syzbot


assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c

Status: upstream: reported on 2026/04/30 00:50
Reported-by: syzbot+65bf0a9d1cc48d8c3760@syzkaller.appspotmail.com
First crash: 51d, last: 1d10h

Sample crash report:
panic: kernel diagnostic assertion "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_sig.c", line 1602
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*228128  26253      0      0x8000  0xc000000    0  syz-executor
 363040  68903      0           0  0x4000000    1  syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834bfdd0) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834fac31,ffffffff8345fc25,642,ffffffff83442006) at __assert+0x29 sys/kern/subr_prf.c:-1
process_stop(ffff8000fffddd08,8000000,1) at process_stop+0x3fe
cursig(ffff80002a222a70,ffff80002a272d38,0) at cursig+0x509 x86_atomic_setbits_u32 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:-1 [inline]
cursig(ffff80002a222a70,ffff80002a272d38,0) at cursig+0x509 sys/kern/kern_sig.c:1445
userret(ffff80002a222a70) at userret+0x203 sys/kern/kern_sig.c:2207
syscall(ffff80002a272e70) at syscall+0x9ce mi_syscall_return sys/sys/syscall_mi.h:203 [inline]
syscall(ffff80002a272e70) at syscall+0x9ce sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x729b8374900, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: kernel diagnostic assertion "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_sig.c", line 1602
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834bfdd0) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834fac31,ffffffff8345fc25,642,ffffffff83442006) at __assert+0x29 sys/kern/subr_prf.c:-1
process_stop(ffff8000fffddd08,8000000,1) at process_stop+0x3fe
cursig(ffff80002a222a70,ffff80002a272d38,0) at cursig+0x509 x86_atomic_setbits_u32 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:-1 [inline]
cursig(ffff80002a222a70,ffff80002a272d38,0) at cursig+0x509 sys/kern/kern_sig.c:1445
userret(ffff80002a222a70) at userret+0x203 sys/kern/kern_sig.c:2207
syscall(ffff80002a272e70) at syscall+0x9ce mi_syscall_return sys/sys/syscall_mi.h:203 [inline]
syscall(ffff80002a272e70) at syscall+0x9ce sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x729b8374900, count: -8
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a272b50
rbx               0xffffffff838f2e07    cpu_info_full_primary+0x2e07
rdx                                0
rcx               0xffff80002a222a70
rax               0xffffffff838f1ff0    cpu_info_full_primary+0x1ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xcdf291ac2d88c80a
r11                0xf96954239da4537
r12               0xffffffff838f2c08    cpu_info_full_primary+0x2c08
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff811e2e55    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a272b40
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=228128 pid=26253 tcnt=4 stat=onproc
    flags process=8000<STOPPING> proc=c000000<THREAD,SUSPSIG>
    runpri=32, usrpri=83, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=3 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000fffe5788,0xffffffff83a31ff0
    process=0xffff8000fffddd08 user=0xffff80002a26d000, vmspace=0xfffff0006f37f3d8
    estcpu=33, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 21160  108068  35963      0  2           0                syz-executor
 21160  166912  35963      0  3   0x4000080  fsleep        syz-executor
 78958   48650  26272      0  2           0                syz-executor
 78958  517291  26272      0  3   0x4000080  fsleep        syz-executor
 26253  241629   3717      0  2   0x8008000                syz-executor
 26253  359889   3717      0  4   0xc008000                syz-executor
 26253  488597   3717      0  2   0xc008000                syz-executor
*26253  228128   3717      0  7   0xc008000                syz-executor
 68903  238307  60802      0  2           0                syz-executor
 68903  363040  60802      0  7   0x4000000                syz-executor
 68903  308406  60802      0  3   0x4000080  fsleep        syz-executor
 87908  204674  96538      0  2           0                syz-executor
 87908  391984  96538      0  3   0x4000080  fsleep        syz-executor
 87908  428054  96538      0  3   0x4000080  fsleep        syz-executor
 87908  229444  96538      0  3   0x4000080  fsleep        syz-executor
 89842  310385   6862      0  2           0                syz-executor
 89842  149680   6862      0  3   0x4000080  fsleep        syz-executor
 12656  124252  31497      0  2           0                syz-executor
 12656  247085  31497      0  2   0x4000000                syz-executor
 12656  321845  31497      0  2   0x4000000                syz-executor
 33849  496120   8131      0  3      0x3000  suspend       syz-executor
 33849  348924   8131      0  2   0x4081000                syz-executor
 82271   45946      0      0  3     0x14200  acct          acct
 57709  335312      0      0  3     0x14280  nfsidl        nfsio
 15565  141202      0      0  3     0x14280  nfsidl        nfsio
  1870  285287      0      0  3     0x14280  nfsidl        nfsio
  6224   33665      0      0  3     0x14280  nfsidl        nfsio
 94631  443146      0      0  3     0x14280  nfsidl        nfsio
 16378  399383      0      0  3     0x14280  nfsidl        nfsio
 46362  165262      0      0  3     0x14280  nfsidl        nfsio
 10582  126158      0      0  3     0x14280  nfsidl        nfsio
 96400   77671      0      0  3     0x14280  nfsidl        nfsio
 54538    6305      0      0  3     0x14280  nfsidl        nfsio
 94536  387998      0      0  3     0x14280  nfsidl        nfsio
 65992   10509      0      0  3     0x14280  nfsidl        nfsio
 19817  440787      0      0  3     0x14280  nfsidl        nfsio
 27729   62561      0      0  3     0x14280  nfsidl        nfsio
 15329  368158      0      0  3     0x14280  nfsidl        nfsio
 70847  366643      0      0  3     0x14280  nfsidl        nfsio
 27031   84249      0      0  3     0x14280  nfsidl        nfsio
 46793  191925      0      0  3     0x14280  nfsidl        nfsio
 76851  159389      0      0  3     0x14280  nfsidl        nfsio
 58830  104305      0      0  3     0x14280  nfsidl        nfsio
 78386  189009      1      0  3        0x80  nanoslp       init
 31497  346208  72380      0  3        0x82  nanoslp       syz-executor
 60802  408040  72380      0  3        0x82  nanoslp       syz-executor
  6862  419525  72380      0  3        0x82  nanoslp       syz-executor
 35963  106878  72380      0  3        0x82  nanoslp       syz-executor
  8131  330797  72380      0  3        0x82  nanoslp       syz-executor
 96538  473473  72380      0  3        0x82  nanoslp       syz-executor
 26272  181692  72380      0  3        0x82  nanoslp       syz-executor
  3717  296732  72380      0  3        0x82  nanoslp       syz-executor
 72380  479343      1      0  3        0x82  kqread        syz-executor
 50741   66996      0      0  3     0x14200  bored         smr
 57973  440343      0      0  2     0x14200                zerothread
 52189   63604      0      0  3     0x14200  aiodoned      aiodoned
 96372  111759      0      0  3     0x14200  syncer        update
 35161  445842      0      0  3     0x14200  cleaner       cleaner
 79567   25955      0      0  3     0x14200  reaper        reaper
  5321  374745      0      0  3     0x14200  pgdaemon      pagedaemon
 25107  263081      0      0  3     0x14200  bored         viomb
 73538  106433      0      0  3  0x40014200  acpi0         acpi0
 54328  287906      0      0  3  0x40014200                idle1
 51063  298641      0      0  3     0x14200  bored         softnet1
 29396  200180      0      0  3     0x14200  bored         softnet0
 33410  216509      0      0  3     0x14200  bored         systqmp
 30896   23277      0      0  3     0x14200  bored         systq
 13510  305754      0      0  3     0x14200  tmoslp        softclockmp
 10095  483737      0      0  3  0x40014200  tmoslp        softclock
 18160  161033      0      0  3  0x40014200                idle0
     1  259324      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex &sched_lock r = 0 (0xffffffff839ebe50)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  cursig+0x4ee sys/kern/kern_sig.c:1444
#3  userret+0x203 sys/kern/kern_sig.c:2207
#4  syscall+0x9ce mi_syscall_return sys/sys/syscall_mi.h:203 [inline]
#4  syscall+0x9ce sys/arch/amd64/amd64/trap.c:804
#5  Xsyscall+0x128
exclusive mutex &pr->ps_mtx r = 0 (0xffff8000fffdde20)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  cursig+0x4c2 sys/kern/kern_sig.c:1440
#3  userret+0x203 sys/kern/kern_sig.c:2207
#4  syscall+0x9ce mi_syscall_return sys/sys/syscall_mi.h:203 [inline]
#4  syscall+0x9ce sys/arch/amd64/amd64/trap.c:804
#5  Xsyscall+0x128
Process 21160 (syz-executor) thread 0xffff8000fffe4560 (108068)
exclusive rwlock vmmaplk r = 0 (0xfffff0006e7de110)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5171
#3  uvm_map_protect+0xe0 sys/uvm/uvm_map.c:3075
#4  sys_mprotect+0x351 sys/uvm/uvm_mmap.c:590
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11091  12035K   12449K 166960K     12934        0
            pcb    17     15K      16K 166960K       168        0
         rtable   247      9K       9K 166960K       449        0
             pf    41     18K      25K 166960K       301        0
         ifaddr    46      8K       8K 166960K        81        0
        ifgroup    64      2K       2K 166960K       124        0
         sysctl     4      1K       9K 166960K         9        0
       counters    76     37K      38K 166960K       134        0
       ioctlops     1      1K       4K 166960K      1614        0
            iov     1     16K      16K 166960K        22        0
          mount     1      1K       1K 166960K         1        0
            log     1      0K       0K 166960K         5        0
         vnodes  1360     86K      86K 166960K      1854        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        17        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        36        0
        dirhash    12      2K       2K 166960K        27        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     65K      89K 166960K       633        0
          sigio     0      0K       0K 166960K         2        0
           proc    12     17K     164K 166960K       621        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        75        0
       in_multi   100      7K       7K 166960K       123        0
    ether_multi     1      0K       0K 166960K         6        0
            mrt     1      0K       0K 166960K        23        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   265   1182K    1182K 166960K       265        0
           exec     0      0K       1K 166960K       432        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   138     78K     174K 166960K      7774        0
       UVM aobj    13      4K       4K 166960K        13        0
     pinsyscall    19     38K     101K 166960K      1804        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        60        0
            NDP    14      0K       2K 166960K        53        0
           temp    49   9121K    9201K 166960K     29019        0
         kqueue     2      4K      32K 166960K       124        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> 

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/19 04:34 openbsd e607e174aea6 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/18 11:08 openbsd 135881df8fe2 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/17 06:19 openbsd 2f229140c828 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/16 08:21 openbsd 3894b14b3da6 50bb0618 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/14 00:13 openbsd 4abe9ebbcc38 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/13 19:08 openbsd 4abe9ebbcc38 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/13 14:10 openbsd 4abe9ebbcc38 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/10 18:18 openbsd 01c8afc2223d f79bac11 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/08 22:53 openbsd 867bf89e0da6 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/06 00:34 openbsd ce89dc54e9c4 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/04 13:19 openbsd e098f50ba37b 197909be .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/06/01 03:32 openbsd ca362689551c cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/05/23 09:42 openbsd dbd5cf8c5e8a c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/05/21 13:06 openbsd 19a7e1efad25 747d777d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/05/16 10:19 openbsd 25d4b1a85733 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
2026/04/30 00:49 openbsd 167506022718 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid assert "ISSET(p->p_flag, P_SUSPSIG | P_SUSPSINGLE) == NUM" failed in kern_sig.c
* Struck through repros no longer work on HEAD.