syzbot


assert "refs > NUM" failed in kern_synch.c

Status: upstream: reported on 2025/09/09 19:41
Reported-by: syzbot+e0d831b30701aaff71bd@syzkaller.appspotmail.com
First crash: 54d, last: 10d

Sample crash report:
panic: kernel diagnostic assertion "refs > 1" failed: file "/syzkaller/managers/main/kernel/sys/kern/kern_synch.c", line 918
Starting stack trace...
panic(ffffffff833510ef) at panic+0x1ba sys/kern/subr_prf.c:229
__assert(ffffffff8339062a,ffffffff833f1dac,396,ffffffff8335fda6) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_take(ffff8000015596a0) at refcnt_take+0xf9 sys/kern/kern_synch.c:919
bpfsdetach(ffff8000014b5e80) at bpfsdetach+0xf0 sys/net/bpf.c:1793
bpfdetach(ffff800001456000) at bpfdetach+0x76 sys/net/bpf.c:-1
if_detach(ffff80000
1456000) at if_detach+0x1bb sys/net/if.c:1226
tun_clone_destroy(ffff800001456000) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:340
if_clone_destroy(ffff80003ca57d00) at if_clone_destroy+0x1d5 sys/net/if.c:1415
fifo_ioctl(ffff80003ca57b48) at fifo_ioctl+0x8e sys/miscfs/fifofs/fifo_vnops.c:308
VOP_IOCTL(fffffd8070de9568,80206979,ffff80003ca57d00,3,fffffd8007bfb618,ffff80003c94a7e8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806b8e82e0,80206979,ffff80003ca57d00,ffff80003c94a7e8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:531
sys_ioctl(ffff80003c94a7e8,ffff80003ca57ed0,ffff80003ca57e20) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003ca57ed0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003ca57ed0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xafd436fdc40, count: 243
End of stack trace.
syncing disks...set $lines = 0
set $maxwidth = 0
show panic
trace
show registers
show proc
ps
show all locks
show malloc
show all pools
machine ddbcpu 0
trace
machine ddbcpu 1
trace

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/23 11:36 openbsd 22e0e8faf4c6 c0460fcd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs > NUM" failed in kern_synch.c
2025/09/09 19:40 openbsd 3efab2192dd6 fdeaa69b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs > NUM" failed in kern_synch.c
* Struck through repros no longer work on HEAD.