panic: ffs_valloc: dup alloc Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *300814 14940 0 0x2 0 0 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346895c) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(fffff2006d460100,41ed,fffff20007ffd750,ffff80002a8a38b8) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a8a3920) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(fffff2006d35be98,ffff80002a8a3a80,ffff80002a8a3ab0,ffff80002a8a39b0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a737760,ffffff9c,7cc9423f5f00,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 syscall(ffff80002a8a3c20) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a8a3c20) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7cc9423f5fa0, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: ffs_valloc: dup alloc ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346895c) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(fffff2006d460100,41ed,fffff20007ffd750,ffff80002a8a38b8) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a8a3920) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(fffff2006d35be98,ffff80002a8a3a80,ffff80002a8a3ab0,ffff80002a8a39b0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a737760,ffffff9c,7cc9423f5f00,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 syscall(ffff80002a8a3c20) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a8a3c20) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7cc9423f5fa0, count: -8 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80002a8a3640 rbx 0x6656 __ALIGN_SIZE+0x5656 rdx 0 rcx 0 rax 0xffff80002a737760 r8 0x101010101010101 r9 0x8080808080808080 r10 0x1af4d34bfa6001c2 r11 0xe1c798fcd62929fa r12 0 r13 0xfffff2006c862400 r14 0 r15 0x1 rip 0xffffffff8117abc5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a8a3630 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=300814 pid=14940 tcnt=1 stat=onproc flags process=2 proc=0 runpri=17, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a736f98,0xffff80002f0b0fb8 process=0xffff80002a793a90 user=0xffff80002a89e000, vmspace=0xfffff2006f9bc458 estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 82013 30614 10109 0 2 0xc80 syz-executor 82013 314465 10109 0 2 0x4000c80 syz-executor 82013 510979 10109 0 3 0x4000080 fsleep syz-executor 67645 71770 85932 0 2 0xc80 syz-executor 67645 441136 85932 0 3 0x4000080 kqread syz-executor 67645 225066 85932 0 3 0x4000080 fsleep syz-executor 11596 389257 17527 0 2 0xc80 syz-executor 11596 266379 17527 0 3 0x4000080 sbwait syz-executor 11596 402461 17527 0 3 0x4000080 fsleep syz-executor 70279 451615 0 0 3 0x14200 acct acct *14940 300814 13746 0 7 0x2 syz-executor 72538 184359 13746 0 2 0x2 syz-executor 10109 515150 13746 0 2 0xc82 syz-executor 85932 138317 13746 0 2 0xc82 syz-executor 17527 180224 13746 0 2 0xc82 syz-executor 13746 513156 78652 0 3 0x82 wait syz-executor 78652 190063 90255 0 3 0x10008a sigsusp ksh 90255 302366 73574 0 3 0x98 kqread sshd-session 73574 336512 50377 0 3 0x92 kqread sshd-session 72241 455669 1 0 3 0x100083 ttyin getty 50377 52844 1 0 3 0x88 kqread sshd 17891 460048 68931 73 3 0x1100090 kqread syslogd 68931 402552 1 0 3 0x100082 sbwait syslogd 77908 209450 1 0 3 0x100080 kqread resolvd 57343 387699 6001 77 3 0x100092 kqread dhcpleased 76508 145402 6001 77 3 0x100092 kqread dhcpleased 6001 4434 1 0 3 0x80 kqread dhcpleased 34333 417327 0 0 3 0x14200 bored smr 89092 50921 0 0 2 0x14200 zerothread 48729 484283 0 0 3 0x14200 aiodoned aiodoned 38672 99350 0 0 3 0x14200 syncer update 37744 438974 0 0 3 0x14200 cleaner cleaner 92111 383500 0 0 3 0x14200 reaper reaper 85793 376972 0 0 3 0x14200 pgdaemon pagedaemon 44228 281793 0 0 3 0x14200 bored viomb 28956 305012 0 0 3 0x40014200 acpi0 acpi0 53712 61164 0 0 3 0x14200 bored softnet0 12466 346759 0 0 3 0x14200 bored systqmp 51331 170678 0 0 3 0x14200 bored systq 53624 383785 0 0 3 0x40014200 tmoslp softclock 17601 129096 0 0 3 0x40014200 idle0 1 255034 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11044 12172K 12367K 166960K 12370 0 pcb 18 12K 12K 166960K 46 0 rtable 223 6K 7K 166960K 381 0 pf 36 14K 20K 166960K 65 0 ifaddr 39 6K 7K 166960K 45 0 ifgroup 54 2K 2K 166960K 54 0 sysctl 4 1K 9K 166960K 8 0 counters 34 17K 17K 166960K 34 0 ioctlops 0 0K 4K 166960K 76 0 iov 0 0K 8K 166960K 10 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1295 81K 82K 166960K 1526 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 17 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 13 45K 89K 166960K 267 0 proc 60 59K 108K 166960K 504 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 1 0K 0K 166960K 34 0 in_multi 87 6K 7K 166960K 104 0 ether_multi 1 0K 0K 166960K 2 0 mrt 0 0K 0K 166960K 4 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 91 413K 413K 166960K 91 0 exec 0 0K 1K 166960K 383 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 187 149K 179K 166960K 3929 0 UVM aobj 7 2K 2K 166960K 7 0 pinsyscall 34 68K 93K 166960K 1380 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 1 0K 0K 166960K 7 0 NDP 12 0K 2K 166960K 28 0 temp 38 9107K 9155K 166960K 8570 0 kqueue 15 24K 26K 166960K 42 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 44 0 41 1 0 1 1 0 8 0 rtentry 136 112 0 15 4 0 4 4 0 8 0 unpcb 144 124 0 105 2 0 2 2 0 8 1 syncache 336 7 0 7 1 0 1 1 0 8 1 tcpqe 32 3 0 3 1 0 1 1 0 8 1 tcpcb 736 34 0 26 1 0 1 1 0 8 0 arp 96 18 0 2 1 0 1 1 0 8 0 ipq 40 4 0 0 1 0 1 1 0 8 0 ipqe 40 4 0 0 1 0 1 1 0 8 0 inpcb 328 174 0 158 2 0 2 2 0 8 0 ip6q 72 1 0 1 1 0 1 1 0 8 1 ip6af 40 2 0 2 1 0 1 1 0 8 1 nd6 112 25 0 3 1 0 1 1 0 8 0 pkpcb 40 1 0 1 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pfstscr 40 14 0 9 1 0 1 1 0 8 0 pfanchor 1288 4 0 0 1 0 1 1 0 8 0 pfstitem 24 5 0 2 1 0 1 1 0 8 0 pfstkey 128 21 0 17 1 0 1 1 0 8 0 pfstate 384 11 0 8 1 0 1 1 0 8 0 pfrule 1360 2 0 2 1 0 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 454 0 50 29 0 29 29 0 8 0 art_table 40 455 0 50 5 0 5 5 0 8 0 art_node 32 112 0 24 1 0 1 1 0 8 0 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 72 15 0 5 1 0 1 1 0 8 0 shmpl 112 4 0 0 1 0 1 1 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 1863 0 405 92 0 92 92 0 8 0 ffsino 256 1865 0 407 92 0 92 92 0 8 0 nchpl 144 2233 0 544 64 0 64 64 0 8 0 vnodes 216 2011 0 0 112 0 112 112 0 8 0 namei 1024 6660 0 6659 2 0 2 2 0 8 1 kstatmem 264 25 0 0 2 0 2 2 0 8 0 scsiplug 72 1 0 1 1 0 1 1 0 8 1 scxspl 216 7096 0 7096 2 0 2 2 1 8 2 plimitpl 152 43 0 26 1 0 1 1 0 8 0 sigapl 424 567 0 528 6 0 6 6 0 8 1 knotepl 120 9250 0 9195 19 3 16 19 0 8 13 kqueuepl 184 49 0 38 1 0 1 1 0 8 0 pipepl 304 129 0 102 3 0 3 3 0 8 0 fdescpl 448 553 0 528 5 0 5 5 0 8 1 filepl 120 2326 0 2104 10 0 10 10 0 8 2 lockfpl 104 213 0 210 1 0 1 1 0 8 0 lockfspl 48 35 0 32 1 0 1 1 0 8 0 sessionpl 144 25 0 17 1 0 1 1 0 8 0 pgrppl 48 34 0 18 1 0 1 1 0 8 0 ucredpl 104 463 0 452 1 0 1 1 0 8 0 zombiepl 144 531 0 528 1 0 1 1 0 8 0 processpl 1152 567 0 528 4 0 4 4 0 8 0 procpl 664 762 0 717 5 0 5 5 0 8 0 sockpl 552 344 0 306 4 0 4 4 0 8 0 mcl64k 65536 16 0 14 1 0 1 1 0 8 0 mcl16k 16384 10 0 10 1 0 1 1 0 8 1 mcl12k 12288 2 0 2 1 0 1 1 0 8 1 mcl9k128 9344 4 0 4 1 0 1 1 0 8 1 mcl8k 8192 13 0 13 1 0 1 1 0 8 1 mcl4k 4096 2723 0 2673 13 0 13 13 0 8 6 mcl2k 2048 218 0 218 2 0 2 2 0 8 2 mextrefs 64 130 0 130 1 0 1 1 0 8 1 mtagpl 96 4 0 4 1 0 1 1 0 8 1 mbufpl 256 5697 0 5572 13 0 13 13 0 8 2 bufpl 272 2540 0 102 163 0 163 163 0 8 0 anonpl 24 92525 0 89591 33 0 33 33 0 187 10 amapchunkpl 152 11782 0 11418 35 0 35 35 0 158 12 amappl16 200 1282 0 1261 4 0 4 4 0 8 2 amappl15 192 3 0 3 1 0 1 1 0 8 1 amappl14 184 453 0 452 1 0 1 1 0 8 0 amappl13 176 114 0 104 1 0 1 1 0 8 0 amappl12 168 794 0 770 2 0 2 2 0 8 0 amappl11 160 37 0 37 1 0 1 1 0 8 1 amappl10 152 55 0 45 1 0 1 1 0 8 0 amappl9 144 295 0 295 1 0 1 1 0 8 1 amappl8 136 172 0 171 1 0 1 1 0 8 0 amappl7 128 158 0 147 1 0 1 1 0 8 0 amappl6 120 147 0 145 1 0 1 1 0 8 0 amappl5 112 97 0 88 1 0 1 1 0 8 0 amappl4 104 280 0 263 1 0 1 1 0 8 0 amappl3 96 2290 0 2206 4 0 4 4 0 8 0 amappl2 88 535 0 479 2 0 2 2 0 8 0 amappl1 80 10860 0 10330 13 0 13 13 0 8 1 amappl 88 3205 0 3080 5 0 5 5 0 92 1 uvmvnodes 80 106 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 0 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 0 1 1 0 8 1 dma128 128 253 0 253 1 0 1 1 0 8 1 dma64 64 6 0 6 1 0 1 1 0 8 1 dma32 32 7 0 7 1 0 1 1 0 8 1 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 6 0 0 1 0 1 1 0 8 0 uaddrrnd 24 553 0 528 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 553 0 528 1 0 1 1 0 8 0 vmmpekpl 168 6304 0 6263 2 0 2 2 0 8 0 vmmpepl 168 43674 0 42114 81 0 81 81 0 357 1 vmsppl 368 552 0 528 4 0 4 4 0 8 1 rwobjpl 40 14907 0 13992 11 0 11 11 0 8 1 pdppl 4096 1112 0 1056 96 30 66 78 0 8 10 pvpl 32 249226 0 241406 104 0 104 104 0 265 24 pmappl 216 552 0 528 2 0 2 2 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 524 0 30 15 0 15 15 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346895c) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(fffff2006d460100,41ed,fffff20007ffd750,ffff80002a8a38b8) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a8a3920) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(fffff2006d35be98,ffff80002a8a3a80,ffff80002a8a3ab0,ffff80002a8a39b0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a737760,ffffff9c,7cc9423f5f00,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 syscall(ffff80002a8a3c20) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a8a3c20) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7cc9423f5fa0, count: -8 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346895c) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(fffff2006d460100,41ed,fffff20007ffd750,ffff80002a8a38b8) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a8a3920) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(fffff2006d35be98,ffff80002a8a3a80,ffff80002a8a3ab0,ffff80002a8a39b0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a737760,ffffff9c,7cc9423f5f00,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3063 syscall(ffff80002a8a3c20) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a8a3c20) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7cc9423f5fa0, count: -8