syzbot

panic: thread with borrowed priority returning to userland
cpuid = 0
time = 1591904129
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025a3b990
vpanic() at vpanic+0x1c7/frame 0xfffffe0025a3b9f0
panic() at panic+0x43/frame 0xfffffe0025a3ba50
userret() at userret+0x745/frame 0xfffffe0025a3bac0
amd64_syscall() at amd64_syscall+0x399/frame 0xfffffe0025a3bbf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0025a3bbf0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x28289a, rsp = 0x7fffdff79f08, rbp = 0x7fffdff79f70 ---
KDB: enter: panic
[ thread pid 819 tid 100188 ]
Stopped at      kdb_enter+0x67: movq    $0,0x14a4a26(%rip)
db> 
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs                        0x20
ds                        0x3b  ll+0x1a
es                        0x3b  ll+0x1a
fs                        0x13
gs                        0x1b
ss                        0x28  ll+0x7
rax                       0x12
rcx                       0x80  ll+0x5f
rdx         0xffffffff81901af9
rbx                          0
rsp         0xfffffe0025a3b970
rbp         0xfffffe0025a3b990
rsi                        0x1
rdi                          0
r8                           0
r9                  0xffffffff
r10                          0
r11         0xfffffe002585ca10
r12         0xffffffff82068f70  ddb_dbbe
r13                          0
r14         0xffffffff819a607a
r15         0xffffffff819a607a
rip         0xffffffff810b51c7  kdb_enter+0x67
rflags                    0x82  ll+0x61
kdb_enter+0x67: movq    $0,0x14a4a26(%rip)
db> show proc
Process 819 (syz-executor.0) at 0xfffff8000c466000:
 state: NORMAL
 uid: 0  gids: 0, 0, 5
 parent: pid 775 at 0xfffff8000c41a000
 ABI: FreeBSD ELF64
 arguments: /root/syz-executor.0
 reaper: 0xfffff8000331c000 reapsubtree: 1
 sigparent: 20
 vmspace: 0xfffffe00258723d0
   (map 0xfffffe00258723d0)
   (map.pmap 0xfffffe0025872490)
   (pmap 0xfffffe00258724f0)
 threads: 6
100104                   Run     CPU 1                       syz-executor.0
100184                   S       connec  0xfffffe001cfca478  syz-executor.0
100185                   S       connec  0xfffffe001cfcc800  syz-executor.0
100186                   S       connec  0xfffffe001cfcc800  syz-executor.0
100187                   S       uwait   0xfffff80003a3f000  syz-executor.0
100188                   Run     CPU 0                       syz-executor.0
db> ps
  pid  ppid  pgrp   uid  state   wmesg   wchan               cmd
  819   775   775     0  R       (threaded)                  syz-executor.0
100104                   Run     CPU 1                       syz-executor.0
100184                   S       connec  0xfffffe001cfca478  syz-executor.0
100185                   S       connec  0xfffffe001cfcc800  syz-executor.0
100186                   S       connec  0xfffffe001cfcc800  syz-executor.0
100187                   S       uwait   0xfffff80003a3f000  syz-executor.0
100188                   Run     CPU 0                       syz-executor.0
  804   798   804     0  Ss      select  0xfffff80003a5b1c0  dhclient
  801     1   801     0  Ss      select  0xfffff80003a5b140  dhclient
  798   790   424    65  S       select  0xfffff80003a5b4c0  dhclient
  790   424   424     0  S       wait    0xfffff8000c90f000  sh
  775   773   775     0  Rs                                  syz-executor.0
  773   771   771     0  S       (threaded)                  syz-execprog
100109                   S       uwait   0xfffff80003a42180  syz-execprog
100110                   S       uwait   0xfffff800037fb400  syz-execprog
100111                   S       uwait   0xfffff800037fea80  syz-execprog
100112                   S       uwait   0xfffff800037fb680  syz-execprog
100113                   S       uwait   0xfffff800037fb780  syz-execprog
100114                   S       uwait   0xfffff800037fb880  syz-execprog
100116                   S       uwait   0xfffff80003a42700  syz-execprog
100117                   S       kqread  0xfffff80003346a00  syz-execprog
100118                   S       uwait   0xfffff80003a42900  syz-execprog
  771   769   771     0  Ss      pause   0xfffff8000c41aae8  csh
  769   682   769     0  Ss      select  0xfffff80003352440  sshd
  748     1   748     0  Ss+     ttyin   0xfffff8000380c0b0  getty
  747     1   747     0  Ss+     ttyin   0xfffff80003b7dcb0  getty
  746     1   746     0  Ss+     ttyin   0xfffff80003b804b0  getty
  745     1   745     0  Ss+     ttyin   0xfffff80003b80cb0  getty
  744     1   744     0  Ss+     ttyin   0xfffff800033b54b0  getty
  743     1   743     0  Ss+     ttyin   0xfffff800033b5cb0  getty
  742     1   742     0  Ss+     ttyin   0xfffff800033b84b0  getty
  741     1   741     0  Ss+     ttyin   0xfffff800033b8cb0  getty
  740     1   740     0  Ss+     ttyin   0xfffff800033b74b0  getty
  738     1    24     0  S+      piperd  0xfffff80003df1000  logger
  737   736    24     0  S+      nanslp  0xffffffff8252f1f1  sleep
  736     1    24     0  S+      wait    0xfffff8000c466520  sh
  686     1   686     0  Ss      nanslp  0xffffffff8252f1f1  cron
  682     1   682     0  Ss      select  0xfffff80003a5b340  sshd
  495     1   495     0  Ss      select  0xfffff80003a5bd40  syslogd
  424     1   424     0  Ss      wait    0xfffff80003d30000  devd
  423     1   423    65  Ss      select  0xfffff80003352ac0  dhclient
  338     1   338     0  Ss      select  0xfffff80003a5bcc0  dhclient
  335     1   335     0  Ss      select  0xfffff80003a5bc40  dhclient
   23     0     0     0  DL      vlruwt  0xfffff800033f7520  [vnlru]
   22     0     0     0  DL      syncer  0xffffffff8261a498  [syncer]
   21     0     0     0  DL      (threaded)                  [bufdaemon]
100069                   D       qsleep  0xffffffff826197b0  [bufdaemon]
100076                   D       -       0xffffffff8200aa00  [bufspacedaemon-0]
100088                   D       sdflush 0xfffff80003d15ce8  [/ worker]
   20     0     0     0  DL      psleep  0xffffffff826407c8  [vmdaemon]
   19     0     0     0  DL      (threaded)                  [pagedaemon]
100067                   D       psleep  0xffffffff82634c58  [dom0]
100074                   D       launds  0xffffffff82634c64  [laundry: dom0]
100075                   D       umarcl  0xffffffff8154c3a0  [uma]
   18     0     0     0  DL      -       0xffffffff82362e58  [rand_harvestq]
   17     0     0     0  DL      pftm    0xffffffff82c583a0  [pf purge]
   16     0     0     0  DL      waiting 0xffffffff8261cc10  [sctp_iterator]
   15     0     0     0  DL      -       0xffffffff82618dac  [soaiod4]
    9     0     0     0  DL      -       0xffffffff82618dac  [soaiod3]
    8     0     0     0  DL      -       0xffffffff82618dac  [soaiod2]
    7     0     0     0  DL      -       0xffffffff82618dac  [soaiod1]
    6     0     0     0  DL      (threaded)                  [cam]
100033                   D       -       0xffffffff8223abc0  [doneq0]
100066                   D       -       0xffffffff8223aa90  [scanner]
    5     0     0     0  DL      crypto_ 0xfffff800033f6090  [crypto returns 1]
    4     0     0     0  DL      crypto_ 0xfffff800033f6030  [crypto returns 0]
    3     0     0     0  DL      crypto_ 0xffffffff82632440  [crypto]
   14     0     0     0  DL      seqstat 0xfffff8000338f888  [sequencer 00]
   13     0     0     0  DL      (threaded)                  [geom]
100024                   D       -       0xffffffff8250e180  [g_event]
100025                   D       -       0xffffffff8250e188  [g_up]
100026                   D       -       0xffffffff8250e190  [g_down]
    2     0     0     0  DL      (threaded)                  [KTLS]
100017                   D       -       0xfffff80003351e80  [thr_0]
100018                   D       -       0xfffff80003351ec0  [thr_1]
   12     0     0     0  LL      (threaded)                  [intr]
100010                   I                                   [swi5: fast taskq]
100013                   I                                   [swi6: task queue]
100014                   I                                   [swi6: Giant taskq]
100019                   I                                   [swi4: clock (0)]
100020                   I                                   [swi4: clock (1)]
100021                   I                                   [swi3: vm]
100022                   I                                   [swi1: netisr 0]
100034                   I                                   [irq24: virtio_pci0]
100035                   I                                   [irq25: virtio_pci0]
100036                   I                                   [irq26: virtio_pci0]
100037                   I                                   [irq27: virtio_pci0]
100038                   I                                   [irq28: virtio_pci1]
100039                   I                                   [irq29: virtio_pci1]
100040                   I                                   [irq30: virtio_pci1]
100041                   I                                   [irq31: virtio_pci1]
100042                   I                                   [irq32: virtio_pci1]
100047                   I                                   [irq10: virtio_pci2]
100049                   I                                   [irq1: atkbd0]
100050                   I                                   [irq12: psm0]
100051                   I                                   [swi0: uart uart++]
100060                   I                                   [swi1: pf send]
100072                   L      *so_snd  0xfffff80003a40c00  [swi1: hpts]
100073                   I                                   [swi1: hpts]
   11     0     0     0  RL      (threaded)                  [idle]
100003                   CanRun                              [idle: cpu0]
100004                   CanRun                              [idle: cpu1]
    1     0     1     0  SLs     wait    0xfffff8000331c000  [init]
   10     0     0     0  DL      audit_w 0xffffffff82632918  [audit]
    0     0     0     0  DLs     (threaded)                  [kernel]
100000                   D       swapin  0xffffffff8250e710  [swapper]
100005                   D       -       0xfffff80003346100  [if_config_tqg_0]
100006                   D       -       0xfffff80003346000  [softirq_0]
100007                   D       -       0xfffff80003343e00  [softirq_1]
100008                   D       -       0xfffff80003343d00  [if_io_tqg_0]
100009                   D       -       0xfffff80003343c00  [if_io_tqg_1]
100011                   D       -       0xfffff8000334d000  [kqueue_ctx taskq]
100012                   D       -       0xfffff8000334ee00  [aiod_kick taskq]
100015                   D       -       0xfffff8000334eb00  [in6m_free taskq]
100016                   D       -       0xfffff8000334ea00  [thread taskq]
100023                   D       -       0xfffff8000334e900  [firmware taskq]
100028                   D       -       0xfffff8000334e700  [crypto_0]
100029                   D       -       0xfffff8000334e700  [crypto_1]
100043                   D       -       0xfffff80003349d00  [vtnet0 rxq 0]
100044                   D       -       0xfffff80003349c00  [vtnet0 txq 0]
100045                   D       -       0xfffff80003349b00  [vtnet0 rxq 1]
100046                   D       -       0xfffff80003349a00  [vtnet0 txq 1]
100048                   D       vtbslp  0xfffff80003597800  [virtio_balloon]
100052                   D       -       0xfffff80003821600  [mca taskq]
100057                   D       -       0xffffffff81d4b5d0  [deadlkres]
100061                   D       -       0xfffff80003b72900  [acpi_task_0]
100062                   D       -       0xfffff80003b72900  [acpi_task_1]
100063                   D       -       0xfffff80003b72900  [acpi_task_2]
100065                   D       -       0xfffff8000334e500  [CAM taskq]
db> show all locks
Process 819 (syz-executor.0) thread 0xfffffe001cff1800 (100104)
exclusive sleep mutex umtxql (umtxql) r = 0 (0xffffffff82550630) locked @ /syzkaller/managers/main/kernel/sys/kern/kern_umtx.c:512
Process 819 (syz-executor.0) thread 0xfffffe002585c500 (100188)
exclusive sleep mutex so_snd (so_snd) r = 0 (0xfffffe001cfcc968) locked @ /syzkaller/managers/main/kernel/sys/modules/tcp/bbr/../../../netinet/tcp_stacks/bbr.c:12517
Process 12 (intr) thread 0xfffffe0004cfb700 (100072)
exclusive rw tcpinp (tcpinp) r = 0 (0xfffff8000c5585d8) locked @ /syzkaller/managers/main/kernel/sys/netinet/tcp_hpts.c:1272
db> show malloc
              Type        InUse        MemUse     Requests
           pf_hash            5        11524K            5
            devbuf         4213         4851K         4238
          tcp_hpts            5         3201K            5
             vtbuf           24         1968K           46
         sysctloid        27849         1625K        27913
              kobj          334         1336K          493
            newblk          397         1123K          453
          vfscache            4         1025K            4
          inodedep           70          547K           94
               pcb           24          537K          110
         ufs_quota            1          512K            1
          vfs_hash            1          512K            1
           callout            2          512K            2
              intr            4          388K            4
           subproc          119          242K          887
            acpica         1674          185K        55859
         vnet_data            1          168K            1
           pagedep           17          132K           37
        tfo_ccache            1          128K            1
               sem            4          106K            4
            DEVFS1          102          102K          113
            linker          239           96K          271
               bus          972           79K         3368
          mtx_pool            2           72K            2
          syncache            1           68K            1
          acpitask            1           64K            1
       ddb_capture            1           64K            1
            module          501           63K          501
          filedesc            5           37K           47
              umtx          288           36K          288
               BPF           19           36K           19
           kdtrace          171           33K         1767
              temp           23           33K         1669
         hostcache            1           32K            1
               shm            1           32K            1
            DEVFS3          121           31K          131
               msg            4           30K            4
        DEVFS_RULE           56           27K           56
        gtaskqueue           18           26K           18
              vmem            3           22K            4
            kbdmux            6           22K            6
         ufs_mount            4           17K            5
              proc            3           17K            3
            ifaddr           43           17K           43
               tty           16           16K           16
           tidhash            1           16K            1
           ithread           98           16K           98
            bus-sc           30           14K         1439
            KTRACE          100           13K          100
              kenv           95           12K           99
      eventhandler          132           12K          132
         pfs_nodes           20           10K           20
              GEOM           60           10K          487
              rman           82           10K          423
         bmsafemap            3            9K           62
              UART           12            9K           12
           devstat            4            9K            4
               rpc            2            8K            2
            dirrem           32            8K           43
             shmfd            1            8K            1
       pfs_vncache            1            8K            1
           lltable           21            8K           21
     audit_evclass          233            8K          291
             ifnet            4            7K            4
           CAM DEV            3            6K          510
       ether_multi           73            6K           78
                vt           11            6K           11
              cred           22            6K          240
            kqueue           54            6K          824
            sglist            5            6K            5
         CAM queue            5            6K         1528
         in6_multi           41            5K           41
            plimit           19            5K          344
         taskqueue           45            5K           45
       ufs_dirhash           24            5K           24
           memdesc            1            4K            1
               MCA           32            4K           32
               UMA          248            4K          248
            diradd           32            4K           59
             evdev            4            4K            4
          routetbl           17            4K           17
          pf_ifnet            7            4K           10
             hhook           13            4K           13
            select           23            3K           23
           session           23            3K           34
              pgrp           23            3K           34
           acpisem           22            3K           22
          terminal           11            3K           11
         proc-args           44            3K          509
           uidinfo            3            3K            8
        local_apic            1            2K            1
           io_apic            1            2K            1
         ipsec-saq            2            2K            2
             lockf           19            2K           29
          freefile           15            2K           24
           CAM XPT           22            2K          543
            Unitno           25            2K           39
           acpidev           20            2K           20
               msi            9            2K            9
             mkdir            9            2K           52
           softdep            1            1K            1
          indirdep            4            1K            4
       ipsecpolicy            1            1K            1
            sahead            1            1K            1
          secasvar            1            1K            1
          sctp_ifa            8            1K            8
             clone            8            1K            8
       vnodemarker            2            1K            8
      NFSD session            1            1K            1
            ip6ndp            6            1K            9
        CAM periph            4            1K          271
         newdirblk            7            1K           26
          in_multi            3            1K            4
             nhops            6            1K            6
         toponodes            6            1K            6
            isadev            6            1K            6
             mount           16            1K           86
          pci_link           10            1K           10
            crypto            3            1K            3
              pfil            4            1K            4
    chacha20random            1            1K            1
           CAM SIM            2            1K            2
             epoch            4            1K            4
              cdev            2            1K            2
 encap_export_host            8            1K            8
               mld            3            1K            3
          sctp_ifn            3            1K            3
              igmp            3            1K            3
               tun            4            1K            4
          freework            2            1K           41
               osd            3            1K            9
            DEVFSP            5            1K            5
       inpcbpolicy            9            1K          179
          freeblks            1            1K           40
            vnodes            1            1K            1
      NFSD lckfile            1            1K            1
     NFSD V4client            1            1K            1
             DEVFS            9            1K           10
            feeder            7            1K            7
        loginclass            3            1K            7
            soname            7            1K         5942
     CAM dev queue            2            1K            2
 CAM I/O Scheduler            1            1K            1
            apmdev            1            1K            1
          atkbddev            2            1K            2
          CAM path            4            1K         1034
           tcpfunc            2            1K            2
              ktls            1            1K            1
          pmchooks            1            1K            1
            prison            4            1K            4
          filecaps            5            1K           72
          nexusdev            5            1K            5
           entropy            2            1K           38
          sctp_vrf            1            1K            1
              vnet            1            1K            1
          acpiintr            1            1K            1
               pmc            1            1K            1
              cpus            2            1K            2
    vnet_data_free            1            1K            1
           Per-cpu            1            1K            1
          p1003.1b            1            1K            1
          pf_table            0            0K            0
           pf_rule            0            0K            0
           pf_altq            0            0K            0
           pf_osfp            0            0K            0
           pf_temp            0            0K            0
           ath_hal            0            0K            0
        madt_table            0            0K            2
            athdev            0            0K            0
           ata_pci            0            0K            0
           ata_dma            0            0K            0
       ata_generic            0            0K            0
               amr            0            0K            0
           scsi_da            0            0K           69
            ata_da            0            0K            0
            pvscsi            0            0K            0
          smartpqi            0            0K            0
           scsi_ch            0            0K            0
           scsi_cd            0            0K            0
            USBdev            0            0K            0
               USB            0            0K            0
       AHCI driver            0            0K            0
               agp            0            0K            0
              iavf            0            0K            0
               ixl            0            0K            0
           nvme_da            0            0K            0
           acpipwr            0            0K            0
            twsbuf            0            0K            0
      twe_commands            0            0K            0
      twa_commands            0            0K            0
       tcp_log_dev            0            0K            0
        ice-resmgr            0            0K            0
         ice-osdep            0            0K            0
               ice            0            0K            0
       fpukern_ctx            0            0K            0
      midi buffers            0            0K            0
          xen_intr            0            0K            0
             mixer            0            0K            0
           xen_hvm            0            0K            0
         legacydrv            0            0K            0
            qpidrv            0            0K            0
              ac97            0            0K            0
             hdacc            0            0K            0
      dmar_idpgtbl            0            0K            0
          dmar_dom            0            0K            0
          dmar_ctx            0            0K            0
       dmar_dmamap            0            0K            0
              hdac            0            0K            0
              hdaa            0            0K            0
         acpi_perf            0            0K            0
              isci            0            0K            0
     hyperv_socket            0            0K            0
           bxe_ilt            0            0K            0
            xenbus            0            0K            0
         acpicmbat            0            0K            0
       SIIS driver            0            0K            0
     vm_fictitious            0            0K            0
           CAM CCB            0            0K         1778
               PUC            0            0K            0
          ppbusdev            0            0K            0
agtiapi_MemAlloc malloc            0            0K            0
    osti_cacheable            0            0K            0
          tempbuff            0            0K            0
          tempbuff            0            0K            0
           UMAHash            0            0K            0
ag_tgt_map_t malloc            0            0K            0
ag_slr_map_t malloc            0            0K            0
         vm_pgdata            0            0K            0
           jblocks            0            0K            0
          savedino            0            0K           11
          sentinel            0            0K            0
            jfsync            0            0K            0
            jtrunc            0            0K            0
             sbdep            0            0K            3
           jsegdep            0            0K            0
              jseg            0            0K            0
         jfreefrag            0            0K            0
          jfreeblk            0            0K            0
           jnewblk            0            0K            0
            jmvref            0            0K            0
           jremref            0            0K            0
           jaddref            0            0K            0
           freedep            0            0K            0
          freefrag            0            0K            5
        allocindir            0            0K            0
       allocdirect            0            0K            0
          ufs_trim            0            0K            0
           mactemp            0            0K            0
     audit_trigger            0            0K            0
 audit_pipe_presel            0            0K            0
     audit_pipeent            0            0K            0
        audit_pipe            0            0K            0
      audit_evname            0            0K            0
         audit_bsm            0            0K            0
      audit_gidset            0            0K            0
        audit_text            0            0K            0
        audit_path            0            0K            0
        audit_data            0            0K            0
        audit_cred            0            0K            0
             xform            0            0K            0
               NLM            0            0K            0
    ipsec-spdcache            0            0K            0
         ipsec-reg            0            0K            0
        ipsec-misc            0            0K            0
      ipsecrequest            0            0K            0
            ip6opt            0            0K            3
       ip6_msource            0            0K            0
      ip6_moptions            0            0K            0
       in6_mfilter            0            0K            0
             frag6            0            0K            0
            tcplog            0            0K            0
lDevFlags * malloc            0            0K            0
               LRO            0            0K            0
        sctp_mcore            0            0K            0
        sctp_socko            0            0K            0
         sctp_iter            0            0K            5
         sctp_mvrf            0            0K            0
         sctp_timw            0            0K            0
         sctp_cpal            0            0K            0
         sctp_cmsg            0            0K            0
         sctp_stre            0            0K            0
         sctp_athi            0            0K            0
         sctp_athm            0            0K            0
         sctp_atky            0            0K            0
         sctp_atcl            0            0K            0
         sctp_a_it            0            0K            5
         sctp_aadr            0            0K            0
         sctp_stro            0            0K            0
         sctp_stri            0            0K            0
          sctp_map            0            0K            0
      newreno data            0            0K            0
        ip_msource            0            0K            0
       ip_moptions            0            0K            0
        in_mfilter            0            0K            0
              ipid            0            0K            0
         80211scan            0            0K            0
      80211ratectl            0            0K            0
        80211power            0            0K            0
       80211nodeie            0            0K            0
         80211node            0            0K            0
      80211mesh_gt            0            0K            0
      80211mesh_rt            0            0K            0
         80211perr            0            0K            0
         80211prep            0            0K            0
         80211preq            0            0K            0
          80211dfs            0            0K            0
       80211crypto            0            0K            0
          80211vap            0            0K            0
             iflib            0            0K            0
              vlan            0            0K            0
               gif            0            0K            0
           ifdescr            0            0K            0
              zlib            0            0K            0
           fadvise            0            0K            0
tiDeviceHandle_t * malloc            0            0K            0
            statfs            0            0K          210
       export_host            0            0K            0
        cl_savebuf            0            0K            2
ag_portal_data_t malloc            0            0K            0
ag_device_t malloc            0            0K            0
     STLock malloc            0            0K            0
          CCB List            0            0K            0
            sr_iov            0            0K            0
               OCS            0            0K            0
               OCS            0            0K            0
              nvme            0            0K            0
               nvd            0            0K            0
            netmap            0            0K            0
            mwldev            0            0K            0
        MVS driver            0            0K            0
     CAM ccb queue            0            0K            0
          mrsasbuf            0            0K            0
          mpt_user            0            0K            0
          mps_user            0            0K            0
            biobuf            0            0K            0
              aios            0            0K            0
               lio            0            0K            0
               acl            0            0K            0
            MPSSAS            0            0K            0
          mbuf_tag            0            0K           48
              accf            0            0K            0
               pts            0            0K            0
               iov            0            0K        13428
          ioctlops            0            0K           92
           Witness            0            0K            0
             stack            0            0K            0
               mps            0            0K            0
          mpr_user            0            0K            0
            MPRSAS            0            0K            0
               mpr            0            0K            0
            mfibuf            0            0K            0
        md_sectors            0            0K            0
              sbuf            0            0K          288
           md_disk            0            0K            0
          firmware            0            0K            0
        compressor            0            0K            0
           malodev            0            0K            0
              SWAP            0            0K            0
               LED            0            0K            0
         sysctltmp            0            0K          597
            sysctl            0            0K            1