syzbot

 sign-in | mailing list | source | docs
🐞 Open [178]
🐞 Fixed [301]
🐞 Invalid [1016]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

assert "map->limit == rtmap_limit" failed in rtable.c (2)

Status: upstream: reported on 2025/02/06 18:09
Reported-by: syzbot+4b7aca0368015987c9cc@syzkaller.appspotmail.com
First crash: 432d, last: 1d18h
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "map->limit == rtmap_limit" failed in rtable.c -1 77 510d 641d 0/3 auto-obsoleted due to no activity on 2025/01/09 07:35

Sample crash report:
panic: kernel diagnostic assertion "map->limit == rtmap_limit" failed: file "/syzkaller/managers/main/kernel/sys/net/rtable.c", line 132
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*149567  26363      0           0  0x4000000    0  syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83419bd8) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff83455330,ffffffff83431729,84,ffffffff834a4e3c) at __assert+0x29 sys/kern/subr_prf.c:-1
rtmap_grow(c,21) at rtmap_grow+0x1f2
rtable_add(b) at rtable_add+0x289 rtable_alloc sys/net/rtable.c:370 [inline]
rtable_add(b) at rtable_add+0x289 sys/net/rtable.c:223
if_createrdomain(b,ffff8000015ee000) at if_createrdomain+0x40 sys/net/if.c:2046
ifioctl(ffff800001595598,8020699f,ffff80002ccb94c0,ffff80002a7762a8) at ifioctl+0x1be2 sys/net/if.c:2395
sys_ioctl(ffff80002a7762a8,ffff80002ccb9690,ffff80002ccb95e0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80002ccb9690) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002ccb9690) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc6871a71000, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: kernel diagnostic assertion "map->limit == rtmap_limit" failed: file "/syzkaller/managers/main/kernel/sys/net/rtable.c", line 132
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83419bd8) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff83455330,ffffffff83431729,84,ffffffff834a4e3c) at __assert+0x29 sys/kern/subr_prf.c:-1
rtmap_grow(c,21) at rtmap_grow+0x1f2
rtable_add(b) at rtable_add+0x289 rtable_alloc sys/net/rtable.c:370 [inline]
rtable_add(b) at rtable_add+0x289 sys/net/rtable.c:223
if_createrdomain(b,ffff8000015ee000) at if_createrdomain+0x40 sys/net/if.c:2046
ifioctl(ffff800001595598,8020699f,ffff80002ccb94c0,ffff80002a7762a8) at ifioctl+0x1be2 sys/net/if.c:2395
sys_ioctl(ffff80002a7762a8,ffff80002ccb9690,ffff80002ccb95e0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80002ccb9690) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002ccb9690) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc6871a71000, count: -10
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002ccb91f0
rbx                             0x21
rdx                                0
rcx                                0
rax               0xffff80002a7762a8
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x6a99b15eebc0369e
r11               0x48f2c13b84cd523d
r12                                0
r13                              0x6
r14                                0
r15                              0x1
rip               0xffffffff81389065    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002ccb91e0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor) tid=149567 pid=26363 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=80, usrpri=81, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a776d08,0xffff80002f0c07f0
    process=0xffff80002f0be418 user=0xffff80002ccb4000, vmspace=0xfffffd806cb2de70
    estcpu=31, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 60658  458397  24421      0  2           0                syz-executor
 60658   36690  24421      0  2   0x4000000                syz-executor
 60658  315186  24421      0  2   0x4000000                syz-executor
 10957  250302  82676      0  2           0                syz-executor
 10957  286102  82676      0  3   0x4000080  kqread        syz-executor
 10957   32900  82676      0  2   0x4000000                syz-executor
 26363  196930  64775      0  2           0                syz-executor
 26363  329955  64775      0  2   0x4000000                syz-executor
*26363  149567  64775      0  7   0x4000000                syz-executor
 46488  197039      1      0  3        0x80  nanoslp       init
 79597  410880  82718      0  2        0x10                syz-executor
 79597  237346  82718      0  2   0x4000010                syz-executor
 79597  390228  82718      0  3   0x4000090  fsleep        syz-executor
 63124  269360  26746      0  2           0                syz-executor
 63124  356016  26746      0  2   0x4000000                syz-executor
 63124  523811  26746      0  3   0x4000080  fsleep        syz-executor
 70893   47949    663  60929  3        0x90  nanoslp       syz-executor
 70893   40966    663  60929  3   0x4000090  kqread        syz-executor
 70893  407401    663  60929  3   0x4000090  fsleep        syz-executor
 70893  399394    663  60929  3   0x4000090  fsleep        syz-executor
 38158  243309  45379      0  3           0  vmmaplk       syz-executor
 38158  107264  45379      0  2   0x4000000                syz-executor
 38158  468013  45379      0  3   0x4000080  fsleep        syz-executor
 84378   92404      0      0  3     0x14200  acct          acct
 45379  169665  75229      0  3        0x82  nanoslp       syz-executor
 64775  193410  75229      0  2       0xc82                syz-executor
 24421  287420  75229      0  3        0x82  nanoslp       syz-executor
 82676  287126  75229      0  3        0x82  nanoslp       syz-executor
 82718  463719  75229      0  2       0xc82                syz-executor
   663  421668  75229      0  2       0xc82                syz-executor
 26746  502007  75229      0  3        0x82  nanoslp       syz-executor
 84425  161564  75229      0  2         0x2                syz-executor
 75229   84343      1      0  3        0x82  kqread        syz-executor
 34336   20745      0      0  3     0x14200  bored         smr
 33602  401243      0      0  2     0x14200                zerothread
 40119  406379      0      0  3     0x14200  aiodoned      aiodoned
 26750  214428      0      0  3     0x14200  syncer        update
 22070  384040      0      0  3     0x14200  cleaner       cleaner
 66034  446677      0      0  3     0x14200  reaper        reaper
 43735  413506      0      0  3     0x14200  pgdaemon      pagedaemon
 60789  392887      0      0  3     0x14200  bored         viomb
 57241  492717      0      0  3  0x40014200  acpi0         acpi0
 11457  472890      0      0  2     0x14200                softnet0
 69773   69855      0      0  3     0x14200  bored         systqmp
 30133   78340      0      0  3     0x14200  bored         systq
  6839  176949      0      0  3  0x40014200  tmoslp        softclock
 74182   11714      0      0  3  0x40014200                idle0
     1  429085      0      0  3     0x80082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb>

Crashes (483):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/13 06:52 openbsd 4ec71eeccea4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/04/13 00:25 openbsd 4ec71eeccea4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/04/11 14:01 openbsd 9bac450dd51b 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/04/10 23:52 openbsd 411a0c209e89 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/04/09 17:50 openbsd f951d642cc52 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/04/07 16:53 openbsd c0c2c6a525e1 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/04/03 16:57 openbsd de6be2070bf6 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/04/02 21:05 openbsd 38cd3ff5d287 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/04/01 23:04 openbsd ffc378411de4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/28 18:30 openbsd cc88cbeddb7d 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/28 15:25 openbsd 9d790fdba930 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/28 05:20 openbsd 9d790fdba930 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/27 14:42 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/27 05:44 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/27 01:03 openbsd 9c6370df4fcd 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/26 23:49 openbsd 9c6370df4fcd 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/26 16:16 openbsd 9c6370df4fcd 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/25 16:07 openbsd ee1bf64f5bae 4367a094 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/25 04:55 openbsd 87dc1fa97379 35e4ff71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/24 02:14 openbsd 2084961b940b baf8bf12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/23 21:42 openbsd ccfcb3e6ef18 5e3db351 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/22 23:58 openbsd 33c7e43e4e2f 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/22 12:11 openbsd 67e6794a9e1c 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/22 00:18 openbsd 8aa14d77a9ab 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/21 20:58 openbsd 8aa14d77a9ab 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/21 19:54 openbsd 8aa14d77a9ab 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/21 08:04 openbsd a71bcab410b6 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/21 05:41 openbsd a71bcab410b6 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/21 04:33 openbsd a71bcab410b6 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/20 20:05 openbsd 65032adb4937 85bf2a64 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/20 05:09 openbsd f53d362946f9 2f245add .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/19 20:29 openbsd e3f28ea82b45 0291cd06 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/19 18:58 openbsd e3f28ea82b45 0291cd06 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/19 02:48 openbsd cf7d68fc25cd 0199f9a1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/18 15:46 openbsd 561bf2d2294a 0199f9a1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/18 00:24 openbsd 7b59c65f5490 c8810548 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/17 20:16 openbsd 7b59c65f5490 c8810548 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/16 21:36 openbsd 15ef65f2835f 64e21424 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/16 16:13 openbsd 15ef65f2835f 64e21424 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/14 05:44 openbsd fd49698d88e5 351cb5cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/13 07:01 openbsd 7210d95da7cb 2f7f359d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/13 04:07 openbsd fd49698d88e5 2f7f359d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/11 17:27 openbsd 177cf78f1bc3 b4075e21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/03/11 09:28 openbsd 177cf78f1bc3 b4075e21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/02/13 18:57 openbsd 002f3ac1824d 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2025/02/06 18:08 openbsd 4a7e1005694f 1e1faf27 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
* Struck through repros no longer work on HEAD.