syzbot


assert "!_kernel_lock_held()" failed in kern_fork.c (3)

Status: upstream: reported on 2022/01/18 16:21
Reported-by: syzbot+3c2eced405b9de6f79c2@syzkaller.appspotmail.com
First crash: 379d, last: 3d03h
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "!_kernel_lock_held()" failed in kern_fork.c 15 1197d 1458d 0/3 auto-closed as invalid on 2020/01/21 16:10
openbsd assert "!_kernel_lock_held()" failed in kern_fork.c (2) 1 1008d 1008d 0/3 auto-closed as invalid on 2020/07/29 04:11

Sample crash report:
panic: vop_gepanic: kernel diagnostic assertion "!_kernel_lock_held()" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_fork.c", line 674
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 12292  26757  32767        0x10          0    1  syz-executor.1
 135878  38589  32767        0x10  0x4000000    0  syz-executor.7
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82751908) at panic+0x177 sys/kern/subr_prf.c:198
__assert(ffffffff827cd07e,ffffffff8278d03a,2a2,ffffffff82785288) at __assert+0x25 sys/kern/subr_prf.c:157
proc_trampoline_mp() at proc_trampoline_mp+0x131
end trace frame: 0x0, count: 11
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu0: vop_generic_badop
 cpu1: kernel diagnostic assertion "!_kernel_lock_held()" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_fork.c", line 674
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82751908) at panic+0x177 sys/kern/subr_prf.c:198
__assert(ffffffff827cd07e,ffffffff8278d03a,2a2,ffffffff82785288) at __assert+0x25 sys/kern/subr_prf.c:157
proc_trampoline_mp() at proc_trampoline_mp+0x131
end trace frame: 0x0, count: -4
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002ca2f480
rbx               0xffff800020d69b8f
rdx                                0
rcx                                0
rax               0xffff800021228890
r8                 0x101010101010101
r9                0x8080808080808080
r10                0x167b15ca7c625de
r11               0xf6706249f83dc824
r12               0xffff800020d69990
r13                                0
r14               0xffffffff82bd3990    cpu_info_full_primary+0x2990
r15                              0x1
rip               0xffffffff81818fb8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80002ca2f470
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.1) pid=12292 stat=onproc
    flags process=10<SUGID> proc=0
    pri=86, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff80002121c2d8,0xffffffff82c0cfb0
    process=0xffff800027bb25c8 user=0xffff80002ca2a000, vmspace=0xfffffd8067961188
    estcpu=36, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*26757   12292  22346  32767  7        0x10                syz-executor.1
 41283   19013  10125  32767  2        0x10                syz-executor.3
 41283  239841  10125  32767  3   0x4000090  fsleep        syz-executor.3
 38589  279055   6836  32767  2        0x10                syz-executor.7
 38589  135878   6836  32767  7   0x4000010                syz-executor.7
 38589   50094   6836  32767  3   0x4000090  fsleep        syz-executor.7
 24480  330245  86020  32767  3        0x90  nanoslp       syz-executor.6
 24480   16034  86020  32767  3   0x4000090  fsleep        syz-executor.6
 24480  352808  86020  32767  3   0x4000090  pipewr        syz-executor.6
 24480   41207  86020  32767  3   0x4000090  fsleep        syz-executor.6
 22346  191533  56116  32767  3        0x90  nanoslp       syz-executor.1
 56116  361911   5964      0  3        0x82  wait          syz-executor.1
 66776  437820      0      0  3     0x14200  bored         sosplice
  6836  516048  88345  32767  3        0x90  nanoslp       syz-executor.7
 88345  217061   5964      0  3        0x82  wait          syz-executor.7
 86020  492513  45694  32767  3        0x90  nanoslp       syz-executor.6
 45694  321570   5964      0  3        0x82  wait          syz-executor.6
 45811   82459  33197  32767  3        0x90  nanoslp       syz-executor.4
 10125  455984  42384  32767  3        0x90  nanoslp       syz-executor.3
 26006  295368  91218  32767  3        0x90  piperd        syz-executor.5
 33197  326841   5964      0  3        0x82  wait          syz-executor.4
 91218  336422   5964      0  3        0x82  wait          syz-executor.5
 42384  397941   5964      0  3        0x82  wait          syz-executor.3
 62711  130626  91666  32767  3        0x10  biowait       syz-executor.2
 91666  361973   5964      0  3        0x82  wait          syz-executor.2
 76489  196058  72614  32767  2        0x10                syz-executor.0
 72614   59210   5964      0  3        0x82  wait          syz-executor.0
  5964  144597  45200      0  3        0x82  wait          syz-fuzzer
  5964  524065  45200      0  3   0x4000082  nanoslp       syz-fuzzer
  5964  403172  45200      0  3   0x4000082  thrsleep      syz-fuzzer
  5964  226074  45200      0  3   0x4000082  wait          syz-fuzzer
  5964  298077  45200      0  3   0x4000082  wait          syz-fuzzer
  5964  174643  45200      0  3   0x4000082  thrsleep      syz-fuzzer
  5964  288239  45200      0  3   0x4000082  wait          syz-fuzzer
  5964  221149  45200      0  3   0x4000082  thrsleep      syz-fuzzer
  5964  317062  45200      0  3   0x4000082  thrsleep      syz-fuzzer
  5964  493159  45200      0  3   0x4000082  wait          syz-fuzzer
  5964  515777  45200      0  3   0x4000082  thrsleep      syz-fuzzer
  5964  488440  45200      0  3   0x4000082  wait          syz-fuzzer
  5964  261276  45200      0  3   0x4000082  wait          syz-fuzzer
  5964  368354  45200      0  3   0x4000082  kqread        syz-fuzzer
  5964  379197  45200      0  3   0x4000082  wait          syz-fuzzer
  5964  470180  45200      0  3   0x4000082  thrsleep      syz-fuzzer
 45200   57708  75705      0  3    0x10008a  sigsusp       ksh
 75705  112306  77157      0  3        0x9a  kqread        sshd
 92777  497671      1      0  3    0x100083  ttyin         getty
 77157  424971      1      0  3        0x88  kqread        sshd
 35574  485046  30705     73  3   0x1100090  kqread        syslogd
 30705  454033      1      0  3    0x100082  netio         syslogd
 26161  292555      1      0  3    0x100080  kqread        resolvd
 29268   58515  37832     77  3    0x100092  kqread        dhcpleased
  9788  263840  37832     77  3    0x100092  kqread        dhcpleased
 37832  328404      1      0  3        0x80  kqread        dhcpleased
  8121  480800      0      0  3     0x14200  bored         smr
 42543   47524      0      0  2     0x14200                zerothread
 95197  181058      0      0  3     0x14200  aiodoned      aiodoned
 67999  155220      0      0  3     0x14200  syncer        update
 10172  463528      0      0  3     0x14200  cleaner       cleaner
 66113   19331      0      0  3     0x14200  reaper        reaper
 18632  356551      0      0  3     0x14200  pgdaemon      pagedaemon
 41286  234512      0      0  3     0x14200  bored         viomb
 68394  118770      0      0  3  0x40014200  acpi0         acpi0
 93992   75908      0      0  3  0x40014200                idle1
  7002  256658      0      0  3     0x14200  bored         softnet
 31991  386813      0      0  3     0x14200  bored         softnet
 90853   37116      0      0  3     0x14200  bored         softnet
 83260   54983      0      0  3     0x14200  bored         softnet
 98076   98470      0      0  3     0x14200  bored         systqmp
  3273  117535      0      0  3     0x14200  bored         systq
 56586  468519      0      0  3  0x40014200  bored         softclock
 89075  139388      0      0  3  0x40014200                idle0
     1   84885      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 38589 (syz-executor.7) thread 0xffff80002128cb10 (135878)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82d74e78)
#0  witness_lock+0x44d
#1  __mp_acquire_count+0x48 sys/kern/kern_lock.c:227
#2  mi_switch+0x3bb sys/kern/sched_bsd.c:415
#3  sleep_finish+0x180 sys/kern/kern_synch.c:417
#4  tsleep+0x12c sys/kern/kern_synch.c:155
#5  biowait+0x91 sys/kern/vfs_bio.c:1268
#6  bwrite+0x21b sys/kern/vfs_bio.c:769
#7  ffs_update+0x27d sys/ufs/ffs/ffs_inode.c:113
#8  ufs_mkdir+0x662 sys/ufs/ufs/ufs_vnops.c:1220
#9  VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388
#10 domkdirat+0x121 sys/kern/vfs_syscalls.c:3112
#11 syscall+0x555 mi_syscall sys/sys/syscall_mi.h:113 [inline]
#11 syscall+0x555 sys/arch/amd64/amd64/trap.c:626
#12 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806f1061b0)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vget+0x1fc sys/kern/vfs_subr.c:676
#6  ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119
#7  ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1324
#8  ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394
#9  ufs_mkdir+0xf4 sys/ufs/ufs/ufs_vnops.c:1150
#10 VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388
#11 domkdirat+0x121 sys/kern/vfs_syscalls.c:3112
#12 syscall+0x555 mi_syscall sys/sys/syscall_mi.h:113 [inline]
#12 syscall+0x555 sys/arch/amd64/amd64/trap.c:626
#13 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd805dc8a6f8)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0xd1 sys/kern/vfs_lookup.c:418
#6  namei+0x55a sys/kern/vfs_lookup.c:250
#7  domkdirat+0x75 sys/kern/vfs_syscalls.c:3097
#8  syscall+0x555 mi_syscall sys/sys/syscall_mi.h:113 [inline]
#8  syscall+0x555 sys/arch/amd64/amd64/trap.c:626
#9  Xsyscall+0x128
Process 62711 (syz-executor.2) thread 0xffff80002128e028 (130626)
exclusive rrwlock inode r = 0 (0xfffffd805dc8aa28)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  ufs_ihashins+0x42 sys/ufs/ufs/ufs_ihash.c:140
#5  ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1353
#6  ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394
#7  ufs_mkdir+0xf4 sys/ufs/ufs/ufs_vnops.c:1150
#8  VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388
#9  domkdirat+0x121 sys/kern/vfs_syscalls.c:3112
#10 syscall+0x555 mi_syscall sys/sys/syscall_mi.h:113 [inline]
#10 syscall+0x555 sys/arch/amd64/amd64/trap.c:626
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806b8d73c8)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0xd1 sys/kern/vfs_lookup.c:418
#6  namei+0x55a sys/kern/vfs_lookup.c:250
#7  domkdirat+0x75 sys/kern/vfs_syscalls.c:3097
#8  syscall+0x555 mi_syscall sys/sys/syscall_mi.h:113 [inline]
#8  syscall+0x555 sys/arch/amd64/amd64/trap.c:626
#9  Xsyscall+0x128
Process 76489 (syz-executor.0) thread 0xffff80002121c590 (196058)
exclusive rrwlock inode r = 0 (0xfffffd806f1065f0)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:465
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vn_closefile+0xc6 vn_close sys/kern/vfs_vnops.c:292 [inline]
#5  vn_closefile+0xc6 sys/kern/vfs_vnops.c:609
#6  fdrop+0xc7 sys/kern/kern_descrip.c:1274
#7  closef+0x11c sys/kern/kern_descrip.c:1258
#8  syscall+0x57c mi_syscall sys/sys/syscall_mi.h:113 [inline]
#8  syscall+0x57c sys/arch/amd64/amd64/trap.c:626
#9  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10226   6413K    6421K  78643K     11324        0
            pcb    13     12K      14K  78643K        17        0
         rtable   240      6K       7K  78643K       566        0
         ifaddr    73     24K      24K  78643K        87        0
       counters    60     35K      35K  78643K        64        0
       ioctlops     0      0K       2K  78643K        29        0
            iov     0      0K      18K  78643K       438        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1272     80K      80K  78643K      1635        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       9K  78643K        36        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       0K  78643K      1218        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    22     81K     121K  78643K      2706        0
          sigio     0      0K       0K  78643K         8        0
           proc    56     78K     103K  78643K       690        0
        subproc   104      6K       6K  78643K       130        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       126        0
       in_multi    99      6K       7K  78643K       172        0
    ether_multi     1      0K       0K  78643K         8        0
            mrt     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   229   1023K    1023K  78643K       229        0
           exec     0      0K       1K  78643K       873        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   317     85K      88K  78643K     20438        0
       UVM aobj   131      4K       4K  78643K       131        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K        74        0
            NDP    11      0K       2K  78643K        33        0
           temp   124   5774K    5898K  78643K     10126        0
         kqueue    12     18K      28K  78643K       215        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120      308    0      305     5     4     1     3     0     8    0
rtentry    112      137    0       24     4     0     4     4     0     8    0
unpcb      144     4547    0     4533    29    28     1    10     0     8    0
syncache   296       55    0       55     8     7     1     1     0     8    1
tcpqe       32       52    0       52     5     5     0     1     0     8    0
tcpcb      776     1245    0     1241    34    33     1    14     0     8    0
arp        120       23    0        4     1     0     1     1     0     8    0
ipq         40        6    0        6     3     3     0     1     0     8    0
ipqe        40       22    0       22     3     3     0     1     0     8    0
inpcb      368     2426    0     2417    35    33     2    13     0     8    1
nd6         48       33    0        7     1     0     1     1     0     8    0
kcovpl      48       10    0        2     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      548    0       90    29     0    29    29     0     8    0
art_table   32      549    0       90     4     0     4     4     0     8    0
art_node    16      136    0       33     1     0     1     1     0     8    0
semapl     112     1216    0     1206     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     4795    0     3358    91     0    91    91     0     8    0
ffsino     272     4795    0     3358    97     0    97    97     0     8    0
nchpl      144     8488    0     6856    63     0    63    63     0     8    0
uvmvnodes   80     4934    0        0   101     0   101   101     0     8    0
vnodes     216     4934    0        0   275     0   275   275     0     8    0
namei      1024   31281    0    31279     4     3     1     2     0     8    0
percpumem   16       45    0        2     1     0     1     1     0     8    0
kstatmem   264       26    0        4     2     0     2     2     0     8    0
scxspl     216    31242    0    31241    16    15     1     8     0     8    0
plimitpl   152      699    0      676     6     5     1     2     0     8    0
sigapl     424     2995    0     2943     7     0     7     7     0     8    0
futexpl     64    23816    0    23812     2     1     1     1     0     8    0
knotepl    120      418    0        0    11     0    11    11     0     8    0
kqueuepl   216      768    0      759    22    21     1     8     0     8    0
pipepl     320      896    0      867    22    19     3     8     0     8    0
fdescpl    496     2977    0     2944     7     2     5     6     0     8    0
filepl     152    23618    0    23377    53    40    13    25     0     8    1
lockfpl    104      204    0      202     1     0     1     1     0     8    0
lockfspl    48       95    0       93     1     0     1     1     0     8    0
sessionpl  144       25    0        9     1     0     1     1     0     8    0
pgrppl      48       51    0       35     1     0     1     1     0     8    0
ucredpl    104     2958    0     2940     1     0     1     1     0     8    0
zombiepl   144     2944    0     2943     1     0     1     1     0     8    0
processpl  1072    2995    0     2943     5     1     4     5     0     8    0
procpl     696     7980    0     7907    14     5     9     9     0     8    0
sosppl     168       33    0       32     7     6     1     1     0     8    0
sockpl     488     7298    0     7270   145   139     6    33     0     8    1
mcl64k     65536     20    0        0     3     0     3     3     0     8    0
mcl16k     16384     25    0        0     4     1     3     3     0     8    0
mcl12k     12288     16    0        0     2     0     2     2     0     8    0
mcl9k      9216       4    0        0     1     0     1     1     0     8    0
mcl8k      8192      21    0        0     3     1     2     3     0     8    0
mcl4k      4096      17    0        0     3     0     3     3     0     8    0
mcl2k2     2112       5    0        0     1     0     1     1     0     8    0
mcl2k      2048     254    0        0    32     0    32    32     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256     1126    0        0    62     0    62    62     0     8    0
bufpl      288     9407    0     3083   452     0   452   452     0     8    0
anonpl      24   611104    0   597597   128    38    90   112     0   186    0
amapchunkpl 152   56453    0    55732    44    12    32    41     0   158    0
amappl16   200     5736    0     5358    33    12    21    32     0     8    0
amappl15   192       23    0       22     1     0     1     1     0     8    0
amappl14   184      138    0      128     1     0     1     1     0     8    0
amappl13   176        3    0        2     1     0     1     1     0     8    0
amappl12   168      422    0      417     1     0     1     1     0     8    0
amappl11   160       50    0       40     1     0     1     1     0     8    0
amappl10   152       36    0       24     1     0     1     1     0     8    0
amappl9    144      977    0      975     1     0     1     1     0     8    0
amappl8    136      235    0      167     3     0     3     3     0     8    0
amappl7    128      150    0      127     2     1     1     2     0     8    0
amappl6    120      192    0      175     2     1     1     2     0     8    0
amappl5    112      155    0      148     1     0     1     1     0     8    0
amappl4    104      534    0      505     2     1     1     2     0     8    0
amappl3     96     8687    0     8630     2     0     2     2     0     8    0
amappl2     88     3447    0     3370     3     1     2     3     0     8    0
amappl1     80    69737    0    68996    24     6    18    22     0     8    0
amappl      88    19799    0    19602     8     2     6     6     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      130    0        0     3     0     3     3     0     8    0
uaddrrnd    24     2977    0     2944     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2977    0     2944     1     0     1     1     0     8    0
vmmpekpl   168    29381    0    29318     4     0     4     4     0     8    0
vmmpepl    168   276985    0   274298   157    22   135   140     0   357    6
vmsppl     368     2976    0     2944     4     0     4     4     0     8    0
rwobjpl     56    79358    0    72801    94     0    94    94     0     8    0
pdppl      4096    5961    0     5888   159    78    81    93     0     8    8
pvpl        32  1245811    0  1226495   271    97   174   269     0   265    0
pmappl     248     2976    0     2944     4     1     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      985    0      118    26     0    26    26     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
x86_ipi_db(ffffffff82bd2ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff82d74c70) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82d74c70) at __mp_lock+0x122 sys/kern/kern_lock.c:147
intr_handler(ffff80002e453270,ffff80000006ba00) at intr_handler+0x5e sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge21_untramp() at Xintr_ioapic_edge21_untramp+0x18f
Xspllower() at Xspllower+0x19
cnputc(65) at cnputc+0x4b sys/dev/cons.c:218
db_putchar(65) at db_putchar+0x3fc sys/ddb/db_output.c:155
kprintf() at kprintf+0x20ec sys/kern/subr_prf.c:1064
db_printf(ffffffff827d325b) at db_printf+0x85 sys/kern/subr_prf.c:498
panic(ffffffff8274275f) at panic+0xd7 sys/kern/subr_prf.c:216
vop_generic_badop(ffff80002e453698) at vop_generic_badop+0x1b sys/kern/vfs_default.c:133
VOP_STRATEGY(fffffd8061c24dd0,fffffd807af3c918) at VOP_STRATEGY+0x9b sys/kern/vfs_vops.c:628
end trace frame: 0xffff80002e453740, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff82bd2ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
__mp_lock(ffffffff82d74c70) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82d74c70) at __mp_lock+0x122 sys/kern/kern_lock.c:147
intr_handler(ffff80002e453270,ffff80000006ba00) at intr_handler+0x5e sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge21_untramp() at Xintr_ioapic_edge21_untramp+0x18f
Xspllower() at Xspllower+0x19
cnputc(65) at cnputc+0x4b sys/dev/cons.c:218
db_putchar(65) at db_putchar+0x3fc sys/ddb/db_output.c:155
kprintf() at kprintf+0x20ec sys/kern/subr_prf.c:1064
db_printf(ffffffff827d325b) at db_printf+0x85 sys/kern/subr_prf.c:498
panic(ffffffff8274275f) at panic+0xd7 sys/kern/subr_prf.c:216
vop_generic_badop(ffff80002e453698) at vop_generic_badop+0x1b sys/kern/vfs_default.c:133
VOP_STRATEGY(fffffd8061c24dd0,fffffd807af3c918) at VOP_STRATEGY+0x9b sys/kern/vfs_vops.c:628
bwrite(fffffd807af3c918) at bwrite+0x1f0 sys/kern/vfs_bio.c:760
VOP_BWRITE(fffffd807af3c918) at VOP_BWRITE+0x4a sys/kern/vfs_vops.c:640
ufs_mkdir(ffff80002e453930) at ufs_mkdir+0x6b4 sys/ufs/ufs/ufs_vnops.c:1236
VOP_MKDIR(fffffd805c195208,ffff80002e453a90,ffff80002e453ac0,ffff80002e4539c0) at VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388
domkdirat(ffff80002128cb10,ffffff9c,20001ac0,0) at domkdirat+0x121 sys/kern/vfs_syscalls.c:3112
syscall(ffff80002e453c40) at syscall+0x555 mi_syscall sys/sys/syscall_mi.h:113 [inline]
syscall(ffff80002e453c40) at syscall+0x555 sys/arch/amd64/amd64/trap.c:626
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x53f45dc7030, count: -21
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82751908) at panic+0x177 sys/kern/subr_prf.c:198
__assert(ffffffff827cd07e,ffffffff8278d03a,2a2,ffffffff82785288) at __assert+0x25 sys/kern/subr_prf.c:157
proc_trampoline_mp() at proc_trampoline_mp+0x131
end trace frame: 0x0, count: 11
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff82751908) at panic+0x177 sys/kern/subr_prf.c:198
__assert(ffffffff827cd07e,ffffffff8278d03a,2a2,ffffffff82785288) at __assert+0x25 sys/kern/subr_prf.c:157
proc_trampoline_mp() at proc_trampoline_mp+0x131
end trace frame: 0x0, count: -4

Crashes (41):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-openbsd-setuid 2023/01/30 08:30 openbsd 964a7cf02a85 b68fb8d6 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2023/01/25 01:39 openbsd a6ee4600a754 3d904c7a .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2023/01/24 22:56 openbsd a6ee4600a754 3d904c7a .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2023/01/18 14:18 openbsd 56539331b134 4620c2d9 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2023/01/17 19:43 openbsd 0f5e1a03e120 42660d9e .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2023/01/16 00:02 openbsd 93d5a0ee2db2 a63719e7 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/12/23 11:50 openbsd 29216d8731b3 9da18ae8 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/12/21 12:10 openbsd bcc2e3d7508b 4067838e .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/12/01 06:34 openbsd dc8195713cae 4c2a66e8 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/11/30 18:12 openbsd 55dbd79d3d7e 4c2a66e8 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/11/28 01:55 openbsd d5dfbc11ac08 75740b3f .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/11/20 05:29 openbsd fa086fd2b583 5bb70014 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/11/16 20:07 openbsd e38e0490fe8f 3a127a31 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/11/13 15:13 openbsd a9bf6d57fde5 f42ee5d8 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/11/05 17:22 openbsd 84f3eaed82ca 6d752409 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/10/30 17:18 openbsd cad45e2ea101 8168b69e .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/10/28 07:28 openbsd ba77ede935ac 8168b69e .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/10/11 23:37 openbsd d290b41a8d7e 1353c374 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/10/11 14:16 openbsd d290b41a8d7e 1353c374 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/10/09 01:51 openbsd 721f596233a1 aea5da89 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/10/08 20:42 openbsd 5cb1d9dce18f aea5da89 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/10/04 08:46 openbsd 80411f110b5f 3fe4fea8 .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/09/15 22:27 openbsd 1627b89b0a3e dd9a85ff .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/09/09 21:00 openbsd fd522c34be5c 90058bdc .config console log report [disk image] [bsd.gdb] [kernel image] assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/08/08 17:51 openbsd 470043df5a59 da700653 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/08/07 20:54 openbsd 68960257f35d 88e3a122 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/07/15 03:06 openbsd c4c62a46cca6 5d921b08 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/07/01 18:20 openbsd 74158beac1ed 1434eec0 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/06/27 07:27 openbsd a5953208fc7d a371c43c .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/06/05 23:02 openbsd 56fd04f19a61 c8857892 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/05/25 05:57 openbsd aaf8962a38dd 647c0e27 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/05/19 15:29 openbsd f9b15afb6ca0 cb1ac2e7 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/05/07 08:57 openbsd ef8f8f938aa6 e60b1103 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/04/07 19:56 openbsd b306148fec45 c6ff3e05 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/04/02 15:13 openbsd d67ade9b91db 79a2a8fc .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-multicore 2022/03/28 10:16 openbsd c0f44e363efa ee339263 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/03/08 06:20 openbsd 30dd31d2109d 7bdd8b2c .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/03/05 06:41 openbsd 04601fb1cd19 45a13a73 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/02/19 21:39 openbsd c2d9aa031d5e 3cd800e4 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/02/17 19:48 openbsd 00c8a03295fc 3cd800e4 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
ci-openbsd-setuid 2022/01/18 16:20 openbsd 8b31f2a3f55c 731a2d23 .config console log report assert "!_kernel_lock_held()" failed in kern_fork.c
* Struck through repros no longer work on HEAD.