panic: handle_workitem_remove: bad file delta cpuid = 0 time = 1753788824 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056c59690 kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056c597f0 vpanic() at vpanic+0x257/frame 0xfffffe0056c599b0 panic() at panic+0xb5/frame 0xfffffe0056c59a70 handle_workitem_remove() at handle_workitem_remove+0xedf/frame 0xfffffe0056c59bb0 handle_workitem_remove() at handle_workitem_remove+0xc0f/frame 0xfffffe0056c59cf0 process_worklist_item() at process_worklist_item+0x525/frame 0xfffffe0056c59e40 softdep_process_worklist() at softdep_process_worklist+0xfd/frame 0xfffffe0056c59e90 softdep_flush() at softdep_flush+0x1a4/frame 0xfffffe0056c59ef0 fork_exit() at fork_exit+0xcc/frame 0xfffffe0056c59f30 fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0056c59f30 --- trap 0, rip = 0, rsp = 0, rbp = 0 --- KDB: enter: panic [ thread pid 14 tid 100093 ] Stopped at kdb_enter+0x6e: movq $0,0x25c45c7(%rip) db> db> set $lines = 0 db> set $maxwidth = 0 db> show registers cs 0x20 ds 0x3b es 0x3b fs 0x13 gs 0x1b ss 0 rax 0x12 rcx 0xfffffe0002bf1850 rdx 0 rbx 0xffffffff827cb4c0 .str.27 rsp 0xfffffe0056c597d0 rbp 0xfffffe0056c597f0 rsi 0 rdi 0xffffffff81614a99 printf+0x149 r8 0 r9 0xffffffff r10 0x1000000001011 r11 0xb r12 0xfffffe00540c2780 r13 0xfffffffffffffffe r14 0xffffffff827cb4c0 .str.27 r15 0 rip 0xffffffff815fe5ce kdb_enter+0x6e rflags 0x46 kdb_enter+0x6e: movq $0,0x25c45c7(%rip) db> show proc Process 14 (bufdaemon) at 0xfffffe000780a5c0: state: NORMAL uid: 0 gids: 0 parent: pid 0 at 0xffffffff83b4d060 ABI: null flag: 0x10000284 flag2: 0 reaper: 0xffffffff83b4d060 reapsubtree: 14 sigparent: 20 vmspace: 0xffffffff83b4e040 (map 0xffffffff83b4e040) (map.pmap 0xffffffff83b4e0e0) (pmap 0xffffffff83b4e150) threads: 3 100079 D psleep 0xffffffff83cbfd60 [bufdaemon] 100082 D - 0xffffffff83001ec0 [bufspacedaemon-0] 100093 Run CPU 0 [/ worker] db> ps pid ppid pgrp uid state wmesg wchan cmd 1020 763 763 0 R syz-executor 1017 765 765 0 R (threaded) syz-executor 100116 Run CPU 1 syz-executor 100360 RunQ syz-executor 1007 764 764 0 R (threaded) syz-executor 100317 RunQ syz-executor 100341 RunQ syz-executor 100348 S uwait 0xfffffe0058258c80 syz-executor 100354 S uwait 0xfffffe00584ec500 syz-executor 1004 1 765 0 S uwait 0xfffffe00596a3180 syz-executor 998 1 998 0 Ss+ ttyin 0xfffffe00582904b0 getty 997 1 997 0 Ss+ ttyin 0xfffffe00585cc4b0 getty 996 1 996 0 Ss+ ttyin 0xfffffe00585cc8b0 getty 995 1 995 0 Ss+ ttyin 0xfffffe00585cccb0 getty 994 1 994 0 Ss+ ttyin 0xfffffe00585cd0b0 getty 993 1 993 0 Ss+ ttyin 0xfffffe00585cd4b0 getty 992 1 992 0 Ss+ ttyin 0xfffffe00585cd8b0 getty 991 1 991 0 Ss+ ttyin 0xfffffe00585ce0b0 getty 990 1 990 0 Ss+ ttyin 0xfffffe00585cdcb0 getty 976 1 766 0 S uwait 0xfffffe005825ab00 syz-executor 959 1 764 0 S uwait 0xfffffe00596a3380 syz-executor 954 1 764 0 S uwait 0xfffffe005825a280 syz-executor 934 1 763 0 S uwait 0xfffffe00584ec400 syz-executor 929 1 764 0 S uwait 0xfffffe005825a580 syz-executor 925 1 766 0 S uwait 0xfffffe005825ac00 syz-executor 918 1 764 60928 S uwait 0xfffffe00596a1700 syz-executor 899 1 765 0 S uwait 0xfffffe0058259180 syz-executor 898 1 764 0 S uwait 0xfffffe00584ec100 syz-executor 892 1 763 0 S uwait 0xfffffe00596a2180 syz-executor 890 1 765 0 S uwait 0xfffffe00584ebb80 syz-executor 882 781 423 0 S kqread 0xfffffe00584efd00 rtsol 855 1 766 0 S uwait 0xfffffe00584eb280 syz-executor 853 1 766 0 S uwait 0xfffffe005825a900 syz-executor 835 1 766 -1 S uwait 0xfffffe00596a2b80 syz-executor 833 1 766 -1 S uwait 0xfffffe00584ebc80 syz-executor 829 1 802 0 S uwait 0xfffffe00584eba80 syz-executor 825 1 765 0 S uwait 0xfffffe00596a3000 syz-executor 824 1 765 0 S uwait 0xfffffe00596a2e80 syz-executor 819 1 765 0 S uwait 0xfffffe00596a2d80 syz-executor 815 0 0 0 DL aiordy 0xfffffe00540f85c0 [aiod4] 814 0 0 0 DL aiordy 0xfffffe005410eb00 [aiod3] 813 0 0 0 DL aiordy 0xfffffe005410dae0 [aiod2] 812 0 0 0 DL aiordy 0xfffffe005410e040 [aiod1] 807 0 0 0 DL (threaded) [KTLS] 100120 D - 0xfffffe0053e1ed00 [thr_0] 100127 D - 0xfffffe0053e1ed80 [thr_1] 100128 D - 0xffffffff83cb5628 [reclaim_0] 781 1 423 0 S wait 0xfffffe00540055c0 sh 766 762 766 0 R syz-executor 765 762 765 0 R syz-executor 764 762 764 0 S nanslp 0xffffffff83ba3c41 syz-executor 763 762 763 0 S nanslp 0xffffffff83ba3c41 syz-executor 762 760 760 0 S select 0xfffffe0053ffb440 syz-executor 760 1 760 0 Ss sigsusp 0xfffffe00540e0670 csh 16 0 0 0 DL syncer 0xffffffff83cc1820 [syncer] 15 0 0 0 DL vlruwt 0xfffffe000780a060 [vnlru] 14 0 0 0 RL (threaded) [bufdaemon] 100079 D psleep 0xffffffff83cbfd60 [bufdaemon] 100082 D - 0xffffffff83001ec0 [bufspacedaemon-0] 100093 Run CPU 0 [/ worker] 9 0 0 0 DL psleep 0xffffffff83d0acc0 [vmdaemon] 8 0 0 0 DL (threaded) [pagedaemon] 100077 D psleep 0xffffffff83cf0d88 [dom0] 100080 D launds 0xffffffff83cf0d94 [laundry: dom0] 100081 D umarcl 0xffffffff81de0e10 [uma] 7 0 0 0 DL - 0xffffffff8391c5d8 [rand_harvestq] 6 0 0 0 DL pftm 0xffffffff8484b9e0 [pf purge] 5 0 0 0 DL waiting 0xffffffff84712700 [sctp_iterator] 4 0 0 0 DL (threaded) [cam] 100045 D - 0xffffffff838e6340 [doneq0] 100046 D - 0xffffffff838e62c0 [async] 100075 D - 0xffffffff838e6140 [scanner] 3 0 0 0 DL (threaded) [crypto] 100042 D crypto_ 0xffffffff83cec640 [crypto] 100043 D crypto_ 0xfffffe0057d43030 [crypto returns 0] 100044 D crypto_ 0xfffffe0057d43080 [crypto returns 1] 13 0 0 0 DL (threaded) [geom] 100037 D - 0xffffffff83b4c620 [g_event] 100038 D - 0xffffffff83b4c640 [g_up] 100039 D - 0xffffffff83b4c660 [g_down] 2 0 0 0 WL (threaded) [clock] 100031 I [clock (0)] 100032 I [clock (1)] 12 0 0 0 WL (threaded) [intr] 100013 I [swi6: task queue] 100014 I [swi6: Giant taskq] 100016 I [swi5: fast taskq] 100033 I [swi1: netisr 0] 100034 I [swi1: hpts] 100035 I [swi1: hpts] 100047 I [irq24: virtio_pci0] 100048 I [irq25: virtio_pci0] 100049 I [irq26: virtio_pci0] 100050 I [irq27: virtio_pci0] 100051 I [irq28: virtio_pci1] 100052 I [irq29: virtio_pci1] 100053 I [irq30: virtio_pci1] 100054 I [irq31: virtio_pci1] 100055 I [irq32: virtio_pci1] 100060 I [irq10: virtio_pci2] 100062 I [irq1: atkbd0] 100063 I [irq12: psm0] 100064 I [swi0: uart uart++] 100068 I [swi1: pf send] 11 0 0 0 RL (threaded) [idle] 100003 CanRun [idle: cpu0] 100004 CanRun [idle: cpu1] 1 0 1 0 SLs wait 0xfffffe0007809040 [init] 10 0 0 0 DL audit_w 0xffffffff83ced0e0 [audit] 0 0 0 0 DLs (threaded) [kernel] 100000 D parked 0xffffffff84c3dff0 [swapper] 100005 D - 0xfffffe0007768d00 [softirq_0] 100006 D - 0xfffffe0007768b00 [softirq_1] 100007 D - 0xfffffe0007768900 [if_io_tqg_0] 100008 D - 0xfffffe0007768700 [if_io_tqg_1] 100009 D - 0xfffffe0007768500 [if_config_tqg_0] 100010 D - 0xfffffe00083db100 [kqueue_ctx taskq] 100011 D - 0xfffffe00083db000 [jail_remove taskq] 100012 D - 0xfffffe00083dae00 [bus taskq] 100015 D - 0xfffffe00083da900 [thread taskq] 100017 D - 0xfffffe00083da600 [aiod_kick taskq] 100018 D - 0xfffffe00083da500 [deferred_unmount ta] 100019 D - 0xfffffe00083da400 [inm_free taskq] 100020 D - 0xfffffe00083da300 [in6m_free taskq] 100021 D - 0xfffffe00083da200 [linuxkpi_irq_wq] 100022 D - 0xfffffe00083da100 [linuxkpi_short_wq_0] 100023 D - 0xfffffe00083da100 [linuxkpi_short_wq_1] 100024 D - 0xfffffe00083da100 [linuxkpi_short_wq_2] 100025 D - 0xfffffe00083da100 [linuxkpi_short_wq_3] 100026 D - 0xfffffe00083da000 [linuxkpi_long_wq_0] 100027 D - 0xfffffe00083da000 [linuxkpi_long_wq_1] 100028 D - 0xfffffe00083da000 [linuxkpi_long_wq_2] 100029 D - 0xfffffe00083da000 [linuxkpi_long_wq_3] 100036 D - 0xfffffe00083d9900 [firmware taskq] 100040 D - 0xfffffe0057d47300 [crypto_0] 100041 D - 0xfffffe0057d47300 [crypto_1] 100056 D - 0xfffffe00083dd200 [vtnet0 rxq 0] 100057 D - 0xfffffe0058145500 [vtnet0 txq 0] 100058 D - 0xfffffe0058145400 [vtnet0 rxq 1] 100059 D - 0xfffffe0058145300 [vtnet0 txq 1] 100061 D vtbslp 0xfffffe0057d67400 [virtio_balloon] 100065 D - 0xffffffff827cfba0 [deadlkres] 100069 D - 0xfffffe0057d46e00 [acpi_task_0] 100070 D - 0xfffffe0057d46e00 [acpi_task_1] 100071 D - 0xfffffe0057d46e00 [acpi_task_2] 100073 D - 0xfffffe00083dca00 [mca taskq] 100074 D - 0xfffffe0057d46b00 [CAM taskq] 100076 D - 0xfffffe0057d47000 [ipsec_offload] db> show all locks Process 1007 (syz-executor) thread 0xfffffe005412a780 (100341) exclusive lockmgr ufs (ufs) r = 0 (0xfffffe006e5b6ac0) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_vnops.c:1243 exclusive sx filemon (filemon) r = 0 (0xfffffe0077a34000) locked @ /syzkaller/managers/main/kernel/sys/dev/filemon/filemon.c:367 Process 766 (syz-executor) thread 0xfffffe00540a3780 (100110) exclusive lockmgr bufwait (bufwait) r = 0 (0xfffffe0007cebb68) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_bio.c:4022 exclusive lockmgr ufs (ufs) r = 1 (0xfffffe006ded93e0) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_subr.c:3384 exclusive lockmgr ufs (ufs) r = 0 (0xfffffe006dfc5c78) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_cache.c:4844 Process 14 (bufdaemon) thread 0xfffffe00540c2780 (100093) exclusive rw SUrw (SUrw) r = 0 (0xfffffe005828dc00) locked @ /syzkaller/managers/main/kernel/sys/ufs/ffs/ffs_softdep.c:10022 exclusive lockmgr ufs (ufs) r = 0 (0xfffffe005843de30) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_subr.c:3384 db> show malloc Type InUse MemUse Requests pf_hash 6 12804K 6 linker 400 5474K 685 tcp_hpts 7 4801K 7 devbuf 4187 4323K 4212 sysctloid 35104 2068K 35179 vtbuf 24 1968K 46 kobj 330 1320K 498 newblk 11 1027K 1506 vfscache 3 1025K 3 pcb 37 678K 152 inodedep 16 518K 328 ufs_quota 1 512K 1 vfs_hash 1 512K 1 callout 2 512K 2 intr 4 472K 4 filedesc 55 437K 345 subproc 152 282K 1114 vnet_data 2 224K 2 acpitask 1 224K 1 KTRACE 100 200K 334 acpica 1674 184K 54438 vmem 5 144K 6 tidhash 3 141K 3 pagedep 12 131K 168 tfo_ccache 1 128K 1 IP reass 1 128K 1 sem 4 106K 4 DEVFS1 106 106K 123 gtaskqueue 18 98K 18 bus 1004 82K 5082 mtx_pool 3 74K 3 syncache 1 68K 1 NFSD srvcache 3 68K 3 module 522 66K 527 ddb_capture 1 64K 1 umtx 336 42K 336 kdtrace 208 41K 1384 shm 4 38K 12 hostcache 1 32K 1 DEVFS3 125 32K 135 msg 4 30K 4 kbdmux 6 28K 6 filemon 3 24K 7 temp 31 21K 1957 DEVFS_RULE 56 20K 56 ifaddr 66 19K 68 ufs_mount 4 17K 5 proc 3 17K 3 LRO 16 17K 16 tty 16 16K 16 routetbl 129 16K 409 ithread 90 15K 90 bus-sc 34 15K 1653 lltable 44 14K 46 eventhandler 163 14K 163 ifnet 7 13K 7 ether_multi 152 13K 182 kenv 95 12K 95 shmfd 7 11K 34 GEOM 49 11K 431 CAM queue 5 11K 1528 rman 82 10K 457 rpc 8 9K 8 in6_multi 65 9K 66 bmsafemap 3 9K 284 crypto 22 9K 54