panic: kernel diagnostic assertion "pg->wire_count != 0" failed: file "/syzkaller/managers/main/kernel/sys/uvm/uvm_page.c", line 1207 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834a1b8a) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834db626,ffffffff834c0682,4b7,ffffffff8342ec12) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff500078b7b80) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff5006d0aba28,514cd5f8000,514cd5f9000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff5006d0aba28,fffff5006d164158,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff5006d0aba28) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff5006d0aba28) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80002a7747e0,0,0,1) at exit1+0x705 sys/kern/kern_exit.c:259 sys_exit(ffff80002a7747e0,ffff8000380bb710,ffff8000380bb660) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff8000380bb710) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff8000380bb710) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x718803ed87c0, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: kernel diagnostic assertion "pg->wire_count != 0" failed: file "/syzkaller/managers/main/kernel/sys/uvm/uvm_page.c", line 1207 ddb> show kasan No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834a1b8a) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834db626,ffffffff834c0682,4b7,ffffffff8342ec12) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff500078b7b80) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff5006d0aba28,514cd5f8000,514cd5f9000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff5006d0aba28,fffff5006d164158,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff5006d0aba28) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff5006d0aba28) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80002a7747e0,0,0,1) at exit1+0x705 sys/kern/kern_exit.c:259 sys_exit(ffff80002a7747e0,ffff8000380bb710,ffff8000380bb660) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff8000380bb710) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff8000380bb710) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x718803ed87c0, count: -11 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff8000380bb350 rbx 0xffff8000380c8580 rdx 0 rcx 0 rax 0xffff80002a7747e0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x8612dc02aa52a352 r11 0xc0d06f43ccf3e046 r12 0 r13 0xffffffff83574700 uvm_map_addr_RBT_INFO r14 0 r15 0x1 rip 0xffffffff81125285 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff8000380bb340 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=523871 pid=90172 tcnt=0 stat=onproc flags process=1018 proc=2000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0xffff80002a7747e0 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff80002a7742b0,0xffff80003c8f14f0 process=0xffff8000380c84a0 user=0xffff8000380b6000, vmspace=0xfffff5006d0aba28 estcpu=36, cpticks=4, pctcpu=0.0, user=0, sys=2, intr=0 ddb> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 49991 493636 20202 0 2 0 0 syz-executor 49991 391803 20202 0 2 0 0x4000000 syz-executor 91391 106306 29521 0 2 0 0xc80 syz-executor 91391 452243 29521 0 3 0 0x4000080 msgwait syz-executor 91391 174601 29521 0 3 0 0x4000080 fsleep syz-executor 53760 48176 71008 60929 2 0x10 0xc80 syz-executor 53760 347339 71008 60929 3 0x10 0x4000080 sbwait syz-executor 53760 228080 71008 60929 3 0x10 0x4000080 fsleep syz-executor 42459 154329 81746 0 2 0 0xc80 syz-executor 42459 173908 81746 0 3 0 0x4000080 netcon syz-executor 42459 179701 81746 0 3 0 0x4000080 fsleep syz-executor 45952 195101 12907 0 3 0x2 0x80 piperd syz-executor 26875 512492 12907 0 2 0x2 0xc80 syz-executor 29521 295751 12907 0 2 0x2 0xc80 syz-executor 7510 211004 12907 0 3 0x2 0x80 piperd syz-executor 20202 287183 12907 0 2 0x2 0xc80 syz-executor 71008 16614 12907 0 2 0x2 0xc80 syz-executor 81746 182470 12907 0 2 0x2 0xc80 syz-executor 12907 500042 76925 0 3 0x2 0x80 wait syz-executor 76925 314896 8764 0 3 0x100002 0x88 sigsusp ksh 8764 511674 65825 0 3 0x10 0x88 kqread sshd-session 65825 495140 95680 0 3 0x12 0x80 kqread sshd-session 84880 171574 1 0 3 0x100003 0x80 ttyin getty 95680 404058 1 0 3 0 0x88 kqread sshd 89053 493275 1520 73 3 0x1100010 0x80 kqread syslogd 1520 346714 1 0 3 0x100002 0x80 sbwait syslogd 34327 92937 1 0 3 0x100000 0x80 kqread resolvd 98544 308388 25756 77 3 0x100012 0x80 kqread dhcpleased 64950 348777 25756 77 3 0x100012 0x80 kqread dhcpleased 25756 11554 1 0 3 0 0x80 kqread dhcpleased 90134 25443 0 0 3 0x14000 0x200 bored smr 75904 154478 0 0 2 0x14000 0x200 zerothread 2379 197282 0 0 3 0x14000 0x200 aiodoned aiodoned 11830 226349 0 0 3 0x14000 0x200 syncer update 38913 445048 0 0 3 0x14000 0x200 cleaner cleaner 77022 80608 0 0 3 0x14000 0x200 reaper reaper 57539 505543 0 0 3 0x14000 0x200 pgdaemon pagedaemon 78004 205918 0 0 3 0x14000 0x200 bored viomb 64100 521647 0 0 3 0x14000 0x40000200 acpi0 acpi0 86546 286339 0 0 3 0x14000 0x200 bored softnet0 11699 276443 0 0 3 0x14000 0x200 smrbar systqmp 2739 190878 0 0 3 0x14000 0x200 bored systq 36760 227616 0 0 3 0x14000 0x40000200 tmoslp softclock 16980 150849 0 0 3 0x14000 0x40000200 idle0 1 476056 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11031 12111K 12136K 166960K 12203 0 pcb 17 12K 12K 166960K 33 0 rtable 243 7K 7K 166960K 541 0 pf 30 12K 14K 166960K 48 0 ifaddr 42 7K 7K 166960K 73 0 ifgroup 50 2K 2K 166960K 81 0 sysctl 3 1K 9K 166960K 7 0 counters 33 17K 18K 166960K 43 0 ioctlops 0 0K 4K 166960K 58 0 iov 0 0K 12K 166960K 6 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1327 83K 84K 166960K 1505 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 4 0 VM map 2 1K 1K 166960K 2 0 sem 6 0K 0K 166960K 6 0 dirhash 21 3K 3K 166960K 24 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 14 49K 97K 166960K 302 0 proc 60 59K 108K 166960K 675 0 subproc 72 4K 4K 166960K 126 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 10 0 in_multi 99 6K 6K 166960K 171 0 ether_multi 1 0K 0K 166960K 2 0 mrt 1 0K 0K 166960K 7 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 55 254K 254K 166960K 55 0 exec 0 0K 1K 166960K 441 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 209 152K 161K 166960K 3943 0 UVM aobj 4 2K 2K 166960K 4 0 pinsyscall 35 70K 96K 166960K 1538 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 15 0K 2K 166960K 47 0 temp 34 9110K 9130K 166960K 8795 0 kqueue 14 22K 26K 166960K 36 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 48 0 45 1 0 1 1 0 8 0 rtentry 136 181 0 69 4 0 4 4 0 8 0 unpcb 144 75 0 55 1 0 1 1 0 8 0 syncache 336 7 0 7 1 0 1 1 0 8 1 tcpcb 736 38 0 33 2 0 2 2 0 8 1 arp 96 31 0 12 1 0 1 1 0 8 0 inpcb 328 150 0 139 2 0 2 2 0 8 0 nd6 112 44 0 19 1 0 1 1 0 8 0 pkpcb 40 2 0 2 1 0 1 1 0 8 1 kcovpl 48 14 0 6 1 0 1 1 0 8 0 ppxss 1072 3 0 3 1 0 1 1 0 8 1 pppxif 1416 2 0 2 1 0 1 1 0 8 1 pfrule 1360 1 0 1 1 0 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 731 0 270 32 0 32 32 0 8 0 art_table 40 732 0 270 6 0 6 6 0 8 0 art_node 32 181 0 78 1 0 1 1 0 8 0 semapl 72 4 0 0 1 0 1 1 0 8 0 shmpl 120 1 0 0 1 0 1 1 0 8 0 dirhash 1024 25 0 2 3 0 3 3 0 8 0 dino2pl 256 1729 0 247 93 0 93 93 0 8 0 ffsino 256 1729 0 247 93 0 93 93 0 8 0 nchpl 144 1994 0 278 64 0 64 64 0 8 0 vnodes 216 1930 0 0 108 0 108 108 0 8 0 namei 1024 7819 0 7817 3 0 3 3 0 8 2 kstatmem 264 39 0 16 2 0 2 2 0 8 0 scxspl 216 6731 0 6731 3 0 3 3 1 8 3 plimitpl 152 43 0 25 1 0 1 1 0 8 0 sigapl 424 579 0 539 6 0 6 6 0 8 1 knotepl 120 4701 0 4653 9 0 9 9 0 8 7 kqueuepl 184 110 0 99 3 0 3 3 0 8 2 pipepl 304 142 0 115 3 0 3 3 0 8 0 fdescpl 448 566 0 540 5 0 5 5 0 8 1 filepl 120 2331 0 2113 9 0 9 9 0 8 2 lockfpl 104 157 0 153 2 0 2 2 0 8 1 lockfspl 48 16 0 12 1 0 1 1 0 8 0 sessionpl 144 32 0 24 1 0 1 1 0 8 0 pgrppl 48 48 0 32 1 0 1 1 0 8 0 ucredpl 104 250 0 237 1 0 1 1 0 8 0 zombiepl 144 541 0 539 1 0 1 1 0 8 0 processpl 1160 579 0 539 4 0 4 4 0 8 0 procpl 664 709 0 662 5 0 5 5 0 8 0 sockpl 552 278 0 244 3 0 3 3 0 8 0 mcl64k 65536 3 0 3 1 0 1 1 0 8 1 mcl16k 16384 2 0 2 1 0 1 1 0 8 1 mcl12k 12288 1 0 1 1 0 1 1 0 8 1 mcl8k 8192 5 0 5 1 0 1 1 0 8 1 mcl4k 4096 2580 0 2528 14 0 14 14 0 8 7 mcl2k 2048 277 0 277 1 0 1 1 0 8 1 mextrefs 64 80 0 79 1 0 1 1 0 8 0 mtagpl 96 4 0 4 1 0 1 1 0 8 1 mbufpl 256 5356 0 5200 12 0 12 12 0 8 1 bufpl 272 4916 0 102 321 0 321 321 0 8 0 anonpl 24 93656 0 85914 48 0 48 48 0 187 0 amapchunkpl 152 11131 0 10436 29 0 29 29 0 158 1 amappl16 200 1088 0 1066 4 0 4 4 0 8 2 amappl15 192 4 0 4 1 0 1 1 0 8 1 amappl14 184 529 0 528 1 0 1 1 0 8 0 amappl13 176 126 0 116 1 0 1 1 0 8 0 amappl12 168 821 0 795 2 0 2 2 0 8 0 amappl11 160 5 0 5 1 0 1 1 0 8 1 amappl10 152 58 0 48 1 0 1 1 0 8 0 amappl9 144 327 0 327 1 0 1 1 0 8 1 amappl8 136 113 0 112 1 0 1 1 0 8 0 amappl7 128 148 0 137 1 0 1 1 0 8 0 amappl6 120 210 0 209 1 0 1 1 0 8 0 amappl5 112 88 0 80 1 0 1 1 0 8 0 amappl4 104 276 0 259 1 0 1 1 0 8 0 amappl3 96 1992 0 1905 3 0 3 3 0 8 0 amappl2 88 657 0 590 2 0 2 2 0 8 0 amappl1 80 11074 0 10537 13 0 13 13 0 8 1 amappl 88 3154 0 3007 4 0 4 4 0 92 0 uvmvnodes 80 99 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 0 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 0 1 1 0 8 1 dma128 128 253 0 253 1 0 1 1 0 8 1 dma64 64 6 0 6 1 0 1 1 0 8 1 dma32 32 7 0 7 1 0 1 1 0 8 1 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 3 0 0 1 0 1 1 0 8 0 uaddrrnd 24 566 0 539 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 566 0 539 1 0 1 1 0 8 0 vmmpekpl 168 6327 0 6290 2 0 2 2 0 8 0 vmmpepl 168 44636 0 42981 81 0 81 81 0 357 4 vmsppl 368 565 0 539 4 0 4 4 0 8 1 rwobjpl 40 15205 0 14285 10 0 10 10 0 8 0 pdppl 4096 1138 0 1078 96 28 68 82 0 8 8 pvpl 32 262595 0 235385 223 0 223 223 0 265 1 pmappl 216 565 0 539 3 0 3 3 0 8 1 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 688 0 28 19 0 19 19 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834a1b8a) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834db626,ffffffff834c0682,4b7,ffffffff8342ec12) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff500078b7b80) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff5006d0aba28,514cd5f8000,514cd5f9000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff5006d0aba28,fffff5006d164158,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff5006d0aba28) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff5006d0aba28) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80002a7747e0,0,0,1) at exit1+0x705 sys/kern/kern_exit.c:259 sys_exit(ffff80002a7747e0,ffff8000380bb710,ffff8000380bb660) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff8000380bb710) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff8000380bb710) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x718803ed87c0, count: -11 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834a1b8a) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834db626,ffffffff834c0682,4b7,ffffffff8342ec12) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff500078b7b80) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff5006d0aba28,514cd5f8000,514cd5f9000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff5006d0aba28,fffff5006d164158,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff5006d0aba28) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff5006d0aba28) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80002a7747e0,0,0,1) at exit1+0x705 sys/kern/kern_exit.c:259 sys_exit(ffff80002a7747e0,ffff8000380bb710,ffff8000380bb660) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff8000380bb710) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff8000380bb710) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x718803ed87c0, count: -11