assert "!_kernel_lock_held()" failed in kern

assert "!_kernel_lock_held()" failed in kern_fork.c
Status: auto-closed as invalid on 2020/01/21 16:10
Reported-by: syzbot+790495af3d9b4f5e45cd@syzkaller.appspotmail.com
First crash: 987d, last: 726d
duplicates (1):
Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
panic: malloc: allocationp atnoico: lakerrgnee,l tdyiapgen o=s ti2c, saisszeer t=i on "!_kernel_lock_held()" failed:				1	982d	982d	0/3	closed as dup on 2019/02/09 12:22
similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
openbsd	assert "!_kernel_lock_held()" failed in kern_fork.c (2)				1	536d	536d	0/3	auto-closed as invalid on 2020/07/29 04:11
Sample crash report:
panic: ifpanic: kernel diagnostic assertion "!_kernel_lock_held()" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_fork.c", line 683
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
  94227  43572      0           0  0x4000000    0  syz-executor.1
*402738  43572      0           0  0x4000000    1  syz-executor.1
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff82205e21,ffffffff821f1bbd,2ab,ffffffff821d425c) at __assert+0x2b sys/kern/subr_prf.c:154
proc_trampoline_mp() at proc_trampoline_mp+0x123
end trace frame: 0x0, count: 11
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
ifa_update_broadaddr does not support dynamic length
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:207
__assert(ffffffff82205e21,ffffffff821f1bbd,2ab,ffffffff821d425c) at __assert+0x2b sys/kern/subr_prf.c:154
proc_trampoline_mp() at proc_trampoline_mp+0x123
end trace frame: 0x0, count: -4
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800021bc5310
rbx               0xffff800021bc53c0
rdx               0xffff800020b75658
rcx                                0
rax                                0
r8                0xffffffff8188b28f    kprintf+0x16f
r9                               0x1
r10                             0x25
r11               0x66b17750e813f74b
r12                     0x3000000008
r13               0xffff800021bc5320
r14                            0x104
r15                              0x1
rip               0xffffffff81bab4d8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800021bc5300
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.1) pid=402738 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=86, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff800020b75168,0xffffffff8264c6f8
    process=0xffff800020addc00 user=0xffff800021bc0000, vmspace=0xfffffd807f00a170
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 70704  398074  83017      0  2           0                syz-executor.0
 70704  313395  83017      0  3   0x4000080  fsleep        syz-executor.0
 43572  411584  11599      0  2           0                syz-executor.1
 43572   94227  11599      0  7   0x4000000                syz-executor.1
*43572  402738  11599      0  7   0x4000000                syz-executor.1
 11599  150172  98418      0  3        0x82  nanosleep     syz-executor.1
  1039   29270      0      0  3     0x14200  bored         sosplice
 83017  394919  98418      0  3        0x82  nanosleep     syz-executor.0
 98418  166280  36738      0  3        0x82  kqread        syz-fuzzer
 98418  288496  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 98418   81338  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 98418  139790  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 98418   96517  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 98418   68387  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 98418  433030  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 98418  267988  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 98418  210406  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 98418  398950  36738      0  3   0x4000082  thrsleep      syz-fuzzer
 36738  463431  81674      0  3    0x10008a  pause         ksh
 81674  383875  32617      0  3        0x92  select        sshd
 34795  172335      1      0  3    0x100083  ttyin         getty
 32617  253247      1      0  3        0x80  select        sshd
 46435  182563  53261     74  3    0x100092  bpf           pflogd
 53261  136836      1      0  3        0x80  netio         pflogd
 36178  261778  23465     73  3    0x100090  kqread        syslogd
 23465   37969      1      0  3    0x100082  netio         syslogd
 77350  250418      1     77  3    0x100090  poll          dhclient
 68518  137321      1      0  3        0x80  poll          dhclient
 55612   87699      0      0  2     0x14200                zerothread
   326  445560      0      0  3     0x14200  aiodoned      aiodoned
 70451  409195      0      0  3     0x14200  syncer        update
 65231  423782      0      0  3     0x14200  cleaner       cleaner
 95854  403348      0      0  3     0x14200  reaper        reaper
 15679  189472      0      0  3     0x14200  pgdaemon      pagedaemon
 78254  521636      0      0  3     0x14200  bored         crynlk
 64380   36383      0      0  3     0x14200  bored         crypto
 18604  521532      0      0  3  0x40014200  acpi0         acpi0
 18204  259238      0      0  3  0x40014200                idle1
 11850  466469      0      0  3     0x14200  bored         softnet
 90727  482807      0      0  3     0x14200  bored         systqmp
 93020  269464      0      0  3     0x14200  bored         systq
 53816  163486      0      0  3  0x40014200  bored         softclock
 31104  218087      0      0  3  0x40014200                idle0
 14007  369304      0      0  3     0x14200  bored         smr
     1  317542      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 70704 (syz-executor.0) thread 0xffff800020b75168 (313395)
exclusive rrwlock inode r = 0 (0xfffffd8061e30b40)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  rw_enter+0x447 sys/kern/kern_rwlock.c:306
#2  rrw_enter+0x4f sys/kern/kern_rwlock.c:435
#3  ufs_ihashins+0x45 sys/ufs/ufs/ufs_ihash.c:140
#4  ffs_vget+0x13e sys/ufs/ffs/ffs_vfsops.c:1352
#5  ffs_inode_alloc+0x1cf sys/ufs/ffs/ffs_alloc.c:392
#6  ufs_makeinode+0xaa sys/ufs/ufs/ufs_vnops.c:1832
#7  ufs_create+0x41 sys/ufs/ufs/ufs_vnops.c:152
#8  VOP_CREATE+0xc0 sys/kern/vfs_vops.c:113
#9  vn_open+0x2b4 sys/kern/vfs_vnops.c:125
#10 doopenat+0x28b sys/kern/vfs_syscalls.c:1157
#11 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#11 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#12 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806ac61098)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  rw_enter+0x447 sys/kern/kern_rwlock.c:306
#2  rrw_enter+0x4f sys/kern/kern_rwlock.c:435
#3  VOP_LOCK+0xf0 sys/kern/vfs_vops.c:615
#4  vn_lock+0x81 sys/kern/vfs_vnops.c:574
#5  vfs_lookup+0xe6 sys/kern/vfs_lookup.c:419
#6  namei+0x63c sys/kern/vfs_lookup.c:249
#7  vn_open+0x1c2 sys/kern/vfs_vnops.c:116
#8  doopenat+0x28b sys/kern/vfs_syscalls.c:1157
#9  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#9  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#10 Xsyscall+0x128
Process 43572 (syz-executor.1) thread 0xffff800020b74a00 (94227)
exclusive rwlock netlock r = 0 (0xffffffff824e8728)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  in_ioctl_change_ifaddr+0x3f
#2  in_ioctl+0x205 sys/netinet/in.c:234
#3  ifioctl+0xb64 sys/net/if.c:2202
#4  sys_ioctl+0x5b9
#5  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#5  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:555
#6  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8266bc58)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  syscall+0x400 mi_syscall sys/sys/syscall_mi.h:83 [inline]
#1  syscall+0x400 sys/arch/amd64/amd64/trap.c:555
#2  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9537   6664K    6851K  78643K     11220        0        0
            pcb    13      8K       8K  78643K        70        0        0
         rtable    90      3K       4K  78643K       358        0        0
         ifaddr    54     12K      13K  78643K       118        0        0
       counters    39     33K      33K  78643K        39        0        0
       ioctlops     0      0K       4K  78643K      1517        0        0
            iov     0      0K      16K  78643K        57        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1219     77K      77K  78643K      1501        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       5K  78643K         7        0        0
         VM map     3      1K       1K  78643K         3        0        0
            sem    12      0K       0K  78643K       172        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1808    196K     290K  78643K     12765        0        0
      file desc     6     17K      25K  78643K       284        0        0
          sigio     0      0K       0K  78643K         7        0        0
           proc    61     63K      95K  78643K       491        0        0
        subproc    32      2K       2K  78643K        51        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       155        0        0
       in_multi    23      1K       2K  78643K        44        0        0
    ether_multi     1      0K       0K  78643K         1        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys   102    450K     450K  78643K       102        0        0
           exec     0      0K       1K  78643K       236        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   107     38K      39K  78643K      1906        0        0
       UVM aobj    30      2K       2K  78643K        32        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       0K  78643K        74        0        0
            NDP    11      0K       0K  78643K        32        0        0
           temp   164   3559K    3623K  78643K      7593        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        8    0        3     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       27    0       25     1     0     1     1     0     8    0
rtentry    112       62    0       27     2     0     2     2     0     8    0
unpcb      120      175    0      165     1     0     1     1     0     8    0
syncache   264        5    0        5     2     2     0     1     0     8    0
tcpqe       32       69    0       69     1     1     0     1     0     8    0
tcpcb      544      214    0      210     3     2     1     2     0     8    0
inpcb      280      577    0      569     3     1     2     3     0     8    1
ip6q        72        2    0        2     1     1     0     1     0     8    0
ip6af       40        6    0        6     1     1     0     1     0     8    0
nd6         48        8    0        6     1     0     1     1     0     8    0
pkpcb       40        2    0        2     1     1     0     1     0     8    0
ppxss      1128      12    0       12     2     1     1     1     0     8    1
pffrag     232        6    0        6     2     1     1     1     0   482    1
pffrnode    88        6    0        6     2     1     1     1     0     8    1
pffrent     40      227    0      227     2     1     1     1     0     8    1
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       27    0        4     1     0     1     1     0     8    0
pfstkey    112       27    0        4     1     0     1     1     0     8    0
pfstate    328       27    0        4     2     0     2     2     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      298    0      124    15     4    11    15     0     8    0
art_table   32      299    0      124     2     0     2     2     0     8    0
art_node    16       61    0       29     1     0     1     1     0     8    0
sysvmsgpl   40       18    0       14     1     0     1     1     0     8    0
semupl     112        3    0        3     1     1     0     1     0     8    0
semapl     112      170    0      160     1     0     1     1     0     8    0
shmpl      112       30    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1863    0      450    46     0    46    46     0     8    0
ffsino     272     1863    0      450    95     0    95    95     0     8    0
nchpl      144     2467    0      857    61     0    61    61     0     8    0
uvmvnodes   72     2084    0        0    38     0    38    38     0     8    0
vnodes     208     2084    0        0   110     0   110   110     0     8    0
namei      1024    7526    0     7526     1     0     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
vcpupl     1984       1    0        0     1     0     1     1     0     8    0
vmpool     552        1    0        0     1     0     1     1     0     8    0
scxspl     192     6760    0     6760     8     6     2     7     0     8    2
plimitpl   152       32    0       24     1     0     1     1     0     8    0
sigapl     432      481    0      465     3     1     2     3     0     8    0
futexpl     56     7138    0     7137     1     0     1     1     0     8    0
knotepl    112       99    0       80     1     0     1     1     0     8    0
kqueuepl   104       76    0       74     1     0     1     1     0     8    0
pipepl     112      428    0      409     3     1     2     2     0     8    1
fdescpl    488      482    0      465     3     0     3     3     0     8    0
filepl     152     3999    0     3897     7     1     6     7     0     8    2
lockfpl    104       88    0       86     1     0     1     1     0     8    0
lockfspl    48       34    0       32     1     0     1     1     0     8    0
sessionpl  112       19    0        8     1     0     1     1     0     8    0
pgrppl      48       23    0       12     1     0     1     1     0     8    0
ucredpl     96      693    0      684     1     0     1     1     0     8    0
zombiepl   144      466    0      466     1     0     1     1     0     8    1
processpl  896      499    0      466     4     0     4     4     0     8    0
procpl     632     1097    0     1052     5     0     5     5     0     8    0
srpgc       64        4    0        4     1     1     0     1     0     8    0
sosppl     128        3    0        3     2     1     1     1     0     8    1
sockpl     384      784    0      764     6     2     4     6     0     8    2
mcl64k     65536      9    0        0     2     0     2     2     0     8    0
mcl12k     12288      4    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       5    0        0     1     0     1     1     0     8    0
mcl4k      4096       9    0        0     2     0     2     2     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     150    0        0    18     0    18    18     0     8    0
mtagpl      80        6    0        0     1     0     1     1     0     8    0
mbufpl     256      341    0        0    20     0    20    20     0     8    0
bufpl      256     6719    0     1314   338     0   338   338     0     8    0
anonpl      16    68211    0    48980    98    10    88    97     0   124    7
amapchunkpl 152    2754    0     2615    10     4     6     9     0   158    0
amappl16   192     2525    0     1405    68    11    57    68     0     8    1
amappl15   184        1    0        0     1     0     1     1     0     8    0
amappl14   176      230    0      226     1     0     1     1     0     8    0
amappl13   168        1    0        1     1     1     0     1     0     8    0
amappl12   160       48    0       45     1     0     1     1     0     8    0
amappl11   152       55    0       40     1     0     1     1     0     8    0
amappl10   144       14    0       10     1     0     1     1     0     8    0
amappl9    136      630    0      624     1     0     1     1     0     8    0
amappl8    128      186    0      163     1     0     1     1     0     8    0
amappl7    120       46    0       41     1     0     1     1     0     8    0
amappl6    112       74    0       64     1     0     1     1     0     8    0
amappl5    104      186    0      169     1     0     1     1     0     8    0
amappl4     96      505    0      474     1     0     1     1     0     8    0
amappl3     88      549    0      537     1     0     1     1     0     8    0
amappl2     80     2879    0     2798     3     1     2     3     0     8    0
amappl1     72    20598    0    20139    25    14    11    20     0     8    0
amappl      80     1363    0     1320     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64       31    0        2     1     0     1     1     0     8    0
uaddrrnd    24      483    0      465     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      483    0      465     1     0     1     1     0     8    0
vmmpekpl   168     8090    0     8057     2     0     2     2     0     8    0
vmmpepl    168    67390    0    65023   154    13   141   142     0   357   38
vmsppl     368      481    0      465     2     0     2     2     0     8    0
pdppl      4096     973    0      931     6     0     6     6     0     8    0
pvpl        32   208398    0   186140   221     9   212   221     0   265   26
pmappl     232      482    0      465     2     0     2     2     0     8    1
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      511    0        9    15     0    15    15     0     8    0
Crashes (15):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report
ci-openbsd-multicore	2019/10/23 16:09	openbsd	aaf7ae02776d	d894f260	.config	log	report
ci-openbsd-multicore	2019/10/01 18:50	openbsd	99bf39cb214a	b7a87a83	.config	log	report
ci-openbsd-multicore	2019/10/01 04:37	openbsd	9eb036517c72	c7a4fb99	.config	log	report
ci-openbsd-multicore	2019/09/17 03:46	openbsd	173a66230c49	51ca0454	.config	log	report
ci-openbsd-multicore	2019/09/15 13:14	openbsd	e2edd18482d8	32d59357	.config	log	report
ci-openbsd-multicore	2019/09/08 14:37	openbsd	aed271771839	a60cb4cd	.config	log	report
ci-openbsd-multicore	2019/09/06 17:34	openbsd	5d7df2904516	acb5b744	.config	log	report
ci-openbsd-multicore	2019/09/05 17:30	openbsd	f69acb9a9285	bf6bcce4	.config	log	report
ci-openbsd-multicore	2019/08/26 16:34	openbsd	4350d62ed76b	d21c5d9d	.config	log	report
ci-openbsd-multicore	2019/08/25 17:21	openbsd	a1d6d12691b4	d21c5d9d	.config	log	report
ci-openbsd-multicore	2019/08/25 07:38	openbsd	1507cfe1d6a4	d21c5d9d	.config	log	report
ci-openbsd-multicore	2019/03/26 03:25	openbsd	13a73e99f6f8	52a20ba4	.config	log	report
ci-openbsd-setuid	2019/03/25 22:35	openbsd	13a73e99f6f8	52a20ba4	.config	log	report
ci-openbsd-multicore	2019/02/19 08:32	openbsd	644ac04beb28	59f36113	.config	log	report
ci-openbsd-multicore	2019/02/04 20:01	openbsd	6e31582a5a78	d672172c	.config	log	report