panic: ffs_valloc: dup alloc Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *275782 53081 0 0x2 0 0 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346b2d8) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(fffffa806d647d00,41ed,fffffa8007ffd750,ffff80002a848e88) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a848ef0) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(fffffa806d59b470,ffff80002a849050,ffff80002a849080,ffff80002a848f80) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a7367d0,ffffff9c,6f9847ab86b0,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 syscall(ffff80002a8491f0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a8491f0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x6f9847ab8750, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: ffs_valloc: dup alloc ddb> show kasan No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346b2d8) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(fffffa806d647d00,41ed,fffffa8007ffd750,ffff80002a848e88) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a848ef0) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(fffffa806d59b470,ffff80002a849050,ffff80002a849080,ffff80002a848f80) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a7367d0,ffffff9c,6f9847ab86b0,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 syscall(ffff80002a8491f0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a8491f0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x6f9847ab8750, count: -8 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80002a848c10 rbx 0x6654 __ALIGN_SIZE+0x5654 rdx 0 rcx 0 rax 0xffff80002a7367d0 r8 0x101010101010101 r9 0x8080808080808080 r10 0xa3c60186d4a3ddd3 r11 0xb2fa30d415db0efc r12 0 r13 0xfffffa806b2a8b00 r14 0 r15 0x1 rip 0xffffffff81e12965 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a848c00 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=275782 pid=53081 tcnt=1 stat=onproc flags process=2 proc=0 runpri=17, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a7374c8,0xffff80002a736548 process=0xffff80002a790d90 user=0xffff80002a844000, vmspace=0xfffffa8079ec0738 estcpu=36, cpticks=4, pctcpu=0.0, user=0, sys=4, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 25457 147239 91430 0 3 0x80 nanoslp syz-executor 25457 439542 91430 0 3 0x4000080 kqsel syz-executor 20372 280824 56885 -1 2 0xc90 syz-executor 20372 219040 56885 -1 3 0x4000090 kqsel syz-executor 20372 482352 56885 -1 3 0x4000090 fsleep syz-executor 20372 104125 56885 -1 3 0x4000090 fsleep syz-executor 29654 245175 46681 0 2 0 syz-executor 29654 283475 46681 0 2 0x4000000 syz-executor 29654 116774 46681 0 3 0x4000080 fsleep syz-executor 38320 319581 29743 0 3 0x80 nanoslp syz-executor 38320 522448 29743 0 3 0x4000080 ttyout syz-executor 38320 367496 29743 0 3 0x4000080 ttyout syz-executor 38320 452824 29743 0 3 0x4000080 fsleep syz-executor 61527 30054 78492 0 3 0x80 nanoslp syz-executor 61527 414392 78492 0 3 0x4000080 lockf syz-executor 61527 198181 78492 0 3 0x4000080 fsleep syz-executor 16068 247210 0 0 3 0x14280 nfsidl nfsio 58117 227424 0 0 3 0x14280 nfsidl nfsio 51839 151645 0 0 3 0x14280 nfsidl nfsio 66638 468055 0 0 3 0x14280 nfsidl nfsio 26368 228122 0 0 3 0x14280 nfsidl nfsio 62117 59546 0 0 3 0x14280 nfsidl nfsio 56708 98615 0 0 3 0x14280 nfsidl nfsio 32508 288683 0 0 3 0x14280 nfsidl nfsio 45920 213304 0 0 3 0x14280 nfsidl nfsio 44091 57320 0 0 3 0x14280 nfsidl nfsio 18998 310415 0 0 3 0x14280 nfsidl nfsio 39092 315230 0 0 3 0x14280 nfsidl nfsio 24984 341482 0 0 3 0x14280 nfsidl nfsio 50007 482812 0 0 3 0x14280 nfsidl nfsio 42045 29248 0 0 3 0x14280 nfsidl nfsio 93530 270094 0 0 3 0x14280 nfsidl nfsio 99322 506219 0 0 3 0x14280 nfsidl nfsio 96047 203297 0 0 3 0x14280 nfsidl nfsio 38401 466534 0 0 3 0x14280 nfsidl nfsio 18073 481523 0 0 3 0x14280 nfsidl nfsio 31864 85629 1 0 3 0x100083 ttyin getty 56885 338561 63699 0 3 0x82 nanoslp syz-executor 46681 344944 63699 0 2 0xc82 syz-executor *53081 275782 63699 0 7 0x2 syz-executor 29743 405480 63699 0 3 0x82 nanoslp syz-executor 78492 158338 63699 0 3 0x82 nanoslp syz-executor 91430 266706 63699 0 2 0xc82 syz-executor 63699 448128 1 0 3 0x82 wait syz-executor 19325 522463 1 73 3 0x1100090 kqread syslogd 64229 132942 0 0 3 0x14200 bored smr 37895 91356 0 0 2 0x14200 zerothread 6405 188425 0 0 3 0x14200 aiodoned aiodoned 31802 474058 0 0 3 0x14200 syncer update 38191 76181 0 0 3 0x14200 cleaner cleaner 86899 210312 0 0 3 0x14200 reaper reaper 31843 208442 0 0 3 0x14200 pgdaemon pagedaemon 64576 404194 0 0 3 0x14200 bored viomb 5598 35700 0 0 3 0x40014200 acpi0 acpi0 21687 265993 0 0 3 0x14200 bored softnet0 77593 204215 0 0 3 0x14200 bored systqmp 94203 38841 0 0 3 0x14200 bored systq 85379 17570 0 0 3 0x40014200 tmoslp softclock 77349 328666 0 0 3 0x40014200 idle0 1 264483 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11045 12246K 12507K 166960K 12314 0 pcb 17 12K 12K 166960K 43 0 rtable 237 6K 7K 166960K 358 0 pf 33 13K 14K 166960K 48 0 ifaddr 43 7K 7K 166960K 51 0 ifgroup 52 2K 2K 166960K 63 0 sysctl 2 1K 9K 166960K 8 0 counters 34 17K 18K 166960K 38 0 ioctlops 0 0K 4K 166960K 114 0 iov 0 0K 12K 166960K 16 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1305 82K 82K 166960K 1459 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 4 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 46 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 15 53K 236K 166960K 274 0 proc 20 25K 83K 166960K 533 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 69 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 2 0 mrt 0 0K 0K 166960K 4 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 73 334K 334K 166960K 73 0 exec 0 0K 1K 166960K 384 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 141 83K 163K 166960K 3946 0 UVM aobj 9 2K 2K 166960K 9 0 pinsyscall 19 38K 96K 166960K 1371 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 11 0 NDP 12 0K 2K 166960K 32 0 temp 42 9113K 9123K 166960K 11230 0 kqueue 4 6K 31K 166960K 56 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 45 0 45 2 1 1 1 0 8 1 rtentry 136 111 0 1 4 0 4 4 0 8 0 unpcb 144 226 0 218 3 2 1 3 0 8 0 syncache 336 4 0 4 1 1 0 1 0 8 0 tcpcb 736 70 0 66 4 3 1 4 0 8 0 arp 96 18 0 0 1 0 1 1 0 8 0 ipq 40 3 0 0 1 0 1 1 0 8 0 ipqe 40 3 0 0 1 0 1 1 0 8 0 inpcb 328 163 0 157 3 2 1 3 0 8 0 nd6 112 24 0 0 1 0 1 1 0 8 0 pkpcb 40 1 0 1 1 1 0 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1072 4 0 3 1 0 1 1 0 8 0 pfstscr 40 2 0 0 1 0 1 1 0 8 0 pfstitem 24 2 0 0 1 0 1 1 0 8 0 pfstkey 128 2 0 0 1 0 1 1 0 8 0 pfstate 384 1 0 0 1 0 1 1 0 8 0 pfrule 1360 2 0 2 2 1 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 452 0 0 29 0 29 29 0 8 0 art_table 40 453 0 0 5 0 5 5 0 8 0 art_node 32 111 0 11 1 0 1 1 0 8 0 sysvmsgpl 40 6 0 1 1 0 1 1 0 8 0 semupl 112 2 0 2 1 1 0 1 0 8 0 semapl 72 43 0 33 1 0 1 1 0 8 0 shmpl 112 6 0 0 1 0 1 1 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 1789 0 330 92 0 92 92 0 8 0 ffsino 256 1791 0 332 92 0 92 92 0 8 0 nchpl 144 2157 0 459 64 0 64 64 0 8 0 vnodes 216 1926 0 0 107 0 107 107 0 8 0 namei 1024 6665 0 6664 2 1 1 2 0 8 0 kstatmem 264 33 0 8 2 0 2 2 0 8 0 scsiplug 72 1 0 1 1 1 0 1 0 8 0 scxspl 216 7194 0 7194 4 3 1 4 1 8 1 plimitpl 152 78 0 66 1 0 1 1 0 8 0 sigapl 424 574 0 523 7 0 7 7 0 8 0 knotepl 120 6813 0 6784 10 1 9 9 0 8 7 kqueuepl 184 120 0 114 4 3 1 4 0 8 0 pipepl 304 199 0 172 3 0 3 3 0 8 0 fdescpl 448 541 0 523 5 1 4 5 0 8 0 filepl 120 2383 0 2189 11 3 8 11 0 8 0 lockfpl 104 71 0 67 1 0 1 1 0 8 0 lockfspl 48 32 0 29 1 0 1 1 0 8 0 sessionpl 144 61 0 57 1 0 1 1 0 8 0 pgrppl 48 70 0 58 1 0 1 1 0 8 0 ucredpl 104 223 0 217 1 0 1 1 0 8 0 zombiepl 144 525 0 523 1 0 1 1 0 8 0 processpl 1152 574 0 523 4 0 4 4 0 8 0 procpl 664 749 0 687 7 0 7 7 0 8 1 sockpl 552 440 0 426 7 5 2 7 0 8 0 mcl64k 65536 18 0 18 2 1 1 1 0 8 1 mcl16k 16384 6 0 6 1 1 0 1 0 8 0 mcl8k 8192 7 0 7 1 1 0 1 0 8 0 mcl4k 4096 2664 0 2613 14 7 7 14 0 8 0 mcl2k 2048 200 0 197 1 0 1 1 0 8 0 mextrefs 64 89 0 88 2 1 1 1 0 8 0 mtagpl 96 6 0 5 2 1 1 1 0 8 0 mbufpl 256 5448 0 5314 12 1 11 11 0 8 0 bufpl 272 2692 0 102 173 0 173 173 0 8 0 anonpl 24 94511 0 92749 21 3 18 21 0 187 0 amapchunkpl 152 11347 0 10993 22 4 18 21 0 158 1 amappl16 200 1537 0 1517 6 3 3 5 0 8 1 amappl15 192 11 0 11 1 1 0 1 0 8 0 amappl14 184 412 0 412 1 1 0 1 0 8 0 amappl13 176 118 0 116 1 0 1 1 0 8 0 amappl12 168 780 0 763 2 0 2 2 0 8 0 amappl11 160 5 0 5 1 1 0 1 0 8 0 amappl10 152 57 0 55 1 0 1 1 0 8 0 amappl9 144 273 0 273 1 1 0 1 0 8 0 amappl8 136 93 0 93 1 1 0 1 0 8 0 amappl7 128 152 0 148 1 0 1 1 0 8 0 amappl6 120 151 0 150 1 0 1 1 0 8 0 amappl5 112 180 0 179 1 0 1 1 0 8 0 amappl4 104 293 0 286 1 0 1 1 0 8 0 amappl3 96 2222 0 2147 3 0 3 3 0 8 0 amappl2 88 549 0 533 2 0 2 2 0 8 0 amappl1 80 10767 0 10618 13 2 11 13 0 8 1 amappl 88 3230 0 3110 4 0 4 4 0 92 0 uvmvnodes 80 100 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 19 0 18 1 0 1 1 0 8 0 aobjpl 72 8 0 0 1 0 1 1 0 8 0 uaddrrnd 24 541 0 523 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 541 0 523 1 0 1 1 0 8 0 vmmpekpl 168 6475 0 6440 2 0 2 2 0 8 0 vmmpepl 168 43360 0 42514 80 33 47 80 0 357 0 vmsppl 368 540 0 523 4 1 3 4 0 8 0 rwobjpl 40 15146 0 14673 11 0 11 11 0 8 0 pdppl 4096 1088 0 1046 102 54 48 82 0 8 6 pvpl 32 244869 0 240775 74 27 47 74 0 265 0 pmappl 216 540 0 523 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 544 0 75 15 0 15 15 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346b2d8) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(fffffa806d647d00,41ed,fffffa8007ffd750,ffff80002a848e88) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a848ef0) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(fffffa806d59b470,ffff80002a849050,ffff80002a849080,ffff80002a848f80) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a7367d0,ffffff9c,6f9847ab86b0,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 syscall(ffff80002a8491f0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a8491f0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x6f9847ab8750, count: -8 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346b2d8) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(fffffa806d647d00,41ed,fffffa8007ffd750,ffff80002a848e88) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a848ef0) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(fffffa806d59b470,ffff80002a849050,ffff80002a849080,ffff80002a848f80) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a7367d0,ffffff9c,6f9847ab86b0,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 syscall(ffff80002a8491f0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a8491f0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x6f9847ab8750, count: -8 ddb>