panic: kernel diagnostic assertion "atomic_load_int(&fdp->fd_nuserevents) == 0" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_descrip.c", line 1219 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 348700 89474 32767 0x10 0x4000000 1 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834b280d) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff834f439d,ffffffff834cb06c,4c3,ffffffff83485c4f) at __assert+0x29 sys/kern/subr_prf.c:-1 fdfree(ffff8000fffe67e8) at fdfree+0x349 exit1(ffff8000fffe67e8,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215 sys_exit(ffff8000fffe67e8,ffff80002a2cedd0,ffff80002a2ced20) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a2cedd0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a2cedd0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b16474862c0, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: kernel diagnostic assertion "atomic_load_int(&fdp->fd_nuserevents) == 0" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_descrip.c", line 1219 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834b280d) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff834f439d,ffffffff834cb06c,4c3,ffffffff83485c4f) at __assert+0x29 sys/kern/subr_prf.c:-1 fdfree(ffff8000fffe67e8) at fdfree+0x349 exit1(ffff8000fffe67e8,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215 sys_exit(ffff8000fffe67e8,ffff80002a2cedd0,ffff80002a2ced20) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a2cedd0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a2cedd0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b16474862c0, count: -8 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80002a2ceb10 rbx 0xffffffff8392ee07 cpu_info_full_primary+0x2e07 rdx 0 rcx 0xffff8000fffe67e8 rax 0xffffffff8392dff0 cpu_info_full_primary+0x1ff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x9506e89f0ec4f522 r11 0xccc682414735da88 r12 0xffffffff8392ec08 cpu_info_full_primary+0x2c08 r13 0 r14 0 r15 0x1 rip 0xffffffff833d1ff5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a2ceb00 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=301527 pid=74797 tcnt=0 stat=onproc flags process=1018 proc=2000 runpri=32, usrpri=75, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0xffff8000fffe67e8 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff8000fffe6d18,0xffff8000fffe74f0 process=0xffff80003abceb70 user=0xffff80002a2c9000, vmspace=0xfffffd806c70e7d0 estcpu=25, cpticks=6, pctcpu=0.0, user=0, sys=2, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 89474 452934 27380 32767 2 0xc90 syz-executor 89474 408865 27380 32767 3 0x4000090 fsleep syz-executor 89474 348700 27380 32767 7 0x4000010 syz-executor 34051 64364 69331 32767 3 0x90 piperd syz-executor 89157 335866 25150 32767 2 0x10 syz-executor 27380 199385 53648 32767 2 0xc90 syz-executor 48397 497413 72674 32767 2 0x10 syz-executor 94739 10671 86511 32767 3 0x90 piperd syz-executor 26121 15984 91661 32767 2 0xc90 syz-executor 79593 303799 62010 32767 3 0x90 piperd syz-executor 91661 456438 74884 0 3 0x82 wait syz-executor 62010 71534 74884 0 3 0x82 wait syz-executor 69331 87995 74884 0 3 0x82 wait syz-executor 25150 269211 74884 0 3 0x82 wait syz-executor 72674 39621 74884 0 3 0x82 wait syz-executor 86511 76554 74884 0 3 0x82 wait syz-executor 53648 136895 74884 0 3 0x82 wait syz-executor 74884 419469 69452 0 3 0x82 nanoslp syz-executor 69452 296568 72112 0 3 0x10008a sigsusp ksh 72112 348217 1442 0 3 0x98 kqread sshd-session 1442 488894 95087 0 3 0x92 kqread sshd-session 10859 134734 1 0 3 0x100083 ttyin getty 95087 291509 1 0 3 0x88 kqread sshd 20014 18560 23247 73 3 0x1100090 kqread syslogd 23247 389876 1 0 3 0x100082 sbwait syslogd 48221 161507 1 0 3 0x100080 kqread resolvd 64266 497641 68614 77 3 0x100092 kqread dhcpleased 33165 36856 68614 77 3 0x100092 kqread dhcpleased 68614 11974 1 0 3 0x80 kqread dhcpleased 98288 193893 0 0 3 0x14200 bored smr 9212 327535 0 0 2 0x14200 zerothread 28081 196617 0 0 3 0x14200 aiodoned aiodoned 97669 407021 0 0 3 0x14200 syncer update 13679 249889 0 0 3 0x14200 cleaner cleaner 10507 103520 0 0 3 0x14200 reaper reaper 5508 356803 0 0 3 0x14200 pgdaemon pagedaemon 96885 307299 0 0 3 0x14200 bored viomb 45660 374394 0 0 3 0x40014200 acpi0 acpi0 12824 227511 0 0 3 0x40014200 idle1 364 119342 0 0 3 0x14200 bored softnet1 4497 449389 0 0 3 0x14200 bored softnet0 27902 295510 0 0 3 0x14200 bored systqmp 46290 420321 0 0 3 0x14200 bored systq 73570 51067 0 0 3 0x14200 tmoslp softclockmp 43281 399043 0 0 3 0x40014200 tmoslp softclock 96718 262440 0 0 3 0x40014200 idle0 1 20158 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 89157 (syz-executor) thread 0xffff8000fffe6550 (335866) exclusive rrwlock inode r = 0 (0xfffffd806c824a00) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline] #4 ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:159 #5 ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232 #6 ffs_inode_alloc+0x279 sys/ufs/ffs/ffs_alloc.c:393 #7 ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 #8 VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 #9 domkdirat+0x179 sys/kern/vfs_syscalls.c:3149 #10 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #10 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #11 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffd806cd44550) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576 #5 vfs_lookup+0x12b sys/kern/vfs_lookup.c:431 #6 namei+0x7c5 sys/kern/vfs_lookup.c:250 #7 domkdirat+0x8b sys/kern/vfs_syscalls.c:3134 #8 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 #9 Xsyscall+0x128 Process 48397 (syz-executor) thread 0xffff8000fffef4d8 (497413) exclusive rrwlock inode r = 0 (0xfffffd8060a2bb30) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576 #5 vn_closefile+0x111 vn_close sys/kern/vfs_vnops.c:298 [inline] #5 vn_closefile+0x111 sys/kern/vfs_vnops.c:621 #6 fdrop+0x121 sys/kern/kern_descrip.c:1281 #7 closef+0x192 sys/kern/kern_descrip.c:1265 #8 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #8 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #9 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11049 12016K 12034K 166960K 12143 0 pcb 17 12K 12K 166960K 17 0 rtable 215 6K 7K 166960K 353 0 pf 29 16K 16K 166960K 31 0 ifaddr 38 6K 7K 166960K 44 0 ifgroup 46 2K 2K 166960K 50 0 sysctl 3 1K 9K 166960K 7 0 counters 68 36K 37K 166960K 70 0 ioctlops 0 0K 4K 166960K 32 0 iov 0 0K 16K 166960K 8 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1288 81K 81K 166960K 1434 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 4 0K 0K 166960K 4 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 17 61K 117K 166960K 267 0 proc 61 115K 147K 166960K 516 0 subproc 63 3K 4K 166960K 144 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 27 0 in_multi 88 6K 7K 166960K 107 0 ether_multi 1 0K 0K 166960K 2 0 mrt 0 0K 0K 166960K 5 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 55 254K 254K 166960K 55 0 exec 0 0K 1K 166960K 440 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 193 150K 167K 166960K 3766 0 UVM aobj 6 2K 2K 166960K 6 0 pinsyscall 39 78K 108K 166960K 1337 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 2 0 NDP 10 0K 2K 166960K 27 0 temp 35 9115K 9179K 166960K 4455 0 kqueue 16 22K 24K 166960K 44 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 43 0 40 1 0 1 1 0 8 0 rtentry 176 112 0 13 6 0 6 6 0 8 0 unpcb 144 154 0 139 4 0 4 4 0 8 3 syncache 336 5 0 5 1 0 1 1 0 8 1 tcpcb 736 87 0 83 4 0 4 4 0 8 3 arp 136 18 0 2 1 0 1 1 0 8 0 ipq 40 1 0 0 1 0 1 1 0 8 0 ipqe 40 1 0 0 1 0 1 1 0 8 0 inpcb 328 204 0 197 4 0 4 4 0 8 3 ip6q 72 1 0 0 1 0 1 1 0 8 0 ip6af 40 1 0 0 1 0 1 1 0 8 0 nd6 152 25 0 4 1 0 1 1 0 8 0 kcovpl 48 16 0 9 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 454 0 46 29 0 29 29 0 8 1 art_table 40 455 0 46 5 0 5 5 0 8 0 art_node 32 112 0 22 1 0 1 1 0 8 0 sysvmsgpl 40 5 0 3 1 0 1 1 0 8 0 semapl 72 2 0 0 1 0 1 1 0 8 0 shmpl 112 3 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1707 0 233 93 0 93 93 0 8 0 ffsino 296 1707 0 233 114 0 114 114 0 8 0 nchpl 144 2029 0 334 64 0 64 64 0 8 0 vnodes 216 1860 0 0 104 0 104 104 0 8 0 namei 1024 6206 0 6205 2 0 2 2 0 8 1 percpumem 16 50 0 1 1 0 1 1 0 8 0 kstatmem 264 25 0 2 2 0 2 2 0 8 0 scxspl 216 6756 0 6756 4 2 2 3 1 8 2 plimitpl 152 63 0 41 2 0 2 2 0 8 1 sigapl 424 540 0 494 7 0 7 7 0 8 1 knotepl 120 513 0 0 16 0 16 16 0 8 0 kqueuepl 224 44 0 34 1 0 1 1 0 8 0 pipepl 344 154 0 127 3 0 3 3 0 8 0 fdescpl 528 524 0 494 3 0 3 3 0 8 0 filepl 160 2137 0 1945 12 0 12 12 0 8 3 lockfpl 104 25 0 23 1 0 1 1 0 8 0 lockfspl 48 11 0 9 1 0 1 1 0 8 0 sessionpl 144 39 0 24 1 0 1 1 0 8 0 pgrppl 48 57 0 35 1 0 1 1 0 8 0 ucredpl 104 212 0 194 1 0 1 1 0 8 0 zombiepl 144 495 0 494 1 0 1 1 0 8 0 processpl 1232 540 0 494 5 0 5 5 0 8 0 procpl 664 721 0 673 6 0 6 6 0 8 1 sockpl 752 401 0 376 11 0 11 11 0 8 8 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 126 0 0 16 0 16 16 0 8 0 mcl2k 2048 21 0 0 3 0 3 3 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 178 0 0 12 0 12 12 0 8 0 bufpl 280 2345 0 102 161 0 161 161 0 8 0 anonpl 32 7418 0 0 60 0 60 60 0 246 0 amapchunkpl 152 10551 0 10181 23 0 23 23 0 158 3 amappl16 200 1342 0 1326 15 6 9 14 0 8 8 amappl15 192 11 0 11 1 1 0 1 0 8 0 amappl14 184 400 0 398 1 0 1 1 0 8 0 amappl13 176 113 0 103 1 0 1 1 0 8 0 amappl12 168 757 0 728 2 0 2 2 0 8 0 amappl11 160 8 0 8 1 1 0 1 0 8 0 amappl10 152 56 0 46 1 0 1 1 0 8 0 amappl9 144 270 0 270 1 1 0 1 0 8 0 amappl8 136 92 0 91 1 0 1 1 0 8 0 amappl7 128 136 0 124 1 0 1 1 0 8 0 amappl6 120 149 0 147 1 0 1 1 0 8 0 amappl5 112 92 0 84 1 0 1 1 0 8 0 amappl4 104 258 0 242 1 0 1 1 0 8 0 amappl3 96 2039 0 1951 5 1 4 4 0 8 0 amappl2 88 503 0 450 2 0 2 2 0 8 0 amappl1 80 10578 0 10036 15 1 14 14 0 8 1 amappl 88 3079 0 2948 5 0 5 5 0 92 1 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 5 0 0 1 0 1 1 0 8 0 uaddrrnd 24 524 0 494 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 524 0 494 1 0 1 1 0 8 0 vmmpekpl 168 6212 0 6175 3 0 3 3 0 8 0 vmmpepl 168 41496 0 39809 99 0 99 99 0 357 14 vmsppl 488 523 0 494 7 1 6 6 0 8 0 rwobjpl 80 14563 0 13701 25 0 25 25 0 8 4 pdppl 4096 1055 0 988 103 22 81 93 0 8 14 pvpl 32 13555 0 0 110 0 110 110 0 265 0 pmappl 256 523 0 494 4 1 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 276 0 25 8 0 8 8 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834b280d) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff834f439d,ffffffff834cb06c,4c3,ffffffff83485c4f) at __assert+0x29 sys/kern/subr_prf.c:-1 fdfree(ffff8000fffe67e8) at fdfree+0x349 exit1(ffff8000fffe67e8,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215 sys_exit(ffff8000fffe67e8,ffff80002a2cedd0,ffff80002a2ced20) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a2cedd0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a2cedd0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b16474862c0, count: -8 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83aa5400) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff83aa5400) at __mp_lock+0x192 sys/kern/kern_lock.c:173 sysctl_file(ffff80002bb76b28,4,200000000100,ffff80002bb76b58,ffff8000fffe6020) at sysctl_file+0x2d20 sys/kern/kern_sysctl.c:1796 kern_sysctl(ffff80002bb76b24,5,200000000100,ffff80002bb76b58,0,37,7eb45cc7ea47a4eb) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:736 sys_sysctl(ffff8000fffe6020,ffff80002bb76c90,ffff80002bb76be0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1 syscall(ffff80002bb76c90) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002bb76c90) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xa920db7e160, count: 6 ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83aa5400) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff83aa5400) at __mp_lock+0x192 sys/kern/kern_lock.c:173 sysctl_file(ffff80002bb76b28,4,200000000100,ffff80002bb76b58,ffff8000fffe6020) at sysctl_file+0x2d20 sys/kern/kern_sysctl.c:1796 kern_sysctl(ffff80002bb76b24,5,200000000100,ffff80002bb76b58,0,37,7eb45cc7ea47a4eb) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:736 sys_sysctl(ffff8000fffe6020,ffff80002bb76c90,ffff80002bb76be0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1 syscall(ffff80002bb76c90) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002bb76c90) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xa920db7e160, count: -9