login: panic: kernel diagnostic assertion "rn != NULL" failed: file "/syzkaller/managers/multicore/kernel/sys/net/pipex.c", line 459 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND * 94897 59856 0 0 0x4000000 1K syz-executor 19389 11304 0 0x100000 0x1 0 resolvd db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff83450f17) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8348b8e2,ffffffff834a3acd,1cb,ffffffff83442dc4) at __assert+0x29 sys/kern/subr_prf.c:-1 pipex_unlink_session_locked(ffff80003c3e0950) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff80000160c000) at pipex_destroy_all_sessions+0xd9 pipex_rele_session sys/net/pipex.c:-1 [inline] pipex_destroy_all_sessions(ffff80000160c000) at pipex_destroy_all_sessions+0xd9 sys/net/pipex.c:151 pppacclose(637e,1,2000,ffff8000fffeed10) at pppacclose+0x16f sys/net/if_pppx.c:1335 spec_close(ffff8000357aba00) at spec_close+0x417 sys/kern/spec_vnops.c:-1 VOP_CLOSE(fffffd806ce790e0,1,fffffd80097fd680,ffff8000fffeed10) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156 vn_closefile(fffffd806d7138d8,ffff8000fffeed10) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline] vn_closefile(fffffd806d7138d8,ffff8000fffeed10) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615 fdrop(fffffd806d7138d8,ffff8000fffeed10) at fdrop+0x121 sys/kern/kern_descrip.c:1281 closef(fffffd806d7138d8,ffff8000fffeed10) at closef+0x192 sys/kern/kern_descrip.c:1265 syscall(ffff8000357abc60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff8000357abc60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x66728fee350, count: 2 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "rn != NULL" failed: file "/syzkaller/managers/multicore/kernel/sys/net/pipex.c", line 459 ddb{1}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff83450f17) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff8348b8e2,ffffffff834a3acd,1cb,ffffffff83442dc4) at __assert+0x29 sys/kern/subr_prf.c:-1 pipex_unlink_session_locked(ffff80003c3e0950) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff80000160c000) at pipex_destroy_all_sessions+0xd9 pipex_rele_session sys/net/pipex.c:-1 [inline] pipex_destroy_all_sessions(ffff80000160c000) at pipex_destroy_all_sessions+0xd9 sys/net/pipex.c:151 pppacclose(637e,1,2000,ffff8000fffeed10) at pppacclose+0x16f sys/net/if_pppx.c:1335 spec_close(ffff8000357aba00) at spec_close+0x417 sys/kern/spec_vnops.c:-1 VOP_CLOSE(fffffd806ce790e0,1,fffffd80097fd680,ffff8000fffeed10) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156 vn_closefile(fffffd806d7138d8,ffff8000fffeed10) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline] vn_closefile(fffffd806d7138d8,ffff8000fffeed10) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615 fdrop(fffffd806d7138d8,ffff8000fffeed10) at fdrop+0x121 sys/kern/kern_descrip.c:1281 closef(fffffd806d7138d8,ffff8000fffeed10) at closef+0x192 sys/kern/kern_descrip.c:1265 syscall(ffff8000357abc60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff8000357abc60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x66728fee350, count: -13 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff8000357ab7d0 rbx 0xffff8000299bee07 rdx 0xffff8000015f13c0 rcx 0xffff8000fffeed10 rax 0xffff8000299bdff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x14695d09cba69bb r11 0x1225e5225f101a9d r12 0xffff8000299bec08 r13 0 r14 0 r15 0x1 rip 0xffffffff82d5efc5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff8000357ab7c0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=94897 pid=59856 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000fffee2b0,0xffff8000fffee558 process=0xffff80003c3f44f0 user=0xffff8000357a6000, vmspace=0xfffffd806eaa15c8 estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 59856 12307 23805 0 3 0x80 nanoslp syz-executor *59856 94897 23805 0 7 0x4000000 syz-executor 59856 128389 23805 0 3 0x4000080 fsleep syz-executor 11200 41261 4704 60929 3 0x10 fltagain2 syz-executor 11200 470172 4704 60929 3 0x4000010 biowait syz-executor 11200 184749 4704 60929 3 0x4000010 fltagain2 syz-executor 11200 25024 4704 60929 3 0x4000010 inode syz-executor 11200 278679 4704 60929 3 0x4000010 inode syz-executor 11200 434390 4704 60929 3 0x4000090 fsleep syz-executor 81224 392980 1 0 3 0x100083 ttyin getty 85748 369552 86208 0 3 0x100082 sbwait arp 86208 407043 99438 0 3 0x10008a sigsusp sh 40824 57163 63415 0 3 0x82 piperd syz-executor 4704 122609 63415 0 3 0x82 nanoslp syz-executor 23805 312594 63415 0 3 0x82 nanoslp syz-executor 12774 470695 63415 0 3 0x82 piperd syz-executor 99438 300876 63415 0 3 0x82 wait syz-executor 27734 60558 63415 0 3 0x82 piperd syz-executor 67061 300580 63415 0 3 0x82 piperd syz-executor 63415 484224 1 0 3 0x82 wait syz-executor 49809 463744 1 0 3 0x1000008a kqread sshd 72971 386093 10857 74 3 0x1100092 bpf pflogd 10857 165584 1 0 3 0x80 sbwait pflogd 33325 344789 49998 73 3 0x1100090 kqread syslogd 49998 121450 1 0 3 0x100082 sbwait syslogd 11304 19389 1 0 7 0x100001 resolvd 97508 267149 84417 77 3 0x100092 kqread dhcpleased 87126 393842 84417 77 3 0x100092 kqread dhcpleased 84417 227305 1 0 3 0x80 kqread dhcpleased 13423 497969 0 0 3 0x14200 bored smr 75135 58069 0 0 3 0x14200 pgzero zerothread 45528 337765 0 0 3 0x14200 aiodoned aiodoned 37598 480895 0 0 3 0x14200 syncer update 60242 77177 0 0 3 0x14200 cleaner cleaner 42105 264730 0 0 3 0x14200 reaper reaper 69226 394548 0 0 3 0x14200 pgdaemon pagedaemon 91357 36404 0 0 3 0x14200 bored viomb 23836 65999 0 0 3 0x40014200 acpi0 acpi0 16653 411119 0 0 3 0x40014200 idle1 94626 267383 0 0 3 0x14200 bored softnet1 77798 108024 0 0 3 0x14200 bored softnet0 96320 231047 0 0 3 0x14200 smrbar systqmp 19610 459754 0 0 3 0x14200 bored systq 4676 16939 0 0 3 0x14200 tmoslp softclockmp 1505 250813 0 0 3 0x40014200 tmoslp softclock 14549 173324 0 0 3 0x40014200 idle0 1 34859 0 0 3 0x82 wait init 0 0 -1 0 3 0x10010200 scheduler swapper ddb{1}>