panic: vop_gpeanneriicc_:ba kdernoepl Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 174483 66216 32767 0x10 0x4000000 1 syz-executor.5 *362667 9595 32767 0x10 0 0 syz-executor.4 db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff82740948) at panic+0x177 sys/kern/subr_prf.c:198 vop_generic_badop(ffff800025bb1868) at vop_generic_badop+0x1b sys/kern/vfs_default.c:133 VOP_STRATEGY(fffffd80622156f8,fffffd80796627f0) at VOP_STRATEGY+0x9b sys/kern/vfs_vops.c:628 bwrite(fffffd80796627f0) at bwrite+0x1f0 sys/kern/vfs_bio.c:760 VOP_BWRITE(fffffd80796627f0) at VOP_BWRITE+0x4a sys/kern/vfs_vops.c:640 ufs_mkdir(ffff800025bb1b00) at ufs_mkdir+0x6b4 sys/ufs/ufs/ufs_vnops.c:1236 VOP_MKDIR(fffffd806510a618,ffff800025bb1c60,ffff800025bb1c90,ffff800025bb1b90) at VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388 domkdirat(ffff8000212a8038,ffffff9c,7f7fffff8e40,1ff) at domkdirat+0x121 sys/kern/vfs_syscalls.c:3112 syscall(ffff800025bb1e10) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] syscall(ffff800025bb1e10) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:625 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7fffff8eb0, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: vop_generic_badop cpu1: kernel diagnostic assertion "!_kernel_lock_held()" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_fork.c", line 674 ddb{0}> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff82740948) at panic+0x177 sys/kern/subr_prf.c:198 vop_generic_badop(ffff800025bb1868) at vop_generic_badop+0x1b sys/kern/vfs_default.c:133 VOP_STRATEGY(fffffd80622156f8,fffffd80796627f0) at VOP_STRATEGY+0x9b sys/kern/vfs_vops.c:628 bwrite(fffffd80796627f0) at bwrite+0x1f0 sys/kern/vfs_bio.c:760 VOP_BWRITE(fffffd80796627f0) at VOP_BWRITE+0x4a sys/kern/vfs_vops.c:640 ufs_mkdir(ffff800025bb1b00) at ufs_mkdir+0x6b4 sys/ufs/ufs/ufs_vnops.c:1236 VOP_MKDIR(fffffd806510a618,ffff800025bb1c60,ffff800025bb1c90,ffff800025bb1b90) at VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388 domkdirat(ffff8000212a8038,ffffff9c,7f7fffff8e40,1ff) at domkdirat+0x121 sys/kern/vfs_syscalls.c:3112 syscall(ffff800025bb1e10) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] syscall(ffff800025bb1e10) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:625 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7fffff8eb0, count: -11 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff800025bb1790 rbx 0xffffffff82bc2b8f cpu_info_full_primary+0x2b8f rdx 0 rcx 0 rax 0xffff8000212a8038 r8 0x101010101010101 r9 0x8080808080808080 r10 0xa57772e3f682d407 r11 0xdfdc5a47c6d153f3 r12 0xffffffff82bc2990 cpu_info_full_primary+0x2990 r13 0 r14 0 r15 0x1 rip 0xffffffff818c3858 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff800025bb1780 ss 0 db_enter+0x18: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor.4) pid=362667 stat=onproc flags process=10 proc=0 pri=17, usrpri=79, nice=20 forw=0xffffffffffffffff, list=0xffff8000212a8860,0xffff8000212bc878 process=0xffff800024b44018 user=0xffff800025bac000, vmspace=0xfffffd8069992000 estcpu=36, cpticks=0, pctcpu=0.3 user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 23839 419885 13662 32767 2 0x10 syz-executor.1 66216 69147 15907 32767 2 0x10 syz-executor.5 66216 174483 15907 32767 7 0x4000010 syz-executor.5 23663 501076 26037 32767 2 0x10 syz-executor.7 26037 498657 31350 0 3 0x82 wait syz-executor.7 51625 177054 69067 32767 2 0x10 syz-executor.6 69067 454201 31350 0 3 0x82 wait syz-executor.6 52984 69599 44664 32767 3 0x90 nanoslp syz-executor.0 44664 424461 31350 0 3 0x82 wait syz-executor.0 15907 201605 16381 32767 3 0x90 nanoslp syz-executor.5 16381 109492 31350 0 3 0x82 wait syz-executor.5 84342 245475 0 0 3 0x14200 bored sosplice * 9595 362667 84748 32767 7 0x10 syz-executor.4 65314 396195 19949 32767 3 0x90 nanoslp syz-executor.3 82598 268394 22631 32767 2 0x10 syz-executor.2 84748 381106 31350 0 3 0x82 wait syz-executor.4 19949 521391 31350 0 3 0x82 wait syz-executor.3 22631 50625 31350 0 3 0x82 wait syz-executor.2 13662 84501 94955 32767 3 0x90 nanoslp syz-executor.1 94955 473729 31350 0 3 0x82 wait syz-executor.1 31350 70915 40560 0 3 0x82 wait syz-fuzzer 31350 284943 40560 0 3 0x4000082 nanoslp syz-fuzzer 31350 261973 40560 0 3 0x4000082 wait syz-fuzzer 31350 373680 40560 0 3 0x4000082 wait syz-fuzzer 31350 84899 40560 0 3 0x4000082 wait syz-fuzzer 31350 44320 40560 0 3 0x4000082 thrsleep syz-fuzzer 31350 384479 40560 0 3 0x4000082 wait syz-fuzzer 31350 346149 40560 0 3 0x4000082 wait syz-fuzzer 31350 69088 40560 0 3 0x4000082 thrsleep syz-fuzzer 31350 254261 40560 0 3 0x4000082 thrsleep syz-fuzzer 31350 159150 40560 0 3 0x4000082 thrsleep syz-fuzzer 31350 504205 40560 0 3 0x4000082 wait syz-fuzzer 31350 378463 40560 0 2 0x4000082 syz-fuzzer 31350 20703 40560 0 3 0x4000082 wait syz-fuzzer 31350 90360 40560 0 3 0x4000082 thrsleep syz-fuzzer 31350 453388 40560 0 2 0x4000082 syz-fuzzer 40560 134401 656 0 3 0x10008a sigsusp ksh 656 240853 39578 0 2 0x9a sshd 18868 431455 1 0 3 0x100083 ttyin getty 39578 235746 1 0 3 0x88 kqread sshd 4850 84558 85557 73 3 0x1100090 kqread syslogd 85557 229831 1 0 3 0x100082 netio syslogd 33025 44642 1 0 3 0x100080 kqread resolvd 75871 242480 30415 77 3 0x100092 kqread dhcpleased 40852 148333 30415 77 3 0x100092 kqread dhcpleased 30415 228046 1 0 3 0x80 kqread dhcpleased 98825 206651 0 0 3 0x14200 bored smr 79187 98170 0 0 2 0x14200 zerothread 75598 272246 0 0 3 0x14200 aiodoned aiodoned 4639 353448 0 0 3 0x14200 syncer update 13328 463483 0 0 3 0x14200 cleaner cleaner 15960 265394 0 0 3 0x14200 reaper reaper 93093 328422 0 0 3 0x14200 pgdaemon pagedaemon 70906 229938 0 0 3 0x14200 bored viomb 30089 445304 0 0 3 0x40014200 acpi0 acpi0 12547 230286 0 0 3 0x40014200 idle1 14252 312084 0 0 3 0x14200 bored softnet 49540 351750 0 0 3 0x14200 bored softnet 32925 261440 0 0 3 0x14200 bored softnet 38681 185150 0 0 3 0x14200 bored softnet 18300 109419 0 0 3 0x14200 bored systqmp 2527 445771 0 0 3 0x14200 bored systq 26244 135072 0 0 3 0x40014200 bored softclock 59186 401835 0 0 3 0x40014200 idle0 1 160395 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 9595 (syz-executor.4) thread 0xffff8000212a8038 (362667) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82c2ca98) #0 witness_lock+0x44d #1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:227 #2 mi_switch+0x3bb sys/kern/sched_bsd.c:405 #3 sleep_finish+0x180 sys/kern/kern_synch.c:417 #4 tsleep+0x12c sys/kern/kern_synch.c:155 #5 biowait+0x91 sys/kern/vfs_bio.c:1268 #6 bwrite+0x21b sys/kern/vfs_bio.c:769 #7 ffs_update+0x27d sys/ufs/ffs/ffs_inode.c:113 #8 ufs_mkdir+0x662 sys/ufs/ufs/ufs_vnops.c:1220 #9 VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388 #10 domkdirat+0x121 sys/kern/vfs_syscalls.c:3112 #11 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #11 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:625 #12 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffd807dfab4e8) #0 witness_lock+0x44d #1 rw_enter+0x3e1 sys/kern/kern_rwlock.c:310 #2 rrw_enter+0x8b sys/kern/kern_rwlock.c:465 #3 VOP_LOCK+0x87 sys/kern/vfs_vops.c:518 #4 vn_lock+0x84 sys/kern/vfs_vnops.c:564 #5 vget+0x1fc sys/kern/vfs_subr.c:676 #6 ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119 #7 ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1324 #8 ffs_inode_alloc+0x1be sys/ufs/ffs/ffs_alloc.c:394 #9 ufs_mkdir+0xf4 sys/ufs/ufs/ufs_vnops.c:1150 #10 VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388 #11 domkdirat+0x121 sys/kern/vfs_syscalls.c:3112 #12 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #12 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:625 #13 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffd80666731b0) #0 witness_lock+0x44d #1 rw_enter+0x3e1 sys/kern/kern_rwlock.c:310 #2 rrw_enter+0x8b sys/kern/kern_rwlock.c:465 #3 VOP_LOCK+0x87 sys/kern/vfs_vops.c:518 #4 vn_lock+0x84 sys/kern/vfs_vnops.c:564 #5 vfs_lookup+0xd1 sys/kern/vfs_lookup.c:418 #6 namei+0x55a sys/kern/vfs_lookup.c:250 #7 domkdirat+0x75 sys/kern/vfs_syscalls.c:3097 #8 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #8 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:625 #9 Xsyscall+0x128 Process 82598 (syz-executor.2) thread 0xffff80002123a028 (268394) exclusive rrwlock inode r = 0 (0xfffffd807dfabf88) #0 witness_lock+0x44d #1 rw_enter+0x3e1 sys/kern/kern_rwlock.c:310 #2 rrw_enter+0x8b sys/kern/kern_rwlock.c:465 #3 VOP_LOCK+0x87 sys/kern/vfs_vops.c:518 #4 vn_lock+0x84 sys/kern/vfs_vnops.c:564 #5 vn_closefile+0xc6 vn_close sys/kern/vfs_vnops.c:292 [inline] #5 vn_closefile+0xc6 sys/kern/vfs_vnops.c:609 #6 fdrop+0xc7 sys/kern/kern_descrip.c:1274 #7 closef+0x11c sys/kern/kern_descrip.c:1258 #8 syscall+0x606 mi_syscall sys/sys/syscall_mi.h:110 [inline] #8 syscall+0x606 sys/arch/amd64/amd64/trap.c:625 #9 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10231 6414K 6421K 78643K 11362 0 pcb 13 12K 14K 78643K 17 0 rtable 240 6K 7K 78643K 1151 0 ifaddr 73 24K 24K 78643K 155 0 sysctl 2 0K 2K 78643K 69 0 counters 60 35K 35K 78643K 86 0 ioctlops 0 0K 2K 78643K 73 0 iov 0 0K 24K 78643K 1136 0 mount 1 1K 1K 78643K 1 0 log 0 0K 0K 78643K 4 0 vnodes 1271 79K 79K 78643K 2456 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 9K 78643K 92 0 VM map 2 1K 1K 78643K 2 0 sem 12 0K 0K 78643K 1798 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1697 195K 286K 78643K 12548 0 file desc 20 73K 121K 78643K 5773 0 sigio 0 0K 0K 78643K 175 0 proc 56 78K 127K 78643K 1301 0 subproc 104 6K 6K 78643K 273 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 819 0 in_multi 99 6K 7K 78643K 303 0 ether_multi 1 0K 0K 78643K 17 0 mrt 1 0K 0K 78643K 1 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 259 1155K 1155K 78643K 259 0 exec 0 0K 1K 78643K 1384 0 tdb 3 0K 0K 78643K 3 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 8 62K 64K 78643K 10 0 UVM amap 358 92K 107K 78643K 42212 0 UVM aobj 131 4K 4K 78643K 131 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 235 0 NDP 11 0K 2K 78643K 66 0 temp 124 5778K 5906K 78643K 18573 0 kqueue 12 18K 26K 78643K 569 0 SYN cache 2 16K 16K 78643K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 22 0 0 1 0 1 1 0 8 0 rtpcb 120 691 0 688 10 9 1 6 0 8 0 rtentry 112 264 0 151 4 0 4 4 0 8 0 unpcb 144 9917 0 9904 63 60 3 9 0 8 2 syncache 296 69 0 69 14 13 1 1 0 8 1 tcpqe 32 57 0 57 12 11 1 1 0 8 1 tcpcb 776 2904 0 2896 86 81 5 15 0 8 4 arp 120 44 0 26 1 0 1 1 0 8 0 ipq 40 45 0 45 4 4 0 1 0 8 0 ipqe 40 108 0 108 4 4 0 1 0 8 0 inpcb 368 5175 0 5164 97 90 7 19 0 8 5 ip6q 72 3 0 3 1 1 0 1 0 8 0 ip6af 40 9 0 9 1 1 0 1 0 8 0 nd6 48 73 0 46 1 0 1 1 0 8 0 kcovpl 48 21 0 13 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 1064 0 596 34 4 30 30 0 8 0 art_table 32 1065 0 596 4 0 4 4 0 8 0 art_node 16 263 0 160 1 0 1 1 0 8 0 semapl 112 1796 0 1786 1 0 1 1 0 8 0 shmpl 112 128 0 0 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 9000 0 7565 91 0 91 91 0 8 0 ffsino 272 9000 0 7565 97 0 97 97 0 8 0 nchpl 144 16831 0 15197 63 0 63 63 0 8 0 uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0 vnodes 216 5926 0 0 330 0 330 330 0 8 0 namei 1024 61235 0 61234 4 3 1 2 0 8 0 percpumem 16 56 0 13 1 0 1 1 0 8 0 kstatmem 264 48 0 26 2 0 2 2 0 8 0 scxspl 216 57225 0 57225 29 27 2 8 0 8 2 plimitpl 152 1216 0 1193 8 6 2 2 0 8 0 sigapl 424 6040 0 5989 7 0 7 7 0 8 0 futexpl 64 55671 0 55671 4 3 1 1 0 8 1 knotepl 120 505 0 0 13 0 13 13 0 8 0 kqueuepl 216 1331 0 1323 20 19 1 6 0 8 0 pipepl 320 2135 0 2107 63 55 8 13 0 8 5 fdescpl 496 6022 0 5991 7 2 5 6 0 8 0 filepl 152 45384 0 45149 91 76 15 21 0 8 5 lockfpl 104 393 0 391 1 0 1 1 0 8 0 lockfspl 48 161 0 159 1 0 1 1 0 8 0 sessionpl 144 36 0 20 1 0 1 1 0 8 0 pgrppl 48 199 0 183 1 0 1 1 0 8 0 ucredpl 104 7476 0 7458 1 0 1 1 0 8 0 zombiepl 144 5991 0 5989 1 0 1 1 0 8 0 processpl 1072 6040 0 5989 5 1 4 5 0 8 0 procpl 696 16918 0 16851 19 10 9 9 0 8 1 sosppl 168 117 0 117 10 9 1 1 0 8 1 sockpl 488 16178 0 16150 330 318 12 42 0 8 8 mcl64k 65536 20 0 0 3 0 3 3 0 8 0 mcl16k 16384 17 0 0 3 0 3 3 0 8 0 mcl12k 12288 17 0 0 2 0 2 2 0 8 0 mcl9k 9216 15 0 0 2 0 2 2 0 8 0 mcl8k 8192 26 0 0 3 0 3 3 0 8 0 mcl4k 4096 26 0 0 3 0 3 3 0 8 0 mcl2k2 2112 15 0 0 1 0 1 1 0 8 0 mcl2k 2048 395 0 0 42 6 36 42 0 8 3 mtagpl 96 4 0 0 1 0 1 1 0 8 0 mbufpl 256 1377 0 0 68 0 68 68 0 8 0 bufpl 288 14644 0 8320 452 0 452 452 0 8 0 anonpl 24 1306340 0 1293231 222 116 106 114 0 186 0 amapchunkpl 152 126589 0 125908 125 87 38 44 0 158 5 amappl16 200 15121 0 14755 102 77 25 33 0 8 4 amappl15 192 5 0 5 1 1 0 1 0 8 0 amappl14 184 187 0 172 2 1 1 2 0 8 0 amappl13 176 15 0 15 4 3 1 1 0 8 1 amappl12 168 567 0 562 1 0 1 1 0 8 0 amappl11 160 55 0 44 1 0 1 1 0 8 0 amappl10 152 58 0 47 1 0 1 1 0 8 0 amappl9 144 1025 0 1025 8 8 0 1 0 8 0 amappl8 136 590 0 472 5 0 5 5 0 8 0 amappl7 128 206 0 182 2 0 2 2 0 8 0 amappl6 120 298 0 278 2 1 1 2 0 8 0 amappl5 112 263 0 257 1 0 1 1 0 8 0 amappl4 104 709 0 677 2 1 1 2 0 8 0 amappl3 96 18041 0 17993 2 0 2 2 0 8 0 amappl2 88 6767 0 6690 3 1 2 3 0 8 0 amappl1 80 140207 0 139527 34 16 18 26 0 8 0 amappl 88 41301 0 41109 7 1 6 6 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 130 0 0 3 0 3 3 0 8 0 uaddrrnd 24 6022 0 5991 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 6022 0 5991 1 0 1 1 0 8 0 vmmpekpl 168 55046 0 54981 5 1 4 4 0 8 0 vmmpepl 168 563833 0 561275 225 88 137 157 0 357 3 vmsppl 440 6021 0 5991 5 0 5 5 0 8 0 rwobjpl 56 159345 0 151824 122 11 111 112 0 8 0 pdppl 4096 12051 0 11982 270 189 81 93 0 8 12 pvpl 32 2565533 0 2546481 460 268 192 360 0 265 2 pmappl 248 6021 0 5991 4 1 3 3 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 1174 0 294 26 0 26 26 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff82740948) at panic+0x177 sys/kern/subr_prf.c:198 vop_generic_badop(ffff800025bb1868) at vop_generic_badop+0x1b sys/kern/vfs_default.c:133 VOP_STRATEGY(fffffd80622156f8,fffffd80796627f0) at VOP_STRATEGY+0x9b sys/kern/vfs_vops.c:628 bwrite(fffffd80796627f0) at bwrite+0x1f0 sys/kern/vfs_bio.c:760 VOP_BWRITE(fffffd80796627f0) at VOP_BWRITE+0x4a sys/kern/vfs_vops.c:640 ufs_mkdir(ffff800025bb1b00) at ufs_mkdir+0x6b4 sys/ufs/ufs/ufs_vnops.c:1236 VOP_MKDIR(fffffd806510a618,ffff800025bb1c60,ffff800025bb1c90,ffff800025bb1b90) at VOP_MKDIR+0xbf sys/kern/vfs_vops.c:388 domkdirat(ffff8000212a8038,ffffff9c,7f7fffff8e40,1ff) at domkdirat+0x121 sys/kern/vfs_syscalls.c:3112 syscall(ffff800025bb1e10) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] syscall(ffff800025bb1e10) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:625 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7fffff8eb0, count: -11 ddb{0}> machine ddbcpu 1