panic: kernel diagnostic assertion "ps->ps_uvncount == 0" faile d: file "/syzkaller/managers/main/kernel/sys/kern/kern_unveil.c ", line 188 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830b234c) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff830679a2,ffffffff8303bf3f,bc,ffffffff82fef017) at __assert+0x29 unveil_destroy(ffff800033ff6ae8) at unveil_destroy+0x1dd sys/kern/kern_unveil.c:188 exit1(ffff80002a4c3708,0,0,1) at exit1+0x60f sys/kern/kern_exit.c:233 sys_exit(ffff80002a4c3708,ffff80002a585ba0,ffff80002a585af0) at sys_exit+0x1a syscall(ffff80002a585ba0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7196bfcfd240, count: 7 https://www.openbsd.org/ddb.html describes the minimum info req uired in bug reports. Insufficient info makes it difficult to find and fix b ugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: kernel diagnostic assertion "ps->ps_uvncount == 0" failed: file "/syzkaller/managers/main/kernel/sys/kern/kern_unveil.c", line 188 ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830b234c) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff830679a2,ffffffff8303bf3f,bc,ffffffff82fef017) at __assert+0x29 unveil_destroy(ffff800033ff6ae8) at unveil_destroy+0x1dd sys/kern/kern_unveil.c:188 exit1(ffff80002a4c3708,0,0,1) at exit1+0x60f sys/kern/kern_exit.c:233 sys_exit(ffff80002a4c3708,ffff80002a585ba0,ffff80002a585af0) at sys_exit+0x1a syscall(ffff80002a585ba0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7196bfcfd240, count: -8 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80002a5858f0 rbx 0xffff800033ff6ae8 rdx 0 rcx 0 rax 0xffff80002a4c3708 r8 0 r9 0x8080808080808080 r10 0x456432e9d0ec42aa r11 0x1ee51453ae45476f r12 0 r13 0x2 r14 0 r15 0x1 rip 0xffffffff81a9d155 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a5858e0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=262281 pid=62497 tcnt=0 stat=onproc flags process=1008 proc=2000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0xffff80002a4c3708 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff80002a4c2f70,0xffff80002a4c3c28 process=0xffff800033ff6ae8 user=0xffff80002a580000, vmspace=0xfffffd806b6ebc30 estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 16358 446792 5976 0 2 0 syz-executor 44452 250629 99386 0 2 0x1044 syz-executor 13625 286866 26183 0 2 0 syz-executor 87476 513657 65893 0 2 0x1044 syz-executor 56684 86906 42803 0 2 0 syz-executor 56684 116081 42803 0 2 0x4000000 syz-executor 57406 51575 86088 0 2 0x100002 sh 85304 164381 20634 0 2 0 syz-executor 85304 212069 20634 0 2 0x4000000 syz-executor 85304 261440 20634 0 3 0x4000080 fsleep syz-executor 99386 318018 5166 0 3 0x82 ppwait syz-executor 86088 244662 5166 0 3 0x82 wait syz-executor 65893 142651 5166 0 3 0x82 ppwait syz-executor 20634 1856 5166 0 2 0x482 syz-executor 94737 90834 5166 0 2 0x482 syz-executor 26183 221888 5166 0 2 0x482 syz-executor 5976 34236 5166 0 3 0x82 nanoslp syz-executor 42803 208422 5166 0 2 0x482 syz-executor 96224 320869 0 0 3 0x14200 acct acct 52478 40624 0 0 3 0x14280 nfsidl nfsio 62652 439057 0 0 3 0x14280 nfsidl nfsio 19991 397466 0 0 3 0x14280 nfsidl nfsio 83530 475863 0 0 3 0x14280 nfsidl nfsio 44027 413050 0 0 3 0x14280 nfsidl nfsio 69116 86883 0 0 3 0x14280 nfsidl nfsio 87566 10550 0 0 3 0x14280 nfsidl nfsio 5024 26263 0 0 3 0x14280 nfsidl nfsio 3305 358328 0 0 3 0x14280 nfsidl nfsio 39454 454096 0 0 3 0x14280 nfsidl nfsio 53048 56926 0 0 3 0x14280 nfsidl nfsio 37811 366024 0 0 3 0x14280 nfsidl nfsio 8422 207952 0 0 3 0x14280 nfsidl nfsio 42846 247517 0 0 3 0x14280 nfsidl nfsio 10810 21671 0 0 3 0x14280 nfsidl nfsio 55963 520951 0 0 3 0x14280 nfsidl nfsio 95837 311251 0 0 3 0x14280 nfsidl nfsio 35635 387162 0 0 3 0x14280 nfsidl nfsio 96638 306527 0 0 3 0x14280 nfsidl nfsio 63598 255059 0 0 3 0x14280 nfsidl nfsio 73400 207172 1 0 3 0x100083 ttyin getty 90453 107940 0 0 3 0x14200 bored sosplice 5166 130183 59191 0 3 0x82 kqread syz-executor 59191 418998 72842 0 3 0x10008a sigsusp ksh 72842 62984 89119 0 3 0x98 kqread sshd-session 89119 140460 67490 0 3 0x92 kqread sshd-session 67490 120270 1 0 3 0x88 kqread sshd 92473 51415 57584 73 2 0x1100010 syslogd 57584 30755 1 0 3 0x100082 sbwait syslogd 81739 368598 1 0 3 0x100080 kqread resolvd 79487 162606 49169 77 3 0x100092 kqread dhcpleased 43368 168968 49169 77 3 0x100092 kqread dhcpleased 49169 31190 1 0 3 0x80 kqread dhcpleased 28916 281205 0 0 3 0x14200 bored smr 5150 413145 0 0 2 0x14200 zerothread 82906 257628 0 0 3 0x14200 aiodoned aiodoned 20551 60927 0 0 3 0x14200 syncer update 40706 370033 0 0 3 0x14200 cleaner cleaner 38659 243143 0 0 2 0x14200 reaper 28596 241343 0 0 3 0x14200 pgdaemon pagedaemon 64725 186774 0 0 3 0x14200 bored viomb 46901 465131 0 0 3 0x40014200 acpi0 acpi0 13651 469267 0 0 3 0x14200 bored softnet3 260 420062 0 0 3 0x14200 bored softnet2 79199 353548 0 0 3 0x14200 bored softnet1 62248 436772 0 0 3 0x14200 bored softnet0 66037 166684 0 0 3 0x14200 bored systqmp 68952 357819 0 0 3 0x14200 bored systq 63317 227981 0 0 2 0x40014200 softclock 60143 219963 0 0 3 0x40014200 idle0 1 35995 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10218 11180K 11387K 166960K 12640 0 pcb 17 15K 16K 166960K 386 0 rtable 176 7K 8K 166960K 2228 0 pf 37 14K 269K 166960K 209 0 ifaddr 37 6K 8K 166960K 294 0 ifgroup 54 2K 2K 166960K 323 0 sysctl 4 1K 5K 166960K 6 0 counters 31 17K 17K 166960K 100 0 ioctlops 0 0K 4K 166960K 215 0 iov 0 0K 17K 166960K 216 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1451 91K 92K 166960K 2949 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 21 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 1K 166960K 34 0 dirhash 15 2K 3K 166960K 39 0 ACPI 1690 195K 286K 166960K 12468 0 file desc 17 61K 93K 166960K 2092 0 sigio 0 0K 0K 166960K 27 0 proc 64 75K 116K 166960K 2188 0 subproc 104 6K 6K 166960K 859 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 235 0 in_multi 78 5K 7K 166960K 747 0 ether_multi 1 0K 0K 166960K 9 0 mrt 0 0K 0K 166960K 7 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 265 1182K 1182K 166960K 265 0 exec 2 0K 1K 166960K 1204 0 pfkey data 0 0K 0K 166960K 3 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 202 72K 93K 166960K 17442 0 UVM aobj 113 3K 3K 166960K 115 0 pinsyscall 41 82K 95K 166960K 4613 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 62 0 NDP 12 0K 2K 166960K 211 0 temp 77 6816K 6900K 166960K 68334 0 kqueue 13 20K 30K 166960K 225 0 SYN cache 2 2352K 2360K 166960K 3 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 236 0 233 1 0 1 1 0 8 0 rtentry 112 759 0 683 4 1 3 4 0 8 0 unpcb 144 1193 0 1178 14 8 6 6 0 8 5 syncache 336 11 0 11 3 2 1 1 0 8 1 tcpqe 32 5 0 5 1 1 0 1 0 8 0 tcpcb 808 441 0 436 9 7 2 7 0 8 1 arp 88 136 0 121 1 0 1 1 0 8 0 ipq 40 9 0 9 1 0 1 1 0 8 1 ipqe 40 63 0 63 1 0 1 1 0 8 1 inpcb 336 2041 0 2034 20 16 4 15 0 8 3 nd6 104 203 0 186 1 0 1 1 0 8 0 pkpcb 40 11 0 11 2 1 1 1 0 8 1 kcovpl 48 66 0 58 1 0 1 1 0 8 0 ppxss 1072 8 0 8 2 2 0 1 0 8 0 pfstscr 40 4 0 2 1 0 1 1 0 8 0 pfrktable 1344 2 0 2 1 1 0 1 0 8 0 pftag 88 1 0 0 1 0 1 1 0 8 0 pfstitem 24 3 0 0 1 0 1 1 0 8 0 pfstkey 128 9 0 7 1 0 1 1 0 8 0 pfstate 344 5 0 3 1 0 1 1 0 8 0 pfrule 1344 9 0 9 2 2 0 1 0 8 0 art_heap8 4096 3 0 0 3 0 3 3 0 8 0 art_heap4 256 3061 0 2728 32 5 27 30 0 8 6 art_table 32 3064 0 2728 4 0 4 4 0 8 0 art_node 16 756 0 688 1 0 1 1 0 8 0 sysvmsgpl 40 106 0 66 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 112 31 0 21 1 0 1 1 0 8 0 shmpl 112 112 0 2 4 0 4 4 0 8 0 dirhash 1024 35 0 16 3 0 3 3 0 8 0 dino2pl 256 3691 0 2093 100 0 100 100 0 8 0 ffsino 240 3691 0 2093 95 0 95 95 0 8 0 nchpl 144 5553 0 3804 66 0 66 66 0 8 1 uvmvnodes 80 5046 0 0 103 0 103 103 0 8 0 vnodes 216 5046 0 0 281 0 281 281 0 8 0 namei 1024 24358 0 24354 7 4 3 3 0 8 2 kstatmem 264 162 0 138 2 0 2 2 0 8 0 scsiplug 72 1 0 1 1 1 0 1 0 8 0 scxspl 216 42684 0 42684 11 9 2 8 1 8 2 plimitpl 152 659 0 642 1 0 1 1 0 8 0 sigapl 424 2288 0 2220 8 0 8 8 0 8 0 futexpl 64 17860 0 17859 1 0 1 1 0 8 0 knotepl 120 56342 0 56295 43 33 10 17 0 8 7 kqueuepl 184 317 0 308 1 0 1 1 0 8 0 pipepl 288 485 0 458 7 4 3 7 0 8 0 fdescpl 432 2246 0 2217 5 1 4 5 0 8 0 filepl 120 12250 0 12014 20 6 14 15 0 8 5 lockfpl 104 635 0 633 3 1 2 2 0 8 1 lockfspl 48 256 0 254 1 0 1 1 0 8 0 sessionpl 144 85 0 77 1 0 1 1 0 8 0 pgrppl 48 236 0 220 1 0 1 1 0 8 0 ucredpl 104 1388 0 1377 1 0 1 1 0 8 0 zombiepl 144 2405 0 2404 3 2 1 1 0 8 0 processpl 1096 2288 0 2220 6 0 6 6 0 8 1 procpl 648 4074 0 4001 9 1 8 8 0 8 1 sosppl 168 8 0 8 3 2 1 1 0 8 1 sockpl 504 3500 0 3475 68 47 21 27 0 8 17 mcl64k 65536 23 0 23 3 2 1 1 0 8 1 mcl16k 16384 1 0 1 1 1 0 1 0 8 0 mcl12k 12288 1 0 1 1 1 0 1 0 8 0 mcl9k 9216 1 0 1 1 0 1 1 0 8 1 mcl8k 8192 69 0 69 3 2 1 1 0 8 1 mcl4k 4096 4383 0 4333 17 9 8 14 0 8 1 mcl2k2 2112 1 0 1 1 1 0 1 0 8 0 mcl2k 2048 2555 0 2554 5 4 1 4 0 8 0 mtagpl 96 108 0 107 2 1 1 2 0 8 0 mbufpl 256 22842 0 22624 35 12 23 28 0 8 7 bufpl 280 10262 0 2894 527 0 527 527 0 8 0 anonpl 24 381133 0 377732 153 54 99 99 0 187 67 amapchunkpl 152 58591 0 58164 74 24 50 50 0 158 30 amappl16 200 7069 0 7060 51 42 9 15 0 8 8 amappl15 192 57 0 57 1 1 0 1 0 8 0 amappl14 184 233 0 223 1 0 1 1 0 8 0 amappl13 176 15 0 15 1 1 0 1 0 8 0 amappl12 168 3764 0 3735 2 0 2 2 0 8 0 amappl11 160 50 0 40 1 0 1 1 0 8 0 amappl10 152 5 0 5 1 1 0 1 0 8 0 amappl9 144 117 0 117 1 1 0 1 0 8 0 amappl8 136 24 0 22 1 0 1 1 0 8 0 amappl7 128 222 0 211 1 0 1 1 0 8 0 amappl6 120 739 0 736 1 0 1 1 0 8 0 amappl5 112 369 0 360 1 0 1 1 0 8 0 amappl4 104 490 0 473 1 0 1 1 0 8 0 amappl3 96 11103 0 11008 6 2 4 4 0 8 1 amappl2 88 1507 0 1444 2 0 2 2 0 8 0 amappl1 80 17743 0 17225 14 1 13 13 0 8 0 amappl 88 16554 0 16406 5 0 5 5 0 92 0 dma65536 65536 1 0 1 1 1 0 1 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 254 0 254 1 1 0 1 0 8 0 dma64 64 8 0 8 3 2 1 1 0 8 1 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 114 0 2 3 0 3 3 0 8 0 uaddrrnd 24 2246 0 2216 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 2246 0 2216 1 0 1 1 0 8 0 vmmpekpl 168 18323 0 18267 4 1 3 4 0 8 0 vmmpepl 168 143696 0 142070 104 17 87 89 0 357 13 vmsppl 344 2245 0 2216 4 1 3 4 0 8 0 rwobjpl 24 46843 0 40863 37 0 37 37 0 8 0 pdppl 4096 4498 0 4432 178 110 68 80 0 8 2 pvpl 32 1088346 0 1079573 538 257 281 344 0 265 183 pmappl 216 2245 0 2216 3 1 2 3 0 8 0 extentpl 40 55 0 38 1 0 1 1 0 8 0 phpool 112 593 0 228 12 0 12 12 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830b234c) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff830679a2,ffffffff8303bf3f,bc,ffffffff82fef017) at __assert+0x29 unveil_destroy(ffff800033ff6ae8) at unveil_destroy+0x1dd sys/kern/kern_unveil.c:188 exit1(ffff80002a4c3708,0,0,1) at exit1+0x60f sys/kern/kern_exit.c:233 sys_exit(ffff80002a4c3708,ffff80002a585ba0,ffff80002a585af0) at sys_exit+0x1a syscall(ffff80002a585ba0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7196bfcfd240, count: -8 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830b234c) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff830679a2,ffffffff8303bf3f,bc,ffffffff82fef017) at __assert+0x29 unveil_destroy(ffff800033ff6ae8) at unveil_destroy+0x1dd sys/kern/kern_unveil.c:188 exit1(ffff80002a4c3708,0,0,1) at exit1+0x60f sys/kern/kern_exit.c:233 sys_exit(ffff80002a4c3708,ffff80002a585ba0,ffff80002a585af0) at sys_exit+0x1a syscall(ffff80002a585ba0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7196bfcfd240, count: -8