panic: Caught invalid memory access at ffff800001b4d0e8 size 8 op 1
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
428762 79573 0 0 0x1 0 syz-executor
*337144 6461 0 0x2 0x1 1 syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
__asan_store8_noabort(ffff800001b4d0e8) at __asan_store8_noabort+0xe4 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_store8_noabort(ffff800001b4d0e8) at __asan_store8_noabort+0xe4 sys/kern/subr_kasan.c:1038
free(ffff800001b4d200,7f,18) at free+0x678 sys/kern/kern_malloc.c:556
ktrsyscall(ffff800029942548,57,10,ffff800029ad8db0) at ktrsyscall+0x4ae x86_atomic_clearbits_u32 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:-1 [inline]
ktrsyscall(ffff800029942548,57,10,ffff800029ad8db0) at ktrsyscall+0x4ae sys/kern/kern_ktrace.c:186
syscall(ffff800029ad8db0) at syscall+0x640 mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff800029ad8db0) at syscall+0x640 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f056732a4e0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffff800001b4d0e8 size 8 op 1
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
__asan_store8_noabort(ffff800001b4d0e8) at __asan_store8_noabort+0xe4 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_store8_noabort(ffff800001b4d0e8) at __asan_store8_noabort+0xe4 sys/kern/subr_kasan.c:1038
free(ffff800001b4d200,7f,18) at free+0x678 sys/kern/kern_malloc.c:556
ktrsyscall(ffff800029942548,57,10,ffff800029ad8db0) at ktrsyscall+0x4ae x86_atomic_clearbits_u32 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:-1 [inline]
ktrsyscall(ffff800029942548,57,10,ffff800029ad8db0) at ktrsyscall+0x4ae sys/kern/kern_ktrace.c:186
syscall(ffff800029ad8db0) at syscall+0x640 mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff800029ad8db0) at syscall+0x640 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f056732a4e0, count: -7
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800029ad8850
rbx 0xffff800029ad88c0
rdx 0
rcx 0xffff800028ff3ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff800029ad8638
r11 0xffffffff814e1f30 x86_bus_space_io_read_1
r12 0xffffffff846334c7 db_machine_command_table+0x9b027
r13 0xffff800028ff4c08
r14 0xffff800028ff4e07
r15 0x1
rip 0xffffffff81006567 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff800029ad8850
ss 0x10
db_enter+0x17: popq %rbp
ddb{1}> show proc
PROC (syz-executor) tid=337144 pid=6461 tcnt=1 stat=onproc
flags process=2<EXEC> proc=1<INKTR>
runpri=32, usrpri=74, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff800029942fa8,0xffff8000298a4548
process=0xffff800045ffab68 user=0xffff800029acd000, vmspace=0xffff800000d87000
estcpu=24, cpticks=75, pctcpu=0.40, user=0, sys=73, intr=1
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
15507 437008 20693 0 2 0 syz-executor
15507 63237 20693 0 2 0x4000000 syz-executor
79573 428762 92466 0 7 0x1 syz-executor
22448 139632 24290 0 2 0 syz-executor
22448 412951 24290 0 3 0x4000080 fsleep syz-executor
41704 436934 24551 0 2 0x2 syz-executor
72170 471163 40732 0 3 0x80 nanoslp syz-executor
72170 21450 40732 0 3 0x4000088 kqpoll syz-executor
72170 440344 40732 0 3 0x4000080 fsleep syz-executor
22566 36441 45000 0 3 0x90 nanoslp syz-executor
22566 92896 45000 0 3 0x4000090 msgwait syz-executor
22566 276844 45000 0 3 0x4000090 fsleep syz-executor
45000 83215 24551 0 3 0x82 nanoslp syz-executor
81462 128388 1 0 3 0x82 nanoslp getty
* 6461 337144 24551 0 7 0x3 syz-executor
20693 395313 24551 0 3 0x82 nanoslp syz-executor
40732 450053 24551 0 3 0x82 nanoslp syz-executor
92466 24010 24551 0 3 0x82 nanoslp syz-executor
824 306386 24551 0 3 0x82 nanoslp syz-executor
24290 485568 24551 0 3 0x82 nanoslp syz-executor
24551 306910 1 0 3 0x82 kqread syz-executor
85144 104162 0 0 2 0x40014200 smr
38464 292637 0 0 2 0x14200 zerothread
66282 261703 0 0 3 0x14200 aiodoned aiodoned
75008 266703 0 0 3 0x14200 syncer update
16555 232068 0 0 3 0x14200 cleaner cleaner
22747 196155 0 0 3 0x14200 reaper reaper
14714 388220 0 0 3 0x14200 pgdaemon pagedaemon
18138 464546 0 0 3 0x14200 bored viomb
53854 4768 0 0 3 0x40014200 acpi0 acpi0
26348 105954 0 0 3 0x40014200 idle1
99210 5583 0 0 3 0x14200 bored softnet1
66772 222385 0 0 3 0x14200 bored softnet0
90023 36328 0 0 3 0x14200 smrbar systqmp
37156 121659 0 0 3 0x14200 bored systq
20024 215405 0 0 3 0x14200 tmoslp softclockmp
43827 111913 0 0 3 0x40014200 tmoslp softclock
6664 367748 0 0 3 0x40014200 idle0
1 175063 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
CPU 1:
exclusive mutex /syzkaller/managers/kasan/kernel/sys/kern/kern_malloc.c:109 r = 0 (0xffffffff85227630)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 mtx_enter+0x683 sys/kern/kern_lock.c:487
#2 free+0x129 sys/kern/kern_malloc.c:441
#3 ktrsyscall+0x4ae x86_atomic_clearbits_u32 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:-1 [inline]
#3 ktrsyscall+0x4ae sys/kern/kern_ktrace.c:186
#4 syscall+0x640 mi_syscall sys/sys/syscall_mi.h:154 [inline]
#4 syscall+0x640 sys/arch/amd64/amd64/trap.c:783
#5 Xsyscall+0x128
Process 90023 (systqmp) thread 0xffff800045ffe000 (36328)
shared rwlock systqmp r = 0 (0xffffffff85403f18)
#0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x632 sys/kern/subr_witness.c:1160
#1 taskq_thread+0x1ba sys/kern/kern_task.c:442
#2 proc_trampoline+0x10
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11046 12477K 12624K 166960K 12290 0
pcb 17 28K 30K 166960K 49 0
rtable 216 11K 13K 166960K 418 0
pf 34 22K 24K 166960K 78 0
ifaddr 40 11K 13K 166960K 60 0
ifgroup 53 2K 2K 166960K 79 0
sysctl 3 1K 13K 166960K 8 0
counters 70 42K 43K 166960K 84 0
ioctlops 0 0K 4K 166960K 1509 0
iov 0 0K 8K 166960K 71 0
mount 1 1K 1K 166960K 1 0
log 2 0K 0K 166960K 6 0
vnodes 1301 84K 84K 166960K 1487 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 10K 166960K 17 0
VM map 2 1K 1K 166960K 2 0
sem 8 0K 1K 166960K 9 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 16 61K 97K 166960K 332 0
sigio 0 0K 0K 166960K 1 0
proc 21 46K 177K 166960K 660 0
subproc 64 8K 9K 166960K 91 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 0 0K 0K 166960K 6 0
in_multi 88 6K 7K 166960K 121 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 13 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 61 425K 425K 166960K 61 0
exec 0 0K 2K 166960K 421 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 122 127K 254K 166960K 4722 0
UVM aobj 58 7K 7K 166960K 59 0
pinsyscall 19 38K 108K 166960K 1548 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 1 0
NDP 12 0K 1K 166960K 39 0
temp 36 9171K 9491K 166960K 10678 0
kqueue 2 8K 45K 166960K 46 0
SYN cache 2 16K 16K 166960K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 38 0 38 1 0 1 1 0 8 1
rtentry 176 135 0 36 6 0 6 6 0 8 0
unpcb 144 305 0 305 6 0 6 6 0 8 6
syncache 336 4 0 4 2 2 0 1 0 8 0
tcpcb 736 55 0 54 4 0 4 4 0 8 3
arp 136 22 0 6 1 0 1 1 0 8 0
inpcb 328 237 0 236 6 0 6 6 0 8 5
nd6 152 32 0 11 1 0 1 1 0 8 0
kcovpl 48 10 0 3 1 0 1 1 0 8 0
ppxss 1192 3 0 2 1 0 1 1 0 8 0
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 1 0 0 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfrktable 1344 1 0 1 1 0 1 1 0 8 1
pftag 88 2 0 0 1 0 1 1 0 8 0
pfstitem 24 33 0 0 1 0 1 1 0 8 0
pfstkey 128 33 0 0 2 0 2 2 0 8 0
pfstate 448 33 0 0 4 0 4 4 0 8 0
pfrule 1360 25 0 20 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 546 0 90 29 0 29 29 0 8 0
art_table 40 547 0 90 5 0 5 5 0 8 0
art_node 32 135 0 45 1 0 1 1 0 8 0
sysvmsgpl 40 35 0 34 1 0 1 1 0 8 0
semupl 112 1 0 1 1 1 0 1 0 8 0
semapl 72 6 0 0 1 0 1 1 0 8 0
shmpl 112 56 0 1 2 0 2 2 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1822 0 345 93 0 93 93 0 8 0
ffsino 296 1822 0 345 114 0 114 114 0 8 0
nchpl 144 2240 0 532 64 0 64 64 0 8 0
vnodes 216 2005 0 0 112 0 112 112 0 8 0
namei 1024 7119 0 7119 2 1 1 2 0 8 1
percpumem 16 58 0 7 1 0 1 1 0 8 0
kstatmem 264 41 0 14 2 0 2 2 0 8 0
scxspl 216 8225 0 8225 6 4 2 3 1 8 2
plimitpl 152 41 0 31 1 0 1 1 0 8 0
sigapl 424 645 0 610 7 1 6 7 0 8 1
knotepl 120 61 0 0 2 0 2 2 0 8 0
kqueuepl 224 61 0 59 1 0 1 1 0 8 0
pipepl 344 191 0 164 6 0 6 6 0 8 3
fdescpl 528 629 0 610 3 0 3 3 0 8 0
filepl 160 2786 0 2639 15 0 15 15 0 8 6
lockfpl 104 65 0 65 1 0 1 1 0 8 1
lockfspl 48 32 0 32 1 0 1 1 0 8 1
sessionpl 144 35 0 33 1 0 1 1 0 8 0
pgrppl 48 50 0 40 1 0 1 1 0 8 0
ucredpl 104 292 0 288 1 0 1 1 0 8 0
zombiepl 144 612 0 610 1 0 1 1 0 8 0
processpl 1232 645 0 610 5 1 4 5 0 8 0
procpl 664 906 0 865 6 0 6 6 0 8 1
sosppl 176 2 0 2 1 0 1 1 0 8 1
sockpl 752 581 0 580 16 7 9 16 0 8 8
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl16k 16384 1 0 0 1 0 1 1 0 8 0
mcl12k 12288 1 0 0 1 0 1 1 0 8 0
mcl9k128 9344 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 3 0 0 1 0 1 1 0 8 0
mcl4k 4096 111 0 0 14 0 14 14 0 8 0
mcl2k 2048 21 0 0 3 0 3 3 0 8 0
mextrefs 64 19 0 0 1 0 1 1 0 8 0
mtagpl 96 2 0 0 1 0 1 1 0 8 0
mbufpl 256 185 0 0 12 0 12 12 0 8 0
bufpl 272 2670 0 105 171 0 171 171 0 8 0
anonpl 32 4389 0 0 37 1 36 37 0 222 0
amapchunkpl 152 13797 0 13480 23 0 23 23 0 158 5
amappl16 200 2127 0 2112 5 3 2 5 0 8 0
amappl15 192 2 0 2 1 1 0 1 0 8 0
amappl14 184 457 0 457 1 0 1 1 0 8 1
amappl13 176 130 0 129 1 0 1 1 0 8 0
amappl12 168 891 0 874 2 0 2 2 0 8 0
amappl11 160 10 0 10 2 1 1 1 0 8 1
amappl10 152 69 0 69 1 0 1 1 0 8 1
amappl9 144 272 0 272 1 0 1 1 0 8 1
amappl8 136 109 0 109 1 0 1 1 0 8 1
amappl7 128 157 0 155 1 0 1 1 0 8 0
amappl6 120 178 0 178 1 0 1 1 0 8 1
amappl5 112 114 0 114 1 0 1 1 0 8 1
amappl4 104 324 0 321 1 0 1 1 0 8 0
amappl3 96 2617 0 2546 4 0 4 4 0 8 1
amappl2 88 562 0 554 2 0 2 2 0 8 0
amappl1 80 11483 0 11367 15 2 13 15 0 8 8
amappl 88 3922 0 3815 5 0 5 5 0 92 0
uvmvnodes 80 103 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 58 0 1 2 0 2 2 0 8 0
uaddrrnd 24 629 0 610 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 629 0 610 1 0 1 1 0 8 0
vmmpekpl 168 7326 0 7289 3 0 3 3 0 8 0
vmmpepl 168 49084 0 48276 87 0 87 87 0 357 46
vmsppl 488 628 0 610 5 0 5 5 0 8 1
rwobjpl 80 16963 0 16512 25 2 23 25 0 8 2
pdppl 4096 1267 0 1220 101 50 51 89 0 8 4
pvpl 32 10716 0 0 88 1 87 87 0 265 0
pmappl 256 628 0 610 3 0 3 3 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 450 0 56 12 0 12 12 0 8 0
ddb{1}> machine ddbcpu 0
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffffffff853a2ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
mtx_enter(ffffffff85227620) at mtx_enter+0x467 sys/kern/kern_lock.c:454
malloc(10,7f,1) at malloc+0x2a5 sys/kern/kern_malloc.c:217
ktrsyscall(ffff800029942a78,c,8,ffff80002999bab0) at ktrsyscall+0x201 sys/kern/kern_ktrace.c:174
syscall(ffff80002999bab0) at syscall+0x640 mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff80002999bab0) at syscall+0x640 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x72cd72455d70, count: 7
ddb{0}> trace
x86_ipi_db(ffffffff853a2ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
mtx_enter(ffffffff85227620) at mtx_enter+0x467 sys/kern/kern_lock.c:454
malloc(10,7f,1) at malloc+0x2a5 sys/kern/kern_malloc.c:217
ktrsyscall(ffff800029942a78,c,8,ffff80002999bab0) at ktrsyscall+0x201 sys/kern/kern_ktrace.c:174
syscall(ffff80002999bab0) at syscall+0x640 mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff80002999bab0) at syscall+0x640 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x72cd72455d70, count: -8
ddb{0}> machine ddbcpu 1
Stopped at db_enter+0x17: popq %rbp
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
__asan_store8_noabort(ffff800001b4d0e8) at __asan_store8_noabort+0xe4 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_store8_noabort(ffff800001b4d0e8) at __asan_store8_noabort+0xe4 sys/kern/subr_kasan.c:1038
free(ffff800001b4d200,7f,18) at free+0x678 sys/kern/kern_malloc.c:556
ktrsyscall(ffff800029942548,57,10,ffff800029ad8db0) at ktrsyscall+0x4ae x86_atomic_clearbits_u32 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:-1 [inline]
ktrsyscall(ffff800029942548,57,10,ffff800029ad8db0) at ktrsyscall+0x4ae sys/kern/kern_ktrace.c:186
syscall(ffff800029ad8db0) at syscall+0x640 mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff800029ad8db0) at syscall+0x640 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f056732a4e0, count: 8
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846334c7) at panic+0x270 sys/kern/subr_prf.c:198
__asan_store8_noabort(ffff800001b4d0e8) at __asan_store8_noabort+0xe4 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_store8_noabort(ffff800001b4d0e8) at __asan_store8_noabort+0xe4 sys/kern/subr_kasan.c:1038
free(ffff800001b4d200,7f,18) at free+0x678 sys/kern/kern_malloc.c:556
ktrsyscall(ffff800029942548,57,10,ffff800029ad8db0) at ktrsyscall+0x4ae x86_atomic_clearbits_u32 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:-1 [inline]
ktrsyscall(ffff800029942548,57,10,ffff800029ad8db0) at ktrsyscall+0x4ae sys/kern/kern_ktrace.c:186
syscall(ffff800029ad8db0) at syscall+0x640 mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff800029ad8db0) at syscall+0x640 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f056732a4e0, count: -7
ddb{1}>