syzbot


assert "sc->sc_dev == NUM" failed in if_tun.c

Status: fixed on 2022/02/16 17:50
Reported-by: syzbot+5df2ad232f5f8b671442@syzkaller.appspotmail.com
Fix commit: 156bbf72d5e4 prevent (re)opening of tun/tap interfaces that are being destroyed.
First crash: 325d, last: 293d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (2) 1 289d 289d 3/3 fixed on 2022/02/26 07:36
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (3) 25 11d 281d 0/3 upstream: reported on 2022/02/27 12:47

Sample crash report:
panic: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/net/if_tun.c", line 305
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 86834  22803      0           0  0x4000000    1K syz-executor.2
 383028  42058      0           0          0    0  syz-executor.1
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff825714b1) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff825eab00,ffffffff82632279,131,ffffffff825fcd23) at __assert+0x25 sys/kern/subr_prf.c:161
tun_clone_destroy(ffff800000c4a000) at tun_clone_destroy+0x278 sys/net/if_tun.c:305
if_clone_destroy(ffff80002e3684b0) at if_clone_destroy+0x132 sys/net/if.c:1218
soo_ioctl(fffffd80663c5908,80206979,ffff80002e3684b0,ffff8000294e82a0) at soo_ioctl+0x26c
sys_ioctl(ffff8000294e82a0,ffff80002e3685c8,ffff80002e368620) at sys_ioctl+0x4a2
syscall(ffff80002e368690) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002e368690) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x144f9f772f0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/net/if_tun.c", line 305
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff825714b1) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff825eab00,ffffffff82632279,131,ffffffff825fcd23) at __assert+0x25 sys/kern/subr_prf.c:161
tun_clone_destroy(ffff800000c4a000) at tun_clone_destroy+0x278 sys/net/if_tun.c:305
if_clone_destroy(ffff80002e3684b0) at if_clone_destroy+0x132 sys/net/if.c:1218
soo_ioctl(fffffd80663c5908,80206979,ffff80002e3684b0,ffff8000294e82a0) at soo_ioctl+0x26c
sys_ioctl(ffff8000294e82a0,ffff80002e3685c8,ffff80002e368620) at sys_ioctl+0x4a2
syscall(ffff80002e368690) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002e368690) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x144f9f772f0, count: -9
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002e3682c0
rbx               0xffff800020ce9bff
rdx               0xffff800000db4bc0
rcx                                0
rax               0xffff8000294e82a0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x382cf12a74811aed
r11               0xa777eecf007454f5
r12               0xffff800020ce9a00
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff8196dfc8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80002e3682b0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.2) pid=86834 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=32, usrpri=83, nice=20
    forw=0xffffffffffffffff, list=0xffff8000294e8a80,0xffffffff82a02e48
    process=0xffff8000ffff0440 user=0xffff80002e363000, vmspace=0xfffffd80639118b0
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 40777  227546  53218      0  2           0                syz-executor.5
 22803   84057  85686      0  2           0                syz-executor.2
*22803   86834  85686      0  7   0x4000000                syz-executor.2
 42058  383028  52754      0  7           0                syz-executor.1
 42058   75337  52754      0  3   0x4000080  netio         syz-executor.1
 82305  255977  54116      0  2           0                syz-executor.6
 82305  516217  54116      0  3   0x4000080  fsleep        syz-executor.6
 24771  338712   2210      0  2           0                syz-executor.4
 24771  234406   2210      0  3   0x4000080  kqread        syz-executor.4
 51730  245208  95510      0  2           0                syz-executor.0
 52754  386218  99194      0  3        0x82  nanoslp       syz-executor.1
 85686  426689  99194      0  3        0x82  nanoslp       syz-executor.2
 43003  172598      0      0  3     0x14200  acct          acct
 54116  277861  99194      0  3        0x82  nanoslp       syz-executor.6
  2210  314635  99194      0  3        0x82  nanoslp       syz-executor.4
 62618  347661      0      0  3     0x14280  nfsidl        nfsio
 71749  433242      0      0  3     0x14280  nfsidl        nfsio
 37482   10621      0      0  3     0x14280  nfsidl        nfsio
 61980   88818      0      0  3     0x14280  nfsidl        nfsio
 15736  296569      0      0  3     0x14280  nfsidl        nfsio
 81920  510115      0      0  3     0x14280  nfsidl        nfsio
  4985  213265      0      0  3     0x14280  nfsidl        nfsio
 21777  143674      0      0  3     0x14280  nfsidl        nfsio
 52556   78559      0      0  3     0x14280  nfsidl        nfsio
 20143  309683      0      0  3     0x14280  nfsidl        nfsio
 17986  435233      0      0  3     0x14280  nfsidl        nfsio
 48901  458514      0      0  3     0x14280  nfsidl        nfsio
 77564  295097      0      0  3     0x14280  nfsidl        nfsio
  5943   69633      0      0  3     0x14280  nfsidl        nfsio
 50044  471716      0      0  3     0x14280  nfsidl        nfsio
 13075  336844      0      0  3     0x14280  nfsidl        nfsio
 16610  280665      0      0  3     0x14280  nfsidl        nfsio
 86855  100042      0      0  3     0x14280  nfsidl        nfsio
 28607  184911      0      0  3     0x14280  nfsidl        nfsio
 27303  200396      0      0  3     0x14280  nfsidl        nfsio
 95510  324122  99194      0  3        0x82  nanoslp       syz-executor.0
 47182   41154  99194      0  3        0x82  nanoslp       syz-executor.3
 79982  485248      1      0  3    0x100083  ttyopn        getty
 75217  480939  99194      0  2         0x2                syz-executor.7
 53218   43300  99194      0  3        0x82  nanoslp       syz-executor.5
 82740  209794      0      0  3     0x14200  bored         sosplice
 99194  270155  25652      0  3        0x82  thrsleep      syz-fuzzer
 99194  376017  25652      0  3   0x4000082  nanoslp       syz-fuzzer
 99194  497388  25652      0  3   0x4000082  kqread        syz-fuzzer
 99194  302415  25652      0  3   0x4000082  thrsleep      syz-fuzzer
 99194  145965  25652      0  3   0x4000082  thrsleep      syz-fuzzer
 99194  253680  25652      0  3   0x4000082  thrsleep      syz-fuzzer
 99194     900  25652      0  3   0x4000082  thrsleep      syz-fuzzer
 99194   51178  25652      0  3   0x4000082  thrsleep      syz-fuzzer
 99194  404701  25652      0  3   0x4000082  thrsleep      syz-fuzzer
 25652   53098  12911      0  3    0x10008a  sigsusp       ksh
 12911  460795  77506      0  3        0x9a  kqread        sshd
 77506  416221      1      0  3        0x88  kqread        sshd
 82104  287965    636     74  3    0x100092  bpf           pflogd
   636   16302      1      0  3        0x80  netio         pflogd
 57416  306984  99735     73  3    0x100090  kqread        syslogd
 99735   18744      1      0  3    0x100082  netio         syslogd
 52971   89277      1      0  3    0x100080  kqread        resolvd
 47618   89584  43875     77  2    0x100092                dhcpleased
 11602  207407  43875     77  3    0x100092  kqread        dhcpleased
 43875  332634      1      0  3        0x80  kqread        dhcpleased
 17624  232196      0      0  3     0x14200  bored         smr
 69328  388949      0      0  2     0x14200                zerothread
 87835   47968      0      0  3     0x14200  aiodoned      aiodoned
 98078  116080      0      0  3     0x14200  syncer        update
 48322  166227      0      0  3     0x14200  cleaner       cleaner
 38187  286938      0      0  3     0x14200  reaper        reaper
 82953  158050      0      0  3     0x14200  pgdaemon      pagedaemon
 88608  469984      0      0  3     0x14200  bored         viomb
 12763  203480      0      0  3  0x40014200  acpi0         acpi0
 45798  357515      0      0  3  0x40014200                idle1
 47046  173877      0      0  3     0x14200  bored         softnet
 74244  352166      0      0  3     0x14200  bored         systqmp
 43308  218406      0      0  3     0x14200  bored         systq
 89206  253172      0      0  3  0x40014200  bored         softclock
 22299   35072      0      0  3  0x40014200                idle0
     1  207879      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 22803 (syz-executor.2) thread 0xffff8000294e82a0 (86834)
exclusive rwlock clonelk r = 0 (0xffffffff82958b50)
#0  witness_lock+0x44d
#1  if_clone_destroy+0x49
#2  soo_ioctl+0x26c
#3  sys_ioctl+0x4a2
#4  syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#4  syscall+0x489 sys/arch/amd64/amd64/trap.c:585
#5  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82a9cee0)
#0  witness_lock+0x44d
#1  soo_ioctl+0x25a sys/kern/sys_socket.c:136
#2  sys_ioctl+0x4a2
#3  syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#3  syscall+0x489 sys/arch/amd64/amd64/trap.c:585
#4  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10235   6533K    7294K  78643K     45784        0
            pcb    16     22K      27K  78643K      3778        0
         rtable   205     21K      22K  78643K      4309        0
         ifaddr    97     26K      32K  78643K      2204        0
         sysctl     3      1K       1K  78643K         3        0
       counters    56     35K      36K  78643K       736        0
       ioctlops     0      0K       8K  78643K      6427        0
            iov     0      0K      32K  78643K      2345        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         5        0
         vnodes  1514     95K      95K  78643K     14825        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       9K  78643K       320        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       1K  78643K      2460        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    16     57K      82K  78643K     28977        0
          sigio     1      0K       0K  78643K       341        0
           proc    71     87K     124K  78643K      3469        0
        subproc   104      6K       6K  78643K      1002        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K      1502        0
       in_multi    60      4K       6K  78643K      1785        0
    ether_multi     1      0K       0K  78643K       298        0
            mrt     1      0K       0K  78643K       115        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   241   1076K    1076K  78643K       241        0
           exec     0      0K       2K  78643K      5622        0
     pfkey data     0      0K       0K  78643K        83        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   663   1277K    1291K  78643K    369322        0
       UVM aobj   131      8K       8K  78643K       134        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K      1294        0
            NDP    14      0K       2K  78643K       563        0
           temp   147   4719K    8815K  78643K    285280        0
         kqueue    13     20K      28K  78643K      1695        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120    23092    0    23087   125   123     2     6     0     8    1
rtentry    112     1348    0     1277     4     1     3     4     0     8    0
unpcb      136    17983    0    17968   176   175     1     9     0     8    0
syncache   296      102    0      102    26    26     0     1     0     8    0
tcpqe       32       76    0       76    12    12     0     1     0     8    0
tcpcb      736     9687    0     9679   290   288     2    14     0     8    0
arp        120      221    0      207     1     0     1     1     0     8    0
inpcb      304    24093    0    24081   319   318     1    19     0     8    0
rttmr       72       18    0       18     6     6     0     1     0     8    0
nd6         48      292    0      278     1     0     1     1     0     8    0
pkpcb       40      260    0      260    18    18     0     1     0     8    0
kcovpl      48       76    0       68     1     0     1     1     0     8    0
ppxss      1248     177    0      177    17    17     0     1     0     8    0
pfstscr     40       18    0       18     4     4     0     1     0     8    0
pffrag     232      177    0      176    10     9     1     1     0   482    0
pffrnode    88      176    0      175    10     9     1     1     0     8    0
pffrent     40     1903    0     1902    11    10     1     1     0     8    0
pfosfp      40     1431    0     1007     5     0     5     5     0     8    0
pfosfpen   112     1431    0      716    21     0    21    21     0     8    0
pfrktable  1344      57    0       43     4     2     2     2     0     8    0
pftag       88       16    0        7     1     0     1     1     0     8    0
pfstitem    24      104    0      100     1     0     1     1     0     8    0
pfstkey    112      130    0      126     2     1     1     2     0     8    0
pfstate    320      118    0      114     6     5     1     5     0     8    0
pfrule     1360     410    0      337    13     6     7     9     0     8    0
art_heap8  4096       2    0        1     2     1     1     2     0     8    0
art_heap4  256     5556    0     5273    43    21    22    32     0     8    0
art_table   32     5558    0     5274     5     1     4     5     0     8    0
art_node    16     1337    0     1275     1     0     1     1     0     8    0
sysvmsgpl   40       44    0       33     1     0     1     1     0     8    0
semapl     112     2456    0     2446     1     0     1     1     0     8    0
shmpl      112      131    0        3     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256    41478    0    39928    98     0    98    98     0     8    0
ffsino     272    41478    0    39928   104     0   104   104     0     8    0
nchpl      144    81987    0    80363    63     0    63    63     0     8    0
uvmvnodes   80     8748    0        0   179     0   179   179     0     8    0
vnodes     224     8748    0        0   515     0   515   515     0     8    0
namei      1024  279604    0   279604     7     6     1     2     0     8    1
percpumem   16      380    0      340     1     0     1     1     0     8    0
vcpupl     2048     332    0        0    42     0    42    42     0     8    0
vmpool     560      512    0      180    25     1    24    24     0     8    0
pfiaddrpl  120       54    0       17     3     1     2     2     0     8    0
scsiplug    72       14    0       14     6     6     0     1     0     8    0
scxspl     216   257893    0   257893    47    43     4     8     0     8    4
plimitpl   152     3085    0     3070     1     0     1     1     0     8    0
sigapl     424    29193    0    29128    11     3     8     8     0     8    0
futexpl     64   242286    0   242285     9     8     1     1     0     8    0
knotepl    120     1207    0        0    10     0    10    10     0     8    0
kqueuepl   216     6702    0     6693   138   137     1     8     0     8    0
pipepl     336     5411    0     5382   146   140     6     8     0     8    3
fdescpl    496    29132    0    29103     6     1     5     5     0     8    0
filepl     152   202425    0   202177   283   270    13    24     0     8    3
lockfpl    104     8432    0     8430    16    15     1     4     0     8    0
lockfspl    48     2334    0     2332     2     1     1     2     0     8    0
sessionpl  144       96    0       79     1     0     1     1     0     8    0
pgrppl      48      269    0      252     1     0     1     1     0     8    0
ucredpl     96    24011    0    23989     1     0     1     1     0     8    0
zombiepl   144    29128    0    29127     1     0     1     1     0     8    0
processpl  1064   29193    0    29127     5     0     5     5     0     8    0
procpl     672    83901    0    83823    40    32     8     9     0     8    0
srpgc       96       85    0       85    20    20     0     1     0     8    0
sosppl     168      189    0      189    31    31     0     1     0     8    0
sockpl     480    65448    0    65412  1203  1195     8    42     0     8    3
mcl64k     65536     54    0        0     4     1     3     3     0     8    0
mcl16k     16384     17    0        0     3     0     3     3     0     8    0
mcl12k     12288     41    0        0     3     1     2     2     0     8    0
mcl9k      9216      33    0        0     2     0     2     2     0     8    0
mcl8k      8192      57    0        0     6     3     3     3     0     8    0
mcl4k      4096      41    0        0     3     0     3     3     0     8    0
mcl2k2     2112      12    0        0     1     0     1     1     0     8    0
mcl2k      2048     613    0        0    28    10    18    24     0     8    1
mtagpl      96     1125    0        0    15     2    13    15     0     8    0
mbufpl     256    12472    0        0   716     0   716   716     0     8    0
bufpl      288    50225    0    41477   625     0   625   625     0     8    0
anonpl      24  8189404    0  8168785   386   187   199   204     0   186   55
amapchunkpl 152  906618    0   905770   290   228    62    64     0   158   23
amappl16   200    69304    0    68578   177   136    41    52     0     8    0
amappl15   192     7430    0     7424     1     0     1     1     0     8    0
amappl14   184     4129    0     4120     1     0     1     1     0     8    0
amappl13   176     1489    0     1486     1     0     1     1     0     8    0
amappl12   168     1619    0     1614     1     0     1     1     0     8    0
amappl11   160     5827    0     5811     1     0     1     1     0     8    0
amappl10   152     2325    0     2316     1     0     1     1     0     8    0
amappl9    144     3224    0     3220     1     0     1     1     0     8    0
amappl8    136     9422    0     9236     8     1     7     7     0     8    0
amappl7    128     7080    0     7069     1     0     1     1     0     8    0
amappl6    120     3146    0     3119     2     1     1     2     0     8    0
amappl5    112    24413    0    24388     1     0     1     1     0     8    0
amappl4    104    15678    0    15644     3     1     2     2     0     8    0
amappl3     96     3617    0     3604     1     0     1     1     0     8    0
amappl2     88     3796    0     3733     3     1     2     3     0     8    0
amappl1     80   526539    0   525968    19     5    14    19     0     8    0
amappl      88   366856    0   366515    12     3     9     9     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      133    0        3     3     0     3     3     0     8    0
uaddrrnd    24    29644    0    29283     3     0     3     3     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    29644    0    29283     3     0     3     3     0     8    0
vmmpekpl   168   210204    0   210116     5     0     5     5     0     8    0
vmmpepl    168  2663079    0  2659583   504   321   183   192     0   357    9
vmsppl     368    29643    0    29283    36     3    33    33     0     8    0
rwobjpl     56   633873    0   623072   178    24   154   154     0     8    0
pdppl      4096   59295    0    58898  1131   730   401   401     0     8    4
pvpl        32 13920027    0 13895754   840   513   327   334     0   265  106
pmappl     248    29643    0    29283    24     1    23    23     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112     3303    0     1211    61     0    61    61     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffffffff82984ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff82a9ccd8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82a9ccd8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
softintr_dispatch(0) at softintr_dispatch+0x4e sys/arch/amd64/amd64/softintr.c:88
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7fffffb7c0, count: 9
ddb{0}> trace
x86_ipi_db(ffffffff82984ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff82a9ccd8) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82a9ccd8) at __mp_lock+0x122 sys/kern/kern_lock.c:147
softintr_dispatch(0) at softintr_dispatch+0x4e sys/arch/amd64/amd64/softintr.c:88
Xsoftclock() at Xsoftclock+0x1f
end of kernel
end trace frame: 0x7f7fffffb7c0, count: -6
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff825714b1) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff825eab00,ffffffff82632279,131,ffffffff825fcd23) at __assert+0x25 sys/kern/subr_prf.c:161
tun_clone_destroy(ffff800000c4a000) at tun_clone_destroy+0x278 sys/net/if_tun.c:305
if_clone_destroy(ffff80002e3684b0) at if_clone_destroy+0x132 sys/net/if.c:1218
soo_ioctl(fffffd80663c5908,80206979,ffff80002e3684b0,ffff8000294e82a0) at soo_ioctl+0x26c
sys_ioctl(ffff8000294e82a0,ffff80002e3685c8,ffff80002e368620) at sys_ioctl+0x4a2
syscall(ffff80002e368690) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002e368690) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x144f9f772f0, count: 6
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440
panic(ffffffff825714b1) at panic+0x177 sys/kern/subr_prf.c:202
__assert(ffffffff825eab00,ffffffff82632279,131,ffffffff825fcd23) at __assert+0x25 sys/kern/subr_prf.c:161
tun_clone_destroy(ffff800000c4a000) at tun_clone_destroy+0x278 sys/net/if_tun.c:305
if_clone_destroy(ffff80002e3684b0) at if_clone_destroy+0x132 sys/net/if.c:1218
soo_ioctl(fffffd80663c5908,80206979,ffff80002e3684b0,ffff8000294e82a0) at soo_ioctl+0x26c
sys_ioctl(ffff8000294e82a0,ffff80002e3685c8,ffff80002e368620) at sys_ioctl+0x4a2
syscall(ffff80002e368690) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002e368690) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x144f9f772f0, count: -9

Crashes (24):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2022/02/15 11:38 openbsd 685b342a2af1 8b9ca619 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/13 03:02 openbsd d41f1964b687 8b9ca619 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/12 17:51 openbsd b92d1435fff2 8b9ca619 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/12 16:33 openbsd b92d1435fff2 8b9ca619 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/12 13:45 openbsd b92d1435fff2 8b9ca619 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/12 08:03 openbsd b92d1435fff2 8b9ca619 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 18:52 openbsd 8395b968152a 8b9ca619 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 13:40 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 11:38 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 10:51 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 10:48 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 08:26 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 08:11 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 02:55 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/11 02:22 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/10 21:08 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/10 17:27 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/10 10:33 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/10 10:15 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/10 07:53 openbsd 4e4477fd5c2f 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/02/10 00:16 openbsd 555fd15dcf83 0b33604d .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/01/27 11:34 openbsd ff683e69af4a 2cbffd88 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/01/19 03:26 openbsd be3edcf0ecf3 731a2d23 .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
ci-openbsd-multicore 2022/01/14 03:54 openbsd a5505455aa34 b8d780ab .config log report assert "sc->sc_dev == NUM" failed in if_tun.c
* Struck through repros no longer work on HEAD.