login: panic: kernel diagnostic assertion "cpipe->pipe_buffer.cnt == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/sys_pipe.c", line 223
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
416932 27995 0 0x2 0 1 syz-executor1001
* 50835 27995 0 0x2 0x4000000 0K syz-executor1001
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:212
__assert(ffffffff81fac4df,ffffffff81f97e38,df,ffffffff81f4ba54) at __assert+0x2e sys/kern/subr_prf.c:159
pipespace(fffffd8074bd6b68,10000) at pipespace+0x18f sys/kern/sys_pipe.c:219
pipe_write(fffffd8074bf1c78,ffff800020bbb368,0) at pipe_write+0x973 sys/kern/sys_pipe.c:472
dofilewritev(ffff800020b618c0,4,ffff800020bbb368,0,ffff800020bbb470) at dofilewritev+0x1ac sys/kern/sys_generic.c:364
sys_write(ffff800020b618c0,ffff800020bbb408,ffff800020bbb470) at sys_write+0x83 sys/kern/sys_generic.c:284
syscall(ffff800020bbb4e0) at syscall+0x552 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800020bbb4e0) at syscall+0x552 sys/arch/amd64/amd64/trap.c:554
Xsyscall(6,0,31ad4d14138,0,31ad4d14118,31ad4d14110) at Xsyscall+0x128
end of kernel
end trace frame: 0x31da0278a70, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel diagnostic assertion "cpipe->pipe_buffer.cnt == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/sys_pipe.c", line 223
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:212
__assert(ffffffff81fac4df,ffffffff81f97e38,df,ffffffff81f4ba54) at __assert+0x2e sys/kern/subr_prf.c:159
pipespace(fffffd8074bd6b68,10000) at pipespace+0x18f sys/kern/sys_pipe.c:219
pipe_write(fffffd8074bf1c78,ffff800020bbb368,0) at pipe_write+0x973 sys/kern/sys_pipe.c:472
dofilewritev(ffff800020b618c0,4,ffff800020bbb368,0,ffff800020bbb470) at dofilewritev+0x1ac sys/kern/sys_generic.c:364
sys_write(ffff800020b618c0,ffff800020bbb408,ffff800020bbb470) at sys_write+0x83 sys/kern/sys_generic.c:284
syscall(ffff800020bbb4e0) at syscall+0x552 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800020bbb4e0) at syscall+0x552 sys/arch/amd64/amd64/trap.c:554
Xsyscall(6,0,31ad4d14138,0,31ad4d14118,31ad4d14110) at Xsyscall+0x128
end of kernel
end trace frame: 0x31da0278a70, count: -9
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800020bbb0e0
rbx 0xffff800020bbb190
rdx 0x8b
rcx 0x2
rax 0x1
r8 0xffffffff8129f2b3 kprintf+0x173
r9 0x1
r10 0xebcc0324f435994d
r11 0x5e9058dc3d58bbc8
r12 0x3000000008
r13 0xffff800020bbb0f0
r14 0x100
r15 0x1
rip 0xffffffff81c0e2c8 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020bbb0d0
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor1001) pid=50835 stat=onproc
flags process=2<EXEC> proc=4000000<THREAD>
pri=16, usrpri=53, nice=20
forw=0xffffffffffffffff, list=0xffff800020b60c68,0xffffffff823aadc0
process=0xffff800020b2b890 user=0xffff800020bb6000, vmspace=0xfffffd806e7e0cf8
estcpu=3, cpticks=2, pctcpu=0.0
user=0, sys=2, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
27995 416932 47164 0 7 0x2 syz-executor1001
27995 408787 47164 0 2 0x4000002 syz-executor1001
27995 264224 47164 0 2 0x4000002 syz-executor1001
*27995 50835 47164 0 7 0x4000002 syz-executor1001
47164 479012 10813 0 3 0x10008a pause ksh
10813 389890 75096 0 3 0x92 select sshd
30328 4483 1 0 3 0x100083 ttyin getty
75096 136739 1 0 3 0x80 select sshd
17758 131227 77225 74 3 0x100092 bpf pflogd
77225 314754 1 0 3 0x80 netio pflogd
41468 402788 81494 73 3 0x100090 kqread syslogd
81494 345563 1 0 3 0x100082 netio syslogd
38192 137329 1 77 3 0x100090 poll dhclient
1924 3379 1 0 3 0x80 poll dhclient
3967 89463 0 0 3 0x14200 pgzero zerothread
41531 108612 0 0 3 0x14200 aiodoned aiodoned
70809 307534 0 0 3 0x14200 syncer update
71607 372936 0 0 3 0x14200 cleaner cleaner
97917 476194 0 0 3 0x14200 reaper reaper
94743 475458 0 0 3 0x14200 pgdaemon pagedaemon
30618 160213 0 0 3 0x14200 bored crynlk
13818 90235 0 0 3 0x14200 bored crypto
58229 159970 0 0 3 0x40014200 acpi0 acpi0
71179 265649 0 0 3 0x40014200 idle1
42230 354849 0 0 3 0x14200 bored softnet
2391 144984 0 0 3 0x14200 bored systqmp
20466 248695 0 0 3 0x14200 bored systq
75734 174105 0 0 3 0x40014200 bored softclock
66857 68618 0 0 3 0x40014200 idle0
12798 117740 0 0 3 0x14200 bored smr
1 456409 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 27995 (syz-executor1001) thread 0xffff800020b618c0 (50835)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff823a5968)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1163
#1 __mp_acquire_count+0x51 sys/kern/kern_lock.c:227
#2 mi_switch+0x38f sys/kern/sched_bsd.c:440
#3 sleep_finish+0x113 sys/kern/kern_synch.c:373
#4 tsleep+0x198 sleep_finish_timeout sys/kern/kern_synch.c:397 [inline]
#4 tsleep+0x198 sleep_finish_all sys/kern/kern_synch.c:183 [inline]
#4 tsleep+0x198 sys/kern/kern_synch.c:152
#5 pipe_write+0x8f0 pipelock sys/kern/sys_pipe.c:286 [inline]
#5 pipe_write+0x8f0 sys/kern/sys_pipe.c:471
#6 dofilewritev+0x1ac sys/kern/sys_generic.c:364
#7 sys_write+0x83 sys/kern/sys_generic.c:284
#8 syscall+0x552 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#8 syscall+0x552 sys/arch/amd64/amd64/trap.c:554
#9 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9452 6383K 6384K 78643K 10539 0 0
pcb 25 9K 9K 78643K 57 0 0
rtable 61 2K 2K 78643K 125 0 0
ifaddr 25 7K 7K 78643K 26 0 0
counters 39 33K 33K 78643K 39 0 0
ioctlops 0 0K 4K 78643K 1467 0 0
iov 0 0K 12K 78643K 1 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1181 74K 74K 78643K 1186 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 1K 78643K 2 0 0
VM map 2 1K 1K 78643K 2 0 0
sem 2 0K 0K 78643K 2 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1808 196K 290K 78643K 12765 0 0
file desc 1 0K 0K 78643K 1 0 0
proc 52 50K 58K 78643K 334 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
in_multi 11 0K 0K 78643K 11 0 0
ether_multi 1 0K 0K 78643K 1 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 18 79K 79K 78643K 18 0 0
exec 0 0K 1K 78643K 179 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 66 11K 11K 78643K 821 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
NDP 4 0K 0K 78643K 4 0 0
temp 39 2728K 2792K 78643K 1993 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 2 0 0 1 0 1 1 0 8 0
inpcbpl 280 29 0 23 1 0 1 1 0 8 0
plcache 128 20 0 0 1 0 1 1 0 8 0
rtentry 112 23 0 1 1 0 1 1 0 8 0
syncache 264 5 0 5 1 0 1 1 0 8 1
tcpcb 544 8 0 5 1 0 1 1 0 8 0
pfosfp 40 846 0 423 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 8 0 0 1 0 1 1 0 8 0
pfstkey 112 8 0 0 1 0 1 1 0 8 0
pfstate 328 8 0 0 1 0 1 1 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 96 0 0 6 0 6 6 0 8 0
art_table 32 97 0 0 1 0 1 1 0 8 0
art_node 16 22 0 2 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino1pl 128 1401 0 17 45 0 45 45 0 8 0
ffsino 272 1401 0 17 93 0 93 93 0 8 0
nchpl 144 1575 0 32 58 0 58 58 0 8 0
uvmvnodes 72 1411 0 0 26 0 26 26 0 8 0
vnodes 200 1411 0 0 75 0 75 75 0 8 0
namei 1024 3645 0 3645 2 1 1 1 0 8 1
percpumem 16 30 0 0 1 0 1 1 0 8 0
scxspl 192 2458 0 2458 2 1 1 2 0 8 1
plimitpl 152 15 0 8 1 0 1 1 0 8 0
sigapl 432 205 0 193 2 0 2 2 0 8 0
knotepl 112 5 0 0 1 0 1 1 0 8 0
kqueuepl 104 1 0 0 1 0 1 1 0 8 0
pipepl 112 136 0 127 2 1 1 1 0 8 0
fdescpl 488 206 0 193 3 0 3 3 0 8 0
filepl 152 987 0 935 2 0 2 2 0 8 0
lockfpl 104 7 0 6 2 1 1 1 0 8 0
lockfspl 48 4 0 3 2 1 1 1 0 8 0
sessionpl 112 19 0 9 1 0 1 1 0 8 0
pgrppl 48 19 0 9 1 0 1 1 0 8 0
ucredpl 96 52 0 43 1 0 1 1 0 8 0
zombiepl 144 193 0 193 2 1 1 1 0 8 1
processpl 896 221 0 193 4 0 4 4 0 8 0
procpl 632 224 0 193 3 0 3 3 0 8 0
sockpl 384 73 0 55 2 0 2 2 0 8 0
mcl4k 4096 3 0 0 1 0 1 1 0 8 0
mcl2k 2048 67 0 0 9 0 9 9 0 8 0
mtagpl 80 1 0 0 1 0 1 1 0 8 0
mbufpl 256 86 0 0 6 0 6 6 0 8 0
bufpl 256 2241 0 276 123 0 123 123 0 8 0
anonpl 16 20337 0 18767 8 1 7 7 0 125 0
amapchunkpl 152 543 0 500 2 0 2 2 0 158 0
amappl16 192 99 0 76 2 0 2 2 0 8 0
amappl14 176 38 0 34 1 0 1 1 0 8 0
amappl12 160 7 0 7 1 0 1 1 0 8 1
amappl11 152 47 0 32 1 0 1 1 0 8 0
amappl10 144 55 0 53 1 0 1 1 0 8 0
amappl9 136 427 0 426 1 0 1 1 0 8 0
amappl8 128 102 0 97 1 0 1 1 0 8 0
amappl7 120 20 0 18 1 0 1 1 0 8 0
amappl6 112 46 0 42 1 0 1 1 0 8 0
amappl5 104 140 0 127 1 0 1 1 0 8 0
amappl4 96 474 0 449 1 0 1 1 0 8 0
amappl3 88 157 0 145 1 0 1 1 0 8 0
amappl2 80 802 0 740 2 0 2 2 0 8 0
amappl1 72 13801 0 13351 16 6 10 16 0 8 0
amappl 80 424 0 400 1 0 1 1 0 84 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma64 64 259 0 259 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 17 0 17 1 1 0 1 0 8 0
aobjpl 64 1 0 0 1 0 1 1 0 8 0
uaddrrnd 24 206 0 193 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 206 0 193 1 0 1 1 0 8 0
vmmpekpl 168 5567 0 5545 2 0 2 2 0 8 0
vmmpepl 168 29476 0 28559 52 12 40 52 0 357 0
vmsppl 368 205 0 193 2 0 2 2 0 8 0
pdppl 4096 419 0 386 5 0 5 5 0 8 0
pvpl 32 80677 0 77352 31 3 28 28 0 265 1
pmappl 232 205 0 193 1 0 1 1 0 8 0
extentpl 40 41 0 26 1 0 1 1 0 8 0
phpool 112 256 0 4 8 0 8 8 0 8 0