panic: kernel diagnostic assertion "cifp != NULL" failed: file "/syzkaller/managers/main/kernel/sys/net/route.c", line 1078
Stopped at db_enter+0x1c: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 78318 87686 0 0x8000002 0 0 ifconfig
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff829274a7) at panic+0x165 sys/kern/subr_prf.c:198
__assert(ffffffff828dea5e,ffffffff8288b075,436,ffffffff8284e8a1) at __assert+0x29 sys/kern/subr_prf.c:157
rtrequest(1,ffff800032996a68,4,ffff800032996b38,0) at rtrequest+0xb49 sys/net/route.c:1078
rt_ifa_add(ffff800000e24300,840100,ffff800000e24358,0) at rt_ifa_add+0x2b3 sys/net/route.c:1273
in_ifinit(ffff800000dd7800,ffff800000e24300,ffff800032996db0,1) at in_ifinit+0x368 in_insert_prefix sys/netinet/in.c:770 [inline]
in_ifinit(ffff800000dd7800,ffff800000e24300,ffff800032996db0,1) at in_ifinit+0x368 sys/netinet/in.c:703
in_ioctl_change_ifaddr(8040691a,ffff800032996da0,ffff800000dd7800) at in_ioctl_change_ifaddr+0x67a sys/netinet/in.c:504
ifioctl(fffffd8058142bf8,8040691a,ffff800032996da0,ffff80002a6082a8) at ifioctl+0x104c pru_control sys/sys/protosw.h:378 [inline]
ifioctl(fffffd8058142bf8,8040691a,ffff800032996da0,ffff80002a6082a8) at ifioctl+0x104c sys/net/if.c:2449
sys_ioctl(ffff80002a6082a8,ffff800032996f80,ffff800032996ed0) at sys_ioctl+0x4a5
syscall(ffff800032996f80) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70871dc64cd0, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: kernel diagnostic assertion "cifp != NULL" failed: file "/syzkaller/managers/main/kernel/sys/net/route.c", line 1078
ddb> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff829274a7) at panic+0x165 sys/kern/subr_prf.c:198
__assert(ffffffff828dea5e,ffffffff8288b075,436,ffffffff8284e8a1) at __assert+0x29 sys/kern/subr_prf.c:157
rtrequest(1,ffff800032996a68,4,ffff800032996b38,0) at rtrequest+0xb49 sys/net/route.c:1078
rt_ifa_add(ffff800000e24300,840100,ffff800000e24358,0) at rt_ifa_add+0x2b3 sys/net/route.c:1273
in_ifinit(ffff800000dd7800,ffff800000e24300,ffff800032996db0,1) at in_ifinit+0x368 in_insert_prefix sys/netinet/in.c:770 [inline]
in_ifinit(ffff800000dd7800,ffff800000e24300,ffff800032996db0,1) at in_ifinit+0x368 sys/netinet/in.c:703
in_ioctl_change_ifaddr(8040691a,ffff800032996da0,ffff800000dd7800) at in_ioctl_change_ifaddr+0x67a sys/netinet/in.c:504
ifioctl(fffffd8058142bf8,8040691a,ffff800032996da0,ffff80002a6082a8) at ifioctl+0x104c pru_control sys/sys/protosw.h:378 [inline]
ifioctl(fffffd8058142bf8,8040691a,ffff800032996da0,ffff80002a6082a8) at ifioctl+0x104c sys/net/if.c:2449
sys_ioctl(ffff80002a6082a8,ffff800032996f80,ffff800032996ed0) at sys_ioctl+0x4a5
syscall(ffff800032996f80) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70871dc64cd0, count: -11
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff800032996890
rbx 0xffff8000006ba1d0
rdx 0
rcx 0
rax 0xffff80002a6082a8
r8 0
r9 0x8080808080808080
r10 0xb1484fac75c04c42
r11 0xc84ea9ae4bf75976
r12 0
r13 0x10000 __ALIGN_SIZE+0xf000
r14 0
r15 0x1
rip 0xffffffff811d128c db_enter+0x1c
cs 0x8
rflags 0x246
rsp 0xffff800032996880
ss 0x10
db_enter+0x1c: addq $0x8,%rsp
ddb> show proc
PROC (ifconfig) tid=78318 pid=87686 tcnt=1 stat=onproc
flags process=8000002<EXEC> proc=0
runpri=86, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0
forw=0xffffffffffffffff, list=0xffff80002a6b02d0,0xffffffff82d33978
process=0xffff80002aafccb8 user=0xffff800032992000, vmspace=0xfffffd806b0d2c30
estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
*87686 78318 46380 0 7 0x8000002 ifconfig
46380 60805 62076 0 3 0x810008a sigsusp sh
62076 449262 21962 0 3 0x8000082 wait syz-executor.0
9065 252575 18675 0 2 0x8000000 syz-executor.4
9065 91632 18675 0 3 0xc000080 fsleep syz-executor.4
76589 70005 65237 0 2 0x8000000 syz-executor.5
76589 486242 65237 0 3 0xc000080 pipewr syz-executor.5
3263 247946 49685 0 2 0x8000000 syz-executor.6
3263 442648 49685 0 3 0xc000080 fsleep syz-executor.6
3263 30297 49685 0 3 0xc000080 fsleep syz-executor.6
53698 177545 67009 0 2 0x8000000 syz-executor.7
53698 9734 67009 0 3 0xc000080 fsleep syz-executor.7
53698 491237 67009 0 3 0xc000080 fsleep syz-executor.7
53698 175638 67009 0 3 0xc000080 fsleep syz-executor.7
87720 220513 57668 0 3 0x8000080 nanoslp syz-executor.1
87720 223024 57668 0 3 0xc000080 sbwait syz-executor.1
87720 12656 57668 0 3 0xc000080 fsleep syz-executor.1
31218 334826 21962 0 3 0x8000082 piperd syz-executor.2
49685 225391 21962 0 3 0x8000082 nanoslp syz-executor.6
65237 135049 21962 0 2 0x8000482 syz-executor.5
76278 372278 21962 0 3 0x8000082 piperd syz-executor.3
67009 298851 21962 0 3 0x8000082 nanoslp syz-executor.7
18675 185937 21962 0 2 0x8000482 syz-executor.4
57668 148088 21962 0 3 0x8000082 nanoslp syz-executor.1
50397 79545 1 0 3 0x18100083 ttyin getty
99598 48197 0 0 3 0x14200 bored sosplice
21962 507492 71678 0 3 0x1a000082 wait syz-fuzzer
21962 73501 71678 0 3 0x1e000082 nanoslp syz-fuzzer
21962 380653 71678 0 3 0x1e000082 thrsleep syz-fuzzer
21962 493903 71678 0 3 0x1e000082 thrsleep syz-fuzzer
21962 452989 71678 0 3 0x1e000082 wait syz-fuzzer
21962 68892 71678 0 3 0x1e000082 wait syz-fuzzer
21962 467857 71678 0 3 0x1e000082 wait syz-fuzzer
21962 19884 71678 0 3 0x1e000082 thrsleep syz-fuzzer
21962 246753 71678 0 3 0x1e000082 wait syz-fuzzer
21962 453584 71678 0 3 0x1e000082 wait syz-fuzzer
21962 482771 71678 0 3 0x1e000082 thrsleep syz-fuzzer
21962 7518 71678 0 3 0x1e000082 thrsleep syz-fuzzer
21962 85420 71678 0 3 0x1e000082 wait syz-fuzzer
21962 27607 71678 0 3 0x1e000082 wait syz-fuzzer
71678 152433 34221 0 3 0x810008a sigsusp ksh
34221 234410 26561 0 3 0x1800009a kqread sshd
26561 317595 1 0 3 0x18000088 kqread sshd
49324 251898 20756 73 3 0x19100090 kqread syslogd
20756 240895 1 0 3 0x18100082 sbwait syslogd
42747 366756 1 0 3 0x18100080 kqread resolvd
98504 127818 82826 77 3 0x18100092 kqread dhcpleased
83209 50214 82826 77 3 0x18100092 kqread dhcpleased
82826 523497 1 0 3 0x18000080 kqread dhcpleased
95071 329905 0 0 3 0x14200 bored smr
72865 365167 0 0 2 0x14200 zerothread
49575 201975 0 0 3 0x14200 aiodoned aiodoned
28716 46205 0 0 3 0x14200 syncer update
48855 354922 0 0 3 0x14200 cleaner cleaner
52610 513581 0 0 3 0x14200 reaper reaper
916 6758 0 0 3 0x14200 pgdaemon pagedaemon
95044 237990 0 0 3 0x14200 bored viomb
40168 513741 0 0 3 0x40014200 acpi0 acpi0
70876 273370 0 0 3 0x14200 bored softnet3
12768 322030 0 0 3 0x14200 bored softnet2
14250 158646 0 0 3 0x14200 bored softnet1
402 296597 0 0 3 0x14200 bored softnet0
56040 100728 0 0 3 0x14200 bored systqmp
82640 89804 0 0 3 0x14200 bored systq
38580 223217 0 0 3 0x40014200 tmoslp softclock
20873 498770 0 0 3 0x40014200 idle0
1 326271 0 0 3 0x8080082 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10193 6561K 10643K 166960K 16512 0
pcb 18 12K 12K 166960K 390 0
rtable 142 9K 10K 166960K 2742 0
pf 31 9K 9K 166960K 266 0
ifaddr 34 9K 12K 166960K 369 0
ifgroup 54 2K 2K 166960K 489 0
sysctl 4 1K 2K 166960K 10 0
counters 31 17K 17K 166960K 134 0
ioctlops 0 0K 2K 166960K 234 0
iov 0 0K 28K 166960K 372 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1432 90K 91K 166960K 4575 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 13K 166960K 67 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 1K 166960K 223 0
dirhash 12 2K 3K 166960K 111 0
ACPI 1697 195K 286K 166960K 12548 0
file desc 17 61K 101K 166960K 3605 0
sigio 0 0K 0K 166960K 69 0
proc 66 67K 125K 166960K 2568 0
subproc 104 6K 7K 166960K 1001 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 387 0
in_multi 47 3K 7K 166960K 949 0
ether_multi 1 0K 0K 166960K 33 0
mrt 1 0K 0K 166960K 4 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 103 466K 466K 166960K 103 0
exec 0 0K 1K 166960K 1610 0
pfkey data 0 0K 0K 166960K 3 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 289 79K 97K 166960K 30455 0
UVM aobj 85 3K 3K 166960K 93 0
pinsyscall 37 74K 100K 166960K 6561 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 1K 166960K 147 0
NDP 12 0K 2K 166960K 265 0
temp 79 6808K 14746K 166960K 143075 0
kqueue 13 20K 30K 166960K 404 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 421 0 418 1 0 1 1 0 8 0
rtentry 112 973 0 915 4 0 4 4 0 8 1
unpcb 144 2690 0 2677 6 0 6 6 0 8 5
syncache 336 6 0 6 1 0 1 1 0 8 1
tcpqe 32 62 0 62 1 0 1 1 0 8 1
tcpcb 808 817 0 812 4 0 4 4 0 8 3
arp 88 177 0 163 1 0 1 1 0 8 0
ipq 40 8 0 6 1 0 1 1 0 8 0
ipqe 40 103 0 101 1 0 1 1 0 8 0
inpcb 352 3205 0 3192 11 2 9 11 0 8 7
nd6 104 259 0 247 1 0 1 1 0 8 0
pkpcb 40 49 0 49 1 0 1 1 0 8 1
kcovpl 48 77 0 69 1 0 1 1 0 8 0
ppxss 1072 16 0 16 1 0 1 1 0 8 1
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 3650 0 3440 47 23 24 30 0 8 5
art_table 32 3651 0 3440 4 0 4 4 0 8 0
art_node 16 952 0 904 1 0 1 1 0 8 0
sysvmsgpl 40 18 0 10 1 0 1 1 0 8 0
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 112 218 0 208 1 0 1 1 0 8 0
shmpl 112 90 0 8 3 0 3 3 0 8 0
dirhash 1024 83 0 66 3 0 3 3 0 8 0
dino2pl 256 6444 0 4931 96 0 96 96 0 8 0
ffsino 240 6444 0 4931 90 0 90 90 0 8 0
nchpl 144 10953 0 9216 67 0 67 67 0 8 0
uvmvnodes 80 8532 0 0 175 0 175 175 0 8 0
vnodes 216 8532 0 0 474 0 474 474 0 8 0
namei 1024 44449 0 44449 3 0 3 3 0 8 3
vcpupl 3904 8 0 0 1 0 1 1 0 8 0
vmpool 664 15 0 7 1 0 1 1 0 8 0
kstatmem 264 230 0 206 2 0 2 2 0 8 0
scsiplug 72 4 0 4 1 0 1 1 0 8 1
scxspl 216 75522 0 75522 8 0 8 8 1 8 8
plimitpl 152 677 0 661 1 0 1 1 0 8 0
sigapl 424 3792 0 3747 9 0 9 9 0 8 2
futexpl 64 50281 0 50274 1 0 1 1 0 8 0
knotepl 120 12159 0 12074 18 5 13 18 0 8 7
kqueuepl 184 1046 0 1034 4 0 4 4 0 8 3
pipepl 288 695 0 666 3 0 3 3 0 8 0
fdescpl 432 3754 0 3726 5 0 5 5 0 8 1
filepl 120 24174 0 23922 14 0 14 14 0 8 6
lockfpl 104 846 0 844 1 0 1 1 0 8 0
lockfspl 48 374 0 372 1 0 1 1 0 8 0
sessionpl 144 95 0 79 1 0 1 1 0 8 0
pgrppl 48 178 0 162 1 0 1 1 0 8 0
ucredpl 104 4376 0 4365 1 0 1 1 0 8 0
zombiepl 144 3747 0 3747 1 0 1 1 0 8 1
processpl 1072 3792 0 3747 6 0 6 6 0 8 1
procpl 656 6968 0 6901 9 0 9 9 0 8 3
sosppl 168 19 0 19 1 0 1 1 0 8 1
sockpl 504 6413 0 6384 42 31 11 22 0 8 6
mcl64k 65536 15 0 15 1 0 1 1 0 8 1
mcl16k 16384 1 0 1 1 0 1 1 0 8 1
mcl12k 12288 6 0 6 1 0 1 1 0 8 1
mcl9k 9216 2 0 2 1 0 1 1 0 8 1
mcl8k 8192 131 0 131 1 0 1 1 0 8 1
mcl4k 4096 11 0 11 1 0 1 1 0 8 1
mcl2k 2048 40890 0 40789 39 18 21 36 0 8 6
mtagpl 96 229 0 220 3 0 3 3 0 8 2
mbufpl 256 111990 0 111808 124 99 25 74 0 8 8
bufpl 280 13173 0 4641 610 0 610 610 0 8 0
anonpl 24 595613 0 589371 114 0 114 114 0 188 57
amapchunkpl 152 99982 0 99298 57 0 57 57 0 158 28
amappl16 200 13242 0 13121 68 51 17 20 0 8 8
amappl15 192 14 0 14 1 0 1 1 0 8 1
amappl14 184 361 0 350 2 0 2 2 0 8 1
amappl13 176 13 0 13 1 0 1 1 0 8 1
amappl12 168 5411 0 5382 3 0 3 3 0 8 1
amappl11 160 47 0 37 1 0 1 1 0 8 0
amappl10 152 114 0 103 1 0 1 1 0 8 0
amappl9 144 169 0 168 1 0 1 1 0 8 0
amappl8 136 284 0 253 2 0 2 2 0 8 0
amappl7 128 66 0 51 1 0 1 1 0 8 0
amappl6 120 1197 0 1181 2 0 2 2 0 8 1
amappl5 112 432 0 419 1 0 1 1 0 8 0
amappl4 104 1009 0 978 2 0 2 2 0 8 1
amappl3 96 18770 0 18680 3 0 3 3 0 8 0
amappl2 88 4341 0 4265 4 0 4 4 0 8 1
amappl1 80 24485 0 23991 22 2 20 22 0 8 7
amappl 88 29276 0 29077 6 0 6 6 0 92 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 253 0 253 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 92 0 8 2 0 2 2 0 8 0
uaddrrnd 24 3769 0 3733 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 3769 0 3733 1 0 1 1 0 8 0
vmmpekpl 168 30044 0 29987 4 0 4 4 0 8 0
vmmpepl 168 256034 0 254199 113 0 113 113 0 357 27
vmsppl 344 3768 0 3733 4 0 4 4 0 8 0
rwobjpl 24 73307 0 63594 60 0 60 60 0 8 0
pdppl 4096 7544 0 7474 350 278 72 87 0 8 2
pvpl 32 1601346 0 1588952 392 44 348 392 0 265 215
pmappl 216 3768 0 3733 3 0 3 3 0 8 0
extentpl 40 56 0 38 1 0 1 1 0 8 0
phpool 112 810 0 449 13 0 13 13 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff829274a7) at panic+0x165 sys/kern/subr_prf.c:198
__assert(ffffffff828dea5e,ffffffff8288b075,436,ffffffff8284e8a1) at __assert+0x29 sys/kern/subr_prf.c:157
rtrequest(1,ffff800032996a68,4,ffff800032996b38,0) at rtrequest+0xb49 sys/net/route.c:1078
rt_ifa_add(ffff800000e24300,840100,ffff800000e24358,0) at rt_ifa_add+0x2b3 sys/net/route.c:1273
in_ifinit(ffff800000dd7800,ffff800000e24300,ffff800032996db0,1) at in_ifinit+0x368 in_insert_prefix sys/netinet/in.c:770 [inline]
in_ifinit(ffff800000dd7800,ffff800000e24300,ffff800032996db0,1) at in_ifinit+0x368 sys/netinet/in.c:703
in_ioctl_change_ifaddr(8040691a,ffff800032996da0,ffff800000dd7800) at in_ioctl_change_ifaddr+0x67a sys/netinet/in.c:504
ifioctl(fffffd8058142bf8,8040691a,ffff800032996da0,ffff80002a6082a8) at ifioctl+0x104c pru_control sys/sys/protosw.h:378 [inline]
ifioctl(fffffd8058142bf8,8040691a,ffff800032996da0,ffff80002a6082a8) at ifioctl+0x104c sys/net/if.c:2449
sys_ioctl(ffff80002a6082a8,ffff800032996f80,ffff800032996ed0) at sys_ioctl+0x4a5
syscall(ffff800032996f80) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70871dc64cd0, count: -11
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff829274a7) at panic+0x165 sys/kern/subr_prf.c:198
__assert(ffffffff828dea5e,ffffffff8288b075,436,ffffffff8284e8a1) at __assert+0x29 sys/kern/subr_prf.c:157
rtrequest(1,ffff800032996a68,4,ffff800032996b38,0) at rtrequest+0xb49 sys/net/route.c:1078
rt_ifa_add(ffff800000e24300,840100,ffff800000e24358,0) at rt_ifa_add+0x2b3 sys/net/route.c:1273
in_ifinit(ffff800000dd7800,ffff800000e24300,ffff800032996db0,1) at in_ifinit+0x368 in_insert_prefix sys/netinet/in.c:770 [inline]
in_ifinit(ffff800000dd7800,ffff800000e24300,ffff800032996db0,1) at in_ifinit+0x368 sys/netinet/in.c:703
in_ioctl_change_ifaddr(8040691a,ffff800032996da0,ffff800000dd7800) at in_ioctl_change_ifaddr+0x67a sys/netinet/in.c:504
ifioctl(fffffd8058142bf8,8040691a,ffff800032996da0,ffff80002a6082a8) at ifioctl+0x104c pru_control sys/sys/protosw.h:378 [inline]
ifioctl(fffffd8058142bf8,8040691a,ffff800032996da0,ffff80002a6082a8) at ifioctl+0x104c sys/net/if.c:2449
sys_ioctl(ffff80002a6082a8,ffff800032996f80,ffff800032996ed0) at sys_ioctl+0x4a5
syscall(ffff800032996f80) at syscall+0x72a sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70871dc64cd0, count: -11