panic: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/main/kernel/sys/net/if_tun.c", line 319 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *231671 45407 0 0x2 0 0 ifconfig db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834891b0) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834c9cf1,ffffffff83407d21,13f,ffffffff834118f3) at __assert+0x29 sys/kern/subr_prf.c:-1 tun_clone_destroy(ffff80000160c800) at tun_clone_destroy+0x32d if_clone_destroy(ffff80002a805d10) at if_clone_destroy+0x1d5 sys/net/if.c:1480 sys_ioctl(ffff80002a86ea88,ffff80002a805ee0,ffff80002a805e30) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80002a805ee0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a805ee0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7585916a70b0, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/main/kernel/sys/net/if_tun.c", line 319 ddb> show kasan No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834891b0) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834c9cf1,ffffffff83407d21,13f,ffffffff834118f3) at __assert+0x29 sys/kern/subr_prf.c:-1 tun_clone_destroy(ffff80000160c800) at tun_clone_destroy+0x32d if_clone_destroy(ffff80002a805d10) at if_clone_destroy+0x1d5 sys/net/if.c:1480 sys_ioctl(ffff80002a86ea88,ffff80002a805ee0,ffff80002a805e30) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80002a805ee0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a805ee0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7585916a70b0, count: -8 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80002a805ba0 rbx 0 rdx 0 rcx 0 rax 0xffff80002a86ea88 r8 0x101010101010101 r9 0x8080808080808080 r10 0xe567165cf7292794 r11 0xed4076f982cc5df4 r12 0 r13 0xffffffff83999960 tap_cloner r14 0 r15 0x1 rip 0xffffffff8320a175 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a805b90 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (ifconfig) tid=231671 pid=45407 tcnt=1 stat=onproc flags process=2 proc=0 runpri=32, usrpri=75, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a86e7f0,0xffff80002a86ed30 process=0xffff80002a78c010 user=0xffff80002a800000, vmspace=0xfffff4807ef33458 estcpu=25, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 36052 129924 52515 0 3 0x2 0 clonelk ifconfig *45407 231671 47773 0 7 0x2 0 ifconfig 32889 330493 24567 0 2 0 0 syz-executor 32889 5468 24567 0 3 0 0x4000080 msgwait syz-executor 32889 435305 24567 0 3 0 0x4000080 msgwait syz-executor 32889 177000 24567 0 2 0 0x4000000 syz-executor 32889 128211 24567 0 2 0 0x4000000 syz-executor 32889 413104 24567 0 2 0 0x4000000 syz-executor 52515 239336 93388 0 3 0x100002 0x88 sigsusp sh 47773 8930 63888 0 3 0x100002 0x88 sigsusp sh 93388 377742 85284 0 3 0x2 0x80 wait syz-executor 30921 373008 2207 0 2 0 0xc80 syz-executor 30921 322302 2207 0 3 0 0x4000080 ttyout syz-executor 30921 131413 2207 0 3 0 0x4000080 ttyout syz-executor 30921 300188 2207 0 3 0 0x4000080 fsleep syz-executor 63888 411277 85284 0 3 0x2 0x80 wait syz-executor 24567 247691 85284 0 3 0x2 0x80 nanoslp syz-executor 2207 385004 85284 0 3 0x2 0x80 nanoslp syz-executor 85284 121444 72734 0 3 0x2 0x80 wait syz-executor 72734 379637 59560 0 3 0x100002 0x88 sigsusp ksh 59560 350942 10658 0 3 0x10 0x88 kqread sshd-session 10658 466525 34916 0 3 0x12 0x80 kqread sshd-session 2857 310549 1 0 3 0x100003 0x80 ttyin getty 34916 116777 1 0 3 0 0x88 kqread sshd 98312 29726 13998 73 3 0x1100010 0x80 kqread syslogd 13998 396177 1 0 3 0x100002 0x80 sbwait syslogd 2917 10594 1 0 3 0x100000 0x80 kqread resolvd 96188 35921 10176 77 2 0x100012 0 dhcpleased 82672 488191 10176 77 3 0x100012 0x80 kqread dhcpleased 10176 438907 1 0 3 0 0x80 kqread dhcpleased 75086 139218 0 0 3 0x14000 0x200 bored smr 78741 421284 0 0 2 0x14000 0x200 zerothread 95728 103818 0 0 3 0x14000 0x200 aiodoned aiodoned 96264 86448 0 0 3 0x14000 0x200 syncer update 16122 121508 0 0 3 0x14000 0x200 cleaner cleaner 30352 363158 0 0 3 0x14000 0x200 reaper reaper 7917 204934 0 0 3 0x14000 0x200 pgdaemon pagedaemon 58686 318049 0 0 3 0x14000 0x200 bored viomb 83062 208006 0 0 3 0x14000 0x40000200 acpi0 acpi0 50234 137556 0 0 3 0x14000 0x200 bored softnet0 93752 296250 0 0 3 0x14000 0x200 smrbar systqmp 23 465463 0 0 3 0x14000 0x200 bored systq 49340 92084 0 0 2 0x14000 0x40000200 softclock 64923 106070 0 0 3 0x14000 0x40000200 idle0 1 229138 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11032 12200K 12697K 166960K 12721 0 pcb 18 12K 12K 166960K 64 0 rtable 141 4K 7K 166960K 2332 0 pf 28 12K 17K 166960K 225 0 ifaddr 31 6K 8K 166960K 325 0 ifgroup 42 1K 2K 166960K 347 0 sysctl 4 1K 9K 166960K 9 0 counters 31 17K 18K 166960K 115 0 ioctlops 0 0K 4K 166960K 340 0 iov 0 0K 12K 166960K 6 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1329 84K 84K 166960K 2241 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 4 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 19 0 dirhash 15 2K 2K 166960K 18 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 16 57K 106K 166960K 1374 0 sigio 0 0K 0K 166960K 4 0 proc 74 75K 100K 166960K 2359 0 subproc 72 4K 4K 166960K 684 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 124 0 in_multi 53 3K 6K 166960K 820 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 23 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 55 254K 254K 166960K 55 0 exec 0 0K 1K 166960K 1241 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 195 160K 175K 166960K 10694 0 UVM aobj 11 2K 2K 166960K 11 0 pinsyscall 37 74K 90K 166960K 4179 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 8 0 NDP 17 1K 2K 166960K 232 0 temp 40 9111K 9182K 166960K 25807 0 kqueue 14 22K 29K 166960K 81 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 187 0 184 1 0 1 1 0 8 0 rtentry 136 831 0 771 4 0 4 4 0 8 0 unpcb 144 198 0 183 2 0 2 2 0 8 1 syncache 336 43 0 43 1 0 1 1 0 8 1 tcpqe 32 5 0 5 1 0 1 1 0 8 1 tcpcb 736 128 0 122 7 0 7 7 0 8 6 arp 96 148 0 136 1 0 1 1 0 8 0 inpcb 328 1140 0 1127 12 2 10 12 0 8 8 ip6q 80 1 0 1 1 0 1 1 0 8 1 ip6af 40 2 0 2 1 0 1 1 0 8 1 nd6 112 219 0 207 1 0 1 1 0 8 0 pkpcb 40 6 0 6 1 0 1 1 0 8 1 kcovpl 48 76 0 68 1 0 1 1 0 8 0 ppxss 1072 10 0 10 1 0 1 1 0 8 1 pppxif 1416 5 0 5 1 0 1 1 0 8 1 pfrktable 1344 3 0 3 1 0 1 1 0 8 1 pfanchor 1288 5 0 5 1 0 1 1 0 8 1 pftag 88 1 0 0 1 0 1 1 0 8 0 pfstitem 24 2 0 0 1 0 1 1 0 8 0 pfstkey 128 132 0 130 1 0 1 1 0 8 0 pfstate 384 66 0 65 1 0 1 1 0 8 0 pfrule 1360 12 0 12 1 0 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 3358 0 3071 32 6 26 32 0 8 5 art_table 40 3359 0 3071 6 0 6 6 0 8 2 art_node 32 831 0 768 1 0 1 1 0 8 0 semupl 112 3 0 3 1 0 1 1 0 8 1 semapl 72 17 0 7 1 0 1 1 0 8 0 shmpl 112 8 0 0 1 0 1 1 0 8 0 dirhash 1024 21 0 2 3 0 3 3 0 8 0 dino2pl 256 2122 0 496 102 0 102 102 0 8 0 ffsino 256 2122 0 496 102 0 102 102 0 8 0 nchpl 144 2605 0 649 73 0 73 73 0 8 0 rtmask 32 2 0 2 1 0 1 1 0 8 1 vnodes 216 2963 0 0 165 0 165 165 0 8 0 namei 1024 16885 0 16885 3 0 3 3 0 8 3 pfiaddrpl 120 1 0 1 1 0 1 1 0 8 1 kstatmem 264 173 0 154 2 0 2 2 0 8 0 scsiplug 72 3 0 3 1 0 1 1 0 8 1 scxspl 216 9858 0 9858 8 0 8 8 1 8 8 plimitpl 152 125 0 108 1 0 1 1 0 8 0 sigapl 424 1529 0 1488 6 0 6 6 0 8 1 knotepl 120 10840 0 10785 10 0 10 10 0 8 7 kqueuepl 184 104 0 94 1 0 1 1 0 8 0 pipepl 304 375 0 347 5 0 5 5 0 8 2 fdescpl 448 1516 0 1488 4 0 4 4 0 8 0 filepl 120 5888 0 5680 13 0 13 13 0 8 6 lockfpl 104 92 0 90 1 0 1 1 0 8 0 lockfspl 48 43 0 41 1 0 1 1 0 8 0 sessionpl 144 166 0 157 1 0 1 1 0 8 0 pgrppl 48 242 0 225 1 0 1 1 0 8 0 ucredpl 104 347 0 336 1 0 1 1 0 8 0 zombiepl 144 1492 0 1488 1 0 1 1 0 8 0 processpl 1152 1529 0 1488 4 0 4 4 0 8 0 procpl 664 2051 0 2002 6 0 6 6 0 8 1 sockpl 552 1542 0 1511 12 1 11 12 0 8 8 mcl64k 65536 16 0 16 1 0 1 1 0 8 1 mcl16k 16384 5 0 5 1 0 1 1 0 8 1 mcl8k 8192 8 0 8 1 0 1 1 0 8 1 mcl4k 4096 2772 0 2715 14 0 14 14 0 8 5 mcl2k 2048 1486 0 1485 2 0 2 2 0 8 1 mextrefs 64 305 0 304 1 0 1 1 0 8 0 mtagpl 96 6 0 6 1 0 1 1 0 8 1 mbufpl 256 12099 0 12012 15 0 15 15 0 8 5 bufpl 272 3877 0 103 252 0 252 252 0 8 0 anonpl 24 177292 0 174331 44 0 44 44 0 187 19 amapchunkpl 152 29192 0 28822 32 0 32 32 0 158 15 amappl16 200 2082 0 2073 14 5 9 14 0 8 8 amappl15 192 1 0 1 1 0 1 1 0 8 1 amappl14 184 1197 0 1194 1 0 1 1 0 8 0 amappl13 176 245 0 235 1 0 1 1 0 8 0 amappl12 168 2017 0 1992 2 0 2 2 0 8 0 amappl11 160 10 0 10 1 0 1 1 0 8 1 amappl10 152 59 0 49 1 0 1 1 0 8 0 amappl9 144 269 0 269 1 0 1 1 0 8 1 amappl8 136 356 0 353 1 0 1 1 0 8 0 amappl7 128 270 0 259 1 0 1 1 0 8 0 amappl6 120 819 0 813 1 0 1 1 0 8 0 amappl5 112 91 0 82 1 0 1 1 0 8 0 amappl4 104 467 0 450 1 0 1 1 0 8 0 amappl3 96 5427 0 5355 3 0 3 3 0 8 1 amappl2 88 1389 0 1322 2 0 2 2 0 8 0 amappl1 80 19649 0 19097 13 0 13 13 0 8 1 amappl 88 8838 0 8708 5 0 5 5 0 92 1 uvmvnodes 80 103 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 0 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 0 1 1 0 8 1 dma128 128 254 0 254 1 0 1 1 0 8 1 dma64 64 6 0 6 1 0 1 1 0 8 1 dma32 32 7 0 7 1 0 1 1 0 8 1 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 10 0 0 1 0 1 1 0 8 0 uaddrrnd 24 1516 0 1488 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1516 0 1488 1 0 1 1 0 8 0 vmmpekpl 168 12999 0 12945 3 0 3 3 0 8 0 vmmpepl 168 106080 0 104489 87 0 87 87 0 357 11 vmsppl 368 1515 0 1488 4 0 4 4 0 8 1 rwobjpl 40 31401 0 30460 12 0 12 12 0 8 0 pdppl 4096 3038 0 2976 140 70 70 76 0 8 8 pvpl 32 544642 0 537069 109 0 109 109 0 265 34 pmappl 216 1515 0 1488 2 0 2 2 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 689 0 76 18 0 18 18 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834891b0) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834c9cf1,ffffffff83407d21,13f,ffffffff834118f3) at __assert+0x29 sys/kern/subr_prf.c:-1 tun_clone_destroy(ffff80000160c800) at tun_clone_destroy+0x32d if_clone_destroy(ffff80002a805d10) at if_clone_destroy+0x1d5 sys/net/if.c:1480 sys_ioctl(ffff80002a86ea88,ffff80002a805ee0,ffff80002a805e30) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80002a805ee0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a805ee0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7585916a70b0, count: -8 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834891b0) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834c9cf1,ffffffff83407d21,13f,ffffffff834118f3) at __assert+0x29 sys/kern/subr_prf.c:-1 tun_clone_destroy(ffff80000160c800) at tun_clone_destroy+0x32d if_clone_destroy(ffff80002a805d10) at if_clone_destroy+0x1d5 sys/net/if.c:1480 sys_ioctl(ffff80002a86ea88,ffff80002a805ee0,ffff80002a805e30) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80002a805ee0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a805ee0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7585916a70b0, count: -8