panic: kernel diagnostic assertion "sin6tosa(&ro->ro_dst)->sa_family == AF_INET6" failed: file "/syzkaller/managers/multicore/kernel/sys/netinet6/in6_src.c", line 328 Stopped at db_enter+0x1c: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *205550 40049 0 0 0x4000000 0 syz-executor.5 db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff82878fb2) at panic+0x17b sys/kern/subr_prf.c:198 __assert(ffffffff828fb7a0,ffffffff828d4a4f,148,ffffffff8294d33b) at __assert+0x29 sys/kern/subr_prf.c:157 in6_selectroute(ffff800033eaab00,0,fffffd806f48c368,0) at in6_selectroute+0x228 sys/netinet6/in6_src.c:328 ip6_output(fffffd8065582e00,0,fffffd806f48c368,0,0,fffffd806f48c428) at ip6_output+0xc6a sys/netinet6/ip6_output.c:467 tcp_output(ffff8000010b0058) at tcp_output+0x2877 sys/netinet/tcp_output.c:1110 tcp_connect(fffffd806d9f37b8,fffffd80757d4a00) at tcp_connect+0x33a sys/netinet/tcp_usrreq.c:670 sys_connect(ffff80002a219d68,ffff800033eaafa0,ffff800033eaaef0) at sys_connect+0x207 sys/kern/uipc_syscalls.c:422 syscall(ffff800033eaafa0) at syscall+0x5ae mi_syscall sys/sys/syscall_mi.h:183 [inline] syscall(ffff800033eaafa0) at syscall+0x5ae sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x3ad044660c0, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: kernel diagnostic assertion "sin6tosa(&ro->ro_dst)->sa_family == AF_INET6" failed: file "/syzkaller/managers/multicore/kernel/sys/netinet6/in6_src.c", line 328 ddb{0}> trace db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff82878fb2) at panic+0x17b sys/kern/subr_prf.c:198 __assert(ffffffff828fb7a0,ffffffff828d4a4f,148,ffffffff8294d33b) at __assert+0x29 sys/kern/subr_prf.c:157 in6_selectroute(ffff800033eaab00,0,fffffd806f48c368,0) at in6_selectroute+0x228 sys/netinet6/in6_src.c:328 ip6_output(fffffd8065582e00,0,fffffd806f48c368,0,0,fffffd806f48c428) at ip6_output+0xc6a sys/netinet6/ip6_output.c:467 tcp_output(ffff8000010b0058) at tcp_output+0x2877 sys/netinet/tcp_output.c:1110 tcp_connect(fffffd806d9f37b8,fffffd80757d4a00) at tcp_connect+0x33a sys/netinet/tcp_usrreq.c:670 sys_connect(ffff80002a219d68,ffff800033eaafa0,ffff800033eaaef0) at sys_connect+0x207 sys/kern/uipc_syscalls.c:422 syscall(ffff800033eaafa0) at syscall+0x5ae mi_syscall sys/sys/syscall_mi.h:183 [inline] syscall(ffff800033eaafa0) at syscall+0x5ae sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x3ad044660c0, count: -10 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff800033eaa940 rbx 0xffffffff82c5cca7 cpu_info_full_primary+0x2ca7 rdx 0xffff80000002a5c0 rcx 0xffff80002a219d68 rax 0xffffffff82c5bff0 cpu_info_full_primary+0x1ff0 r8 0 r9 0x8080808080808080 r10 0xd207dffc9c42989a r11 0xd64b62baf729e34f r12 0xffffffff82c5caa8 cpu_info_full_primary+0x2aa8 r13 0 r14 0 r15 0x1 rip 0xffffffff82408bfc db_enter+0x1c cs 0x8 rflags 0x246 rsp 0xffff800033eaa930 ss 0x10 db_enter+0x1c: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor.5) tid=205550 pid=40049 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 forw=0xffffffffffffffff, list=0xffff80002a21ad58,0xffffffff82d5a5e0 process=0xffff8000fffec020 user=0xffff800033ea6000, vmspace=0xfffffd807cbda550 estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 49788 115158 44139 0 2 0 syz-executor.6 49788 288641 44139 0 3 0x4000080 netio syz-executor.6 37238 158221 5330 0 2 0 syz-executor.0 37238 371524 5330 0 3 0x4000080 fsleep syz-executor.0 40049 76056 3497 0 2 0 syz-executor.5 *40049 205550 3497 0 7 0x4000000 syz-executor.5 1703 474578 94319 0 2 0 syz-executor.2 1703 444567 94319 0 3 0x4000080 ttyout syz-executor.2 46117 153062 21394 0 2 0 syz-executor.1 46117 26040 21394 0 3 0x4000080 fsleep syz-executor.1 46117 243386 21394 0 3 0x4000080 fsleep syz-executor.1 44139 428321 9106 0 2 0x482 syz-executor.6 92907 112945 9106 0 2 0x2 syz-executor.4 3497 216024 9106 0 2 0x482 syz-executor.5 46129 518839 9106 0 2 0x482 syz-executor.7 15654 212955 0 0 3 0x14200 acct acct 93837 31692 9106 0 2 0x2 syz-executor.3 12340 138484 1 0 3 0x100083 ttyin getty 5330 252546 9106 0 2 0x482 syz-executor.0 21394 369389 9106 0 2 0x482 syz-executor.1 94319 173615 9106 0 2 0x482 syz-executor.2 12109 385566 0 0 3 0x14280 nfsidl nfsio 8558 266499 0 0 3 0x14280 nfsidl nfsio 58739 110350 0 0 3 0x14280 nfsidl nfsio 81948 398374 0 0 3 0x14280 nfsidl nfsio 82408 469974 0 0 3 0x14280 nfsidl nfsio 42972 183071 0 0 3 0x14280 nfsidl nfsio 33908 503240 0 0 3 0x14280 nfsidl nfsio 22086 259038 0 0 3 0x14280 nfsidl nfsio 84455 37798 0 0 3 0x14280 nfsidl nfsio 49965 191029 0 0 3 0x14280 nfsidl nfsio 20011 464948 0 0 3 0x14280 nfsidl nfsio 96368 490188 0 0 3 0x14280 nfsidl nfsio 19451 85129 0 0 3 0x14280 nfsidl nfsio 34070 359510 0 0 3 0x14280 nfsidl nfsio 28379 28749 0 0 3 0x14280 nfsidl nfsio 61785 125210 0 0 3 0x14280 nfsidl nfsio 21548 360559 0 0 3 0x14280 nfsidl nfsio 24322 478390 0 0 3 0x14280 nfsidl nfsio 74441 302401 0 0 3 0x14280 nfsidl nfsio 78203 150516 0 0 3 0x14280 nfsidl nfsio 46842 246182 0 0 3 0x14200 bored sosplice 9106 128662 60435 0 3 0x2000082 wait syz-fuzzer 9106 299096 60435 0 2 0x6000482 syz-fuzzer 9106 224231 60435 0 3 0x6000082 wait syz-fuzzer 9106 292337 60435 0 3 0x6000082 wait syz-fuzzer 9106 443494 60435 0 3 0x6000082 thrsleep syz-fuzzer 9106 476807 60435 0 3 0x6000082 wait syz-fuzzer 9106 343006 60435 0 3 0x6000082 wait syz-fuzzer 9106 426014 60435 0 3 0x6000082 wait syz-fuzzer 9106 426380 60435 0 3 0x6000082 wait syz-fuzzer 9106 39883 60435 0 3 0x6000082 thrsleep syz-fuzzer 9106 500961 60435 0 3 0x6000082 thrsleep syz-fuzzer 9106 147107 60435 0 3 0x6000082 thrsleep syz-fuzzer 9106 13344 60435 0 3 0x6000082 wait syz-fuzzer 9106 252074 60435 0 3 0x6000082 kqread syz-fuzzer 9106 426256 60435 0 3 0x6000082 thrsleep syz-fuzzer 9106 477481 60435 0 3 0x6000082 thrsleep syz-fuzzer 60435 316924 15089 0 3 0x10008a sigsusp ksh 15089 314747 22671 0 3 0x9a kqread sshd 22671 407699 1 0 3 0x88 kqread sshd 91977 438832 83775 74 3 0x1100092 bpf pflogd 83775 456361 1 0 3 0x80 netio pflogd 41165 474173 96809 73 3 0x1100090 kqread syslogd 96809 160581 1 0 3 0x100082 netio syslogd 41148 360524 1 0 3 0x100080 kqread resolvd 81256 242749 0 0 3 0x14200 bored smr 1354 298114 0 0 2 0x14200 zerothread 9240 293799 0 0 3 0x14200 aiodoned aiodoned 56163 375313 0 0 3 0x14200 syncer update 64738 283800 0 0 3 0x14200 cleaner cleaner 73375 438329 0 0 3 0x14200 reaper reaper 10054 321648 0 0 3 0x14200 pgdaemon pagedaemon 90865 405884 0 0 3 0x14200 bored viomb 81058 379479 0 0 3 0x40014200 acpi0 acpi0 48720 31456 0 0 7 0x40014200 idle1 40894 258501 0 0 3 0x14200 bored softnet3 96155 156262 0 0 3 0x14200 bored softnet2 22821 413337 0 0 3 0x14200 bored softnet1 64842 342850 0 0 3 0x14200 bored softnet0 32766 293941 0 0 3 0x14200 bored systqmp 3239 517657 0 0 3 0x14200 bored systq 23844 268184 0 0 3 0x14200 tmoslp softclockmp 20800 522266 0 0 3 0x40014200 tmoslp softclock 24815 177294 0 0 3 0x40014200 idle0 1 135674 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 40049 (syz-executor.5) thread 0xffff80002a219d68 (205550) Process 93837 (syz-executor.3) thread 0xffff80002ac78d40 (31692) ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10225 6506K 7185K 166960K 24213 0 pcb 15 20K 22K 166960K 2347 0 rtable 196 6K 8K 166960K 4198 0 pf 33 9K 10K 166960K 476 0 ifaddr 39 15K 17K 166960K 518 0 ifgroup 56 2K 2K 166960K 778 0 sysctl 4 1K 5K 166960K 16 0 counters 64 36K 37K 166960K 490 0 ioctlops 0 0K 4K 166960K 3126 0 iov 1 2K 44K 166960K 3147 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1419 89K 89K 166960K 10522 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 9K 166960K 360 0 VM map 2 1K 1K 166960K 2 0 sem 12 1K 1K 166960K 51 0 dirhash 12 2K 2K 166960K 108 0 ACPI 1697 195K 286K 166960K 12548 0 file desc 15 53K 89K 166960K 27230 0 sigio 0 0K 0K 166960K 1174 0 proc 69 67K 128K 166960K 4113 0 subproc 104 6K 6K 166960K 1336 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 1743 0 in_multi 77 5K 7K 166960K 1266 0 ether_multi 1 0K 0K 166960K 30 0 mrt 1 0K 0K 166960K 13 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 295 1314K 1314K 166960K 295 0 exec 0 0K 1K 166960K 4409 0 pfkey data 0 0K 0K 166960K 19 0 tdb 3 0K 0K 166960K 3 0 pagedep 1 8K 8K 166960K 1 0 inodedep 1 32K 32K 166960K 1 0 newblk 1 0K 0K 166960K 1 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 692 1469K 1470K 166960K 260368 0 UVM aobj 131 4K 4K 166960K 140 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 1321 0 NDP 14 0K 1K 166960K 407 0 temp 74 6716K 7352K 166960K 210289 0 kqueue 6 10K 30K 166960K 2116 0 SYN cache 2 56K 64K 166960K 4 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 24 0 0 1 0 1 1 0 8 0 rtpcb 120 1820 0 1819 21 20 1 3 0 8 0 rtentry 112 1204 0 1116 6 3 3 4 0 8 0 unpcb 144 22535 0 22519 207 198 9 11 0 8 8 syncache 320 317 0 317 43 42 1 1 0 8 1 tcpqe 32 570 0 570 37 36 1 1 0 8 1 tcpcb 808 9100 0 9081 238 225 13 15 0 8 8 arp 120 228 0 214 1 0 1 1 0 8 0 inpcb 376 23806 0 23787 338 325 13 18 0 8 6 nd6 136 291 0 273 1 0 1 1 0 8 0 pkpcb 40 153 0 153 22 21 1 1 0 8 1 kcovpl 48 91 0 83 1 0 1 1 0 8 0 ppxss 1168 68 0 68 23 23 0 1 0 8 0 pffrag 232 246 0 241 3 2 1 1 0 482 0 pffrnode 88 246 0 241 3 2 1 1 0 8 0 pffrent 40 770 0 765 5 4 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 839 0 810 1 0 1 1 0 8 0 pfstkey 128 839 0 810 5 3 2 3 0 8 0 pfstate 376 839 0 810 17 13 4 7 0 8 0 pfrule 1344 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 4352 0 3975 82 58 24 30 0 8 0 art_table 32 4353 0 3975 4 0 4 4 0 8 0 art_node 16 1146 0 1066 1 0 1 1 0 8 0 sysvmsgpl 40 40 0 0 1 0 1 1 0 8 0 semupl 112 3 0 3 1 1 0 1 0 8 0 semapl 112 44 0 34 1 0 1 1 0 8 0 shmpl 112 137 0 9 4 0 4 4 0 8 0 dirhash 1024 81 0 64 3 0 3 3 0 8 0 dino2pl 256 38056 0 36516 97 0 97 97 0 8 0 ffsino 272 38056 0 36516 104 0 104 104 0 8 0 nchpl 144 75175 0 73524 64 1 63 64 0 8 0 uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0 vnodes 216 5926 0 0 330 0 330 330 0 8 0 namei 1024 252879 0 252878 13 12 1 3 0 8 0 percpumem 16 259 0 213 1 0 1 1 0 8 0 vcpupl 2048 356 0 0 45 0 45 45 0 8 0 vmpool 696 528 0 172 34 1 33 33 0 8 0 kstatmem 264 450 0 426 4 1 3 3 0 8 0 scxspl 216 209498 0 209498 37 36 1 8 1 8 1 plimitpl 152 3091 0 3076 1 0 1 1 0 8 0 sigapl 424 27529 0 27462 23 14 9 9 0 8 0 futexpl 64 232814 0 232811 1 0 1 1 0 8 0 knotepl 120 1352 0 0 20 3 17 18 0 8 0 kqueuepl 216 6127 0 6122 115 111 4 8 0 8 3 pipepl 320 4753 0 4725 125 119 6 13 0 8 3 fdescpl 496 27384 0 27359 13 8 5 5 0 8 0 filepl 152 173872 0 173640 266 247 19 27 0 8 8 lockfpl 104 7968 0 7967 13 12 1 2 0 8 0 lockfspl 48 2059 0 2058 1 0 1 1 0 8 0 sessionpl 144 124 0 108 1 0 1 1 0 8 0 pgrppl 48 717 0 701 1 0 1 1 0 8 0 ucredpl 104 25055 0 25042 1 0 1 1 0 8 0 zombiepl 144 27464 0 27462 4 3 1 1 0 8 0 processpl 1136 27529 0 27462 6 0 6 6 0 8 0 procpl 680 72254 0 72166 16 7 9 10 0 8 0 srpgc 96 148 0 148 49 48 1 1 0 8 1 sosppl 168 390 0 390 20 19 1 1 0 8 1 sockpl 488 48349 0 48313 840 822 18 54 0 8 8 mcl64k 65536 17 0 0 3 0 3 3 0 8 0 mcl16k 16384 17 0 0 3 0 3 3 0 8 0 mcl12k 12288 25 0 0 2 0 2 2 0 8 0 mcl9k 9216 17 0 0 2 0 2 2 0 8 0 mcl8k 8192 36 0 0 4 1 3 3 0 8 0 mcl4k 4096 31 0 0 3 0 3 3 0 8 0 mcl2k2 2112 11 0 0 1 0 1 1 0 8 0 mcl2k 2048 471 0 0 34 19 15 34 0 8 0 mtagpl 96 203 0 0 5 0 5 5 0 8 0 mbufpl 256 4302 0 0 215 0 215 215 0 8 0 bufpl 288 51147 0 44828 452 0 452 452 0 8 0 anonpl 24 2665417 0 2652398 309 192 117 118 0 186 7 amapchunkpl 152 820816 0 819932 129 86 43 53 0 158 0 amappl16 200 57642 0 57161 271 236 35 39 0 8 7 amappl15 192 43 0 42 1 0 1 1 0 8 0 amappl14 184 442 0 428 2 1 1 2 0 8 0 amappl13 176 121 0 120 1 0 1 1 0 8 0 amappl12 168 29363 0 29331 4 2 2 3 0 8 0 amappl11 160 59 0 51 1 0 1 1 0 8 0 amappl10 152 183 0 165 2 1 1 1 0 8 0 amappl9 144 290 0 289 1 0 1 1 0 8 0 amappl8 136 1438 0 1206 10 1 9 9 0 8 0 amappl7 128 493 0 468 2 0 2 2 0 8 0 amappl6 120 1691 0 1668 1 0 1 1 0 8 0 amappl5 112 602 0 594 1 0 1 1 0 8 0 amappl4 104 1336 0 1296 8 6 2 2 0 8 0 amappl3 96 160442 0 160356 8 5 3 4 0 8 0 amappl2 88 29361 0 29293 3 1 2 3 0 8 0 amappl1 80 112308 0 111847 31 18 13 23 0 8 0 amappl 88 258181 0 257857 10 1 9 9 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 139 0 9 3 0 3 3 0 8 0 uaddrrnd 24 27912 0 27531 3 0 3 3 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 27912 0 27531 3 0 3 3 0 8 0 vmmpekpl 168 181700 0 181587 7 1 6 6 0 8 0 vmmpepl 168 1632277 0 1629544 572 417 155 176 0 357 0 vmsppl 448 27911 0 27531 48 5 43 43 0 8 0 rwobjpl 56 387190 0 379409 125 9 116 116 0 8 0 pdppl 4096 55831 0 55418 1439 1018 421 421 0 8 8 pvpl 32 45549 0 0 368 0 368 368 0 265 0 pmappl 248 27911 0 27531 28 3 25 25 0 8 1 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 2826 0 1370 42 0 42 42 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff82878fb2) at panic+0x17b sys/kern/subr_prf.c:198 __assert(ffffffff828fb7a0,ffffffff828d4a4f,148,ffffffff8294d33b) at __assert+0x29 sys/kern/subr_prf.c:157 in6_selectroute(ffff800033eaab00,0,fffffd806f48c368,0) at in6_selectroute+0x228 sys/netinet6/in6_src.c:328 ip6_output(fffffd8065582e00,0,fffffd806f48c368,0,0,fffffd806f48c428) at ip6_output+0xc6a sys/netinet6/ip6_output.c:467 tcp_output(ffff8000010b0058) at tcp_output+0x2877 sys/netinet/tcp_output.c:1110 tcp_connect(fffffd806d9f37b8,fffffd80757d4a00) at tcp_connect+0x33a sys/netinet/tcp_usrreq.c:670 sys_connect(ffff80002a219d68,ffff800033eaafa0,ffff800033eaaef0) at sys_connect+0x207 sys/kern/uipc_syscalls.c:422 syscall(ffff800033eaafa0) at syscall+0x5ae mi_syscall sys/sys/syscall_mi.h:183 [inline] syscall(ffff800033eaafa0) at syscall+0x5ae sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x3ad044660c0, count: -10 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x1e: addq $0x8,%rsp x86_ipi_db(ffff800029cfbff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x312 sys/dev/acpi/acpicpu.c:1206 sched_idle(ffff800029cfbff0) at sched_idle+0x41e sys/kern/kern_sched.c:183 end trace frame: 0x0, count: 10 ddb{1}> trace x86_ipi_db(ffff800029cfbff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x312 sys/dev/acpi/acpicpu.c:1206 sched_idle(ffff800029cfbff0) at sched_idle+0x41e sys/kern/kern_sched.c:183 end trace frame: 0x0, count: -5