/05 07:59 openbsd f724afe49a5c bed10395 .config console log report syz ci-openbsd-main
2020/06/29 16:15 openbsd c3a4abad4b7f 0375051c .config console log report syz ci-openbsd-multicore
2020/06/29 15:59 openbsd c3a4abad4b7f 0375051c .config console log report syz ci-openbsd-multicore
2020/06/28 11:21 openbsd 634337a5c27d a2cdad9d .config console log report syz ci-openbsd-multicore
2020/06/27 19:07 openbsd dbf2cc62e98d 032b4239 .config console log report syz ci-openbsd-multicore
2020/06/25 08:59 openbsd 3209772dfcc3 9d60b18e .config console log report syz ci-openbsd-multicore
2020/06/21 14:05 openbsd 9a712520a662 c655ec77 .config console log report syz ci-openbsd-multicore
2020/06/18 20:24 openbsd e8105163f17b 3ea11d3f .config console log report syz ci-openbsd-multicore
2020/06/14 19:55 openbsd 498b1e7a765a 2a22c77a .config console log report syz ci-openbsd-multicore
2020/06/07 00:19 openbsd d3d7dc897d09 e6b89e4e .config console log report syz ci-openbsd-multicore
2020/06/03 21:10 openbsd b8f1c15c74ba a5ce5de0 .config console log report syz ci-openbsd-multicore
2020/06/03 20:30 openbsd b8f1c15c74ba a5ce5de0 .config console log report syz ci-openbsd-multicore
2020/05/29 03:19 openbsd 0a71812f803f d19ed305 .config console log report syz ci-openbsd-multicore
2020/05/28 06:32 openbsd 0025f5bb9c9b fdf90f62 .config console log report syz ci-openbsd-multicore
2020/05/27 07:40 openbsd c5e4be465a16 9072c126 .config console log report syz ci-openbsd-multicore
2020/05/26 13:26 openbsd 4e2f099e1acf 8ca3b7d2 .config console log report syz ci-openbsd-multicore
2020/05/24 21:19 openbsd 12bad2091a27 ce7ca010 .config console log report syz ci-openbsd-main
2020/05/23 16:03 openbsd 4a4f83401893 9682898d .config console log report syz ci-openbsd-multicore
2020/05/11 12:14 openbsd 141b3f16fee0 f8f57555 .config console log report syz ci-openbsd-multicore
2020/05/09 22:32 openbsd 7752f9fda662 88cb3e92 .config console log report syz ci-openbsd-multicore
2020/05/09 10:09 openbsd d38dc9a70468 e97b06d3 .config console log report syz ci-openbsd-main
2020/05/09 04:43 openbsd d38dc9a70468 e97b06d3 .config console log report syz ci-openbsd-multicore
2020/05/09 04:24 openbsd d38dc9a70468 e97b06d3 .config console log report syz ci-openbsd-multicore
2020/05/09 03:28 openbsd d38dc9a70468 e97b06d3 .config console log report syz ci-openbsd-multicore
2020/05/09 03:13 openbsd d38dc9a70468 e97b06d3 .config console log report syz ci-openbsd-main
2020/05/08 17:27 openbsd 7bb4371dccb1 fe4122c3 .config console log report syz ci-openbsd-main
2020/05/08 08:27 openbsd 30e1cf84d14e 6c70a1c2 .config console log report syz ci-openbsd-main
2020/05/07 17:05 openbsd 99490db6b06d 98cbd87b .config console log report syz ci-openbsd-main
2020/05/07 07:43 openbsd 99490db6b06d 4618eb2d .config console log report syz ci-openbsd-main
2020/05/06 18:47 openbsd 7237aa572037 4618eb2d .config console log report syz ci-openbsd-main
2019/09/21 13:19 openbsd ea5e035f4d57 d96e88f3 .config console log report syz ci-openbsd-main
2020/08/05 00:39 openbsd fd07ab7ef78f 43f1389d .config console log report ci-openbsd-multicore
2020/08/04 23:06 openbsd fd07ab7ef78f 43f1389d .config console log report ci-openbsd-main
2020/08/03 17:08 openbsd 02ddb7a22afb 63a73341 .config console log report ci-openbsd-multicore
2020/08/03 09:04 openbsd 84e8f3e59749 63a73341 .config console log report ci-openbsd-multicore
2020/08/03 07:43 openbsd 84e8f3e59749 63a73341 .config console log report ci-openbsd-main
2020/08/03 05:56 openbsd 84e8f3e59749 63a73341 .config console log report ci-openbsd-main
2020/08/03 02:23 openbsd 84e8f3e59749 63a73341 .config console log report ci-openbsd-main
2020/08/02 23:03 openbsd 84e8f3e59749 63a73341 .config console log report ci-openbsd-main
2020/08/02 18:12 openbsd 41d03808d33a 63a73341 .config console log report ci-openbsd-multicore
2020/08/01 20:38 openbsd 724b49ef0a35 d895b3be .config console log report ci-openbsd-multicore
2020/08/01 16:51 openbsd 18f4917e2c82 d895b3be .config console log report ci-openbsd-multicore
2020/08/01 06:54 openbsd 18f4917e2c82 d895b3be .config console log report ci-openbsd-multicore
2020/08/01 05:37 openbsd 18f4917e2c82 d895b3be .config console log report ci-openbsd-multicore
2020/07/31 16:55 openbsd d7a9fa610752 d895b3be .config console log report ci-openbsd-main
2020/07/31 12:19 openbsd b767a9add6bd 8df85ed9 .config console log report ci-openbsd-multicore
2020/07/31 10:46 openbsd b767a9add6bd 8df85ed9 .config console log report ci-openbsd-multicore
2020/07/30 14:50 openbsd 31f29d64e9f9 233283a1 .config console log report ci-openbsd-multicore
2020/07/30 02:16 openbsd 511c53b12928 233283a1 .config console log report ci-openbsd-main
2020/07/30 00:35 openbsd 25f2901d1c23 233283a1 .config console log report ci-openbsd-multicore
2020/07/29 21:13 openbsd 25f2901d1c23 233283a1 .config console log report ci-openbsd-multicore
2020/07/29 12:01 openbsd 25f2901d1c23 19a8de55 .config console log report ci-openbsd-multicore
2020/07/25 23:09 openbsd df3b6e8e927c 1f7cc1ca .config console log report ci-openbsd-multicore
2020/07/25 21:55 openbsd df3b6e8e927c 1f7cc1ca .config console log report ci-openbsd-main
2020/07/25 15:30 openbsd df3b6e8e927c 1f7cc1ca .config console log report ci-openbsd-main
2020/07/25 06:56 openbsd a9f43bc31f08 0a13649c .config console log report ci-openbsd-main
2020/07/25 04:44 openbsd a9f43bc31f08 0a13649c .config console log report ci-openbsd-multicore
2020/07/25 02:05 openbsd a9f43bc31f08 0a13649c .config console log report ci-openbsd-multicore
2020/07/24 20:16 openbsd 6e780b9a59f4 554af388 .config console log report ci-openbsd-main
2020/07/24 13:30 openbsd 6e780b9a59f4 554af388 .config console log report ci-openbsd-multicore
2020/07/24 09:18 openbsd 6e780b9a59f4 70c104a1 .config console log report ci-openbsd-multicore
2020/07/24 08:12 openbsd 6e780b9a59f4 70c104a1 .config console log report ci-openbsd-main
2020/07/23 11:03 openbsd fad015d206fd 340ea530 .config console log report ci-openbsd-main
2020/07/23 03:29 openbsd fad015d206fd 340ea530 .config console log report ci-openbsd-multicore
2020/07/23 00:24 openbsd fad015d206fd 340ea530 .config console log report ci-openbsd-main
2020/07/22 18:56 openbsd e9ef9ac65b9c 128cd85f .config console log report ci-openbsd-multicore
2020/07/22 07:20 openbsd 12d98fe19503 21f1765e .config console log report ci-openbsd-main
2020/07/22 01:32 openbsd 12d98fe19503 21f1765e .config console log report ci-openbsd-multicore
2020/07/21 23:49 openbsd 12d98fe19503 21f1765e .config console log report ci-openbsd-multicore
2020/07/21 14:32 openbsd 38194102e48c 328906f3 .config console log report ci-openbsd-multicore
2020/07/21 06:25 openbsd 610b9993a684 d88894e6 .config console log report ci-openbsd-multicore
2020/07/21 00:00 openbsd 610b9993a684 d88894e6 .config console log report ci-openbsd-main
2020/07/20 18:19 openbsd bea295828719 8caeeeb7 .config console log report ci-openbsd-multicore
2019/09/11 12:56 openbsd 067ee7eb2bf9 a60cb4cd .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.