kernel: protection fault trap, code=0 Stopped at pfi_ifhead_RB_REMOVE+0x50: movq 0x10(%r12),%rbx ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic the kernel did not panic ddb{1}> trace pfi_ifhead_RB_REMOVE(ffffffff82908ad8,ffff800000be7f00) at pfi_ifhead_RB_REMOVE+0x50 sys/net/pf_if.c:80 pfi_detach_ifgroup(ffff800000af5880) at pfi_detach_ifgroup+0x11b pfi_kif_unref sys/net/pf_if.c:211 [inline] pfi_detach_ifgroup(ffff800000af5880) at pfi_detach_ifgroup+0x11b sys/net/pf_if.c:304 if_delgroup(ffff800000b11800,ffff800000af5880) at if_delgroup+0x193 sys/net/if.c:2711 if_detach(ffff800000b11800) at if_detach+0x1cb sys/net/if.c:1049 tun_clone_destroy(ffff800000b11800) at tun_clone_destroy+0x1e1 sys/net/if_tun.c:325 if_clone_destroy(ffff8000222d9600) at if_clone_destroy+0x136 sys/net/if.c:1212 tun_dev_close(5d01,7) at tun_dev_close+0x140 sys/net/if_tun.c:479 spec_close(ffff8000222d96d0) at spec_close+0x311 sys/kern/spec_vnops.c:560 VOP_CLOSE(fffffd806e371088,7,fffffd807f7b7960,ffff80002123c540) at VOP_CLOSE+0xeb sys/kern/vfs_vops.c:177 vn_closefile(fffffd806cb4a860,ffff80002123c540) at vn_closefile+0xd7 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffffd806cb4a860,ffff80002123c540) at vn_closefile+0xd7 sys/kern/vfs_vnops.c:614 fdrop(fffffd806cb4a860,ffff80002123c540) at fdrop+0xc2 sys/kern/kern_descrip.c:1279 closef(fffffd806cb4a860,ffff80002123c540) at closef+0x11c sys/kern/kern_descrip.c:1263 fdfree(ffff80002123c540) at fdfree+0xf4 sys/kern/kern_descrip.c:1195 exit1(ffff80002123c540,0,19,1) at exit1+0x335 sys/kern/kern_exit.c:200 postsig(ffff80002123c540,19) at postsig+0x59c sigexit sys/kern/kern_sig.c:1494 [inline] postsig(ffff80002123c540,19) at postsig+0x59c sys/kern/kern_sig.c:1423 userret(ffff80002123c540) at userret+0x189 sys/kern/kern_sig.c:1914 syscall(ffff8000222d9b50) at syscall+0x55c mi_syscall_return sys/sys/syscall_mi.h:129 [inline] syscall(ffff8000222d9b50) at syscall+0x55c sys/arch/amd64/amd64/trap.c:612 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffd2690, count: -18 ddb{1}> show registers rdi 0xffffffff82908ad8 pfi_ifs rsi 0xffff800000be7f00 rbp 0xffff8000222d9460 rbx 0xdeaf4152deaf4152 rdx 0 rcx 0xffff800000b4f780 rax 0xffff800000be7f10 r8 0xf8 r9 0x8080808080808080 r10 0x9e8acba2cac4379d r11 0x6e37cc025a435fc5 r12 0xdeaf4152deaf4152 r13 0xffff800000afaee0 r14 0xffff800000be7f00 r15 0xffffffff82908ad8 pfi_ifs rip 0xffffffff8149d7f0 pfi_ifhead_RB_REMOVE+0x50 cs 0x8 rflags 0x10282 __ALIGN_SIZE+0xf282 rsp 0xffff8000222d9400 ss 0x10 pfi_ifhead_RB_REMOVE+0x50: movq 0x10(%r12),%rbx ddb{1}> show proc PROC (syz-executor.1) pid=226443 stat=onproc flags process=a proc=2000 pri=32, usrpri=77, nice=20 forw=0xffffffffffffffff, list=0xffff8000211c2a88,0xffff80002123ca90 process=0xffff800021235960 user=0xffff8000222d4000, vmspace=0xfffffd80084968a0 estcpu=36, cpticks=2, pctcpu=0.28 user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 51510 34407 0 0 3 0x14200 acct acct 37020 359963 39730 0 3 0x82 piperd syz-executor.0 18624 458255 0 0 3 0x14280 nfsidl nfsio 91111 427360 0 0 3 0x14280 nfsidl nfsio 20349 157261 0 0 3 0x14280 nfsidl nfsio 77550 422868 0 0 3 0x14280 nfsidl nfsio 4290 195923 0 0 3 0x14280 nfsidl nfsio 72820 331224 0 0 3 0x14280 nfsidl nfsio 1333 247685 0 0 3 0x14280 nfsidl nfsio 77506 468897 0 0 3 0x14280 nfsidl nfsio 83950 31722 0 0 3 0x14280 nfsidl nfsio 85651 481986 0 0 3 0x14280 nfsidl nfsio 38800 362059 0 0 3 0x14280 nfsidl nfsio 47951 454283 0 0 3 0x14280 nfsidl nfsio 15344 76987 0 0 3 0x14280 nfsidl nfsio 55861 420815 0 0 3 0x14280 nfsidl nfsio 42342 76891 0 0 3 0x14280 nfsidl nfsio 29244 444376 0 0 3 0x14280 nfsidl nfsio 16569 449978 0 0 3 0x14280 nfsidl nfsio 95288 128501 0 0 3 0x14280 nfsidl nfsio 53834 226586 0 0 3 0x14280 nfsidl nfsio 87677 483411 0 0 3 0x14280 nfsidl nfsio 55140 370581 0 0 3 0x14200 bored sosplice 39730 95045 78991 0 3 0x82 thrsleep syz-fuzzer 39730 182468 78991 0 3 0x4000082 nanoslp syz-fuzzer 39730 106461 78991 0 3 0x4000082 thrsleep syz-fuzzer 39730 66766 78991 0 3 0x4000082 thrsleep syz-fuzzer 39730 93203 78991 0 3 0x4000082 kqread syz-fuzzer 39730 495797 78991 0 3 0x4000082 thrsleep syz-fuzzer 39730 505981 78991 0 3 0x4000082 thrsleep syz-fuzzer 39730 83242 78991 0 3 0x4000082 thrsleep syz-fuzzer 78991 518702 34236 0 3 0x10008a sigsusp ksh 34236 244381 60258 0 3 0x92 select sshd 42615 227716 1 0 3 0x100083 ttyin getty 60258 299375 1 0 3 0x80 select sshd 25252 195686 17494 74 3 0x100092 bpf pflogd 17494 229048 1 0 3 0x80 netio pflogd 43797 335810 38260 73 3 0x100090 kqread syslogd 38260 417693 1 0 3 0x100082 netio syslogd 60809 513676 1 77 7 0x100090 dhclient 92246 259152 1 0 3 0x80 poll dhclient 71051 509263 0 0 3 0x14200 bored smr 25163 118577 0 0 3 0x14200 pgzero zerothread 44471 363509 0 0 3 0x14200 aiodoned aiodoned 72828 194072 0 0 3 0x14200 syncer update 77412 359440 0 0 3 0x14200 cleaner cleaner 69314 395328 0 0 3 0x14200 reaper reaper 22621 367324 0 0 3 0x14200 pgdaemon pagedaemon 59492 382924 0 0 3 0x14200 bored crynlk 11998 8242 0 0 3 0x14200 bored crypto 7865 225967 0 0 3 0x14200 bored viomb 96714 317254 0 0 3 0x40014200 acpi0 acpi0 40316 121599 0 0 3 0x40014200 idle1 75574 271267 0 0 3 0x14200 bored softnet 7692 326375 0 0 2 0x14200 systqmp 62531 342260 0 0 3 0x14200 bored systq 71298 2220 0 0 3 0x40014200 bored softclock 96450 85671 0 0 3 0x40014200 idle0 1 263844 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 9546 6457K 7103K 78643K 15898 0 pcb 13 8K 8K 78643K 260 0 rtable 89 4K 4K 78643K 644 0 ifaddr 78 15K 16K 78643K 250 0 sysctl 3 1K 1K 78643K 3 0 counters 44 34K 34K 78643K 116 0 ioctlops 0 0K 4K 78643K 1578 0 iov 0 0K 24K 78643K 177 0 mount 1 1K 1K 78643K 1 0 vnodes 1218 77K 77K 78643K 2925 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 9K 78643K 48 0 VM map 2 1K 1K 78643K 2 0 sem 12 0K 0K 78643K 228 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1697 195K 286K 78643K 12598 0 file desc 4 9K 25K 78643K 5504 0 sigio 0 0K 0K 78643K 43 0 proc 63 63K 95K 78643K 746 0 subproc 23 1K 2K 78643K 85 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 235 0 in_multi 22 1K 2K 78643K 200 0 ether_multi 1 0K 0K 78643K 47 0 mrt 0 0K 0K 78643K 4 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 61 281K 281K 78643K 61 0 exec 0 0K 2K 78643K 587 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 7 26K 26K 78643K 7 0 UVM amap 250 357K 365K 78643K 13282 0 UVM aobj 65 7K 7K 78643K 113 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 1K 78643K 208 0 NDP 14 0K 0K 78643K 60 0 temp 144 3985K 4053K 78643K 36213 0 kqueue 3 4K 12K 78643K 193 0 SYN cache 2 16K 16K 78643K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 12 0 8 1 0 1 1 0 8 0 plcache 128 20 0 0 1 0 1 1 0 8 0 rtpcb 120 118 0 116 1 0 1 1 0 8 0 rtentry 112 79 0 46 2 0 2 2 0 8 0 unpcb 120 980 0 966 2 1 1 2 0 8 0 syncache 296 38 0 38 3 3 0 1 0 8 0 tcpqe 32 66 0 66 4 4 0 1 0 8 0 tcpcb 736 640 0 603 18 14 4 4 0 8 0 inpcb 296 1756 0 1749 7 5 2 2 0 8 1 nd6 48 16 0 13 1 0 1 1 0 8 0 pkpcb 40 14 0 14 2 1 1 1 0 8 1 kcovpl 48 5 0 4 1 0 1 1 0 8 0 ppxss 1128 12 0 12 2 2 0 1 0 8 0 pffrag 232 2 0 1 2 1 1 1 0 482 0 pffrnode 88 2 0 1 2 1 1 1 0 8 0 pffrent 40 12 0 11 3 2 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfrktable 1344 1 0 0 1 0 1 1 0 8 0 pfstitem 24 80 0 67 1 0 1 1 0 8 0 pfstkey 112 80 0 67 2 0 2 2 0 8 0 pfstate 328 80 0 67 4 2 2 4 0 8 0 pfrule 1360 31 0 21 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 328 0 137 13 0 13 13 0 8 0 art_table 32 329 0 137 2 0 2 2 0 8 0 art_node 16 78 0 40 1 0 1 1 0 8 0 sysvmsgpl 40 16 0 11 2 1 1 1 0 8 0 semapl 112 226 0 216 1 0 1 1 0 8 0 shmpl 112 110 0 48 2 0 2 2 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 8118 0 6709 90 1 89 89 0 8 0 ffsino 272 8118 0 6709 95 0 95 95 0 8 0 nchpl 144 14433 0 12840 60 0 60 60 0 8 0 uvmvnodes 72 5926 0 0 108 0 108 108 0 8 0 vnodes 224 5926 0 0 349 0 349 349 0 8 0 namei 1024 36265 0 36265 2 1 1 1 0 8 1 percpumem 16 69 0 36 1 0 1 1 0 8 0 vcpupl 1984 25 0 0 4 0 4 4 0 8 0 vmpool 560 32 0 7 2 0 2 2 0 8 0 scsiplug 72 7 0 7 1 1 0 1 0 8 0 scxspl 216 46136 0 46136 12 11 1 8 0 8 1 plimitpl 152 257 0 249 1 0 1 1 0 8 0 sigapl 424 5733 0 5680 7 0 7 7 0 8 0 futexpl 56 35142 0 35142 2 1 1 1 0 8 1 knotepl 112 318 0 300 1 0 1 1 0 8 0 kqueuepl 168 2583 0 2576 1 0 1 1 0 8 0 pipepl 336 228 0 218 7 5 2 2 0 8 1 fdescpl 496 5695 0 5680 3 0 3 3 0 8 0 filepl 152 17454 0 17363 6 1 5 5 0 8 1 lockfpl 104 467 0 466 1 0 1 1 0 8 0 lockfspl 48 134 0 133 1 0 1 1 0 8 0 sessionpl 144 21 0 10 1 0 1 1 0 8 0 pgrppl 48 42 0 31 1 0 1 1 0 8 0 ucredpl 96 2613 0 2604 1 0 1 1 0 8 0 zombiepl 144 5681 0 5680 2 1 1 1 0 8 0 processpl 1080 5733 0 5680 4 0 4 4 0 8 0 procpl 672 12317 0 12257 6 0 6 6 0 8 0 sosppl 168 27 0 27 4 3 1 1 0 8 1 sockpl 432 2868 0 2845 8 4 4 5 0 8 0 mcl64k 65536 17 0 0 3 0 3 3 0 8 0 mcl12k 12288 12 0 0 2 0 2 2 0 8 0 mcl9k 9216 17 0 0 2 0 2 2 0 8 0 mcl8k 8192 7 0 0 1 0 1 1 0 8 0 mcl4k 4096 14 0 0 2 0 2 2 0 8 0 mcl2k2 2112 3 0 0 1 0 1 1 0 8 0 mcl2k 2048 257 0 0 19 1 18 19 0 8 0 mtagpl 96 310 0 0 7 0 7 7 0 8 0 mbufpl 256 916 0 0 49 0 49 49 0 8 0 bufpl 280 12555 0 6308 447 0 447 447 0 8 0 anonpl 24 402879 0 395363 85 36 49 70 0 186 0 amapchunkpl 152 20768 0 20558 16 7 9 12 0 158 0 amappl16 200 18618 0 18328 33 17 16 28 0 8 0 amappl15 192 2 0 1 1 0 1 1 0 8 0 amappl14 184 28 0 21 1 0 1 1 0 8 0 amappl13 176 610 0 607 1 0 1 1 0 8 0 amappl12 168 2731 0 2730 2 1 1 1 0 8 0 amappl11 160 68 0 49 1 0 1 1 0 8 0 amappl10 152 348 0 344 1 0 1 1 0 8 0 amappl9 144 778 0 777 2 1 1 1 0 8 0 amappl8 136 275 0 193 3 0 3 3 0 8 0 amappl7 128 1038 0 1031 1 0 1 1 0 8 0 amappl6 120 418 0 405 1 0 1 1 0 8 0 amappl5 112 3643 0 3627 1 0 1 1 0 8 0 amappl4 104 3024 0 2999 1 0 1 1 0 8 0 amappl3 96 825 0 816 1 0 1 1 0 8 0 amappl2 88 47303 0 47219 4 1 3 3 0 8 0 amappl1 80 164100 0 163649 26 14 12 21 0 8 0 amappl 88 12688 0 12583 3 0 3 3 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 64 112 0 48 2 0 2 2 0 8 0 uaddrrnd 24 5727 0 5687 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 5727 0 5687 1 0 1 1 0 8 0 vmmpekpl 168 32440 0 32405 2 0 2 2 0 8 0 vmmpepl 168 711411 0 709886 115 36 79 85 0 357 1 vmsppl 368 5726 0 5687 4 0 4 4 0 8 0 rwobjpl 56 148314 0 147242 34 17 17 19 0 8 1 pdppl 4096 11461 0 11399 82 16 66 66 0 8 4 pvpl 32 2061934 0 2051313 215 113 102 126 0 265 9 pmappl 232 5726 0 5687 4 1 3 3 0 8 0 extentpl 40 58 0 40 1 0 1 1 0 8 0 phpool 112 394 0 41 11 0 11 11 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x1a: addq $0x8,%rsp ddb{0}> trace x86_ipi_db(ffffffff826e8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:352 x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23 __mp_lock(ffffffff828be420) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline] __mp_lock(ffffffff828be420) at __mp_lock+0x122 sys/kern/kern_lock.c:147 __mp_acquire_count(ffffffff828be420,2) at __mp_acquire_count+0x4c sys/kern/kern_lock.c:227 mi_switch() at mi_switch+0x390 sys/kern/sched_bsd.c:433 sleep_finish(ffff8000212001c8,1) at sleep_finish+0x111 sys/kern/kern_synch.c:427 sleep_finish_all(ffff8000212001c8,1) at sleep_finish_all+0x32 sleep_finish_timeout sys/kern/kern_synch.c:457 [inline] sleep_finish_all(ffff8000212001c8,1) at sleep_finish_all+0x32 sys/kern/kern_synch.c:402 tsleep(ffffffff82936b50,118,ffffffff824257c7,41995d) at tsleep+0x1f2 sys/kern/kern_synch.c:163 doppoll(ffff8000211c3ce8,7f7ffffbc680,3,ffff800021200358,0,ffff800021200410) at doppoll+0x577 sys_poll(ffff8000211c3ce8,ffff8000212003c0,ffff800021200410) at sys_poll+0xa7 syscall(ffff800021200490) at syscall+0x4a1 mi_syscall sys/sys/syscall_mi.h:102 [inline] syscall(ffff800021200490) at syscall+0x4a1 sys/arch/amd64/amd64/trap.c:590 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffbc660, count: -13 ddb{0}> machine ddbcpu 1 Stopped at pfi_ifhead_RB_REMOVE+0x50: movq 0x10(%r12),%rbx ddb{1}> trace pfi_ifhead_RB_REMOVE(ffffffff82908ad8,ffff800000be7f00) at pfi_ifhead_RB_REMOVE+0x50 sys/net/pf_if.c:80 pfi_detach_ifgroup(ffff800000af5880) at pfi_detach_ifgroup+0x11b pfi_kif_unref sys/net/pf_if.c:211 [inline] pfi_detach_ifgroup(ffff800000af5880) at pfi_detach_ifgroup+0x11b sys/net/pf_if.c:304 if_delgroup(ffff800000b11800,ffff800000af5880) at if_delgroup+0x193 sys/net/if.c:2711 if_detach(ffff800000b11800) at if_detach+0x1cb sys/net/if.c:1049 tun_clone_destroy(ffff800000b11800) at tun_clone_destroy+0x1e1 sys/net/if_tun.c:325 if_clone_destroy(ffff8000222d9600) at if_clone_destroy+0x136 sys/net/if.c:1212 tun_dev_close(5d01,7) at tun_dev_close+0x140 sys/net/if_tun.c:479 spec_close(ffff8000222d96d0) at spec_close+0x311 sys/kern/spec_vnops.c:560 VOP_CLOSE(fffffd806e371088,7,fffffd807f7b7960,ffff80002123c540) at VOP_CLOSE+0xeb sys/kern/vfs_vops.c:177 vn_closefile(fffffd806cb4a860,ffff80002123c540) at vn_closefile+0xd7 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffffd806cb4a860,ffff80002123c540) at vn_closefile+0xd7 sys/kern/vfs_vnops.c:614 fdrop(fffffd806cb4a860,ffff80002123c540) at fdrop+0xc2 sys/kern/kern_descrip.c:1279 closef(fffffd806cb4a860,ffff80002123c540) at closef+0x11c sys/kern/kern_descrip.c:1263 fdfree(ffff80002123c540) at fdfree+0xf4 sys/kern/kern_descrip.c:1195 exit1(ffff80002123c540,0,19,1) at exit1+0x335 sys/kern/kern_exit.c:200 postsig(ffff80002123c540,19) at postsig+0x59c sigexit sys/kern/kern_sig.c:1494 [inline] postsig(ffff80002123c540,19) at postsig+0x59c sys/kern/kern_sig.c:1423 userret(ffff80002123c540) at userret+0x189 sys/kern/kern_sig.c:1914 syscall(ffff8000222d9b50) at syscall+0x55c mi_syscall_return sys/sys/syscall_mi.h:129 [inline] syscall(ffff8000222d9b50) at syscall+0x55c sys/arch/amd64/amd64/trap.c:612 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffd2690, count: -18