panic: Caught invalid memory access at ffff8000018cbf30 size 20 op 1 Stopped at db_enter+0x17: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND *355654 80419 0 0x10 0x4000000 0 syz-executor 382718 14641 0 0x2 0x1 1 syz-executor db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff846330ad) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018cbf30,ffff80002994f0b0,14) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80002994f728,1,200000000040,ffff80002994f700) at sysctl_sysvipc+0x71c sys/kern/kern_sysctl.c:2782 kern_sysctl_dirs(33,ffff80002994f728,1,200000000040,ffff80002994f700,0,1,1ffff00005329e5c) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 kern_sysctl(ffff80002994f724,2,200000000040,ffff80002994f700,0,0,ffff80002994f970) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff800045ff6020,ffff80002994f970,ffff80002994f8e0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff80002994f970) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002994f970) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdacce8bf230, count: 6 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: Caught invalid memory access at ffff8000018cbf30 size 20 op 1 ddb{0}> show kasan KASAN: invalid write of 20 bytes at 0xffff8000018cbf30 from pc 0xffffffff8204b9bc KASAN: first bad byte at 0xffff8000018cbf33 (+3); shadow 0x03: partial granule (out-of-bounds) KASAN: 0xffff8000018cbf33 is 3 bytes inside the 16-byte malloc slot [0xffff8000018cbf30..0xffff8000018cbf40) KASAN: allocated at: #0 malloc+0xda0 sys/kern/kern_malloc.c:446 #1 sysctl_sysvipc+0x6fb sys/kern/kern_sysctl.c:2777 #2 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 #3 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 #4 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 #5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 KASAN: pc: sysctl_sysvipc+0x71c KASAN: call trace: #0 kasan_memcpy+0x1ca kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline] #0 kasan_memcpy+0x1ca sys/kern/subr_kasan.c:1025 #1 sysctl_sysvipc+0x71c sys/kern/kern_sysctl.c:2782 #2 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 #3 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 #4 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 #5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 KASAN: shadow of 0xffff8000018cbe00..0xffff8000018cc080 (1 cell = 8 bytes): 0xffff8000018cbe00: fc 08 fc 08 fc 08 08 fb fc 08 fc 08 fc 08 fc 08 0xffff8000018cbe80: fc 08 fc 08 fc 08 fc 08 fc 08 fb 08 fc 08 fc 08 >0xffff8000018cbf00: fc 08 fc 08 fc 08[03]fb 08 08 08 08 08 08 08 08 0xffff8000018cbf80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 0xffff8000018cc000: 08 08 08 08 08 08 08 fb 08 08 08 08 fb fc fc fc KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope ddb{0}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff846330ad) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018cbf30,ffff80002994f0b0,14) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80002994f728,1,200000000040,ffff80002994f700) at sysctl_sysvipc+0x71c sys/kern/kern_sysctl.c:2782 kern_sysctl_dirs(33,ffff80002994f728,1,200000000040,ffff80002994f700,0,1,1ffff00005329e5c) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 kern_sysctl(ffff80002994f724,2,200000000040,ffff80002994f700,0,0,ffff80002994f970) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff800045ff6020,ffff80002994f970,ffff80002994f8e0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff80002994f970) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002994f970) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdacce8bf230, count: -9 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80002994ee50 rbx 0xffff80002994eec0 rdx 0 rcx 0xffffffff84f02ff0 cpu_info_full_primary+0x1ff0 rax 0xffff80000016f300 r8 0x101010101010101 r9 0x8080808080808080 r10 0xffff80002994ec38 r11 0xffffffff82b69490 x86_bus_space_io_read_1 r12 0xffffffff846330ad .str.16+0x9a5ad r13 0xffffffff84f03c08 cpu_info_full_primary+0x2c08 r14 0xffffffff84f03e07 cpu_info_full_primary+0x2e07 r15 0x1 rip 0xffffffff829a9a77 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff80002994ee50 ss 0x10 db_enter+0x17: popq %rbp ddb{0}> show proc PROC (syz-executor) tid=355654 pid=80419 tcnt=2 stat=onproc flags process=10 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045ff6a80,0xffff800045ff7258 process=0xffff80003bca1838 user=0xffff800029944000, vmspace=0xffff800001c4e7b8 estcpu=36, cpticks=21, pctcpu=0.0, user=0, sys=20, intr=1 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 80419 6503 56728 0 2 0x10 0 syz-executor *80419 355654 56728 0 7 0x10 0x4000000 syz-executor 3243 216115 72286 0 2 0 0xc80 syz-executor 3243 70251 72286 0 3 0 0x4000080 kqpoll syz-executor 3243 399949 72286 0 2 0 0x4000000 syz-executor 93589 127063 1 0 3 0 0x80 nanoslp init 7232 280746 18175 0 2 0x400010 0 syz-executor 7232 245934 18175 0 3 0x400010 0x4000080 fsleep syz-executor 84273 275874 0 0 3 0x14000 0x280 nfsidl nfsio 40950 523461 0 0 3 0x14000 0x280 nfsidl nfsio 51590 77875 0 0 3 0x14000 0x280 nfsidl nfsio 33986 235057 0 0 3 0x14000 0x280 nfsidl nfsio 9157 7276 0 0 3 0x14000 0x280 nfsidl nfsio 36943 484851 0 0 3 0x14000 0x280 nfsidl nfsio 6016 338505 0 0 3 0x14000 0x280 nfsidl nfsio 18840 519985 0 0 3 0x14000 0x280 nfsidl nfsio 63131 259165 0 0 3 0x14000 0x280 nfsidl nfsio 81827 440651 0 0 3 0x14000 0x280 nfsidl nfsio 26838 46057 0 0 3 0x14000 0x280 nfsidl nfsio 34198 289600 0 0 3 0x14000 0x280 nfsidl nfsio 68437 496524 0 0 3 0x14000 0x280 nfsidl nfsio 26178 19045 0 0 3 0x14000 0x280 nfsidl nfsio 47635 364850 0 0 3 0x14000 0x280 nfsidl nfsio 78111 54264 0 0 3 0x14000 0x280 nfsidl nfsio 67114 229326 0 0 3 0x14000 0x280 nfsidl nfsio 16492 245993 0 0 3 0x14000 0x280 nfsidl nfsio 67984 98356 0 0 3 0x14000 0x280 nfsidl nfsio 42397 46343 0 0 3 0x14000 0x280 nfsidl nfsio 41378 218643 30620 0 3 0x2 0x80 piperd syz-executor 72286 77513 30620 0 2 0x2 0 syz-executor 33685 219770 30620 0 3 0x2 0x80 wait syz-executor 18175 308112 30620 0 2 0x2 0xc80 syz-executor 62361 496069 30620 0 3 0x2 0x80 piperd syz-executor 56728 397417 30620 0 2 0x2 0xc80 syz-executor 14641 382718 30620 0 7 0x2 0x1 syz-executor 30620 444630 1 0 3 0x2 0x80 wait syz-executor 65427 523876 0 0 2 0x14000 0x40000200 smr 26042 71318 0 0 3 0x14000 0x200 pgzero zerothread 29178 434192 0 0 3 0x14000 0x200 aiodoned aiodoned 55911 426815 0 0 3 0x14000 0x200 syncer update 73304 134781 0 0 3 0x14000 0x200 cleaner cleaner 56221 326034 0 0 3 0x14000 0x200 reaper reaper 10604 194119 0 0 3 0x14000 0x200 pgdaemon pagedaemon 3676 57295 0 0 3 0x14000 0x200 bored viomb 48244 250119 0 0 3 0x14000 0x40000200 acpi0 acpi0 50897 422204 0 0 3 0x14000 0x40000200 idle1 11115 21336 0 0 3 0x14000 0x200 bored softnet1 5825 365090 0 0 3 0x14000 0x200 bored softnet0 63457 89829 0 0 3 0x14000 0x200 bored systqmp 24627 456771 0 0 3 0x14000 0x200 bored systq 5339 150137 0 0 3 0x14000 0x200 tmoslp softclockmp 12864 136833 0 0 3 0x14000 0x40000200 tmoslp softclock 36914 254071 0 0 3 0x14000 0x40000200 idle0 1 294122 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks Process 5339 (softclockmp) thread 0xffff800045ffe000 (150137) shared rwlock netlock r = 0 (0xffffffff85271f18) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413 #2 mld6_fasttimo+0xa9 sys/netinet6/mld6.c:395 #3 pffasttimo+0xa4 sys/kern/uipc_domain.c:313 #4 timeout_run+0x1e3 sys/kern/kern_timeout.c:698 #5 softclock_thread_run+0x174 sys/kern/kern_timeout.c:842 #6 softclock_thread_run #7 proc_trampoline+0x10 shared rwlock timeout r = 0 (0xffffffff8525eb40) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 timeout_run+0x1ba sys/kern/kern_timeout.c:694 #2 softclock_thread_run+0x174 sys/kern/kern_timeout.c:842 #3 softclock_thread_run #4 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11048 12164K 12470K 166960K 12562 0 pcb 17 28K 30K 166960K 67 0 rtable 251 13K 14K 166960K 427 0 pf 35 22K 24K 166960K 61 0 ifaddr 43 12K 13K 166960K 59 0 ifgroup 55 2K 2K 166960K 75 0 sysctl 4 1K 13K 166960K 11 0 counters 70 42K 43K 166960K 82 0 ioctlops 0 0K 4K 166960K 1622 0 iov 0 0K 12K 166960K 11 0 mount 1 1K 1K 166960K 1 0 log 9 1K 1K 166960K 13 0 vnodes 1366 88K 88K 166960K 1904 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 3 6K 10K 166960K 24 0 VM map 2 1K 1K 166960K 2 0 sem 16 1K 1K 166960K 19 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 292K 166960K 11964 0 file desc 14 53K 93K 166960K 556 0 sigio 0 0K 0K 166960K 8 0 proc 13 46K 161K 166960K 673 0 subproc 72 9K 9K 166960K 90 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 ip_moptions 0 0K 0K 166960K 4 0 in_multi 99 7K 7K 166960K 121 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 17 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 67 465K 465K 166960K 67 0 exec 0 0K 2K 166960K 422 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 115 128K 290K 166960K 6746 0 UVM aobj 39 5K 5K 166960K 39 0 pinsyscall 1040 1850K 1864K 166960K 1776 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 14 0K 1K 166960K 38 0 temp 43 9163K 9191K 166960K 6147 0 kqueue 2 8K 70K 166960K 118 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 40 0 40 1 0 1 1 0 8 1 rtentry 176 141 0 24 6 0 6 6 0 8 0 unpcb 144 740 0 737 8 2 6 6 0 8 5 syncache 336 4 0 4 2 2 0 1 0 8 0 tcpcb 736 73 0 70 4 0 4 4 0 8 3 arp 136 23 0 4 1 0 1 1 0 8 0 inpcb 328 425 0 419 11 2 9 9 0 8 8 nd6 152 37 0 7 2 0 2 2 0 8 0 kcovpl 48 10 0 2 1 0 1 1 0 8 0 ppxss 1192 2 0 2 2 1 1 1 0 8 1 pffrag 232 2 0 0 1 0 1 1 0 482 0 pffrnode 88 2 0 0 1 0 1 1 0 8 0 pffrent 40 3 0 1 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 43 0 13 1 0 1 1 0 8 0 pfstkey 128 43 0 13 2 0 2 2 0 8 0 pfstate 448 43 0 13 5 0 5 5 0 8 0 pfrule 1360 24 0 19 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 561 0 93 30 0 30 30 0 8 0 art_table 40 562 0 93 5 0 5 5 0 8 0 art_node 32 141 0 34 1 0 1 1 0 8 0 sysvmsgpl 40 10 0 8 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 72 15 0 1 1 0 1 1 0 8 0 shmpl 112 36 0 0 2 0 2 2 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 2354 0 879 93 0 93 93 0 8 0 ffsino 296 2354 0 879 114 0 114 114 0 8 0 nchpl 144 3125 0 1416 64 0 64 64 0 8 0 vnodes 216 2740 0 0 153 0 153 153 0 8 0 namei 1024 10935 0 10935 1 0 1 1 0 8 1 percpumem 16 57 0 6 1 0 1 1 0 8 0 kstatmem 264 39 0 12 2 0 2 2 0 8 0 scxspl 216 10390 0 10390 6 4 2 3 1 8 2 plimitpl 152 144 0 135 1 0 1 1 0 8 0 sigapl 424 893 0 840 9 1 8 8 0 8 0 knotepl 120 143 0 0 5 0 5 5 0 8 0 kqueuepl 224 157 0 154 2 0 2 2 0 8 1 pipepl 344 210 0 183 3 0 3 3 0 8 0 fdescpl 528 857 0 840 3 0 3 3 0 8 0 filepl 160 5381 0 5221 19 2 17 17 0 8 8 lockfpl 104 316 0 316 2 1 1 2 0 8 1 lockfspl 48 138 0 138 1 0 1 1 0 8 1 sessionpl 144 37 0 35 1 0 1 1 0 8 0 pgrppl 48 58 0 48 1 0 1 1 0 8 0 ucredpl 104 1177 0 1171 1 0 1 1 0 8 0 zombiepl 144 843 0 840 1 0 1 1 0 8 0 processpl 1232 893 0 840 6 0 6 6 0 8 0 procpl 664 1522 0 1465 8 0 8 8 0 8 1 sosppl 176 3 0 3 1 1 0 1 0 8 0 sockpl 752 1212 0 1203 19 9 10 15 0 8 8 mcl64k 65536 4 0 0 1 0 1 1 0 8 0 mcl16k 16384 4 0 0 1 0 1 1 0 8 0 mcl9k128 9344 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 114 0 0 15 0 15 15 0 8 0 mcl2k 2048 27 0 0 3 0 3 3 0 8 0 mextrefs 64 20 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 272 0 0 17 0 17 17 0 8 0 bufpl 272 3007 0 107 194 0 194 194 0 8 0 anonpl 32 3958 0 0 32 0 32 32 0 222 0 amapchunkpl 152 20792 0 20431 22 1 21 22 0 158 4 amappl16 200 2445 0 2425 7 4 3 5 0 8 0 amappl15 192 8 0 8 1 0 1 1 0 8 1 amappl14 184 484 0 484 1 0 1 1 0 8 1 amappl13 176 132 0 132 1 0 1 1 0 8 1 amappl12 168 1118 0 1103 2 0 2 2 0 8 0 amappl11 160 13 0 13 2 1 1 1 0 8 1 amappl10 152 68 0 68 1 0 1 1 0 8 1 amappl9 144 278 0 278 2 1 1 1 0 8 1 amappl8 136 122 0 122 1 0 1 1 0 8 1 amappl7 128 159 0 156 1 0 1 1 0 8 0 amappl6 120 175 0 175 1 0 1 1 0 8 1 amappl5 112 102 0 101 1 0 1 1 0 8 0 amappl4 104 309 0 307 1 0 1 1 0 8 0 amappl3 96 4214 0 4147 4 0 4 4 0 8 1 amappl2 88 569 0 561 2 0 2 2 0 8 0 amappl1 80 12340 0 12257 16 3 13 16 0 8 5 amappl 88 5918 0 5815 5 0 5 5 0 92 0 uvmvnodes 80 107 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 38 0 0 1 0 1 1 0 8 0 uaddrrnd 24 857 0 840 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 857 0 840 1 0 1 1 0 8 0 vmmpekpl 168 8849 0 8809 3 0 3 3 0 8 1 vmmpepl 168 62088 0 61381 88 1 87 88 0 357 37 vmsppl 488 856 0 840 5 1 4 5 0 8 0 rwobjpl 80 19741 0 19337 25 1 24 25 0 8 1 pdppl 4096 1723 0 1680 103 48 55 87 0 8 12 pvpl 32 11192 0 0 92 1 91 91 0 265 0 pmappl 256 856 0 840 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 120 482 0 53 13 0 13 13 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff846330ad) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018cbf30,ffff80002994f0b0,14) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80002994f728,1,200000000040,ffff80002994f700) at sysctl_sysvipc+0x71c sys/kern/kern_sysctl.c:2782 kern_sysctl_dirs(33,ffff80002994f728,1,200000000040,ffff80002994f700,0,1,1ffff00005329e5c) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 kern_sysctl(ffff80002994f724,2,200000000040,ffff80002994f700,0,0,ffff80002994f970) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff800045ff6020,ffff80002994f970,ffff80002994f8e0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff80002994f970) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002994f970) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdacce8bf230, count: -9 ddb{0}>