panic: kernel diagnostic assertion "pg->wire_count == 1" failed: file "/syzkaller/managers/main/kernel/sys/kern/vfs_biomem.c", line 329 Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *472019 44212 0 0x2 0 0 syz-fuzzer db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 __assert(ffffffff821e3ce6,ffffffff821fa1e6,149,ffffffff821c31d7) at __assert+0x2b sys/kern/subr_prf.c:154 buf_free_pages(fffffd802ab0db00) at buf_free_pages+0x1ee sys/kern/vfs_biomem.c:318 buf_dealloc_mem(fffffd802ab0db00) at buf_dealloc_mem+0xe1 sys/kern/vfs_biomem.c:194 buf_put(fffffd802ab0db00) at buf_put+0x16b sys/kern/vfs_bio.c:131 brelse(fffffd802ab0db00) at brelse+0x257 sys/kern/vfs_bio.c:922 vinvalbuf(fffffd802f838de8,2,fffffd803f7c68a0,ffff8000ffff4778,0,ffffffffffffffff) at vinvalbuf+0x3b1 sys/kern/vfs_subr.c:1977 ffs_truncate(fffffd8038559790,0,4,fffffd803f7c68a0) at ffs_truncate+0xeb1 sys/ufs/ffs/ffs_inode.c:326 ufs_rmdir(ffff8000148da158) at ufs_rmdir+0x3af sys/ufs/ufs/ufs_vnops.c:1357 VOP_RMDIR(fffffd803671d9d0,fffffd802f838de8,ffff8000148da258) at VOP_RMDIR+0xf8 sys/kern/vfs_vops.c:474 dounlinkat(ffff8000ffff4778,a,c002cedbc0,8) at dounlinkat+0x14c sys/kern/vfs_syscalls.c:1818 syscall(ffff8000148da3d0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555 Xsyscall(0,145,c00002a000,145,100,de) at Xsyscall+0x128 end of kernel end trace frame: 0xc00169b978, count: 1 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic kernel diagnostic assertion "pg->wire_count == 1" failed: file "/syzkaller/managers/main/kernel/sys/kern/vfs_biomem.c", line 329 ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 __assert(ffffffff821e3ce6,ffffffff821fa1e6,149,ffffffff821c31d7) at __assert+0x2b sys/kern/subr_prf.c:154 buf_free_pages(fffffd802ab0db00) at buf_free_pages+0x1ee sys/kern/vfs_biomem.c:318 buf_dealloc_mem(fffffd802ab0db00) at buf_dealloc_mem+0xe1 sys/kern/vfs_biomem.c:194 buf_put(fffffd802ab0db00) at buf_put+0x16b sys/kern/vfs_bio.c:131 brelse(fffffd802ab0db00) at brelse+0x257 sys/kern/vfs_bio.c:922 vinvalbuf(fffffd802f838de8,2,fffffd803f7c68a0,ffff8000ffff4778,0,ffffffffffffffff) at vinvalbuf+0x3b1 sys/kern/vfs_subr.c:1977 ffs_truncate(fffffd8038559790,0,4,fffffd803f7c68a0) at ffs_truncate+0xeb1 sys/ufs/ffs/ffs_inode.c:326 ufs_rmdir(ffff8000148da158) at ufs_rmdir+0x3af sys/ufs/ufs/ufs_vnops.c:1357 VOP_RMDIR(fffffd803671d9d0,fffffd802f838de8,ffff8000148da258) at VOP_RMDIR+0xf8 sys/kern/vfs_vops.c:474 dounlinkat(ffff8000ffff4778,a,c002cedbc0,8) at dounlinkat+0x14c sys/kern/vfs_syscalls.c:1818 syscall(ffff8000148da3d0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555 Xsyscall(0,145,c00002a000,145,100,de) at Xsyscall+0x128 end of kernel end trace frame: 0xc00169b978, count: -14 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff8000148d9c30 rbx 0xffff8000148d9ce0 rdx 0x2 rcx 0 rax 0 r8 0xffff8000148d9bf0 r9 0x1 r10 0 r11 0xa96caec83353470b r12 0x3000000008 r13 0xffff8000148d9c40 r14 0x100 r15 0x1 rip 0xffffffff81c77728 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff8000148d9c20 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (syz-fuzzer) pid=472019 stat=onproc flags process=2 proc=0 pri=17, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffff4288,0xffff8000ffff5b48 process=0xffff8000148a2d98 user=0xffff8000148d5000, vmspace=0xfffffd803f014aa0 estcpu=36, cpticks=7, pctcpu=0.4 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 50206 26955 44212 0 3 0x82 nanosleep syz-executor.0 95223 250388 0 0 3 0x14200 acct acct 88395 490726 0 0 3 0x14200 bored sosplice *44212 472019 68195 0 7 0x2 syz-fuzzer 44212 488860 68195 0 3 0x4000082 nanosleep syz-fuzzer 44212 408657 68195 0 3 0x4000082 thrsleep syz-fuzzer 44212 239930 68195 0 3 0x4000082 thrsleep syz-fuzzer 44212 21127 68195 0 3 0x4000082 thrsleep syz-fuzzer 44212 85167 68195 0 3 0x4000082 thrsleep syz-fuzzer 44212 57766 68195 0 3 0x4000082 thrsleep syz-fuzzer 44212 490784 68195 0 3 0x4000082 thrsleep syz-fuzzer 68195 474950 78082 0 3 0x10008a pause ksh 78082 74386 99379 0 3 0x92 select sshd 90636 398418 1 0 3 0x100083 ttyopn getty 99379 231926 1 0 3 0x80 select sshd 87505 262896 24323 73 3 0x100090 kqread syslogd 24323 41479 1 0 3 0x100082 netio syslogd 93482 32831 1 77 3 0x100090 poll dhclient 38554 445691 1 0 3 0x80 poll dhclient 60122 56113 0 0 3 0x14200 pgzero zerothread 94130 89955 0 0 3 0x14200 aiodoned aiodoned 47372 125606 0 0 3 0x14200 syncer update 48086 452718 0 0 3 0x14200 cleaner cleaner 90240 441530 0 0 3 0x14200 reaper reaper 50446 294507 0 0 3 0x14200 pgdaemon pagedaemon 68952 419309 0 0 3 0x14200 bored crynlk 36565 396367 0 0 3 0x14200 bored crypto 55149 221804 0 0 3 0x40014200 acpi0 acpi0 36115 184277 0 0 3 0x14200 bored softnet 32652 358592 0 0 3 0x14200 bored systqmp 75964 417020 0 0 3 0x14200 bored systq 2184 297706 0 0 3 0x40014200 bored softclock 11839 473234 0 0 3 0x40014200 idle0 6783 121348 0 0 3 0x14200 bored smr 1 22294 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9589 7023K 7668K 78643K 20950 0 0 pcb 13 12K 14K 78643K 1078 0 0 rtable 124 13K 14K 78643K 2755 0 0 ifaddr 91 20K 22K 78643K 805 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 0 0K 2K 78643K 306 0 0 iov 0 0K 34K 78643K 1157 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1215 76K 77K 78643K 5253 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 57 0 0 VM map 2 0K 0K 78643K 28 0 0 sem 12 0K 1K 78643K 795 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1793 195K 288K 78643K 12645 0 0 file desc 3 5K 25K 78643K 5050 0 0 sigio 1 0K 0K 78643K 88 0 0 proc 50 38K 63K 78643K 1709 0 0 subproc 16 1K 2K 78643K 393 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 379 0 0 in_multi 23 1K 2K 78643K 498 0 0 ether_multi 1 0K 0K 78643K 46 0 0 mrt 0 0K 0K 78643K 54 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 96 424K 424K 78643K 96 0 0 exec 0 0K 1K 78643K 939 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 109 14K 32K 78643K 13102 0 0 UVM aobj 130 4K 4K 78643K 152 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 1K 78643K 1026 0 0 NDP 22 0K 1K 78643K 251 0 0 temp 224 3540K 4181K 78643K 157258 0 0 kqueue 0 0K 0K 78643K 34 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 87 0 80 1 0 1 1 0 8 0 rtpcb 80 466 0 464 1 0 1 1 0 8 0 rtentry 112 458 0 414 2 0 2 2 0 8 0 unpcb 120 2316 0 2306 2 1 1 2 0 8 0 syncache 264 27 0 27 13 13 0 1 0 8 0 tcpqe 32 4435 0 4435 4 4 0 1 0 8 0 tcpcb 544 2061 0 2053 25 24 1 12 0 8 0 ipq 40 46 0 46 18 18 0 1 0 8 0 ipqe 40 399 0 399 18 18 0 1 0 8 0 inpcb 280 14024 0 14015 50 47 3 13 0 8 2 rttmr 72 23 0 22 4 3 1 1 0 8 0 ip6q 72 1 0 1 1 1 0 1 0 8 0 nd6 48 58 0 56 4 3 1 1 0 8 0 pkpcb 40 27 0 27 11 10 1 1 0 8 1 swfcl 56 6 0 0 1 0 1 1 0 8 0 ppxss 1128 104 0 104 23 22 1 1 0 8 1 art_heap8 4096 21 0 20 12 11 1 4 0 8 0 art_heap4 256 2179 0 1967 40 24 16 18 0 8 0 art_table 32 2200 0 1987 3 0 3 3 0 8 0 art_node 16 455 0 418 1 0 1 1 0 8 0 sysvmsgpl 40 40 0 25 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 112 793 0 783 1 0 1 1 0 8 0 shmpl 112 150 0 22 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 9157 0 7764 46 0 46 46 0 8 0 ffsino 240 9157 0 7764 83 0 83 83 0 8 0 nchpl 144 16473 0 14858 61 0 61 61 0 8 0 uvmvnodes 72 7232 0 0 132 0 132 132 0 8 0 vnodes 208 7232 0 0 381 0 381 381 0 8 0 namei 1024 54253 0 54253 6 5 1 1 0 8 1 vmpool 520 26 0 26 11 10 1 1 0 8 1 scsiplug 64 7 0 7 4 4 0 1 0 8 0 scxspl 192 68083 0 68083 35 33 2 7 0 8 2 plimitpl 152 433 0 427 1 0 1 1 0 8 0 sigapl 432 5158 0 5147 2 0 2 2 0 8 0 futexpl 56 134953 0 134953 5 4 1 1 0 8 1 knotepl 112 1330 0 1311 4 2 2 2 0 8 1 kqueuepl 104 1558 0 1556 7 6 1 4 0 8 0 pipepl 112 2800 0 2785 12 11 1 2 0 8 0 fdescpl 424 5159 0 5147 2 0 2 2 0 8 0 filepl 120 44582 0 44507 36 32 4 11 0 8 1 lockfpl 104 1822 0 1821 1 0 1 1 0 8 0 lockfspl 48 608 0 607 1 0 1 1 0 8 0 sessionpl 112 38 0 29 1 0 1 1 0 8 0 pgrppl 48 88 0 79 1 0 1 1 0 8 0 ucredpl 96 5047 0 5040 1 0 1 1 0 8 0 zombiepl 144 5148 0 5147 3 2 1 1 0 8 0 processpl 864 5176 0 5147 4 0 4 4 0 8 0 procpl 632 11229 0 11193 4 0 4 4 0 8 0 sosppl 128 85 0 85 20 19 1 1 0 8 1 sockpl 384 16896 0 16877 73 68 5 22 0 8 2 mcl64k 65536 1830 0 1830 191 165 26 33 0 8 26 mcl16k 16384 51 0 51 18 18 0 1 0 8 0 mcl12k 12288 117 0 117 19 18 1 1 0 8 1 mcl9k 9216 95 0 95 21 20 1 1 0 8 1 mcl8k 8192 237 0 237 7 6 1 1 0 8 1 mcl4k 4096 496 0 496 10 9 1 1 0 8 1 mcl2k2 2112 33 0 33 18 18 0 1 0 8 0 mcl2k 2048 66418 0 66374 27 20 7 13 0 8 0 mtagpl 80 228 0 214 3 2 1 1 0 8 0 mbufpl 256 147273 0 147165 190 172 18 36 0 8 8 bufpl 256 31825 0 24593 454 1 453 453 0 8 0 anonpl 16 618398 0 601797 235 153 82 86 0 62 9 amapchunkpl 152 26427 0 26294 115 105 10 20 0 158 3 amappl16 192 30798 0 29884 249 194 55 60 0 8 8 amappl15 184 969 0 968 1 0 1 1 0 8 0 amappl14 176 1661 0 1659 2 1 1 1 0 8 0 amappl13 168 65 0 65 4 4 0 1 0 8 0 amappl12 160 1121 0 1115 1 0 1 1 0 8 0 amappl11 152 589 0 578 1 0 1 1 0 8 0 amappl10 144 694 0 692 2 1 1 1 0 8 0 amappl9 136 1206 0 1201 1 0 1 1 0 8 0 amappl8 128 745 0 711 2 0 2 2 0 8 0 amappl7 120 784 0 778 1 0 1 1 0 8 0 amappl6 112 577 0 567 1 0 1 1 0 8 0 amappl5 104 1421 0 1411 1 0 1 1 0 8 0 amappl4 96 4650 0 4623 1 0 1 1 0 8 0 amappl3 88 2486 0 2481 1 0 1 1 0 8 0 amappl2 80 38816 0 38759 4 2 2 3 0 8 0 amappl1 72 100026 0 99633 26 16 10 20 0 8 0 amappl 80 11845 0 11805 2 0 2 2 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 151 0 22 3 0 3 3 0 8 0 uaddrrnd 24 5185 0 5147 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 5185 0 5147 1 0 1 1 0 8 0 vmmpekpl 168 33559 0 33533 2 0 2 2 0 8 0 vmmpepl 168 617563 0 615752 402 295 107 133 0 357 13 vmsppl 272 5158 0 5147 3 2 1 2 0 8 0 pdppl 4096 10376 0 10346 7 2 5 6 0 8 0 pvpl 32 1695429 0 1675906 598 330 268 305 0 265 99 pmappl 200 5184 0 5173 1 0 1 1 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 1078 0 461 19 1 18 19 0 8 0