kern.securelevel: 0 -> 1 creating runtime link editor directory cache. preserving editor files. starting network daemons: sshd. starting local daemons:. Sat Feb 2 23:00:19 PST 2019 OpenBSD/amd64 (ci-openbsd-setuid-9.c.syzkaller.internal) (tty00) Warning: Permanently added '10.128.10.38' (ECDSA) to the list of known hosts. 2019/02/02 23:13:52 parsed 1 programs 2019/02/02 23:13:58 executed programs: 0 2019/02/02 23:14:03 executed programs: 195 2019/02/02 23:14:08 executed programs: 436 2019/02/02 23:14:13 executed programs: 634 2019/02/02 23:14:18 executed programs: 879 2019/02/02 23:14:23 executed programs: 1044 2019/02/02 23:14:28 executed programs: 1270 2019/02/02 23:14:33 executed programs: 1489 2019/02/02 23:14:38 executed programs: 1719 2019/02/02 23:14:43 executed programs: 1970 2019/02/02 23:14:48 executed programs: 2196 2019/02/02 23:14:53 executed programs: 2394 2019/02/02 23:14:58 executed programs: 2604 2019/02/02 23:15:03 executed programs: 2815 2019/02/02 23:15:08 executed programs: 3041 2019/02/02 23:15:13 executed programs: 3285 2019/02/02 23:15:18 executed programs: 3453 2019/02/02 23:15:23 executed programs: 3622 2019/02/02 23:15:28 executed programs: 3827 2019/02/02 23:15:33 executed programs: 4047 2019/02/02 23:15:38 executed programs: 4285 2019/02/02 23:15:43 executed programs: 4540 2019/02/02 23:15:48 executed programs: 4767 2019/02/02 23:15:53 executed programs: 4957 2019/02/02 23:15:58 executed programs: 5155 2019/02/02 23:16:03 executed programs: 5341 2019/02/02 23:16:08 executed programs: 5591 2019/02/02 23:16:13 executed programs: 5845 login: panic: kernel diagnostic assertion "ps->ps_uvncount == 0" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_unveil.c", line 196 Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 335166 26209 0 0x14000 0x200 1 reaper db_enter() at db_enter+0x18 panic() at panic+0x16c __assert(ffffffff814df464,ffff800020c7fb00,ffff800000957000,50) at __assert+0x2 4 unveil_destroy(7fa4af3dbb8f70cc) at unveil_destroy+0x178 exit1(0,ffff800020be4970,7f7ffffc2038) at exit1+0x337 sys_exit(ffffffff818ead43,ffff800020c7fbc0,0) at sys_exit+0x13 syscall(1af602ef04197bd5) at syscall+0x5a0 Xsyscall(6,1,0,1,0,7f7ffffc2074) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffc2040, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> show panic kernel diagnostic assertion "ps->ps_uvncount == 0" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_unveil.c", line 196 ddb{0}> trace db_enter() at db_enter+0x18 panic() at panic+0x16c __assert(ffffffff814df464,ffff800020c7fb00,ffff800000957000,50) at __assert+0x24 unveil_destroy(7fa4af3dbb8f70cc) at unveil_destroy+0x178 exit1(0,ffff800020be4970,7f7ffffc2038) at exit1+0x337 sys_exit(ffffffff818ead43,ffff800020c7fbc0,0) at sys_exit+0x13 syscall(1af602ef04197bd5) at syscall+0x5a0 Xsyscall(6,1,0,1,0,7f7ffffc2074) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffc2040, count: -8 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff800020c7fa60 rbx 0xffff800020c7fb00 rdx 0xffffffff81ec8b28 cmd0646_9_tim_udma+0x14f93 rcx 0x201 rax 0x1 r8 0xffffffff814dfdf4 kprintf+0x174 r9 0x1 r10 0x8b25aedd989a7a0a r11 0xc9d6af427db244e6 r12 0x3000000008 r13 0xffff800020c7fa70 r14 0x100 r15 0x1 rip 0xffffffff8184b4f8 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff800020c7fa50 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor0) pid=423488 stat=onproc flags process=1008 proc=2000 pri=50, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff800020be5780,0xffffffff82314aa0 process=0xffff800020b94010 user=0xffff800020c7a000, vmspace=0xfffffd807f00c000 estcpu=36, cpticks=7, pctcpu=0.0 user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 30447 294212 85686 0 2 0x3000 syz-executor1 96531 85810 90489 0 3 0x82 nanosleep syz-executor0 85686 260484 90489 0 3 0x82 nanosleep syz-executor1 90489 22302 90013 0 3 0x82 thrsleep syz-execprog 90489 18495 90013 0 3 0x4000082 thrsleep syz-execprog 90489 475988 90013 0 3 0x4000082 thrsleep syz-execprog 90489 246031 90013 0 3 0x4000082 thrsleep syz-execprog 90489 285510 90013 0 3 0x4000082 thrsleep syz-execprog 90489 178595 90013 0 3 0x4000082 thrsleep syz-execprog 90489 438346 90013 0 3 0x4000082 thrsleep syz-execprog 90489 187323 90013 0 3 0x4000082 thrsleep syz-execprog 90489 401180 90013 0 3 0x4000082 kqread syz-execprog 90489 30139 90013 0 3 0x4000082 thrsleep syz-execprog 90013 186868 8263 0 3 0x10008a pause ksh 8263 437841 766 0 3 0x92 select sshd 72437 295214 1 0 3 0x100083 ttyin getty 766 342216 1 0 3 0x80 select sshd 83032 492286 28311 73 3 0x100090 kqread syslogd 28311 385851 1 0 3 0x100082 netio syslogd 14231 58688 1 77 3 0x100090 poll dhclient 9577 167964 1 0 3 0x80 poll dhclient 63474 170100 0 0 3 0x14200 pgzero zerothread 58085 497138 0 0 3 0x14200 aiodoned aiodoned 55487 55098 0 0 3 0x14200 syncer update 34955 397780 0 0 3 0x14200 cleaner cleaner 26209 335166 0 0 7 0x14200 reaper 71447 221455 0 0 3 0x14200 pgdaemon pagedaemon 41578 153715 0 0 3 0x14200 bored crynlk 3234 101814 0 0 3 0x14200 bored crypto 37491 185009 0 0 3 0x40014200 acpi0 acpi0 16977 413812 0 0 3 0x40014200 idle1 87030 5107 0 0 3 0x14200 bored softnet 74701 191049 0 0 3 0x14200 bored systqmp 83385 166970 0 0 3 0x14200 bored systq 97011 179211 0 0 3 0x40014200 bored softclock 70962 222966 0 0 3 0x40014200 idle0 1 230101 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9452 6320K 6320K 78643K 10539 0 0 pcb 23 9K 9K 78643K 55 0 0 rtable 97 3K 3K 78643K 167 0 0 ifaddr 34 9K 9K 78643K 34 0 0 counters 39 33K 33K 78643K 39 0 0 ioctlops 0 0K 2K 78643K 15 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 12 1K 73K 78643K 1171 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 1K 78643K 2 0 0 VM map 2 1K 1K 78643K 2 0 0 sem 2 0K 0K 78643K 2 0 0 dirhash 9 1K 2K 78643K 12 0 0 ACPI 1792 194K 288K 78643K 12592 0 0 file desc 5 13K 25K 78643K 6061 0 0 proc 48 62K 86K 78643K 30460 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 in_multi 33 2K 2K 78643K 33 0 0 ether_multi 1 0K 0K 78643K 1 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 18 79K 79K 78643K 18 0 0 exec 0 0K 1K 78643K 165 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 75 20K 20K 78643K 12943 0 0 UVM aobj 2 2K 2K 78643K 2 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 NDP 5 0K 0K 78643K 9 0 0 temp 46 2350K 2414K 78643K 14771 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 4 0 0 1 0 1 1 0 8 0 inpcbpl 280 26 0 20 1 0 1 1 0 8 0 plimitpl 152 15 0 8 1 0 1 1 0 8 0 plcache 128 20 0 0 1 0 1 1 0 8 0 rtentry 112 41 0 1 2 0 2 2 0 8 0 syncache 264 5 0 5 2 2 0 1 0 8 0 tcpcb 544 8 0 5 1 0 1 1 0 8 0 nd6 48 4 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 185 0 0 12 0 12 12 0 8 0 art_table 32 186 0 0 2 0 2 2 0 8 0 art_node 16 40 0 6 1 0 1 1 0 8 0 dirhash 1024 17 0 2 3 0 3 3 0 8 1 dino1pl 128 7461 0 1361 197 0 197 197 0 8 0 ffsino 272 7461 0 1361 407 0 407 407 0 8 0 nchpl 144 19745 0 18362 59 0 59 59 0 8 1 uvmvnodes 72 6104 0 0 111 0 111 111 0 8 0 vnodes 200 6104 0 0 322 0 322 322 0 8 0 namei 1024 51900 0 51900 2 1 1 1 0 8 1 percpumem 16 30 0 0 1 0 1 1 0 8 0 scxspl 192 40011 0 40011 35 34 1 6 0 8 1 sigapl 432 6232 0 6218 2 0 2 2 0 8 0 futexpl 56 14527 0 14527 1 0 1 1 0 8 1 knotepl 112 63 0 38 2 0 2 2 0 8 0 kqueuepl 104 2 0 0 1 0 1 1 0 8 0 pipepl 112 138 0 119 3 2 1 1 0 8 0 fdescpl 488 6233 0 6219 3 1 2 3 0 8 0 filepl 152 6966 0 6905 3 0 3 3 0 8 0 lockfpl 104 6 0 6 1 1 0 1 0 8 0 lockfspl 32 3 0 3 1 1 0 1 0 8 0 sessionpl 112 19 0 9 1 0 1 1 0 8 0 pgrppl 48 19 0 9 1 0 1 1 0 8 0 ucredpl 96 47 0 40 1 0 1 1 0 8 0 zombiepl 144 6220 0 6218 3 2 1 1 0 8 0 processpl 840 6247 0 6218 4 0 4 4 0 8 0 procpl 600 12358 0 12319 4 0 4 4 0 8 0 sockpl 384 68 0 52 2 0 2 2 0 8 0 mcl4k 4096 2 0 0 1 0 1 1 0 8 0 mcl2k 2048 61 0 0 8 0 8 8 0 8 0 mtagpl 80 1 0 0 1 0 1 1 0 8 0 mbufpl 256 125 0 0 8 0 8 8 0 8 0 bufpl 256 10903 0 4648 436 0 436 436 0 8 0 anonpl 16 317318 0 314805 19 8 11 12 0 125 0 amapchunkpl 152 18998 0 18907 4 0 4 4 0 158 0 amappl16 192 25386 0 25283 6 0 6 6 0 8 0 amappl15 184 3024 0 3021 1 0 1 1 0 8 0 amappl14 176 3 0 1 2 1 1 1 0 8 0 amappl13 168 23 0 19 1 0 1 1 0 8 0 amappl12 160 28 0 24 2 1 1 1 0 8 0 amappl11 152 183 0 174 1 0 1 1 0 8 0 amappl10 144 6098 0 6095 3 2 1 1 0 8 0 amappl9 136 209 0 207 1 0 1 1 0 8 0 amappl8 128 143 0 127 1 0 1 1 0 8 0 amappl7 120 35 0 30 1 0 1 1 0 8 0 amappl6 112 46 0 41 1 0 1 1 0 8 0 amappl5 104 3136 0 3123 1 0 1 1 0 8 0 amappl4 96 304 0 280 2 1 1 2 0 8 0 amappl3 88 130 0 125 1 0 1 1 0 8 0 amappl2 80 61043 0 60980 2 0 2 2 0 8 0 amappl1 72 93784 0 93354 23 13 10 19 0 8 0 amappl 72 12583 0 12547 1 0 1 1 0 75 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma64 64 259 0 259 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 1 0 0 1 0 1 1 0 8 0 uaddrrnd 24 6233 0 6218 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 6233 0 6218 1 0 1 1 0 8 0 vmmpekpl 168 30101 0 30078 2 0 2 2 0 8 0 vmmpepl 168 469218 0 468168 92 45 47 71 0 357 1 vmsppl 360 6232 0 6218 2 0 2 2 0 8 0 pdppl 4096 12473 0 12436 6 1 5 6 0 8 0 pvpl 32 922571 0 917525 102 61 41 92 0 265 0 pmappl 224 6232 0 6218 1 0 1 1 0 8 0 extentpl 40 39 0 25 1 0 1 1 0 8 0 phpool 112 887 0 4 26 0 26 26 0 8 0