syzbot


panic: assertwaitok: non-zero mutex count: NUM

Status: fixed on 2023/12/19 18:40
Reported-by: syzbot+f79c896ec019553655a0@syzkaller.appspotmail.com
Fix commit: 540e94b5c59a soreceive() must not hold mutex when calling sblock().
First crash: 339d, last: 338d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: assertwaitok: non-zero mutex count: NUM (2) 178 1d12h 122d 0/3 upstream: reported on 2024/07/22 08:45

Sample crash report:
panic: assertwaitok: non-zero mutex count: 1
Stopped at      db_enter+0x1c:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 198283  22761      0         0x2  0x4000000    0  syz-executor3014581156
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827c19a3) at panic+0x17b sys/kern/subr_prf.c:198
assertwaitok() at assertwaitok+0x132 sys/kern/subr_xxx.c:163
mi_switch() at mi_switch+0x46 sys/kern/sched_bsd.c:360
sleep_finish(0,1) at sleep_finish+0x19b sys/kern/kern_synch.c:414
rwsleep(fffffd806d86d320,ffffffff82c4a100,118,ffffffff827afd95,0) at rwsleep+0xab sys/kern/kern_synch.c:300
sosleep_nsec(fffffd806d86d200,fffffd806d86d320,118,ffffffff827afd95,ffffffffffffffff) at sosleep_nsec+0xff sys/kern/uipc_socket2.c:468
sblock(fffffd806d86d200,fffffd806d86d2d0,1) at sblock+0x1c4 sys/kern/uipc_socket2.c:514
soreceive(fffffd806d86d200,ffff80002a236938,ffff80002a2368f8,0,0,ffff80002a236abc,27bd27254a5463f2) at soreceive+0x5fe sys/kern/uipc_socket.c:837
recvit(ffff80002a1ce550,5,ffff80002a236a90,0,ffff80002a236a88) at recvit+0x31b sys/kern/uipc_syscalls.c:1082
sys_recvmmsg(ffff80002a1ce550,ffff80002a236b90,ffff80002a236be0) at sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
syscall(ffff80002a236c60) at syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
syscall(ffff80002a236c60) at syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd56cdc45b40, count: 2
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: assertwaitok: non-zero mutex count: 1
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827c19a3) at panic+0x17b sys/kern/subr_prf.c:198
assertwaitok() at assertwaitok+0x132 sys/kern/subr_xxx.c:163
mi_switch() at mi_switch+0x46 sys/kern/sched_bsd.c:360
sleep_finish(0,1) at sleep_finish+0x19b sys/kern/kern_synch.c:414
rwsleep(fffffd806d86d320,ffffffff82c4a100,118,ffffffff827afd95,0) at rwsleep+0xab sys/kern/kern_synch.c:300
sosleep_nsec(fffffd806d86d200,fffffd806d86d320,118,ffffffff827afd95,ffffffffffffffff) at sosleep_nsec+0xff sys/kern/uipc_socket2.c:468
sblock(fffffd806d86d200,fffffd806d86d2d0,1) at sblock+0x1c4 sys/kern/uipc_socket2.c:514
soreceive(fffffd806d86d200,ffff80002a236938,ffff80002a2368f8,0,0,ffff80002a236abc,27bd27254a5463f2) at soreceive+0x5fe sys/kern/uipc_socket.c:837
recvit(ffff80002a1ce550,5,ffff80002a236a90,0,ffff80002a236a88) at recvit+0x31b sys/kern/uipc_syscalls.c:1082
sys_recvmmsg(ffff80002a1ce550,ffff80002a236b90,ffff80002a236be0) at sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
syscall(ffff80002a236c60) at syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
syscall(ffff80002a236c60) at syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd56cdc45b40, count: -13
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a2364a0
rbx               0xffff800029d2cba7
rdx                            0x3fd
rcx                                0
rax                             0x2d
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xc6904616f179d210
r11                0xc80610c20958701
r12               0xffff800029d2c9a8
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff822e738c    db_enter+0x1c
cs                               0x8
rflags                         0x246
rsp               0xffff80002a236490
ss                              0x10
db_enter+0x1c:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor3014581156) tid=26884 pid=22761 tcnt=4 stat=sleep
    flags process=2<EXEC> proc=4000080<SINTR,THREAD>
    runpri=24, usrpri=53, slppri=24, nice=20
    wchan=0xfffffd806d86d320, wmesg=netlck, ps_single=0x0
    forw=0x0, list=0xffff80002a185d50,0xffff80002a1ce2b8
    process=0xffff8000ffff69f0 user=0xffff80002a231000, vmspace=0xfffffd806e9b31e0
    estcpu=3, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 22761   81306  61628      0  3        0x82  nanoslp       syz-executor3014581156
 22761  198283  61628      0  7   0x4000002                syz-executor3014581156
*22761   26884  61628      0  3   0x4000082  netlck        syz-executor3014581156
 22761  280243  61628      0  3   0x4000082  fsleep        syz-executor3014581156
 61628  174040  36343      0  3    0x10008a  sigsusp       ksh
 36343  381081  90090      0  3        0x9a  kqread        sshd
 25172  516296      1      0  3    0x100083  ttyin         getty
 90090  268151      1      0  3        0x88  kqread        sshd
 20798  171767  65414     74  3   0x1100092  bpf           pflogd
 65414   60740      1      0  3        0x80  netio         pflogd
 72019  440083  87753     73  3   0x1100090  kqread        syslogd
 87753  473010      1      0  3    0x100082  netio         syslogd
 44932  104283      1      0  3    0x100080  kqread        resolvd
  4252  291308  42587     77  3    0x100092  kqread        dhcpleased
 69385  486072  42587     77  3    0x100092  kqread        dhcpleased
 42587  499737      1      0  3        0x80  kqread        dhcpleased
 64513  396002      0      0  3     0x14200  bored         smr
 74600  333886      0      0  3     0x14200  pgzero        zerothread
 96240  219718      0      0  3     0x14200  aiodoned      aiodoned
 12174   67676      0      0  3     0x14200  syncer        update
 99807  186239      0      0  3     0x14200  cleaner       cleaner
 30016  169706      0      0  3     0x14200  reaper        reaper
 16021    2173      0      0  3     0x14200  pgdaemon      pagedaemon
 79485   14675      0      0  3     0x14200  bored         viomb
 83583  457085      0      0  3  0x40014200  acpi0         acpi0
 34995  372446      0      0  3  0x40014200                idle1
 93761   95749      0      0  3     0x14200  bored         softnet3
  2263  187180      0      0  3     0x14200  bored         softnet2
 37558  509583      0      0  3     0x14200  bored         softnet1
 47301   70488      0      0  3     0x14200  bored         softnet0
 49275  345517      0      0  3     0x14200  bored         systqmp
 99081  236092      0      0  3     0x14200  bored         systq
 17414  189941      0      0  3     0x14200  tmoslp        softclockmp
 64230  290626      0      0  3  0x40014200  tmoslp        softclock
 41717  237146      0      0  3  0x40014200                idle0
     1  302051      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
CPU 1:
exclusive sched_lock &sched_lock r = 0 (0xffffffff82d3bdb0)
#0  witness_lock+0x447
#1  sleep_finish+0x142 sys/kern/kern_synch.c:398
#2  rwsleep+0xab sys/kern/kern_synch.c:300
#3  sosleep_nsec+0xff sys/kern/uipc_socket2.c:468
#4  sblock+0x1c4 sys/kern/uipc_socket2.c:514
#5  soreceive+0x5fe sys/kern/uipc_socket.c:837
#6  recvit+0x31b sys/kern/uipc_syscalls.c:1082
#7  sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
#8  syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#8  syscall+0x50f sys/arch/amd64/amd64/trap.c:606
#9  Xsyscall+0x128
exclusive mutex &inp->inp_mtx r = 0 (0xfffffd806f514ad0)
#0  witness_lock+0x447
#1  mtx_enter_try+0x104
#2  mtx_enter+0x4f sys/kern/kern_lock.c:266
#3  soreceive+0x5dc pru_lock sys/sys/protosw.h:288 [inline]
#3  soreceive+0x5dc sys/kern/uipc_socket.c:911
#4  recvit+0x31b sys/kern/uipc_syscalls.c:1082
#5  sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
#6  syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#6  syscall+0x50f sys/arch/amd64/amd64/trap.c:606
#7  Xsyscall+0x128
Process 22761 (syz-executor3014581156) thread 0xffff80002a185d50 (198283)
exclusive rwlock solock r = 0 (0xfffffd806d86d218)
#0  witness_lock+0x447
#1  rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2  soreceive+0xd05 pru_lock sys/sys/protosw.h:287 [inline]
#2  soreceive+0xd05 sys/kern/uipc_socket.c:1062
#3  recvit+0x31b sys/kern/uipc_syscalls.c:1082
#4  sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
#5  syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#5  syscall+0x50f sys/arch/amd64/amd64/trap.c:606
#6  Xsyscall+0x128
shared rwlock netlock r = 0 (0xffffffff82c4a110)
#0  witness_lock+0x447
#1  solock_shared+0x68 sys/kern/uipc_socket2.c:370
#2  soreceive+0xd05 pru_lock sys/sys/protosw.h:287 [inline]
#2  soreceive+0xd05 sys/kern/uipc_socket.c:1062
#3  recvit+0x31b sys/kern/uipc_syscalls.c:1082
#4  sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
#5  syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#5  syscall+0x50f sys/arch/amd64/amd64/trap.c:606
#6  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10165   6456K    6457K 166960K     11243        0
            pcb    13      8K       8K 166960K        13        0
         rtable    58      1K       2K 166960K       116        0
             pf    15      6K      10K 166960K        26        0
         ifaddr    13      9K       9K 166960K        13        0
        ifgroup    22      1K       1K 166960K        22        0
       counters    46     34K      34K 166960K        46        0
       ioctlops     0      0K       4K 166960K      1475        0
            iov     2      1K       1K 166960K         2        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1176     74K      74K 166960K      1192        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     2      0K       0K 166960K         2        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc     1      0K       0K 166960K         1        0
           proc    67     91K      91K 166960K       302        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
       in_multi    11      0K       0K 166960K        11        0
    ether_multi     1      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    25    122K     122K 166960K        25        0
           exec     0      0K       1K 166960K       272        0
            tdb     3      0K       0K 166960K         3        0
        pagedep     1      8K       8K 166960K         1        0
       inodedep     1     32K      32K 166960K         1        0
         newblk     1      0K       0K 166960K         1        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   112     12K      12K 166960K      2561        0
       UVM aobj     3      2K       2K 166960K         3        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP     4      0K       0K 166960K         4        0
           temp     1   5908K    5972K 166960K      3079        0
         kqueue    11     16K      18K 166960K        24        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120       21    0       18     1     0     1     1     0     8    0
rtentry    112       23    0        1     1     0     1     1     0     8    0
unpcb      144       35    0       20     1     0     1     1     0     8    0
syncache   312        5    0        5     1     0     1     1     0     8    1
tcpqe       32      127    0      127     1     0     1     1     0     8    1
tcpcb      808        8    0        5     1     0     1     1     0     8    0
arp        120        2    0        0     1     0     1     1     0     8    0
inpcb      368       36    0       28     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24        9    0        0     1     0     1     1     0     8    0
pfstkey    128        9    0        0     1     0     1     1     0     8    0
pfstate    376        9    0        0     1     0     1     1     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256       97    0        0     7     0     7     7     0     8    0
art_table   32       98    0        0     1     0     1     1     0     8    0
art_node    16       22    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1433    0       38    88     0    88    88     0     8    0
ffsino     272     1433    0       38    93     0    93    93     0     8    0
nchpl      144     1619    0       49    59     0    59    59     0     8    0
uvmvnodes   80     1447    0        0    30     0    30    30     0     8    0
vnodes     216     1447    0        0    81     0    81    81     0     8    0
namei      1024    4579    0     4579     1     0     1     1     0     8    1
percpumem   16       36    0        0     1     0     1     1     0     8    0
kstatmem   264        8    0        0     1     0     1     1     0     8    0
scxspl     216     4853    0     4853     3     1     2     2     1     8    2
plimitpl   152       18    0       10     1     0     1     1     0     8    0
sigapl     424      341    0      308     5     1     4     5     0     8    0
futexpl     64        2    0        1     1     0     1     1     0     8    0
knotepl    120       43    0        0     2     0     2     2     0     8    0
kqueuepl   216       20    0       13     1     0     1     1     0     8    0
pipepl     320       95    0       92     1     0     1     1     0     8    0
fdescpl    496      323    0      308     3     0     3     3     0     8    0
filepl     152     1284    0     1224     3     0     3     3     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       18    0        9     1     0     1     1     0     8    0
pgrppl      48       18    0        9     1     0     1     1     0     8    0
ucredpl    104       71    0       59     1     0     1     1     0     8    0
zombiepl   144      308    0      308     1     0     1     1     0     8    1
processpl  1072     341    0      308     3     0     3     3     0     8    0
procpl     680      344    0      308     4     1     3     4     0     8    0
sockpl     488       92    0       66     4     0     4     4     0     8    0
mcl8k      8192       1    0        0     1     0     1     1     0     8    0
mcl4k      4096       3    0        0     1     0     1     1     0     8    0
mcl2k      2048     261    0        0    33     0    33    33     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      273    0        0    18     0    18    18     0     8    0
bufpl      288     2474    0       90   171     0   171   171     0     8    0
anonpl      24   203370    0   201278    25     1    24    25     0   186   11
amapchunkpl 152    9125    0     8939     8     0     8     8     0   158    0
amappl16   200     6222    0     6221     5     1     4     5     0     8    3
amappl15   192       10    0       10     1     1     0     1     0     8    0
amappl14   184      124    0      112     1     0     1     1     0     8    0
amappl13   176        9    0        9     1     1     0     1     0     8    0
amappl12   168      874    0      859     2     1     1     2     0     8    0
amappl11   160       60    0       46     1     0     1     1     0     8    0
amappl10   152       35    0       35     1     0     1     1     0     8    1
amappl9    144      162    0      162     1     0     1     1     0     8    1
amappl8    136       44    0       42     1     0     1     1     0     8    0
amappl7    128      115    0      102     1     0     1     1     0     8    0
amappl6    120      135    0      130     1     0     1     1     0     8    0
amappl5    112      105    0       94     1     0     1     1     0     8    0
amappl4    104      372    0      351     1     0     1     1     0     8    0
amappl3     96     2169    0     2125     3     1     2     2     0     8    0
amappl2     88      648    0      591     2     0     2     2     0     8    0
amappl1     80     9249    0     8776    12     0    12    12     0     8    0
amappl      88     2252    0     2187     2     0     2     2     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      323    0      308     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      323    0      308     1     0     1     1     0     8    0
vmmpekpl   168     7269    0     7251     1     0     1     1     0     8    0
vmmpepl    168    36582    0    35514    52     1    51    52     0   357    4
vmsppl     464      322    0      308     3     0     3     3     0     8    0
rwobjpl     56    20063    0    17896    33     1    32    33     0     8    1
pdppl      4096     654    0      616    54    16    38    46     0     8    0
pvpl        32   307417    0   302535    58     2    56    57     0   265   16
pmappl     248      322    0      308     2     0     2     2     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      481    0       19    14     0    14    14     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1e:        addq    $0x8,%rsp
x86_ipi_db(ffffffff82bfaff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82d3bba8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82d3bba8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
wakeup_n(fffffd806d86d320,ffffffff) at wakeup_n+0x37 sys/kern/kern_synch.c:541
soreceive(fffffd806d86d200,ffff80002a230048,ffff80002a230008,0,0,ffff80002a2301cc,27bd27254a5463f2) at soreceive+0x1857 pru_unlock sys/sys/protosw.h:294 [inline]
soreceive(fffffd806d86d200,ffff80002a230048,ffff80002a230008,0,0,ffff80002a2301cc,27bd27254a5463f2) at soreceive+0x1857 sys/kern/uipc_socket.c:1194
recvit(ffff80002a185d50,5,ffff80002a2301a0,0,ffff80002a230198) at recvit+0x31b sys/kern/uipc_syscalls.c:1082
sys_recvmmsg(ffff80002a185d50,ffff80002a2302a0,ffff80002a2302f0) at sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
syscall(ffff80002a230370) at syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
syscall(ffff80002a230370) at syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd5742c15ea0, count: 5
ddb{0}> trace
x86_ipi_db(ffffffff82bfaff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82d3bba8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82d3bba8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
wakeup_n(fffffd806d86d320,ffffffff) at wakeup_n+0x37 sys/kern/kern_synch.c:541
soreceive(fffffd806d86d200,ffff80002a230048,ffff80002a230008,0,0,ffff80002a2301cc,27bd27254a5463f2) at soreceive+0x1857 pru_unlock sys/sys/protosw.h:294 [inline]
soreceive(fffffd806d86d200,ffff80002a230048,ffff80002a230008,0,0,ffff80002a2301cc,27bd27254a5463f2) at soreceive+0x1857 sys/kern/uipc_socket.c:1194
recvit(ffff80002a185d50,5,ffff80002a2301a0,0,ffff80002a230198) at recvit+0x31b sys/kern/uipc_syscalls.c:1082
sys_recvmmsg(ffff80002a185d50,ffff80002a2302a0,ffff80002a2302f0) at sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
syscall(ffff80002a230370) at syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
syscall(ffff80002a230370) at syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd5742c15ea0, count: -10
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x1c:  addq    $0x8,%rsp
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827c19a3) at panic+0x17b sys/kern/subr_prf.c:198
assertwaitok() at assertwaitok+0x132 sys/kern/subr_xxx.c:163
mi_switch() at mi_switch+0x46 sys/kern/sched_bsd.c:360
sleep_finish(0,1) at sleep_finish+0x19b sys/kern/kern_synch.c:414
rwsleep(fffffd806d86d320,ffffffff82c4a100,118,ffffffff827afd95,0) at rwsleep+0xab sys/kern/kern_synch.c:300
sosleep_nsec(fffffd806d86d200,fffffd806d86d320,118,ffffffff827afd95,ffffffffffffffff) at sosleep_nsec+0xff sys/kern/uipc_socket2.c:468
sblock(fffffd806d86d200,fffffd806d86d2d0,1) at sblock+0x1c4 sys/kern/uipc_socket2.c:514
soreceive(fffffd806d86d200,ffff80002a236938,ffff80002a2368f8,0,0,ffff80002a236abc,27bd27254a5463f2) at soreceive+0x5fe sys/kern/uipc_socket.c:837
recvit(ffff80002a1ce550,5,ffff80002a236a90,0,ffff80002a236a88) at recvit+0x31b sys/kern/uipc_syscalls.c:1082
sys_recvmmsg(ffff80002a1ce550,ffff80002a236b90,ffff80002a236be0) at sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
syscall(ffff80002a236c60) at syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
syscall(ffff80002a236c60) at syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd56cdc45b40, count: 2
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827c19a3) at panic+0x17b sys/kern/subr_prf.c:198
assertwaitok() at assertwaitok+0x132 sys/kern/subr_xxx.c:163
mi_switch() at mi_switch+0x46 sys/kern/sched_bsd.c:360
sleep_finish(0,1) at sleep_finish+0x19b sys/kern/kern_synch.c:414
rwsleep(fffffd806d86d320,ffffffff82c4a100,118,ffffffff827afd95,0) at rwsleep+0xab sys/kern/kern_synch.c:300
sosleep_nsec(fffffd806d86d200,fffffd806d86d320,118,ffffffff827afd95,ffffffffffffffff) at sosleep_nsec+0xff sys/kern/uipc_socket2.c:468
sblock(fffffd806d86d200,fffffd806d86d2d0,1) at sblock+0x1c4 sys/kern/uipc_socket2.c:514
soreceive(fffffd806d86d200,ffff80002a236938,ffff80002a2368f8,0,0,ffff80002a236abc,27bd27254a5463f2) at soreceive+0x5fe sys/kern/uipc_socket.c:837
recvit(ffff80002a1ce550,5,ffff80002a236a90,0,ffff80002a236a88) at recvit+0x31b sys/kern/uipc_syscalls.c:1082
sys_recvmmsg(ffff80002a1ce550,ffff80002a236b90,ffff80002a236be0) at sys_recvmmsg+0x320 sys/kern/uipc_syscalls.c:973
syscall(ffff80002a236c60) at syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
syscall(ffff80002a236c60) at syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd56cdc45b40, count: -13
ddb{1}> 

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/12/18 20:40 openbsd 9171d7d9aa9c 924661f4 .config console log report syz C ci-openbsd-multicore panic: assertwaitok: non-zero mutex count: NUM
2023/12/18 20:16 openbsd 9171d7d9aa9c 924661f4 .config console log report syz C ci-openbsd-setuid panic: assertwaitok: non-zero mutex count: NUM
2023/12/19 17:42 openbsd 5134f2df90e8 3ad490ea .config console log report ci-openbsd-setuid panic: assertwaitok: non-zero mutex count: NUM
2023/12/19 16:35 openbsd 5134f2df90e8 3ad490ea .config console log report ci-openbsd-setuid panic: assertwaitok: non-zero mutex count: NUM
2023/12/19 05:58 openbsd 5134f2df90e8 3ad490ea .config console log report ci-openbsd-setuid panic: assertwaitok: non-zero mutex count: NUM
2023/12/19 05:50 openbsd 5134f2df90e8 3ad490ea .config console log report ci-openbsd-setuid panic: assertwaitok: non-zero mutex count: NUM
2023/12/19 02:16 openbsd 9171d7d9aa9c 924661f4 .config console log report ci-openbsd-multicore panic: assertwaitok: non-zero mutex count: NUM
2023/12/19 02:08 openbsd 9171d7d9aa9c 924661f4 .config console log report ci-openbsd-multicore panic: assertwaitok: non-zero mutex count: NUM
2023/12/18 20:48 openbsd 9171d7d9aa9c 924661f4 .config console log report ci-openbsd-setuid panic: assertwaitok: non-zero mutex count: NUM
2023/12/18 19:48 openbsd 9171d7d9aa9c 924661f4 .config console log report ci-openbsd-setuid panic: assertwaitok: non-zero mutex count: NUM
* Struck through repros no longer work on HEAD.