kernel: protection fault trap, code=0 Stopped at bpfdetach+0x70: movq 0(%r15),%r12 ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic the kernel did not panic ddb{0}> show kasan No such command ddb{0}> trace bpfdetach(ffff800001617800) at bpfdetach+0x70 sys/net/bpf.c:1770 if_detach(ffff800001617800) at if_detach+0x12b sys/net/if.c:1289 tun_clone_destroy(ffff800001617800) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343 if_clone_destroy(ffff80003c3d3780) at if_clone_destroy+0x205 sys/net/if.c:1479 ifioctl(ffff800010fda8e8,80206979,ffff80003c3d3780,ffff80002a221ca0) at ifioctl+0x59d sys/net/if.c:2160 sys_ioctl(ffff80002a221ca0,ffff80003c3d3960,ffff80003c3d38b0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1 syscall(ffff80003c3d3960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3d3960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4370de62fe0, count: -8 ddb{0}> show registers rdi 0xffff8000387b3000 rsi 0x16cbe acpi_pdirpa+0x2b2f rbp 0xffff80003c3d35a0 rbx 0x80206979 __kernel_virt_to_phys+0x206979 rdx 0xffff8000387b3000 rcx 0x16cbd acpi_pdirpa+0x2b2e rax 0xffffffff82c54119 bpfdetach+0xb9 r8 0 r9 0xffffffffffffffff r10 0x11b9df3c0e82e955 r11 0xf018b627856d462f r12 0xdeaf0002deaf4152 r13 0xffff800001617e48 r14 0xffff800001617800 r15 0xdeaf0002deaf4152 rip 0xffffffff82c540d0 bpfdetach+0x70 cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80003c3d3570 ss 0x10 bpfdetach+0x70: movq 0(%r15),%r12 ddb{0}> show proc PROC (syz-executor) tid=575 pid=10310 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045fe9248,0xffff800045fe82c8 process=0xffff800045fedcf8 user=0xffff80003c3ce000, vmspace=0xfffff0000d979d78 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 12524 486091 19125 0 2 0 0 syz-executor 42160 296944 3520 0 3 0 0x80 nanoslp syz-executor 42160 63240 3520 0 3 0 0x4000080 kqsel syz-executor 10310 498245 88980 0 2 0 0xc80 syz-executor *10310 575 88980 0 7 0 0x4000000 syz-executor 16933 449748 74318 0 2 0 0 syz-executor 16933 366189 74318 0 3 0 0x4000080 semwait syz-executor 16933 76208 74318 0 3 0 0x4000080 fsleep syz-executor 88980 450678 28440 0 3 0x2 0x80 nanoslp syz-executor 94718 432075 28440 0 2 0x2 0xc80 syz-executor 55212 173309 28440 0 2 0x2 0xc80 syz-executor 43263 430397 28440 0 3 0x2 0x80 wait syz-executor 74318 178455 28440 0 2 0x2 0xc80 syz-executor 3520 107754 28440 0 3 0x2 0x80 nanoslp syz-executor 31182 265822 28440 0 3 0x2 0 kmmaplk syz-executor 19125 523843 28440 0 3 0x2 0x80 nanoslp syz-executor 28440 475485 68949 0 3 0x2 0x80 kqread syz-executor 68949 473566 91909 0 3 0x100002 0x88 sigsusp ksh 91909 476655 38983 0 3 0x10 0x88 kqread sshd-session 38983 435774 30000 0 3 0x12 0x80 kqread sshd-session 45586 209233 1 0 3 0x100003 0x80 ttyin getty 30000 166592 1 0 3 0 0x88 kqread sshd 53611 340117 85775 74 3 0x1100012 0x80 bpf pflogd 85775 236748 1 0 3 0 0x80 sbwait pflogd 93994 306818 85292 73 3 0x1100010 0x80 kqread syslogd 85292 415433 1 0 3 0x100002 0x80 sbwait syslogd 49653 498793 1 0 3 0x100000 0x80 kqread resolvd 42812 438381 38149 77 3 0x100012 0x80 kqread dhcpleased 92371 434513 38149 77 3 0x100012 0x80 kqread dhcpleased 38149 110632 1 0 3 0 0x80 kqread dhcpleased 56752 301630 0 0 3 0x14000 0x200 bored smr 2619 337638 0 0 2 0x14000 0x200 zerothread 79919 66120 0 0 3 0x14000 0x200 aiodoned aiodoned 38091 192008 0 0 3 0x14000 0x200 syncer update 76363 22156 0 0 3 0x14000 0x200 cleaner cleaner 30880 324733 0 0 2 0x14000 0x200 reaper 68018 231865 0 0 3 0x14000 0x200 pgdaemon pagedaemon 63620 258938 0 0 3 0x14000 0x200 bored viomb 38594 351008 0 0 3 0x14000 0x40000200 acpi0 acpi0 98581 487462 0 0 3 0x14000 0x40000200 idle1 45097 152869 0 0 3 0x14000 0x200 bored softnet1 58374 361427 0 0 3 0x14000 0x200 bored softnet0 85023 212880 0 0 3 0x14000 0x200 bored systqmp 14190 424252 0 0 3 0x14000 0x200 bored systq 18103 281651 0 0 3 0x14000 0x200 tmoslp softclockmp 82247 372594 0 0 3 0x14000 0x40000200 tmoslp softclock 25211 430714 0 0 3 0x14000 0x40000200 idle0 1 194573 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks Process 10310 (syz-executor) thread 0xffff80002a221ca0 (575) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83aafe80) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1 #2 sleep_finish+0x2d8 sys/kern/kern_synch.c:369 #3 rw_do_enter_write+0x1dc sys/kern/kern_rwlock.c:298 #4 lf_purgelocks+0x2f sys/kern/vfs_lockf.c:731 #5 vgonel+0x47e sys/kern/vfs_subr.c:1232 #6 vop_generic_revoke+0x3ea sys/kern/vfs_default.c:124 #7 VOP_REVOKE+0x65 sys/kern/vfs_vops.c:291 #8 vdevgone+0x17b sys/kern/vfs_subr.c:-1 #9 bpfsdetach+0x155 sys/net/bpf.c:1794 #10 bpfdetach+0xa6 sys/net/bpf.c:-1 #11 if_detach+0x12b sys/net/if.c:1289 #12 tun_clone_destroy+0x2ce sys/net/if_tun.c:343 #13 if_clone_destroy+0x205 sys/net/if.c:1479 #14 ifioctl+0x59d sys/net/if.c:2160 #15 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #16 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #16 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #17 Xsyscall+0x128 exclusive rwlock clonelk r = 0 (0xffffffff839d33c8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 if_clone_destroy+0x93 sys/net/if.c:-1 #3 ifioctl+0x59d sys/net/if.c:2160 #4 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #5 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 Process 30880 (reaper) thread 0xffff800045ffdc90 (324733) exclusive rwlock kmmaplk r = 0 (0xffffffff83ab1fc8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5170 #3 uvm_unmap+0x7d sys/uvm/uvm_map.c:1798 #4 km_free+0x85 sys/uvm/uvm_km.c:714 #5 uvm_uarea_free+0x4f sys/uvm/uvm_glue.c:304 #6 reaper+0x1ca sys/kern/kern_exit.c:495 #7 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11070 12338K 12343K 166960K 12252 0 pcb 18 12K 12K 166960K 68 0 rtable 219 6K 7K 166960K 361 0 pf 34 17K 19K 166960K 54 0 ifaddr 39 6K 7K 166960K 47 0 ifgroup 51 2K 2K 166960K 59 0 sysctl 3 1K 9K 166960K 7 0 counters 68 36K 37K 166960K 82 0 ioctlops 0 0K 4K 166960K 1510 0 iov 0 0K 1K 166960K 1 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1294 81K 82K 166960K 1460 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 13 0K 0K 166960K 20 0 dirhash 12 2K 2K 166960K 18 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 15 53K 93K 166960K 257 0 proc 71 115K 164K 166960K 557 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 2 0K 0K 166960K 26 0 in_multi 88 6K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 11 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 49 228K 228K 166960K 49 0 exec 0 0K 1K 166960K 389 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 209 158K 168K 166960K 4106 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 40 80K 108K 166960K 1413 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 11 0K 1K 166960K 30 0 temp 40 9115K 9122K 166960K 5975 0 kqueue 14 22K 24K 166960K 46 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 33 0 30 1 0 1 1 0 8 0 rtentry 176 115 0 15 6 0 6 6 0 8 0 unpcb 144 104 0 87 1 0 1 1 0 8 0 syncache 336 4 0 4 1 1 0 1 0 8 0 tcpcb 736 28 0 23 1 0 1 1 0 8 0 arp 136 18 0 2 1 0 1 1 0 8 0 inpcb 328 156 0 146 2 0 2 2 0 8 1 nd6 152 25 0 3 1 0 1 1 0 8 0 pkpcb 40 6 0 6 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 6 0 6 1 0 1 1 0 8 1 pfstscr 40 2 0 2 1 0 1 1 0 8 1 pfosfp 40 1428 0 1428 5 0 5 5 0 8 5 pfosfpen 112 1428 0 1428 21 0 21 21 0 8 21 pfstitem 24 27 0 0 1 0 1 1 0 8 0 pfstkey 128 29 0 2 1 0 1 1 0 8 0 pfstate 448 28 0 1 3 0 3 3 0 8 0 pfrule 1360 25 0 19 2 0 2 2 0 8 0 rttmr 136 3 0 3 1 0 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 468 0 44 30 0 30 30 0 8 1 art_table 40 469 0 44 5 0 5 5 0 8 0 art_node 32 115 0 24 1 0 1 1 0 8 0 sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1 semapl 72 17 0 7 1 0 1 1 0 8 0 dirhash 1024 21 0 4 3 0 3 3 0 8 0 dino2pl 256 1754 0 287 93 0 93 93 0 8 0 ffsino 296 1754 0 287 114 0 114 114 0 8 0 nchpl 144 2098 0 398 64 0 64 64 0 8 0 vnodes 216 1921 0 0 107 0 107 107 0 8 0 namei 1024 6329 0 6329 3 2 1 2 0 8 1 percpumem 16 57 0 7 1 0 1 1 0 8 0 kstatmem 264 31 0 6 2 0 2 2 0 8 0 scxspl 216 7187 0 7187 4 3 1 3 1 8 1 plimitpl 152 32 0 15 1 0 1 1 0 8 0 sigapl 424 574 0 527 7 1 6 7 0 8 0 knotepl 120 295 0 0 9 0 9 9 0 8 0 kqueuepl 224 49 0 39 1 0 1 1 0 8 0 pipepl 344 131 0 104 3 0 3 3 0 8 0 fdescpl 528 558 0 529 3 0 3 3 0 8 0 filepl 160 2076 0 1854 10 0 10 10 0 8 0 lockfpl 104 43 0 39 1 0 1 1 0 8 0 lockfspl 48 23 0 19 1 0 1 1 0 8 0 sessionpl 144 29 0 20 1 0 1 1 0 8 0 pgrppl 48 37 0 20 1 0 1 1 0 8 0 ucredpl 104 163 0 149 1 0 1 1 0 8 0 zombiepl 144 557 0 554 1 0 1 1 0 8 0 processpl 1232 574 0 527 5 1 4 5 0 8 0 procpl 664 729 0 677 6 0 6 6 0 8 1 sockpl 752 310 0 280 5 0 5 5 0 8 1 mcl64k 65536 10 0 0 2 0 2 2 0 8 0 mcl16k 16384 8 0 0 1 0 1 1 0 8 0 mcl12k 12288 2 0 0 1 0 1 1 0 8 0 mcl9k128 9344 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 4 0 0 1 0 1 1 0 8 0 mcl4k 4096 113 0 0 15 0 15 15 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 35 0 0 5 0 5 5 0 8 0 mextrefs 64 31 0 0 1 0 1 1 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 174 0 0 11 0 11 11 0 8 0 bufpl 272 2497 0 105 160 0 160 160 0 8 0 anonpl 32 5497 0 0 46 1 45 46 0 247 0 amapchunkpl 152 11657 0 11255 25 1 24 24 0 158 4 amappl16 200 1646 0 1624 5 3 2 5 0 8 0 amappl15 192 4 0 4 1 1 0 1 0 8 0 amappl14 184 431 0 430 1 0 1 1 0 8 0 amappl13 176 142 0 130 1 0 1 1 0 8 0 amappl12 168 814 0 786 2 0 2 2 0 8 0 amappl11 160 10 0 9 1 0 1 1 0 8 0 amappl10 152 86 0 72 1 0 1 1 0 8 0 amappl9 144 292 0 292 1 1 0 1 0 8 0 amappl8 136 97 0 95 1 0 1 1 0 8 0 amappl7 128 152 0 139 1 0 1 1 0 8 0 amappl6 120 157 0 156 1 0 1 1 0 8 0 amappl5 112 91 0 81 1 0 1 1 0 8 0 amappl4 104 294 0 274 1 0 1 1 0 8 0 amappl3 96 2191 0 2096 3 0 3 3 0 8 0 amappl2 88 535 0 475 2 0 2 2 0 8 0 amappl1 80 10824 0 10231 15 0 15 15 0 8 2 amappl 88 3361 0 3223 4 0 4 4 0 92 0 uvmvnodes 80 106 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 558 0 529 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 558 0 529 1 0 1 1 0 8 0 vmmpekpl 168 6400 0 6362 2 0 2 2 0 8 0 vmmpepl 168 43980 0 42202 87 1 86 87 0 357 2 vmsppl 488 557 0 527 5 0 5 5 0 8 1 rwobjpl 80 15412 0 14415 25 2 23 25 0 8 0 pdppl 4096 1123 0 1054 97 26 71 85 0 8 2 pvpl 32 13431 0 0 110 1 109 109 0 265 0 pmappl 256 557 0 527 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 435 0 31 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace bpfdetach(ffff800001617800) at bpfdetach+0x70 sys/net/bpf.c:1770 if_detach(ffff800001617800) at if_detach+0x12b sys/net/if.c:1289 tun_clone_destroy(ffff800001617800) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343 if_clone_destroy(ffff80003c3d3780) at if_clone_destroy+0x205 sys/net/if.c:1479 ifioctl(ffff800010fda8e8,80206979,ffff80003c3d3780,ffff80002a221ca0) at ifioctl+0x59d sys/net/if.c:2160 sys_ioctl(ffff80002a221ca0,ffff80003c3d3960,ffff80003c3d38b0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1 syscall(ffff80003c3d3960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3d3960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4370de62fe0, count: -8 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83aaf680) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff83aaf680) at __mp_lock+0x199 sys/kern/kern_lock.c:173 exit1(ffff800045fe9ca8,0,0,1) at exit1+0x720 sys/kern/kern_exit.c:260 sys_exit(ffff800045fe9ca8,ffff80003c3ed140,ffff80003c3ed090) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80003c3ed140) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3ed140) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x76c4f9a71ad0, count: -8