Warning: Permanently added '10.128.0.6' (ED25519) to the list of known hosts. 2024/05/14 23:18:00 ignoring optional flag "sandboxArg"="0" 2024/05/14 23:18:00 parsed 1 programs 2024/05/14 23:18:01 executed programs: 0 2024/05/14 23:18:06 executed programs: 113 [ 56.8465874] panic: kernel diagnostic assertion "lwpcnt >= 0" failed: file "/syzkaller/managers/ci2-netbsd-kmsan/kernel/sys/kern/kern_uidinfo.c", line 259 uid=60928 diff=-1 lwpcnt=-1 [ 56.8465874] cpu1: Begin traceback... [ 56.8665732] vpanic() at netbsd:vpanic+0xc9d [ 56.9165695] kern_assert() at netbsd:kern_assert+0x228 [ 56.9665728] chglwpcnt() at netbsd:chglwpcnt+0x22e [ 57.0165697] lwp_free() at netbsd:lwp_free+0x3e9 [ 57.0565795] lwp_wait() at netbsd:lwp_wait+0x1366 [ 57.1065716] exit_lwps() at netbsd:exit_lwps+0x642 [ 57.1565804] exit1() at netbsd:exit1+0x338 [ 57.1965712] sys_exit() at netbsd:sys_exit+0x1d6 [ 57.2565787] syscall() at netbsd:syscall+0x576 [ 57.2665704] --- syscall (number 1) --- [ 57.2865700] netbsd:syscall+0x576: [ 57.2865700] cpu1: End traceback... [ 57.2865700] fatal breakpoint trap in supervisor mode [ 57.2965698] trap type 1 code 0 rip 0xffffffff8023687d cs 0x8 rflags 0x282 cr2 0x6250a0 ilevel 0 rsp 0xffffa100c7b9d700 [ 57.3065698] curlwp 0xffffa100137ec2c0 pid 3559.3559 lowest kstack 0xffffa100c7b962c0 Stopped in pid 3559.3559 (syz-executor.3) at netbsd:breakpoint+0x5: leave ? breakpoint() at netbsd:breakpoint+0x5 vpanic() at netbsd:vpanic+0xc9d kern_assert() at netbsd:kern_assert+0x228 chglwpcnt() at netbsd:chglwpcnt+0x22e lwp_free() at netbsd:lwp_free+0x3e9 lwp_wait() at netbsd:lwp_wait+0x1366 exit_lwps() at netbsd:exit_lwps+0x642 exit1() at netbsd:exit1+0x338 sys_exit() at netbsd:sys_exit+0x1d6 syscall() at netbsd:syscall+0x576 --- syscall (number 1) --- netbsd:syscall+0x576: Panic string: kernel diagnostic assertion "lwpcnt >= 0" failed: file "/syzkaller/managers/ci2-netbsd-kmsan/kernel/sys/kern/kern_uidinfo.c", line 259 uid=60928 diff=-1 lwpcnt=-1 PID LID S CPU FLAGS STRUCT LWP * NAME WAIT 3583 3583 2 0 0 ffffa100137f5b80 syz-executor.4 3409 3409 2 0 40000 ffffa100137f5740 syz-executor.1 3382 3382 2 1 10040000 ffffa100137f5300 syz-executor.2 3405 3504 2 0 0 ffffa10013607a00 syz-executor.0 3405 3405 2 0 40000 ffffa10013694a40 syz-executor.0 3559 3258 5 0 140100 ffffa100137ecb40 syz-executor.3 3559 > 3559 7 1 10040000 ffffa100137ec2c0 syz-executor.3 1205 1205 2 1 140 ffffa100136941c0 syz-executor.1 1203 1203 2 1 140 ffffa100136075c0 syz-executor.5 1106 1106 2 1 140 ffffa10013607180 syz-executor.2 1240 1240 2 1 140 ffffa100134f19c0 syz-executor.3 1199 1199 2 0 140 ffffa100134f1580 syz-executor.0 1236 1236 2 0 0 ffffa100134f1140 syz-executor.4 1226 1999 3 0 180 ffffa100136b4a80 syz-execprog parked 1226 1204 3 0 180 ffffa100136b4640 syz-execprog parked 1226 1209 3 1 180 ffffa10013694600 syz-execprog parked 1226 990 3 0 180 ffffa100134e4980 syz-execprog wait 1226 1120 3 1 180 ffffa100134e4540 syz-execprog wait 1226 1244 3 0 180 ffffa100134e4100 syz-execprog kqueue 1226 1245 3 0 180 ffffa10012cf6940 syz-execprog wait 1226 1241 3 1 180 ffffa10012cf6500 syz-execprog wait 1226 829 3 0 180 ffffa10012cf60c0 syz-execprog parked 1226 929 3 1 180 ffffa10012c35900 syz-execprog parked 1226 1239 3 1 180 ffffa10012c354c0 syz-execprog wait 1226 1223 3 0 180 ffffa10012c35080 syz-execprog wait 1226 449 3 1 180 ffffa1001230fb00 syz-execprog parked 1226 1226 3 1 180 ffffa1001230f6c0 syz-execprog parked 1080 1080 3 0 180 ffffa1001233db40 sshd select 1184 1184 3 0 180 ffffa1001230f280 getty nanoslp 966 966 3 1 180 ffffa10012522300 getty nanoslp 1216 1216 3 1 180 ffffa10012275ac0 getty nanoslp 1132 1132 3 1 180 ffffa100121d7200 getty ttyraw 1107 1107 3 0 180 ffffa10012b818c0 sshd select 1096 1096 3 0 180 ffffa10012b81480 powerd kqueue 702 702 3 0 180 ffffa1001233d2c0 syslogd kqueue 746 746 3 0 180 ffffa10012b81040 dhcpcd poll 747 747 3 1 180 ffffa10012522b80 dhcpcd poll 742 742 3 1 180 ffffa1001233d700 dhcpcd poll 602 602 3 0 180 ffffa1001254dbc0 dhcpcd poll 292 292 3 1 180 ffffa1001254d780 dhcpcd poll 485 485 3 1 180 ffffa1001254d340 dhcpcd poll 291 291 3 1 180 ffffa10012522740 dhcpcd poll 1 1 3 0 180 ffffa10011e53100 init wait 0 686 3 0 200 ffffa100121d7640 physiod physiod 0 196 3 0 200 ffffa10012275680 pooldrain pooldrain 0 > 195 7 0 240 ffffa10012275240 ioflush 0 194 3 1 200 ffffa100121d7a80 pgdaemon pgdaemon 0 167 3 1 200 ffffa100121a7a40 usb7 usbevt 0 171 3 1 200 ffffa100121a7600 usb6 usbevt 0 169 3 1 200 ffffa100121a71c0 usb5 usbevt 0 168 3 0 200 ffffa1001211ba00 usb4 usbevt 0 166 3 0 200 ffffa1001211b5c0 usb3 usbevt 0 165 3 0 200 ffffa1001211b180 usb2 usbevt 0 31 3 0 200 ffffa1001206b9c0 usb1 usbevt 0 63 3 1 200 ffffa1001206b580 usb0 usbevt 0 126 3 1 200 ffffa1001206b140 usbtask-dr usbtsk 0 125 3 1 200 ffffa10011e53980 usbtask-hc usbtsk 0 124 3 0 200 ffffa100103d3b00 swwreboot swwreboot 0 123 3 0 200 ffffa10011e53540 npfgc0 npfgcw 0 122 3 1 200 ffffa10011e47940 rt_free rt_free 0 121 3 1 200 ffffa10011e47500 unpgc unpgc 0 120 3 0 200 ffffa10011e470c0 key_timehandler key_timehandler 0 119 3 1 200 ffffa10011e41900 icmp6_wqinput/1 icmp6_wqinput 0 118 3 0 200 ffffa10011e414c0 icmp6_wqinput/0 icmp6_wqinput 0 117 3 0 200 ffffa10011e41080 nd6_timer nd6_timer 0 116 3 1 200 ffffa10011ccd8c0 carp6_wqinput/1 carp6_wqinput 0 115 3 0 200 ffffa10011ccd480 carp6_wqinput/0 carp6_wqinput 0 114 3 1 200 ffffa10011ccd040 carp_wqinput/1 carp_wqinput 0 113 3 0 200 ffffa10011cc9b80 carp_wqinput/0 carp_wqinput 0 112 3 1 200 ffffa10011cc9740 icmp_wqinput/1 icmp_wqinput 0 111 3 0 200 ffffa10011cccbc0 icmp_wqinput/0 icmp_wqinput 0 110 3 0 200 ffffa10011ccc340 rt_timer rt_timer 0 109 3 1 200 ffffa10011ccc780 vmem_rehash vmem_rehash 0 100 3 0 200 ffffa10011cc9300 entbutler entropy 0 99 3 0 200 ffffa100117c0b40 viomb balloon 0 98 3 1 200 ffffa100117c0700 vioif0_txrx/1 vioif0_txrx 0 97 3 0 200 ffffa100117c02c0 vioif0_txrx/0 vioif0_txrx 0 30 3 0 200 ffffa100103d36c0 scsibus0 sccomp 0 29 3 0 200 ffffa100103d3280 pms0 pmsreset 0 28 3 1 200 ffffa100103baac0 xcall/1 xcall 0 27 1 1 200 ffffa100103ba680 softser/1 0 26 1 1 200 ffffa100103ba240 softclk/1 0 25 1 1 200 ffffa100103b7a80 softbio/1 0 24 1 1 200 ffffa100103b7640 softnet/1 0 23 1 1 201 ffffa100103b7200 idle/1 0 22 3 1 200 ffffa1000f1d2a40 lnxsyswq lnxsyswq 0 21 3 1 200 ffffa1000f1d2600 lnxubdwq lnxubdwq 0 20 3 1 200 ffffa1000f1d21c0 lnxpwrwq lnxpwrwq 0 19 3 0 200 ffffa1000f1d1a00 lnxlngwq lnxlngwq 0 18 3 0 200 ffffa1000f1d15c0 lnxhipwq lnxhipwq 0 17 3 0 200 ffffa1000f1d1180 lnxrcugc lnxrcugc 0 16 3 0 200 ffffa1000f1ca9c0 sysmon smtaskq 0 15 3 0 200 ffffa1000f1ca580 pmfsuspend pmfsuspend 0 14 3 0 200 ffffa1000f1ca140 pmfevent pmfevent 0 13 3 0 200 ffffa1000f1c8980 sopendfree sopendfr 0 12 3 0 200 ffffa1000f1c8540 ifwdog ifwdog 0 11 3 0 200 ffffa1000f1c8100 iflnkst iflnkst 0 10 3 0 200 ffffa1000f1be940 nfssilly nfssilly 0 9 3 0 200 ffffa1000f1be500 pooldisp pooldisp 0 8 3 0 200 ffffa1000f1be0c0 modunload mod_unld 0 7 3 0 200 ffffa1000ebc9900 xcall/0 xcall 0 6 1 0 200 ffffa1000ebc94c0 softser/0 0 5 1 0 200 ffffa1000ebc9080 softclk/0 0 4 1 0 200 ffffa1000ebc88c0 softbio/0 0 3 1 0 200 ffffa1000ebc8480 softnet/0 0 2 1 0 201 ffffa1000ebc8040 idle/0 0 0 3 0 200 ffffffff86a6f8c0 swapper uvm [Locks tracked through LWPs] ****** LWP 3409.3409 (syz-executor.1) @ 0xffffa100137f5740, l_stat=2 *** Locks held: * Lock 0 (initialized at netbsd:pmap_ctor+0xc0) lock address : ffffa100136be380 type : sleep/adaptive initialized : netbsd:pmap_ctor+0xc0 shared holds : 0 exclusive: 1 shares wanted: 0 exclusive: 0 relevant cpu : 0 last held: 0 relevant lwp : 0xffffa100137f5740 last held: 0xffffa100137f5740 last locked* : netbsd:pmap_enter_ma+0x11ce unlocked : netbsd:pmap_extract+0x72d owner field : 0xffffa100137f5740 wait/spin: 0/0 Turnstile: no active turnstile for this lock. *** Locks wanted: none ****** LWP 3405.3405 (syz-executor.0) @ 0xffffa10013694a40, l_stat=2 *** Locks held: * Lock 0 (initialized at netbsd:pmap_ctor+0xc0) lock address : ffffa10012c32fc0 type : sleep/adaptive initialized : netbsd:pmap_ctor+0xc0 shared holds : 0 exclusive: 1 shares wanted: 0 exclusive: 0 relevant cpu : 0 last held: 0 relevant lwp : 0xffffa10013694a40 last held: 0xffffa10013694a40 last locked* : netbsd:pmap_enter_ma+0x11ce unlocked : netbsd:pmap_extract+0x72d owner field : 0xffffa10013694a40 wait/spin: 0/0 Turnstile: no active turnstile for this lock. *** Locks wanted: none ****** LWP 3559.3559 (syz-executor.3) @ 0xffffa100137ec2c0, l_stat=7 *** Locks held: * Lock 0 (initialized at netbsd:fork1+0xa35) lock address : ffffa100137c3300 type : sleep/adaptive initialized : netbsd:fork1+0xa35 shared holds : 0 exclusive: 1 shares wanted: 0 exclusive: 0 relevant cpu : 1 last held: 1 relevant lwp : 0xffffa100137ec2c0 last held: 0xffffa100137ec2c0 last locked* : netbsd:cv_timedwait+0x1aa unlocked : netbsd:lwp_exit+0x1dd5 owner field : 0xffffa100137ec2c0 wait/spin: 0/0 Turnstile: no active turnstile for this lock. *** Locks wanted: none ****** LWP 1236.1236 (syz-executor.4) @ 0xffffa100134f1140, l_stat=2 *** Locks held: * Lock 0 (initialized at netbsd:uvmspace_fork+0x3d8) lock address : ffffa100133e17c8 type : sleep/adaptive initialized : netbsd:uvmspace_fork+0x3d8 shared holds : 0 exclusive: 1 shares wanted: 0 exclusive: 0 relevant cpu : 0 last held: 0 relevant lwp : 0xffffa100134f1140 last held: 0xffffa100134f1140 last locked* : netbsd:vm_map_lock+0x57 unlocked : netbsd:uvm_fault_upper_enter+0x161a owner/count : 000000000000000000 flags : 000000000000000000 Turnstile: no active turnstile for this lock. *** Locks wanted: none ****** LWP 747.747 (dhcpcd) @ 0xffffa10012522b80, l_stat=3 *** Locks held: none *** Locks wanted: * Lock 0 (initialized at netbsd:module_hook_init+0x43) lock address : netbsd:module_hook type : sleep/adaptive initialized : netbsd:module_hook_init+0x43 shared holds : 0 exclusive: 0 shares wanted: 0 exclusive: 0 relevant cpu : 1 last held: 0 relevant lwp : 0xffffa10012522b80 last held: 000000000000000000 last locked : 0 unlocked* : 0 owner field : 000000000000000000 wait/spin: 0/0 Turnstile: no active turnstile for this lock. ****** LWP 742.742 (dhcpcd) @ 0xffffa1001233d700, l_stat=3 *** Locks held: none *** Locks wanted: * Lock 0 (initialized at netbsd:module_hook_init+0x43) lock address : netbsd:module_hook type : sleep/adaptive initialized : netbsd:module_hook_init+0x43 shared holds : 0 exclusive: 0 shares wanted: 0 exclusive: 0 relevant cpu : 1 last held: 0 relevant lwp : 0xffffa1001233d700 last held: 000000000000000000 last locked : 0 unlocked* : 0 owner field : 000000000000000000 wait/spin: 0/0 Turnstile: no active turnstile for this lock. ****** LWP 485.485 (dhcpcd) @ 0xffffa1001254d340, l_stat=3 *** Locks held: none *** Locks wanted: * Lock 0 (initialized at netbsd:module_hook_init+0x43) lock address : netbsd:module_hook type : sleep/adaptive initialized : netbsd:module_hook_init+0x43 shared holds : 0 exclusive: 0 shares wanted: 0 exclusive: 0 relevant cpu : 1 last held: 0 relevant lwp : 0xffffa1001254d340 last held: 000000000000000000 last locked : 0 unlocked* : 0 owner field : 000000000000000000 wait/spin: 0/0 Turnstile: no active turnstile for this lock. ****** LWP 291.291 (dhcpcd) @ 0xffffa10012522740, l_stat=3 *** Locks held: none *** Locks wanted: * Lock 0 (initialized at netbsd:module_hook_init+0x43) lock address : netbsd:module_hook type : sleep/adaptive initialized : netbsd:module_hook_init+0x43 shared holds : 0 exclusive: 0 shares wanted: 0 exclusive: 0 relevant cpu : 1 last held: 0 relevant lwp : 0xffffa10012522740 last held: 000000000000000000 last locked : 0 unlocked* : 0 owner field : 000000000000000000 wait/spin: 0/0 Turnstile: no active turnstile for this lock. ****** LWP 0.26 (softclk/1) @ 0xffffa100103ba240, l_stat=1 *** Locks held: none *** Locks wanted: * Lock 0 (initialized at netbsd:module_hook_init+0x43) lock address : netbsd:module_hook type : sleep/adaptive initialized : netbsd:module_hook_init+0x43 shared holds : 0 exclusive: 0 shares wanted: 0 exclusive: 0 relevant cpu : 1 last held: 0 relevant lwp : 0xffffa100103ba240 last held: 000000000000000000 last locked : 0 unlocked* : 0 owner field : 000000000000000000 wait/spin: 0/0 Turnstile: no active turnstile for this lock. ****** LWP 0.11 (iflnkst) @ 0xffffa1000f1c8100, l_stat=3 *** Locks held: none *** Locks wanted: * Lock 0 (initialized at netbsd:module_hook_init+0x43) lock address : netbsd:module_hook type : sleep/adaptive initialized : netbsd:module_hook_init+0x43 shared holds : 0 exclusive: 0 shares wanted: 0 exclusive: 0 relevant cpu : 0 last held: 0 relevant lwp : 0xffffa1000f1c8100 last held: 000000000000000000 last locked : 0 unlocked* : 0 owner field : 000000000000000000 wait/spin: 0/0 Turnstile: no active turnstile for this lock. ****** LWP 0.0 (swapper) @ 0xffffffff86a6f8c0, l_stat=3 *** Locks held: none *** Locks wanted: * Lock 0 (initialized at netbsd:module_hook_init+0x43) lock address : netbsd:module_hook type : sleep/adaptive initialized : netbsd:module_hook_init+0x43 shared holds : 0 exclusive: 0 shares wanted: 0 exclusive: 0 relevant cpu : 0 last held: 0 relevant lwp : 0xffffffff86a6f8c0 last held: 000000000000000000 last locked : 0 unlocked* : 0 owner field : 000000000000000000 wait/spin: 0/0 Turnstile: no active turnstile for this lock. [Locks tracked through CPUs] ******* Locks held on cpu1: * Lock 0 (initialized at netbsd:kprintf_init+0xcb) lock address : netbsd:kprintf_mtx type : spin initialized : netbsd:kprintf_init+0xcb shared holds : 0 exclusive: 1 shares wanted: 0 exclusive: 0 relevant cpu : 1 last held: 1 relevant lwp : 0xffffa100137ec2c0 last held: 0xffffa100137ec2c0 last locked* : netbsd:vpanic+0x624 unlocked : netbsd:printf+0x2ce owner field : 0x0000000000000800 wait/spin: 0/1 PAGE FLAG PQ UOBJECT UANON 0xffffa10000017180 0001 00000000 0x0 0x0 0xffffa10000017200 0041 00000000 0x0 0x0 0xffffa10000017280 0041 00000000 0x0 0x0 0xffffa10000017300 0041 00000000 0x0 0x0 0xffffa10000017380 0041 00000000 0x0 0x0 0xffffa10000017400 0041 00000000 0x0 0x0 0xffffa10000017480 0041 00000000 0x0 0x0 0xffffa10000017500 0041 00000000 0x0 0x0 0xffffa10000017580 0041 00000000 0x0 0x0 0xffffa10000017600 0041 00000000 0x0 0x0 0xffffa10000017680 0041 00000000 0x0 0x0 0xffffa10000017700 0041 00000000 0x0 0x0 0xffffa10000017780 0041 00000000 0x0 0x0 0xffffa10000017800 0041 00000000 0x0 0x0 0xffffa10000017880 0041 00000000 0x0 0x0 0xffffa10000017900 0041 00000000 0x0 0x0 0xffffa10000017980 0041 00000000 0x0 0x0 0xffffa10000017a00 0041 00000000 0x0 0x0 0xffffa10000017a80 0041 00000000 0x0 0x0 0xffffa10000017b00 0041 00000000 0x0 0x0 0xffffa10000017b80 0041 00000000 0x0 0x0 0xffffa10000017c00 0041 00000000 0x0 0x0 0xffffa10000017c80 0041 00000000 0x0 0x0 0xffffa10000017d00 0041 00000000 0x0 0x0 0xffffa10000017d80 0041 00000000 0x0 0x0 0xffffa10000017e00 0041 00000000 0x0 0x0 0xffffa10000017e80 0041 00000000 0x0 0x0 0xffffa10000017f00 0041 00000000 0x0 0x0 0xffffa10000017f80 0041 00000000 0x0 0x0 0xffffa10000018000 0041 00000000 0x0 0x0 0xffffa10000018080 0041 00000000 0x0 0x0 0xffffa10000018100 0041 00000000 0x0 0x0 0xffffa10000018180 0041 00000000 0x0 0x0 0xffffa10000018200 0041 00000000 0x0 0x0 0xffffa10000018280 0041 00000000 0x0 0x0 0xffffa10000018300 0041 00000000 0x0 0x0 0xffffa10000018380 0041 00000000 0x0 0x0 0xffffa10000018400 0041 00000000 0x0 0x0 0xffffa10000018480 0041 00000000 0x0 0x0 0xffffa10000018500 0041 00000000 0x0 0x0 0xffffa10000018580 0041 00000000 0x0 0x0 0xffffa10000018600 0041 00000000 0x0 0x0 0xffffa10000018680 0041 00000000 0x0 0x0 0xffffa10000018700 0041 00000000 0x0 0x0 0xffffa10000018780 0041 00000000 0x0 0x0 0xffffa10000018800 0041 00000000 0x0 0x0 0xffffa10000018880 0041 00000000 0x0 0x0 0xffffa10000018900 0041 00000000 0x0 0x0 0xffffa10000018980 0041 00000000 0x0 0x0 0xffffa10000018a00 0041 00000000 0x0 0x0 0xffffa10000018a80 0041 00000000 0x0 0x0 0xffffa10000018b00 0041 00000000 0x0 0x0 0xffffa10000018b80 0041 00000000 0x0 0x0 0xffffa10000018c00 0041 00000000 0x0 0x0 0xffffa10000018c80 0041 00000000 0x0 0x0 0xffffa10000018d00 0041 00000000 0x0 0x0 0xffffa10000018d80 0041 00000000 0x0 0x0 0xffffa10000018e00 0041 00000000 0x0 0x0 0xffffa10000018e80 0041 00000000 0x0 0x0 0xffffa10000018f00 0041 00000000 0x0 0x0 0xffffa10000018f80 0041 00000000 0x0 0x0 0xffffa10000019000 0041 00000000 0x0 0x0 0xffffa10000019080 0041 00000000 0x0 0x0 0xffffa10000019100 0041 00000000 0x0 0x0 0xffffa10000019180 0041 00000000 0x0 0x0 0xffffa10000019200 0041 00000000 0x0 0x0 0xffffa10000019280 0041 00000000 0x0 0x0 0xffffa10000019300 0041 00000000 0x0 0x0 0xffffa10000019380 0041 00000000 0x0 0x0 0xffffa10000019400 0041 00000000 0x0 0x0 0xffffa10000019480 0041 00000000 0x0 0x0 0xffffa10000019500 0041 00000000 0x0 0x0 0xffffa10000019580 0041 00000000