syzbot


panic: pool_cache_item_magic_check: mpbaufnpilc :c pkue rfrneeel ldiisatgn omsotdiicf iaeds:s eirtteimo na d"d!r_k e0xr

Status: closed as dup on 2020/06/21 18:20
Reported-by: syzbot+fcba108146de7aec4c72@syzkaller.appspotmail.com
First crash: 1614d, last: 1614d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
pool: cpu free list modified: mbufpl syz 15863 1570d 1856d

Sample crash report:
panic: pool_cache_item_magic_check: mpbaufnpilc :c pkue rfrneeel  ldiisatgn omsotdiicf iaeds:s eirtteimo na d"d!r_k e0xrnffefl_ffldo8c06k_4ahael02d0()0+"1 f6 a0ixle0!d=:0 xfi5dle36 c"c/6s5y7zck4adl53le1rf/
m
anStopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 506562  60666      0           0  0x4000000    1  syz-executor.1
*177232  84403      0     0x14000      0x200    0  softnet
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff823e87fe) at panic+0x15c sys/kern/subr_prf.c:207
pool_cache_get(ffffffff828c78a0) at pool_cache_get+0x323 pool_cache_item_magic_check sys/kern/subr_pool.c:1781 [inline]
pool_cache_get(ffffffff828c78a0) at pool_cache_get+0x323 sys/kern/subr_pool.c:1884
pool_get(ffffffff828c78a0,2) at pool_get+0x91 sys/kern/subr_pool.c:572
m_copym(fffffd8064aa0000,2c00,3a4,2) at m_copym+0x174 m_get sys/kern/uipc_mbuf.c:250 [inline]
m_copym(fffffd8064aa0000,2c00,3a4,2) at m_copym+0x174 sys/kern/uipc_mbuf.c:667
tcp_output(ffff800000ad7100) at tcp_output+0x15ba sys/netinet/tcp_output.c:673
tcp_input(ffff800020db90b8,ffff800020db90c4,6,2) at tcp_input+0x2356
ip_deliver(ffff800020db90b8,ffff800020db90c4,6,2) at ip_deliver+0x353 sys/netinet/ip_input.c:668
ip_ours(ffff800020db90b8,ffff800020db90c4,ffff800020d98750,0) at ip_ours+0x412
ip_input_if(ffff800020db90b8,ffff800020db90c4,4,0,ffff80000017b2a8) at ip_input_if+0x6ce
ipv4_input(ffff80000017b2a8,fffffd80689f0f00) at ipv4_input+0x48 sys/netinet/ip_input.c:215
ether_input(ffff80000017b2a8,fffffd80689f0f00,0) at ether_input+0x345 sys/net/if_ethersubr.c:461
if_input_process(ffff80000017b2a8,ffff800020db91e8) at if_input_process+0x10b if_ih_input sys/net/if.c:908 [inline]
if_input_process(ffff80000017b2a8,ffff800020db91e8) at if_input_process+0x10b sys/net/if.c:942
ifiq_process(ffff80000017b6a0) at ifiq_process+0x80 sys/net/ifq.c:646
end trace frame: 0xffff800020db92c0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
pool_cache_item_magic_check: mbufpl cpu free list modified: item addr 0xfffffd8064aa0200+16 0x0!=0x5d36cc657c4d531f
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff823e87fe) at panic+0x15c sys/kern/subr_prf.c:207
pool_cache_get(ffffffff828c78a0) at pool_cache_get+0x323 pool_cache_item_magic_check sys/kern/subr_pool.c:1781 [inline]
pool_cache_get(ffffffff828c78a0) at pool_cache_get+0x323 sys/kern/subr_pool.c:1884
pool_get(ffffffff828c78a0,2) at pool_get+0x91 sys/kern/subr_pool.c:572
m_copym(fffffd8064aa0000,2c00,3a4,2) at m_copym+0x174 m_get sys/kern/uipc_mbuf.c:250 [inline]
m_copym(fffffd8064aa0000,2c00,3a4,2) at m_copym+0x174 sys/kern/uipc_mbuf.c:667
tcp_output(ffff800000ad7100) at tcp_output+0x15ba sys/netinet/tcp_output.c:673
tcp_input(ffff800020db90b8,ffff800020db90c4,6,2) at tcp_input+0x2356
ip_deliver(ffff800020db90b8,ffff800020db90c4,6,2) at ip_deliver+0x353 sys/netinet/ip_input.c:668
ip_ours(ffff800020db90b8,ffff800020db90c4,ffff800020d98750,0) at ip_ours+0x412
ip_input_if(ffff800020db90b8,ffff800020db90c4,4,0,ffff80000017b2a8) at ip_input_if+0x6ce
ipv4_input(ffff80000017b2a8,fffffd80689f0f00) at ipv4_input+0x48 sys/netinet/ip_input.c:215
ether_input(ffff80000017b2a8,fffffd80689f0f00,0) at ether_input+0x345 sys/net/if_ethersubr.c:461
if_input_process(ffff80000017b2a8,ffff800020db91e8) at if_input_process+0x10b if_ih_input sys/net/if.c:908 [inline]
if_input_process(ffff80000017b2a8,ffff800020db91e8) at if_input_process+0x10b sys/net/if.c:942
ifiq_process(ffff80000017b6a0) at ifiq_process+0x80 sys/net/ifq.c:646
taskq_thread(ffff80000002c000) at taskq_thread+0xec sys/kern/kern_task.c:437
end trace frame: 0x0, count: -15
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800020db8950
rbx               0xffff800020db8a00
rdx                             0x8b
rcx                              0x2
rax                              0x1
r8                0xffffffff821c2b4f    kprintf+0x16f
r9                               0x1
r10                              0x2
r11               0x5c45a98cceae008f
r12                     0x3000000008
r13               0xffff800020db8960
r14                            0x100
r15                              0x1
rip               0xffffffff811a3778    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020db8940
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (softnet) pid=177232 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    pri=32, usrpri=50, nice=20
    forw=0xffffffffffffffff, list=0xffff800020d98c30,0xffff800020d984f0
    process=0xffff800020d9a000 user=0xffff800020db4000, vmspace=0xffffffff82910998
    estcpu=0, cpticks=2, pctcpu=0.10
    user=0, sys=2, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 60666  416505  81888      0  2           0                syz-executor.1
 60666  506562  81888      0  7   0x4000000                syz-executor.1
 44755  318734  75344      0  2           0                syz-executor.0
 40727  485260      1      0  3    0x100083  ttyin         getty
 95213  130740      0      0  3     0x14280  nfsidl        nfsio
 74584  453834      0      0  3     0x14280  nfsidl        nfsio
 56664  347127      0      0  3     0x14280  nfsidl        nfsio
 80231  212554      0      0  3     0x14280  nfsidl        nfsio
 84960  340144      0      0  3     0x14280  nfsidl        nfsio
 85889   16721      0      0  3     0x14280  nfsidl        nfsio
 19483  140785      0      0  3     0x14280  nfsidl        nfsio
 23113  192290      0      0  3     0x14280  nfsidl        nfsio
 71699   68423      0      0  3     0x14280  nfsidl        nfsio
 75066   43041      0      0  3     0x14280  nfsidl        nfsio
 63839  169501      0      0  3     0x14280  nfsidl        nfsio
 53009  111659      0      0  3     0x14280  nfsidl        nfsio
 43298  417216      0      0  3     0x14280  nfsidl        nfsio
 53678  510174      0      0  3     0x14280  nfsidl        nfsio
  2059  423066      0      0  3     0x14280  nfsidl        nfsio
 38530  389955      0      0  3     0x14280  nfsidl        nfsio
  2259   96287      0      0  3     0x14280  nfsidl        nfsio
 78983   16453      0      0  3     0x14280  nfsidl        nfsio
 57479   12886      0      0  3     0x14280  nfsidl        nfsio
  2643   11623      0      0  3     0x14280  nfsidl        nfsio
 75344  395688  68659      0  3        0x82  nanosleep     syz-executor.0
 94079  478710      0      0  3     0x14200  acct          acct
 51804  310284      0      0  3     0x14200  bored         sosplice
 81888  321345  68659      0  3        0x82  nanosleep     syz-executor.1
 68659   77440  15625      0  3        0x82  thrsleep      syz-fuzzer
 68659  463451  15625      0  3   0x4000082  nanosleep     syz-fuzzer
 68659  244755  15625      0  3   0x4000082  thrsleep      syz-fuzzer
 68659  300907  15625      0  3   0x4000082  thrsleep      syz-fuzzer
 68659  125943  15625      0  3   0x4000082  kqread        syz-fuzzer
 68659  193707  15625      0  3   0x4000082  nanosleep     syz-fuzzer
 68659  382974  15625      0  3   0x4000082  thrsleep      syz-fuzzer
 68659  193424  15625      0  3   0x4000082  thrsleep      syz-fuzzer
 68659  467465  15625      0  3   0x4000082  thrsleep      syz-fuzzer
 68659  261822  15625      0  3   0x4000082  thrsleep      syz-fuzzer
 15625  302813  38286      0  3    0x10008a  pause         ksh
 38286  380759  70409      0  2        0x12                sshd
 70409   35332      1      0  3        0x80  select        sshd
 44777  481647  65822     74  3    0x100092  bpf           pflogd
 65822  441129      1      0  3        0x80  netio         pflogd
 14117  448345  25590     73  3    0x100090  kqread        syslogd
 25590  168350      1      0  3    0x100082  netio         syslogd
 23265  287854      1     77  3    0x100090  poll          dhclient
 45359  110023      1      0  3        0x80  poll          dhclient
  4483   41253      0      0  3     0x14200  bored         smr
   195  225643      0      0  2     0x14200                zerothread
 34052  108023      0      0  3     0x14200  aiodoned      aiodoned
 99004  350572      0      0  3     0x14200  syncer        update
 12316   88776      0      0  3     0x14200  cleaner       cleaner
 32839  272218      0      0  3     0x14200  reaper        reaper
 38845  503932      0      0  3     0x14200  pgdaemon      pagedaemon
 53142  254581      0      0  3     0x14200  bored         crynlk
 76143  125990      0      0  3     0x14200  bored         crypto
 97589  361624      0      0  3  0x40014200  acpi0         acpi0
  8538   76628      0      0  3  0x40014200                idle1
*84403  177232      0      0  7     0x14200                softnet
 49695  181986      0      0  3     0x14200  bored         systqmp
 15143  379534      0      0  3     0x14200  bored         systq
 43929   29836      0      0  3  0x40014200  bored         softclock
 55739  385439      0      0  3  0x40014200                idle0
     1  174788      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 60666 (syz-executor.1) thread 0xffff800020ed7618 (416505)
shared rwlock vmmaplk r = 0 (0xfffffd807efffa28)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  uvmfault_lookup+0xd9 sys/uvm/uvm_fault.c:1448
#2  uvm_fault+0x7f sys/uvm/uvm_fault.c:524
#3  pageflttrap+0x1b8 sys/arch/amd64/amd64/trap.c:221
#4  usertrap+0x21a sys/arch/amd64/amd64/trap.c:384
#5  recall_trap+0x8
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82899198)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  pageflttrap+0x7f sys/arch/amd64/amd64/trap.c:180
#2  usertrap+0x21a sys/arch/amd64/amd64/trap.c:384
#3  recall_trap+0x8
Process 84403 (softnet) thread 0xffff800020d98750 (177232)
exclusive rwlock netlock r = 0 (0xffffffff82707e28)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  if_input_process+0x85 sys/net/if.c:941
#2  ifiq_process+0x80 sys/net/ifq.c:646
#3  taskq_thread+0xec sys/kern/kern_task.c:437
#4  proc_trampoline+0x1c
shared rwlock softnet r = 0 (0xffff80000002c070)
#0  witness_lock+0x4c7 stacktrace_save sys/sys/stacktrace.h:36 [inline]
#0  witness_lock+0x4c7 sys/kern/subr_witness.c:1164
#1  taskq_thread+0xdf sys/kern/kern_task.c:436
#2  proc_trampoline+0x1c
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9528   6416K    7064K  78643K     12321        0
            pcb    13      8K       8K  78643K       100        0
         rtable   109      4K       6K  78643K       473        0
         ifaddr    92     19K      19K  78643K       225        0
         sysctl     3      1K       1K  78643K         3        0
       counters    43     33K      34K  78643K        83        0
       ioctlops     0      0K       4K  78643K      1541        0
            iov     0      0K      24K  78643K       343        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1224     77K      77K  78643K      1732        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K         7        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       0K  78643K        73        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1824    197K     290K  78643K     13058        0
      file desc     6     17K      25K  78643K       566        0
          sigio     0      0K       0K  78643K        13        0
           proc    63     63K      95K  78643K       550        0
        subproc    32      2K       2K  78643K        51        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        35        0
       in_multi    87      4K       4K  78643K       182        0
    ether_multi     1      0K       0K  78643K        17        0
            mrt     0      0K       0K  78643K         2        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    55    254K     254K  78643K        55        0
           exec     0      0K       1K  78643K       264        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   144     72K      73K  78643K      2895        0
       UVM aobj    18      2K       2K  78643K        20        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        79        0
            NDP    13      0K       0K  78643K        47        0
           temp   144   3859K    3923K  78643K      8665        0
         kqueue     3      4K       9K  78643K        26        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        9    0        2     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       41    0       39     1     0     1     1     0     8    0
rtentry    112       85    0       43     2     0     2     2     0     8    0
unpcb      120      291    0      281     1     0     1     1     0     8    0
syncache   264        7    0        7     2     2     0     1     0     8    0
tcpqe       32       28    0       28     1     1     0     1     0     8    0
tcpcb      544      314    0      310     1     0     1     1     0     8    0
inpcb      280      737    0      730     3     1     2     2     0     8    1
rttmr       72        1    0        1     1     1     0     1     0     8    0
nd6         48       21    0       18     1     0     1     1     0     8    0
pkpcb       40        6    0        6     2     2     0     1     0     8    0
ppxss      1128       3    0        3     2     2     0     1     0     8    0
pffrag     232        5    0        5     2     1     1     1     0   482    1
pffrnode    88        5    0        5     2     1     1     1     0     8    1
pffrent     40       55    0       55     2     1     1     1     0     8    1
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       9    0        8     2     1     1     1     0     8    0
pfstitem    24       26    0       13     1     0     1     1     0     8    0
pfstkey    112       26    0       13     1     0     1     1     0     8    0
pfstate    328       26    0       13     3     0     3     3     0     8    0
pfrule     1360      34    0       21     3     1     2     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      408    0      223    15     3    12    15     0     8    0
art_table   32      409    0      223     2     0     2     2     0     8    0
art_node    16       84    0       44     1     0     1     1     0     8    0
sysvmsgpl   40       77    0       37     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       71    0       61     1     0     1     1     0     8    0
shmpl      112       18    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     2191    0      788    89     0    89    89     0     8    0
ffsino     272     2191    0      788    94     0    94    94     0     8    0
nchpl      144     3318    0     1725    60     0    60    60     0     8    0
uvmvnodes   72     2645    0        0    49     0    49    49     0     8    0
vnodes     208     2645    0        0   140     0   140   140     0     8    0
namei      1024    9466    0     9466     1     0     1     1     0     8    1
percpumem   16       52    0       20     1     0     1     1     0     8    0
vcpupl     1984       5    0        0     1     0     1     1     0     8    0
vmpool     560       11    0        6     2     1     1     1     0     8    0
pfiaddrpl  120        2    0        2     1     1     0     1     0     8    0
scsiplug    64        2    0        2     1     1     0     1     0     8    0
scxspl     192    10192    0    10192    14    10     4     7     0     8    4
plimitpl   152       59    0       51     1     0     1     1     0     8    0
sigapl     424      801    0      747     7     0     7     7     0     8    0
futexpl     56     8877    0     8877     1     0     1     1     0     8    1
knotepl    112       96    0       77     1     0     1     1     0     8    0
kqueuepl   144       78    0       74     1     0     1     1     0     8    0
pipelkpl    48      139    0      129     1     0     1     1     0     8    0
pipepl     120      278    0      259     1     0     1     1     0     8    0
fdescpl    496      764    0      747     3     0     3     3     0     8    0
filepl     152     4843    0     4743     5     0     5     5     0     8    1
lockfpl    104      151    0      150     1     0     1     1     0     8    0
lockfspl    48       50    0       49     1     0     1     1     0     8    0
sessionpl  112       20    0        9     1     0     1     1     0     8    0
pgrppl      48       22    0       11     1     0     1     1     0     8    0
ucredpl     96      531    0      522     1     0     1     1     0     8    0
zombiepl   144      747    0      747     1     0     1     1     0     8    1
processpl  984      801    0      747     7     0     7     7     0     8    0
procpl     624     2042    0     1978     6     0     6     6     0     8    0
sosppl     128        8    0        8     3     2     1     1     0     8    1
sockpl     400     1076    0     1057     7     3     4     4     0     8    2
mcl64k     65536      6    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288     10    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192       5    0        0     1     0     1     1     0     8    0
mcl4k      4096       7    0        0     1     0     1     1     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048     206    0        0    25     0    25    25     0     8    0
mtagpl      80      133    0        0     3     0     3     3     0     8    0
mbufpl     256      526    0        0    32     0    32    32     0     8    0
bufpl      280     4853    0      135   337     0   337   337     0     8    0
anonpl      16    84728    0    68535    82    15    67    81     0   124    1
amapchunkpl 152    4592    0     4446    15     5    10    11     0   158    3
amappl16   192     3741    0     2870    56    11    45    55     0     8    1
amappl15   184        2    0        1     1     0     1     1     0     8    0
amappl14   176       23    0       19     1     0     1     1     0     8    0
amappl13   168       44    0       40     1     0     1     1     0     8    0
amappl12   160        9    0        8     1     0     1     1     0     8    0
amappl11   152       57    0       41     1     0     1     1     0     8    0
amappl10   144      404    0      394     1     0     1     1     0     8    0
amappl9    136      384    0      382     1     0     1     1     0     8    0
amappl8    128      402    0      356     2     0     2     2     0     8    0
amappl7    120      401    0      385     1     0     1     1     0     8    0
amappl6    112       29    0       22     1     0     1     1     0     8    0
amappl5    104      670    0      652     1     0     1     1     0     8    0
amappl4     96      521    0      487     1     0     1     1     0     8    0
amappl3     88      125    0      119     1     0     1     1     0     8    0
amappl2     80     5048    0     4972     2     0     2     2     0     8    0
amappl1     72    26836    0    26385    23    13    10    18     0     8    0
amappl      80     2310    0     2263     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64       19    0        2     1     0     1     1     0     8    0
uaddrrnd    24      775    0      753     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      775    0      753     1     0     1     1     0     8    0
vmmpekpl   168     9513    0     9466     3     0     3     3     0     8    0
vmmpepl    168   100138    0    98001   140    36   104   122     0   357   11
vmsppl     368      774    0      753     2     0     2     2     0     8    0
pdppl      4096    1557    0     1511     6     0     6     6     0     8    0
pvpl        32   269172    0   249655   193    22   171   193     0   265   13
pmappl     232      774    0      753     4     2     2     2     0     8    0
extentpl    40       53    0       36     1     0     1     1     0     8    0
phpool     112      291    0        9     9     0     9     9     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff823e87fe) at panic+0x15c sys/kern/subr_prf.c:207
pool_cache_get(ffffffff828c78a0) at pool_cache_get+0x323 pool_cache_item_magic_check sys/kern/subr_pool.c:1781 [inline]
pool_cache_get(ffffffff828c78a0) at pool_cache_get+0x323 sys/kern/subr_pool.c:1884
pool_get(ffffffff828c78a0,2) at pool_get+0x91 sys/kern/subr_pool.c:572
m_copym(fffffd8064aa0000,2c00,3a4,2) at m_copym+0x174 m_get sys/kern/uipc_mbuf.c:250 [inline]
m_copym(fffffd8064aa0000,2c00,3a4,2) at m_copym+0x174 sys/kern/uipc_mbuf.c:667
tcp_output(ffff800000ad7100) at tcp_output+0x15ba sys/netinet/tcp_output.c:673
tcp_input(ffff800020db90b8,ffff800020db90c4,6,2) at tcp_input+0x2356
ip_deliver(ffff800020db90b8,ffff800020db90c4,6,2) at ip_deliver+0x353 sys/netinet/ip_input.c:668
ip_ours(ffff800020db90b8,ffff800020db90c4,ffff800020d98750,0) at ip_ours+0x412
ip_input_if(ffff800020db90b8,ffff800020db90c4,4,0,ffff80000017b2a8) at ip_input_if+0x6ce
ipv4_input(ffff80000017b2a8,fffffd80689f0f00) at ipv4_input+0x48 sys/netinet/ip_input.c:215
ether_input(ffff80000017b2a8,fffffd80689f0f00,0) at ether_input+0x345 sys/net/if_ethersubr.c:461
if_input_process(ffff80000017b2a8,ffff800020db91e8) at if_input_process+0x10b if_ih_input sys/net/if.c:908 [inline]
if_input_process(ffff80000017b2a8,ffff800020db91e8) at if_input_process+0x10b sys/net/if.c:942
ifiq_process(ffff80000017b6a0) at ifiq_process+0x80 sys/net/ifq.c:646
taskq_thread(ffff80000002c000) at taskq_thread+0xec sys/kern/kern_task.c:437
end trace frame: 0x0, count: -15
ddb{0}> machine ddbcpu 1

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/21 13:28 openbsd 9a712520a662 c655ec77 .config console log report ci-openbsd-multicore
* Struck through repros no longer work on HEAD.