syzbot


assert "!_kernel_lock_held()" failed in kern_fork.c (3)

Status: fixed on 2023/10/30 23:05
Reported-by: syzbot+3c2eced405b9de6f79c2@syzkaller.appspotmail.com
Fix commit: 6d6c8141fa4d Adjust KERNEL_ASSERT_UNLOCKED() to not assert during a panic.
First crash: 790d, last: 140d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "!_kernel_lock_held()" failed in kern_fork.c 15 1608d 1869d 0/3 auto-closed as invalid on 2020/01/21 16:10
openbsd assert "!_kernel_lock_held()" failed in kern_fork.c (2) 1 1418d 1418d 0/3 auto-closed as invalid on 2020/07/29 04:11

Sample crash report:
papanic: kernel diagnostic assertion "!_kernel_lock_held()" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_fork.c", line 685
Stopped at      db_enter+0x1c:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*334539  51368  32767        0x10          0    1  syz-executor.0
  26001  18396  32767        0x10          0    0  syz-executor.1
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827aa57e) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff828281fe,ffffffff827ecd25,2ad,ffffffff827df7a8) at __assert+0x29 sys/kern/subr_prf.c:157
proc_trampoline_mi() at proc_trampoline_mi+0x221
end trace frame: 0x0, count: 11
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu0: vop_generic_badop
 cpu1: kernel diagnostic assertion "!_kernel_lock_held()" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_fork.c", line 685
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827aa57e) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff828281fe,ffffffff827ecd25,2ad,ffffffff827df7a8) at __assert+0x29 sys/kern/subr_prf.c:157
proc_trampoline_mi() at proc_trampoline_mi+0x221
end trace frame: 0x0, count: -4
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002adf3660
rbx               0xffff800020d49ba7
rdx                                0
rcx               0xffff8000212b2558
rax               0xffff800020d48ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x19bee020674c8531
r11               0xd225a3e109889796
r12               0xffff800020d499a8
r13                                0
r14               0xffffffff82c519a8    cpu_info_full_primary+0x29a8
r15                              0x1
rip               0xffffffff8152babc    db_enter+0x1c
cs                               0x8
rflags                         0x246
rsp               0xffff80002adf3650
ss                              0x10
db_enter+0x1c:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.0) tid=334539 pid=51368 tcnt=1 stat=onproc
    flags process=10<SUGID> proc=0
    runpri=82, usrpri=86, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0
    forw=0xffffffffffffffff, list=0xffff8000212b37f0,0xffffffff82ce5ad0
    process=0xffff800021283258 user=0xffff80002adee000, vmspace=0xfffffd8066c37030
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*51368  334539  37851  32767  7        0x10                syz-executor.0
  2573  377207  30422  32767  2        0x10                syz-executor.5
 31171   49233  37380  32767  2        0x10                syz-executor.4
 31171  229241  37380  32767  3   0x4000090  fsleep        syz-executor.4
 10414  178731  16718  32767  2        0x10                syz-executor.7
 10414  266816  16718  32767  2   0x4000010                syz-executor.7
 30422  472299  83456  32767  2        0x10                syz-executor.5
 83456  102981  14407      0  3        0x82  wait          syz-executor.5
 57278  359746  44549  32767  2        0x10                syz-executor.2
 44549  405388  14407      0  3        0x82  wait          syz-executor.2
 71893  509239  62310  32767  3        0x10  biowait       syz-executor.3
 62310  441696  14407      0  3        0x82  wait          syz-executor.3
 37851   42017  70199  32767  3        0x90  nanoslp       syz-executor.0
 70199  469997  14407      0  3        0x82  wait          syz-executor.0
 16718  262553  26284  32767  3        0x90  nanoslp       syz-executor.7
 26284   95540  14407      0  3        0x82  wait          syz-executor.7
 18396   26001  22116  32767  7        0x10                syz-executor.1
 22116  485696  14407      0  3        0x82  wait          syz-executor.1
 37380  330881  92995  32767  3        0x90  nanoslp       syz-executor.4
 92995  192642  14407      0  3        0x82  wait          syz-executor.4
 70977  513436      0      0  3     0x14200  bored         sosplice
 15776  224089  97055  32767  2        0x10                syz-executor.6
 97055   38609  14407      0  3        0x82  wait          syz-executor.6
 14407  110312  16553      0  3   0x2000082  thrsleep      syz-fuzzer
 14407   72587  16553      0  3   0x6000082  nanoslp       syz-fuzzer
 14407  486809  16553      0  3   0x6000082  thrsleep      syz-fuzzer
 14407  391500  16553      0  3   0x6000082  thrsleep      syz-fuzzer
 14407  478020  16553      0  3   0x6000082  thrsleep      syz-fuzzer
 14407   38475  16553      0  3   0x6000082  wait          syz-fuzzer
 14407   16929  16553      0  3   0x6000082  wait          syz-fuzzer
 14407  120932  16553      0  3   0x6000082  thrsleep      syz-fuzzer
 14407   81974  16553      0  3   0x6000082  wait          syz-fuzzer
 14407  350075  16553      0  3   0x6000082  thrsleep      syz-fuzzer
 14407  231812  16553      0  3   0x6000082  wait          syz-fuzzer
 14407  122136  16553      0  3   0x6000082  wait          syz-fuzzer
 14407  430398  16553      0  3   0x6000082  wait          syz-fuzzer
 14407  423941  16553      0  3   0x6000082  wait          syz-fuzzer
 14407  434718  16553      0  3   0x6000082  kqread        syz-fuzzer
 14407  124118  16553      0  3   0x6000082  wait          syz-fuzzer
 16553  347623  81193      0  3    0x10008a  sigsusp       ksh
 81193   56141  58299      0  3        0x9a  kqread        sshd
 76619  506063      1      0  3    0x100083  ttyin         getty
 58299  220815      1      0  3        0x88  kqread        sshd
 38065  128191  76777     73  3   0x1100090  kqread        syslogd
 76777  139543      1      0  3    0x100082  netio         syslogd
 18683  145149      1      0  3    0x100080  kqread        resolvd
 64610  148109  67633     77  3    0x100092  kqread        dhcpleased
 70748  105144  67633     77  3    0x100092  kqread        dhcpleased
 67633  282170      1      0  3        0x80  kqread        dhcpleased
 54349  437972      0      0  3     0x14200  bored         smr
 97383  327870      0      0  2     0x14200                zerothread
 95368  371081      0      0  3     0x14200  aiodoned      aiodoned
 25126  168809      0      0  3     0x14200  syncer        update
 28818  187104      0      0  3     0x14200  cleaner       cleaner
 83836  203247      0      0  3     0x14200  reaper        reaper
 81995  391353      0      0  3     0x14200  pgdaemon      pagedaemon
 14052  453139      0      0  3     0x14200  bored         viomb
 80134   22944      0      0  3  0x40014200  acpi0         acpi0
  9898  347671      0      0  3  0x40014200                idle1
 44507  428524      0      0  3     0x14200  bored         softnet3
 64914  125473      0      0  3     0x14200  bored         softnet2
 33640  144883      0      0  3     0x14200  bored         softnet1
 30179  406648      0      0  3     0x14200  bored         softnet0
 43349  275876      0      0  3     0x14200  bored         systqmp
 82672    4057      0      0  3     0x14200  bored         systq
 14049  356293      0      0  3     0x14200  tmoslp        softclockmp
 11732   12917      0      0  3  0x40014200  tmoslp        softclock
 58522  364225      0      0  3  0x40014200                idle0
     1   80908      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 31171 (syz-executor.4) thread 0xffff8000212b2ff8 (229241)
exclusive rwlock amaplk r = 0 (0xfffffd8066988908)
#0  witness_lock+0x447
#1  uvm_fault_check+0x41a sys/uvm/uvm_fault.c:782
#2  uvm_fault+0xf2 sys/uvm/uvm_fault.c:600
#3  upageflttrap+0x86 sys/arch/amd64/amd64/trap.c:188
#4  usertrap+0x226 sys/arch/amd64/amd64/trap.c:436
#5  recall_trap+0x8
shared rwlock vmmaplk r = 0 (0xfffffd806be15a20)
#0  witness_lock+0x447
#1  uvmfault_lookup+0xd9 sys/uvm/uvm_fault.c:1785
#2  uvm_fault_check+0x3e sys/uvm/uvm_fault.c:672
#3  uvm_fault+0xf2 sys/uvm/uvm_fault.c:600
#4  upageflttrap+0x86 sys/arch/amd64/amd64/trap.c:188
#5  usertrap+0x226 sys/arch/amd64/amd64/trap.c:436
#6  recall_trap+0x8
Process 57278 (syz-executor.2) thread 0xffff80002125f2b8 (359746)
exclusive rrwlock inode r = 0 (0xfffffd8070737f80)
#0  witness_lock+0x447
#1  rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vn_closefile+0xca vn_close sys/kern/vfs_vnops.c:292 [inline]
#5  vn_closefile+0xca sys/kern/vfs_vnops.c:609
#6  fdrop+0xcb sys/kern/kern_descrip.c:1274
#7  closef+0x120 sys/kern/kern_descrip.c:1258
#8  syscall+0x606 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8  syscall+0x606 sys/arch/amd64/amd64/trap.c:623
#9  Xsyscall+0x128
Process 71893 (syz-executor.3) thread 0xffff80002125e020 (509239)
exclusive rrwlock inode r = 0 (0xfffffd8066ae61b8)
#0  witness_lock+0x447
#1  rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  ufs_ihashins+0x46 sys/ufs/ufs/ufs_ihash.c:140
#5  ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1343
#6  ffs_inode_alloc+0x1c2 sys/ufs/ffs/ffs_alloc.c:394
#7  ufs_mkdir+0xf8 sys/ufs/ufs/ufs_vnops.c:1149
#8  VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388
#9  domkdirat+0x125 sys/kern/vfs_syscalls.c:3073
#10 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#10 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd80685d3e70)
#0  witness_lock+0x447
#1  rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6  namei+0x55a sys/kern/vfs_lookup.c:250
#7  domkdirat+0x79 sys/kern/vfs_syscalls.c:3058
#8  syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8  syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9  Xsyscall+0x128
Process 18396 (syz-executor.1) thread 0xffff80002125e2c8 (26001)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82ce5260)
#0  witness_lock+0x447
#1  __mp_acquire_count+0x48 sys/kern/kern_lock.c:227
#2  mi_switch+0x46d sys/kern/sched_bsd.c:470
#3  sleep_finish+0x19b sys/kern/kern_synch.c:414
#4  biowait+0x91 sys/kern/vfs_bio.c:1278
#5  bwrite+0x21c sys/kern/vfs_bio.c:769
#6  ffs_update+0x281 sys/ufs/ffs/ffs_inode.c:113
#7  ufs_mkdir+0x672 sys/ufs/ufs/ufs_vnops.c:1219
#8  VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388
#9  domkdirat+0x125 sys/kern/vfs_syscalls.c:3073
#10 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#10 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8066ae60a8)
#0  witness_lock+0x447
#1  rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vget+0x200 sys/kern/vfs_subr.c:676
#6  ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119
#7  ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1314
#8  ffs_inode_alloc+0x1c2 sys/ufs/ffs/ffs_alloc.c:394
#9  ufs_mkdir+0xf8 sys/ufs/ufs/ufs_vnops.c:1149
#10 VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388
#11 domkdirat+0x125 sys/kern/vfs_syscalls.c:3073
#12 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#12 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#13 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd807864db38)
#0  witness_lock+0x447
#1  rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6  namei+0x55a sys/kern/vfs_lookup.c:250
#7  domkdirat+0x79 sys/kern/vfs_syscalls.c:3058
#8  syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8  syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9  Xsyscall+0x128
Process 15776 (syz-executor.6) thread 0xffff8000212b2aa8 (224089)
exclusive rrwlock inode r = 0 (0xfffffd8066ae6a38)
#0  witness_lock+0x447
#1  rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  ufs_ihashins+0x46 sys/ufs/ufs/ufs_ihash.c:140
#5  ffs_vget+0x141 sys/ufs/ffs/ffs_vfsops.c:1343
#6  ffs_inode_alloc+0x1c2 sys/ufs/ffs/ffs_alloc.c:394
#7  ufs_mkdir+0xf8 sys/ufs/ufs/ufs_vnops.c:1149
#8  VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388
#9  domkdirat+0x125 sys/kern/vfs_syscalls.c:3073
#10 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#10 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806a80da38)
#0  witness_lock+0x447
#1  rw_enter+0x3c8 sys/kern/kern_rwlock.c:309
#2  rrw_enter+0x8c sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0x8b sys/kern/vfs_vops.c:518
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0xd5 sys/kern/vfs_lookup.c:418
#6  namei+0x55a sys/kern/vfs_lookup.c:250
#7  domkdirat+0x79 sys/kern/vfs_syscalls.c:3058
#8  syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
#8  syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
#9  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10214   6412K    6420K  78643K     11423        0
            pcb    13     16K      20K  78643K        19        0
         rtable   240      6K       7K  78643K      2223        0
             pf    29      8K       8K  78643K       115        0
         ifaddr    44     15K      16K  78643K       222        0
        ifgroup    50      2K       2K  78643K       222        0
         sysctl     4      1K       1K  78643K         4        0
       counters    60     35K      35K  78643K       146        0
       ioctlops     0      0K       2K  78643K       238        0
            iov     0      0K      24K  78643K      1458        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1279     80K      80K  78643K      4389        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       9K  78643K       256        0
         VM map     2      1K       1K  78643K         2        0
            sem    12      0K       1K  78643K       669        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    22     81K     113K  78643K     15424        0
          sigio     0      0K       0K  78643K      2434        0
           proc    56     78K     115K  78643K      2453        0
        subproc   104      6K       6K  78643K       663        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K       537        0
       in_multi    99      7K       7K  78643K       685        0
    ether_multi     1      0K       0K  78643K        30        0
            mrt     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   223    996K     996K  78643K       223        0
           exec     0      0K       1K  78643K      2725        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     8     62K      64K  78643K        10        0
       UVM amap   405     91K     106K  78643K    152065        0
       UVM aobj   131      4K       4K  78643K       131        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K       482        0
            NDP    11      0K       2K  78643K       156        0
           temp    74   5920K    6048K  78643K     43982        0
         kqueue    12     18K      30K  78643K      1306        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120      895    0      892    11    10     1     3     0     8    0
rtentry    112      605    0      492     4     0     4     4     0     8    0
unpcb      144    10626    0    10613   106   104     2    10     0     8    1
syncache   304      159    0      159    22    21     1     1     0     8    1
tcpqe       32      285    0      285    17    17     0     1     0     8    0
tcpcb      808    16220    0    16158   186   169    17    28     0     8    6
arp        120      106    0       88     1     0     1     1     0     8    0
ipq         40       25    0       25     9     9     0     1     0     8    0
ipqe        40      124    0      124     9     9     0     1     0     8    0
inpcb      368    22879    0    22814   158   140    18    22     0     8    6
nd6        136      172    0      145     2     1     1     2     0     8    0
kcovpl      48       51    0       43     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     2410    0     1947    33     4    29    30     0     8    0
art_table   32     2411    0     1947     4     0     4     4     0     8    0
art_node    16      604    0      501     1     0     1     1     0     8    0
semupl     112        7    0        7     1     1     0     1     0     8    0
semapl     112      660    0      650     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256    21964    0    20499    93     0    93    93     0     8    0
ffsino     272    21964    0    20499    99     0    99    99     0     8    0
nchpl      144    42246    0    40608    63     0    63    63     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024  137706    0   137703     5     4     1     2     0     8    0
percpumem   16       86    0       43     1     0     1     1     0     8    0
kstatmem   264      108    0       86     2     0     2     2     0     8    0
scxspl     216   128995    0   128994    40    38     2     8     1     8    1
plimitpl   152     3011    0     2988    19    18     1     2     0     8    0
sigapl     424    15637    0    15585     7     0     7     7     0     8    0
futexpl     64   135314    0   135313     2     1     1     1     0     8    0
knotepl    120     1032    0        0    18     0    18    18     0     8    0
kqueuepl   216     3053    0     3045    52    51     1     8     0     8    0
pipepl     320     5457    0     5429   116   113     3    13     0     8    0
fdescpl    496    15618    0    15585     7     2     5     6     0     8    0
filepl     152   105470    0   105236   170   154    16    24     0     8    6
lockfpl    104     2244    0     2242     3     2     1     2     0     8    0
lockfspl    48      595    0      593     1     0     1     1     0     8    0
sessionpl  144       66    0       50     1     0     1     1     0     8    0
pgrppl      48      429    0      413     1     0     1     1     0     8    0
ucredpl    104    13983    0    13965     1     0     1     1     0     8    0
zombiepl   144    15585    0    15585     1     0     1     1     0     8    1
processpl  1072   15637    0    15585     5     1     4     5     0     8    0
procpl     680    42230    0    42161    20    12     8     8     0     8    1
sosppl     168      219    0      219    12    11     1     1     0     8    1
sockpl     488    35145    0    35064   523   503    20    42     0     8    6
mcl64k     65536     28    0        0     4     1     3     3     0     8    0
mcl16k     16384     25    0        0     4     1     3     3     0     8    0
mcl12k     12288     17    0        0     2     0     2     2     0     8    0
mcl9k      9216      18    0        0     2     0     2     2     0     8    0
mcl8k      8192      41    0        0     5     2     3     3     0     8    0
mcl4k      4096      49    0        0     5     1     4     4     0     8    0
mcl2k2     2112      27    0        0     2     1     1     2     0     8    0
mcl2k      2048     388    0        0    38    12    26    38     0     8    2
mtagpl      96       12    0        0     1     0     1     1     0     8    0
mbufpl     256     1513    0        0    78     0    78    78     0     8    0
bufpl      288    29539    0    23218   452     0   452   452     0     8    0
anonpl      24  1545383    0  1534546   198   113    85    98     0   186    0
amapchunkpl 152  479630    0   478866   133    91    42    52     0   158    6
amappl16   200    29766    0    29446   144   120    24    30     0     8    5
amappl15   192       31    0       31     3     3     0     1     0     8    0
amappl14   184      287    0      275     2     1     1     2     0     8    0
amappl13   176       52    0       52     9     9     0     1     0     8    0
amappl12   168    17006    0    16964     3     0     3     3     0     8    0
amappl11   160       51    0       39     1     0     1     1     0     8    0
amappl10   152       95    0       81     1     0     1     1     0     8    0
amappl9    144      270    0      270     8     8     0     1     0     8    0
amappl8    136      873    0      706     6     0     6     6     0     8    0
amappl7    128      317    0      292     2     0     2     2     0     8    0
amappl6    120     1008    0      994     1     0     1     1     0     8    0
amappl5    112      412    0      404     1     0     1     1     0     8    0
amappl4    104     1115    0     1080     6     4     2     2     0     8    0
amappl3     96    93291    0    93211    15    11     4     4     0     8    1
amappl2     88    16841    0    16758     3     1     2     3     0     8    0
amappl1     80    65411    0    64887    22     9    13    22     0     8    0
amappl      88   150695    0   150468     7     0     7     7     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      130    0        0     3     0     3     3     0     8    0
uaddrrnd    24    15618    0    15585     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    15618    0    15585     1     0     1     1     0     8    0
vmmpekpl   168   130295    0   130228     4     0     4     4     0     8    0
vmmpepl    168   917105    0   914717   246   119   127   128     0   357    3
vmsppl     464    15617    0    15585     7     1     6     6     0     8    0
rwobjpl     56   227553    0   220071   123    14   109   109     0     8    0
pdppl      4096   31244    0    31170   578   496    82    92     0     8    8
pvpl        32  4392981    0  4376165   506   340   166   357     0   265    3
pmappl     248    15617    0    15585     4     1     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112     1765    0      844    27     0    27    27     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1e:        addq    $0x8,%rsp
x86_ipi_db(ffffffff82c50ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x29 kd_curproc sys/dev/kcov.c:589 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x29 sys/dev/kcov.c:158
__mp_lock(ffffffff82ce5058) at __mp_lock+0x133 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82ce5058) at __mp_lock+0x133 sys/kern/kern_lock.c:147
intr_handler(ffff800027b49360,ffff80000007bd80) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
Xspllower() at Xspllower+0x1d
cnputc(61) at cnputc+0x4f sys/dev/cons.c:218
db_putchar(61) at db_putchar+0x3fc sys/ddb/db_output.c:155
kprintf() at kprintf+0x6bc sys/kern/subr_prf.c:724
db_printf(ffffffff8282cffc) at db_printf+0x89 sys/kern/subr_prf.c:498
panic(ffffffff8279cc7c) at panic+0xdb sys/kern/subr_prf.c:216
vop_generic_badop(ffff800027b49788) at vop_generic_badop+0x1f sys/kern/vfs_default.c:133
end trace frame: 0xffff800027b497d0, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff82c50ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x29 kd_curproc sys/dev/kcov.c:589 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x29 sys/dev/kcov.c:158
__mp_lock(ffffffff82ce5058) at __mp_lock+0x133 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82ce5058) at __mp_lock+0x133 sys/kern/kern_lock.c:147
intr_handler(ffff800027b49360,ffff80000007bd80) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
Xspllower() at Xspllower+0x1d
cnputc(61) at cnputc+0x4f sys/dev/cons.c:218
db_putchar(61) at db_putchar+0x3fc sys/ddb/db_output.c:155
kprintf() at kprintf+0x6bc sys/kern/subr_prf.c:724
db_printf(ffffffff8282cffc) at db_printf+0x89 sys/kern/subr_prf.c:498
panic(ffffffff8279cc7c) at panic+0xdb sys/kern/subr_prf.c:216
vop_generic_badop(ffff800027b49788) at vop_generic_badop+0x1f sys/kern/vfs_default.c:133
VOP_STRATEGY(fffffd8070c90368,fffffd80697a7138) at VOP_STRATEGY+0x9f sys/kern/vfs_vops.c:628
bwrite(fffffd80697a7138) at bwrite+0x1f1 sys/kern/vfs_bio.c:760
VOP_BWRITE(fffffd80697a7138) at VOP_BWRITE+0x4e sys/kern/vfs_vops.c:640
ufs_mkdir(ffff800027b49a20) at ufs_mkdir+0x6c4 sys/ufs/ufs/ufs_vnops.c:1235
VOP_MKDIR(fffffd807089ee60,ffff800027b49b80,ffff800027b49bb0,ffff800027b49ab0) at VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388
domkdirat(ffff80002125e2c8,ffffff9c,7c1ff979c820,1ff) at domkdirat+0x125 sys/kern/vfs_syscalls.c:3073
syscall(ffff800027b49d30) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline]
syscall(ffff800027b49d30) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c1ff979c890, count: -22
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x1c:  addq    $0x8,%rsp
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827aa57e) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff828281fe,ffffffff827ecd25,2ad,ffffffff827df7a8) at __assert+0x29 sys/kern/subr_prf.c:157
proc_trampoline_mi() at proc_trampoline_mi+0x221
end trace frame: 0x0, count: 11
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
panic(ffffffff827aa57e) at panic+0x17b sys/kern/subr_prf.c:198
__assert(ffffffff828281fe,ffffffff827ecd25,2ad,ffffffff827df7a8) at __assert+0x29 sys/kern/subr_prf.c:157
proc_trampoline_mi() at proc_trampoline_mi+0x221
end trace frame: 0x0, count: -4

Crashes (107):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/10/30 14:11 openbsd a19ee134455f 116af91f .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/10/29 19:14 openbsd c8ef2279606a 3c418d72 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/10/27 12:02 openbsd 64ccb1834187 bf285f0c .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/10/27 06:24 openbsd ff3feee55e58 bf285f0c .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/10/06 05:35 openbsd 67babe865022 db17ad9f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/10/04 09:13 openbsd 37f6beb378af 65faba36 .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/09/13 03:21 openbsd b2fc71be2998 59da8366 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/08/29 10:18 openbsd 2cc1e2eb2f0d 7ba13a15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/08/15 10:49 openbsd a3e56974213b 39990d51 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/08/13 19:53 openbsd f22a72c18245 39990d51 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/08/04 23:20 openbsd 33bf5a6c99c6 5aed0249 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/08/02 02:19 openbsd 06bd3d808881 df07ffe8 .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/31 22:11 openbsd 254cfd28aa6f 2a0d0f29 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/24 21:57 openbsd 2da88a044fa7 9a0ddda3 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/23 06:11 openbsd 343097702129 27cbe77f .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/19 13:49 openbsd f6f278519334 022df2bb .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/16 04:45 openbsd 4d951e9375c9 35d9ecc5 .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/10 02:23 openbsd 619580f90f04 668cb1fa .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/09 18:43 openbsd 619580f90f04 668cb1fa .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/08 09:17 openbsd d75fd186365b 668cb1fa .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/07/01 07:21 openbsd 79a7ca0d25b8 af3053d2 .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/30 11:41 openbsd 5f0c994b3e51 01298212 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/25 03:22 openbsd 9c8757ead552 79782afc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/23 18:54 openbsd 6405be196b8a 79782afc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/23 07:38 openbsd 6d14abdcc245 79782afc .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/18 11:56 openbsd 0bf07e222152 f3921d4d .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/16 21:28 openbsd d87ad1f5ae73 f3921d4d .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/16 07:04 openbsd 443f525547ad f3921d4d .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/14 17:35 openbsd ea064d447ed0 76decb82 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/12 00:25 openbsd 70842b5acaff 49519f06 .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/09 07:09 openbsd 40d5d4e22dbc 058b3a5a .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/09 04:43 openbsd 40d5d4e22dbc 058b3a5a .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/06 16:26 openbsd 6f702add5934 a4ae4f42 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/02 09:13 openbsd 11d9cfa5c6cb a4ae4f42 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/06/02 03:33 openbsd 76710a0821d7 a4ae4f42 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/05/30 20:10 openbsd 08ac1330e795 09898419 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/05/28 20:27 openbsd a94aa8037025 cf184559 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/05/28 15:36 openbsd 73c48ca30eb7 cf184559 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/05/21 14:12 openbsd 12be23f54c2a 4bce1a3e .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/05/07 00:55 openbsd 3feb172447ac 90c93c40 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/05/04 07:23 openbsd 5045af7fa8aa 5b7ff9dd .config console log report ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/05/01 11:47 openbsd bba11a86879d 62df2017 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/04/27 11:02 openbsd 1e5b016c5082 6f5b1cc4 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/04/26 09:47 openbsd 1e5b016c5082 7560799c .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/04/23 00:47 openbsd 1e5b016c5082 2b32bd34 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/04/22 15:10 openbsd 1e5b016c5082 2b32bd34 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!_kernel_lock_held()" failed in kern_fork.c
2023/04/21 15:58 openbsd 1e5b016c5082 2b32bd34 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/04/20 16:55 openbsd 1e5b016c5082 5ed6c74d .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2023/04/16 12:38 openbsd 1e5b016c5082 3cfcaa1b .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
2022/01/18 16:20 openbsd 8b31f2a3f55c 731a2d23 .config console log report ci-openbsd-setuid assert "!_kernel_lock_held()" failed in kern_fork.c
* Struck through repros no longer work on HEAD.