panic: kernel diagnostic assertion "pg->wire_count != 0" failed: file "/syzkaller/managers/setuid/kernel/sys/uvm/uvm_page.c", line 1207 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 346087 97408 32767 0x10 0 1 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834cf5e4) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8350e887,ffffffff83464c01,4b7,ffffffff83464c36) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff48004c00d10) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff4806d1933f0,9c230dac000,9c2311ab000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff4806d1933f0,fffff4806d0b1358,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff4806d1933f0) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff4806d1933f0) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80003c3ea558,0,0,1) at exit1+0x71b sys/kern/kern_exit.c:260 sys_exit(ffff80003c3ea558,ffff80002a3b86c0,ffff80002a3b8610) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a3b86c0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a3b86c0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x72421a72d1d0, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: kernel diagnostic assertion "pg->wire_count != 0" failed: file "/syzkaller/managers/setuid/kernel/sys/uvm/uvm_page.c", line 1207 ddb{0}> show kasan No such command ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834cf5e4) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8350e887,ffffffff83464c01,4b7,ffffffff83464c36) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff48004c00d10) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff4806d1933f0,9c230dac000,9c2311ab000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff4806d1933f0,fffff4806d0b1358,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff4806d1933f0) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff4806d1933f0) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80003c3ea558,0,0,1) at exit1+0x71b sys/kern/kern_exit.c:260 sys_exit(ffff80003c3ea558,ffff80002a3b86c0,ffff80002a3b8610) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a3b86c0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a3b86c0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x72421a72d1d0, count: -11 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80002a3b82e0 rbx 0xffffffff83967e0f cpu_info_full_primary+0x2e0f rdx 0 rcx 0xffff80003c3ea558 rax 0xffffffff83966ff0 cpu_info_full_primary+0x1ff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0xcc16eae70bf2cc00 r11 0xef4ad6f0c03b6f25 r12 0xffffffff83967c10 cpu_info_full_primary+0x2c10 r13 0 r14 0 r15 0x1 rip 0xffffffff828a9445 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a3b82d0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=502123 pid=14996 tcnt=0 stat=onproc flags process=1019 proc=2000 runpri=32, usrpri=75, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0xffff80003c3ea558 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff80003c3ea028,0xffff80002a23dcb0 process=0xffff800045feb568 user=0xffff80002a3b3000, vmspace=0xfffff4806d1933f0 estcpu=25, cpticks=7, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 57273 342938 97408 32767 2 0x10 0 syz-executor 57273 292786 97408 32767 3 0x10 0x4000080 fsleep syz-executor 57273 443850 97408 32767 3 0x10 0x4000080 fsleep syz-executor 21763 30606 81844 32767 2 0x10 0 syz-executor 21763 446690 81844 32767 3 0x10 0x4000080 fsleep syz-executor 21763 193501 81844 32767 2 0x10 0x4000000 syz-executor 15678 453688 22980 32767 2 0x10 0 syz-executor 15678 329575 22980 32767 3 0x10 0x4000080 ttyout syz-executor 15678 412314 22980 32767 2 0x10 0x4000000 syz-executor 39691 95286 84336 32767 2 0x10 0 syz-executor 39691 450735 84336 32767 3 0x10 0x4000080 lockf syz-executor 39691 266107 84336 32767 3 0x10 0x4000080 fsleep syz-executor 41386 377736 88766 32767 2 0x10 0 syz-executor 41386 219734 88766 32767 3 0x10 0x4000080 fsleep syz-executor 41386 21923 88766 32767 3 0x10 0x4000080 fsleep syz-executor 22980 487465 48260 32767 2 0x10 0xc80 syz-executor 48260 216051 3831 0 3 0x2 0x80 wait syz-executor 88766 454272 765 32767 2 0x10 0xc80 syz-executor 765 113923 3831 0 3 0x2 0x80 wait syz-executor 81844 288282 93884 32767 2 0x10 0 syz-executor 93884 468163 3831 0 3 0x2 0x80 wait syz-executor 84336 346004 55577 32767 2 0x10 0xc80 syz-executor 55577 214987 3831 0 3 0x2 0x80 wait syz-executor 37086 150766 25855 32767 2 0x10 0xc80 syz-executor 17234 286313 70692 32767 3 0x10 0x80 nanoslp syz-executor 97408 346087 96409 32767 7 0x10 0 syz-executor 25855 149769 3831 0 3 0x2 0x80 wait syz-executor 21516 302404 3831 0 3 0x2 0x80 wait syz-executor 70692 304869 3831 0 3 0x2 0x80 wait syz-executor 96409 412840 3831 0 3 0x2 0x80 wait syz-executor 3831 318163 27599 0 3 0x2 0x80 kqread syz-executor 27599 245019 19607 0 3 0x100002 0x88 sigsusp ksh 19607 211235 66600 0 3 0x10 0x88 kqread sshd-session 66600 402491 33751 0 3 0x12 0x80 kqread sshd-session 30314 107153 1 0 3 0x100003 0x80 ttyin getty 33751 222176 1 0 3 0 0x88 kqread sshd 10463 382166 18551 73 3 0x1100010 0x80 kqread syslogd 18551 122023 1 0 3 0x100002 0x80 sbwait syslogd 63178 286705 1 0 3 0x100000 0x80 kqread resolvd 4038 223866 79301 77 3 0x100012 0x80 kqread dhcpleased 94616 507516 79301 77 3 0x100012 0x80 kqread dhcpleased 79301 65577 1 0 3 0 0x80 kqread dhcpleased 51645 27591 0 0 3 0x14000 0x200 bored smr 71290 303950 0 0 3 0x14000 0x200 pgzero zerothread 45851 297759 0 0 3 0x14000 0x200 aiodoned aiodoned 94738 146675 0 0 3 0x14000 0x200 syncer update 50997 456637 0 0 3 0x14000 0x200 cleaner cleaner 72429 170333 0 0 3 0x14000 0x200 reaper reaper 95565 369831 0 0 3 0x14000 0x200 pgdaemon pagedaemon 92357 151818 0 0 3 0x14000 0x200 bored viomb 17261 819 0 0 3 0x14000 0x40000200 acpi0 acpi0 47345 475799 0 0 3 0x14000 0x40000200 idle1 85870 123790 0 0 3 0x14000 0x200 bored softnet1 81626 115896 0 0 3 0x14000 0x200 bored softnet0 91820 436979 0 0 3 0x14000 0x200 bored systqmp 22530 370298 0 0 3 0x14000 0x200 bored systq 73004 270291 0 0 3 0x14000 0x200 tmoslp softclockmp 18495 79677 0 0 3 0x14000 0x40000200 tmoslp softclock 24863 129638 0 0 3 0x14000 0x40000200 idle0 1 269813 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11085 12023K 12034K 166960K 12190 0 pcb 17 12K 12K 166960K 17 0 rtable 243 6K 7K 166960K 479 0 pf 31 16K 16K 166960K 39 0 ifaddr 42 7K 7K 166960K 60 0 ifgroup 50 2K 2K 166960K 66 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 78 0 ioctlops 0 0K 2K 166960K 33 0 iov 0 0K 8K 166960K 6 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1287 81K 81K 166960K 1399 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 11 0K 1K 166960K 13 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 24 89K 121K 166960K 305 0 sigio 0 0K 0K 166960K 1 0 proc 58 99K 147K 166960K 623 0 subproc 72 4K 4K 166960K 108 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 25 0 in_multi 99 6K 6K 166960K 146 0 ether_multi 1 0K 0K 166960K 2 0 mrt 0 0K 0K 166960K 5 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 271 1208K 1208K 166960K 271 0 exec 0 0K 1K 166960K 418 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 259 186K 209K 166960K 4238 0 UVM aobj 104 3K 3K 166960K 105 0 pinsyscall 45 90K 110K 166960K 1489 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 5 0 NDP 11 0K 2K 166960K 39 0 temp 35 9114K 9134K 166960K 4052 0 kqueue 13 20K 24K 166960K 38 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 54 0 50 1 0 1 1 0 8 0 rtentry 176 158 0 45 6 0 6 6 0 8 0 unpcb 144 83 0 68 1 0 1 1 0 8 0 syncache 336 8 0 8 1 0 1 1 0 8 1 tcpqe 32 1 0 1 1 0 1 1 0 8 1 tcpcb 736 58 0 53 2 0 2 2 0 8 1 arp 136 26 0 8 1 0 1 1 0 8 0 inpcb 328 178 0 169 2 0 2 2 0 8 0 nd6 152 39 0 12 2 0 2 2 0 8 0 kcovpl 48 12 0 4 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 657 0 176 31 0 31 31 0 8 0 art_table 40 658 0 176 6 0 6 6 0 8 0 art_node 32 158 0 55 1 0 1 1 0 8 0 semapl 72 10 0 1 1 0 1 1 0 8 0 shmpl 120 102 0 1 4 0 4 4 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 1707 0 232 93 0 93 93 0 8 0 ffsino 296 1707 0 232 114 0 114 114 0 8 0 nchpl 144 2039 0 334 64 0 64 64 0 8 0 vnodes 216 1824 0 0 102 0 102 102 0 8 0 namei 1024 7496 0 7496 4 1 3 3 0 8 3 percpumem 16 55 0 4 1 0 1 1 0 8 0 kstatmem 264 33 0 8 2 0 2 2 0 8 0 scxspl 216 7042 0 7042 4 3 1 3 1 8 1 plimitpl 152 65 0 39 2 0 2 2 0 8 0 sigapl 424 588 0 535 7 0 7 7 0 8 0 knotepl 120 106 0 0 4 0 4 4 0 8 0 kqueuepl 224 108 0 99 5 0 5 5 0 8 4 pipepl 344 141 0 114 3 0 3 3 0 8 0 fdescpl 528 572 0 536 3 0 3 3 0 8 0 filepl 160 2312 0 2099 13 0 13 13 0 8 0 lockfpl 104 37 0 33 1 0 1 1 0 8 0 lockfspl 48 17 0 14 1 0 1 1 0 8 0 sessionpl 144 36 0 19 1 0 1 1 0 8 0 pgrppl 48 48 0 23 1 0 1 1 0 8 0 ucredpl 104 398 0 379 1 0 1 1 0 8 0 zombiepl 144 538 0 535 1 0 1 1 0 8 0 processpl 1240 588 0 535 5 0 5 5 0 8 0 procpl 664 760 0 697 7 0 7 7 0 8 0 sosppl 176 4 0 4 1 0 1 1 0 8 1 sockpl 752 318 0 290 4 0 4 4 0 8 0 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl16k 16384 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 129 0 0 17 0 17 17 0 8 0 mcl2k 2048 32 0 0 4 0 4 4 0 8 0 mextrefs 64 30 0 0 1 0 1 1 0 8 0 mtagpl 96 1 0 0 1 0 1 1 0 8 0 mbufpl 256 240 0 0 15 0 15 15 0 8 0 bufpl 272 5012 0 112 327 0 327 327 0 8 0 anonpl 32 8085 0 0 66 0 66 66 0 247 0 amapchunkpl 152 12178 0 11345 35 0 35 35 0 158 0 amappl16 200 1961 0 1936 5 2 3 5 0 8 1 amappl15 192 6 0 6 1 1 0 1 0 8 0 amappl14 184 448 0 447 1 0 1 1 0 8 0 amappl13 176 125 0 114 1 0 1 1 0 8 0 amappl12 168 819 0 783 2 0 2 2 0 8 0 amappl11 160 4 0 4 1 1 0 1 0 8 0 amappl10 152 95 0 85 1 0 1 1 0 8 0 amappl9 144 274 0 274 1 1 0 1 0 8 0 amappl8 136 107 0 106 1 0 1 1 0 8 0 amappl7 128 143 0 131 1 0 1 1 0 8 0 amappl6 120 193 0 192 1 0 1 1 0 8 0 amappl5 112 96 0 89 1 0 1 1 0 8 0 amappl4 104 296 0 279 1 0 1 1 0 8 0 amappl3 96 2097 0 1988 5 1 4 4 0 8 1 amappl2 88 681 0 603 2 0 2 2 0 8 0 amappl1 80 11394 0 10825 15 0 15 15 0 8 2 amappl 88 3479 0 3285 5 0 5 5 0 92 0 uvmvnodes 80 100 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 104 0 1 2 0 2 2 0 8 0 uaddrrnd 24 572 0 535 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 572 0 535 1 0 1 1 0 8 0 vmmpekpl 168 6682 0 6632 3 0 3 3 0 8 0 vmmpepl 168 46167 0 44107 95 0 95 95 0 357 1 vmsppl 488 571 0 535 7 1 6 6 0 8 0 rwobjpl 80 16588 0 15535 24 0 24 24 0 8 1 pdppl 4096 1151 0 1070 105 20 85 95 0 8 4 pvpl 32 29336 0 0 237 0 237 237 0 265 0 pmappl 256 571 0 535 4 1 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 613 0 24 17 0 17 17 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834cf5e4) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8350e887,ffffffff83464c01,4b7,ffffffff83464c36) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff48004c00d10) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff4806d1933f0,9c230dac000,9c2311ab000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff4806d1933f0,fffff4806d0b1358,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff4806d1933f0) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff4806d1933f0) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80003c3ea558,0,0,1) at exit1+0x71b sys/kern/kern_exit.c:260 sys_exit(ffff80003c3ea558,ffff80002a3b86c0,ffff80002a3b8610) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a3b86c0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a3b86c0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x72421a72d1d0, count: -11 ddb{0}> machine ddbcpu 1