panic: MNT_DEFERRED requires MNT_RECURSE | MNT_FORCE cpuid = 1 time = 1768621226 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056fd9610 kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056fd9770 vpanic() at vpanic+0x257/frame 0xfffffe0056fd9930 panic() at panic+0xb5/frame 0xfffffe0056fd99f0 dounmount() at dounmount+0x1783/frame 0xfffffe0056fd9b30 kern_unmount() at kern_unmount+0x648/frame 0xfffffe0056fd9d10 amd64_syscall() at amd64_syscall+0x4e2/frame 0xfffffe0056fd9f30 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0056fd9f30 --- syscall (198, FreeBSD ELF64, __syscall), rip = 0x3a817a, rsp = 0x825f02f08, rbp = 0x825f02f80 --- KDB: enter: panic [ thread pid 891 tid 100203 ] Stopped at kdb_enter+0x6e: movq $0,0x2587a77(%rip) db> db> set $lines = 0 db> set $maxwidth = 0 db> show registers cs 0x20 ds 0x3b es 0x3b fs 0x13 gs 0x1b ss 0x28 rax 0x12 rcx 0xfffffe0002bf1850 rdx 0 rbx 0xffffffff8283c160 .str.27 rsp 0xfffffe0056fd9750 rbp 0xfffffe0056fd9770 rsi 0 rdi 0xffffffff81664139 printf+0x149 r8 0 r9 0xffffffff r10 0 r11 0x7f r12 0xfffffe0058b0e780 r13 0xfffffffffffffffd r14 0xffffffff8283c160 .str.27 r15 0 rip 0xffffffff8164d41e kdb_enter+0x6e rflags 0x46 kdb_enter+0x6e: movq $0,0x2587a77(%rip) db> show proc Process 891 (syz-executor) at 0xfffffe0058aecac0: state: NORMAL uid: 0 gid: 0 supp gids: 0, 5 parent: pid 763 at 0xfffffe0058aea558 ABI: FreeBSD ELF64 flag: 0x10000080 flag2: 0 arguments: ./syz-executor exec reaper: 0xfffffe0007809010 reapsubtree: 1 sigparent: 20 vmspace: 0xfffffe0058ab0db0 (map 0xfffffe0058ab0db0) (map.pmap 0xfffffe0058ab0e50) (pmap 0xfffffe0058ab0ec0) threads: 2 100155 RunQ syz-executor 100203 Run CPU 1 syz-executor db> ps pid ppid pgrp uid state wmesg wchan cmd 891 763 763 0 R (threaded) syz-executor 100155 RunQ syz-executor 100203 Run CPU 1 syz-executor 890 1 890 0 Ss+ ttyin 0xfffffe0007bf70b0 getty 888 765 765 0 R (threaded) syz-executor 100103 Run CPU 0 syz-executor 100201 S lockf 0xfffffe005800d300 syz-executor 100204 D getblk 0xfffffe0007c02ba0 syz-executor 887 766 766 0 R (threaded) syz-executor 100116 RunQ syz-executor 100200 D getblk 0xfffffe0007c02ba0 syz-executor 878 1 878 0 Ss+ ttyin 0xfffffe0007bf90b0 getty 877 1 765 0 S uwait 0xfffffe00585f4c00 syz-executor 872 1 766 0 S uwait 0xfffffe0059a39780 syz-executor 871 1 871 0 Ss+ ttyin 0xfffffe0007bf80b0 getty 869 764 764 0 S (threaded) syz-executor 100096 S nanslp 0xffffffff83bb5f41 syz-executor 100184 S select 0xfffffe006ebe9e40 syz-executor 100186 S uwait 0xfffffe0059a3b500 syz-executor 867 1 867 0 Ss+ ttyin 0xfffffe005422dcb0 getty 865 1 865 0 Ss+ ttyin 0xfffffe005994f0b0 getty 863 1 766 0 S uwait 0xfffffe00585f4500 syz-executor 861 1 861 0 Ss+ ttyin 0xfffffe0007bf78b0 getty 858 1 858 0 Ss+ ttyin 0xfffffe005994f8b0 getty 854 1 854 0 Ss+ ttyin 0xfffffe00542308b0 getty 851 1 764 0 S uwait 0xfffffe0059a3c000 syz-executor 836 0 0 0 DL aiordy 0xfffffe0058aed570 [aiod4] 835 0 0 0 DL aiordy 0xfffffe0058b0bac0 [aiod3] 834 0 0 0 DL aiordy 0xfffffe0058b0b010 [aiod2] 833 0 0 0 DL aiordy 0xfffffe0058b0aab8 [aiod1] 776 769 423 0 R sh 769 1 423 0 D rangelk 0xfffffe006e36bbe8 sh 766 762 766 0 S nanslp 0xffffffff83bb5f41 syz-executor 765 762 765 0 S nanslp 0xffffffff83bb5f41 syz-executor 764 762 764 0 S nanslp 0xffffffff83bb5f41 syz-executor 763 762 763 0 S nanslp 0xffffffff83bb5f40 syz-executor 762 1 760 0 S select 0xfffffe006df993c0 syz-executor 740 1 740 0 Ds+ biowr 0xfffffe0007c02b20 getty 735 1 17 0 D+ rangelk 0xfffffe006e36bbe8 sh 16 0 0 0 DL syncer 0xffffffff83ce3ae0 [syncer] 15 0 0 0 DL vlruwt 0xfffffe0058a02558 [vnlru] 14 0 0 0 DL (threaded) [bufdaemon] 100079 D psleep 0xffffffff83ce2020 [bufdaemon] 100082 D - 0xffffffff83001ec0 [bufspacedaemon-0] 100091 D sdflush 0xfffffe0057f1fce8 [/ worker] 9 0 0 0 DL psleep 0xffffffff83d23380 [vmdaemon] 8 0 0 0 DL (threaded) [pagedaemon] 100077 D psleep 0xffffffff83d09448 [dom0] 100080 D launds 0xffffffff83d09454 [laundry: dom0] 100081 D umarcl 0xffffffff81e37c30 [uma] 7 0 0 0 DL - 0xffffffff8392e510 [rand_harvestq] 6 0 0 0 DL pftm 0xffffffff844c9f80 [pf purge] 5 0 0 0 DL waiting 0xffffffff84797700 [sctp_iterator] 4 0 0 0 DL (threaded) [cam] 100045 D - 0xffffffff838f8340 [doneq0] 100046 D - 0xffffffff838f82c0 [async] 100075 D - 0xffffffff838f8140 [scanner] 3 0 0 0 DL (threaded) [crypto] 100042 D crypto_ 0xffffffff83d04ce0 [crypto] 100043 D crypto_ 0xfffffe00077af830 [crypto returns 0] 100044 D crypto_ 0xfffffe00077af880 [crypto returns 1] 13 0 0 0 DL (threaded) [geom] 100037 D - 0xffffffff83b5e520 [g_event] 100038 D - 0xffffffff83b5e540 [g_up] 100039 D - 0xffffffff83b5e560 [g_down] 2 0 0 0 WL (threaded) [clock] 100031 I [clock (0)] 100032 I [clock (1)] 12 0 0 0 WL (threaded) [intr] 100013 I [swi6: task queue] 100014 I [swi6: Giant taskq] 100016 I [swi5: fast taskq] 100033 I [swi1: netisr 0] 100034 I [swi1: hpts] 100035 I [swi1: hpts] 100047 I [irq24: virtio_pci0] 100048 I [irq25: virtio_pci0] 100049 I [irq26: virtio_pci0] 100050 I [irq27: virtio_pci0] 100051 I [irq28: virtio_pci1] 100052 I [irq29: virtio_pci1] 100053 I [irq30: virtio_pci1] 100054 I [irq31: virtio_pci1] 100055 I [irq32: virtio_pci1] 100060 I [irq10: virtio_pci2] 100062 I [irq1: atkbd0] 100063 I [irq12: psm0] 100064 I [swi0: uart uart++] 100068 I [swi1: pf send] 11 0 0 0 RL (threaded) [idle] 100003 CanRun [idle: cpu0] 100004 CanRun [idle: cpu1] 1 0 1 0 SLs wait 0xfffffe0007809010 [init] 10 0 0 0 DL audit_w 0xffffffff83d05780 [audit] 0 0 0 0 DLs (threaded) [kernel] 100000 D - 0xffffffff84c5dff0 [kernel] 100005 D - 0xfffffe00077cb000 [softirq_0] 100006 D - 0xfffffe00077cae00 [softirq_1] 100007 D - 0xfffffe00077cad00 [if_io_tqg_0] 100008 D - 0xfffffe00077cac00 [if_io_tqg_1] 100009 D - 0xfffffe00077cab00 [if_config_tqg_0] 100010 D - 0xfffffe00077caa00 [kqueue_ctx taskq] 100011 D - 0xfffffe00077ca900 [jail_remove taskq] 100012 D - 0xfffffe00077ca800 [bus taskq] 100015 D - 0xfffffe00077ca500 [thread taskq] 100017 D - 0xfffffe00077ca300 [aiod_kick taskq] 100018 D - 0xfffffe00077ca200 [deferred_unmount ta] 100019 D - 0xfffffe00077ca100 [inm_free taskq] 100020 D - 0xfffffe00077ca000 [in6m_free taskq] 100021 D - 0xfffffe00077c9e00 [linuxkpi_irq_wq] 100022 D - 0xfffffe00077c9d00 [linuxkpi_short_wq_0] 100023 D - 0xfffffe00077c9d00 [linuxkpi_short_wq_1] 100024 D - 0xfffffe00077c9d00 [linuxkpi_short_wq_2] 100025 D - 0xfffffe00077c9d00 [linuxkpi_short_wq_3] 100026 D - 0xfffffe00077c9c00 [linuxkpi_long_wq_0] 100027 D - 0xfffffe00077c9c00 [linuxkpi_long_wq_1] 100028 D - 0xfffffe00077c9c00 [linuxkpi_long_wq_2] 100029 D - 0xfffffe00077c9c00 [linuxkpi_long_wq_3] 100036 D - 0xfffffe00077c9b00 [firmware taskq] 100040 D - 0xfffffe00077c9100 [crypto_0] 100041 D - 0xfffffe00077c9100 [crypto_1] 100056 D - 0xfffffe00077c8900 [vtnet0 rxq 0] 100057 D - 0xfffffe00077c8800 [vtnet0 txq 0] 100058 D - 0xfffffe00077c8700 [vtnet0 rxq 1] 100059 D - 0xfffffe00077c8600 [vtnet0 txq 1] 100061 D vtbslp 0xfffffe005800d900 [virtio_balloon] 100065 D - 0xffffffff82840841 [deadlkres] 100069 D - 0xfffffe00077c8b00 [acpi_task_0] 100070 D - 0xfffffe00077c8b00 [acpi_task_1] 100071 D - 0xfffffe00077c8b00 [acpi_task_2] 100073 D - 0xfffffe00077cb100 [mca taskq] 100074 D - 0xfffffe00077c8a00 [CAM taskq] 100076 D - 0xfffffe00077c8300 [ipsec_offload] 736 735 17 0 Z+ sleep 846 776 423 0 Z sh db> show all locks Process 888 (syz-executor) thread 0xfffffe0058b18000 (100204) exclusive lockmgr ufs (ufs) r = 0 (0xfffffe006b862908) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_vnops.c:1783 Process 887 (syz-executor) thread 0xfffffe0058b1b000 (100200) exclusive lockmgr ufs (ufs) r = 0 (0xfffffe006e1bc908) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_syscalls.c:3592 Process 740 (getty) thread 0xfffffe0058a0e000 (100089) exclusive lockmgr bufwait (bufwait) r = 0 (0xfffffe0007c02ba0) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_bio.c:4024 exclusive lockmgr ufs (ufs) r = 0 (0xfffffe0077c0cc78) locked @ /syzkaller/managers/main/kernel/sys/kern/coredump_vnode.c:192 db> show malloc Type InUse MemUse Requests pf_hash 6 12804K 6 devbuf 8283 7252K 8308 linker 385 5207K 507 tcp_hpts 8 4865K 8 sysctloid 35065 2066K 35140 vtbuf 24 1968K 46 kobj 337 1348K 501 newblk 82 1045K 1498 vfscache 3 1025K 3 pcb 27 673K 81 inodedep 25 521K 192 ufs_quota 1 512K 1 vfs_hash 1 512K 1 callout 2 512K 2 intr 4 472K 4 vnet_data 2 224K 2 acpitask 1 224K 1 subproc 115 218K 959 KTRACE 101 201K 583 filedesc 25 197K 165 acpica 1674 184K 56977 vmem 5 143K 6 tidhash 3 141K 3 pagedep 12 131K 78 tfo_ccache 1 128K 1 IP reass 1 128K 1 sem 4 106K 4 DEVFS1 106 106K 123 gtaskqueue 18 98K 18 bus 1015 83K 5167 LRO 20 83K 20 mtx_pool 3 74K 3 syncache 1 68K 1 NFSD srvcache 3 68K 3 module 529 67K 529 ddb_capture 1 64K 1 umtx 304 38K 304 kdtrace 179 36K 1097 hostcache 1 32K 1 shm 1 32K 2 DEVFS3 125 32K 135 msg 4 30K 4 temp 71 30K 3292 kbdmux 6 28K 6 DEVFS_RULE 56 20K 56 ifaddr 71 20K 73 ufs_mount 4 17K 5 proc 3 17K 3 tty 16 16K 16 routetbl 124 16K 395 lltable 48 15K 48 ithread 90 15K 90 bus-sc 34 15K 1690 eventhandler 170 14K 170 ether_multi 152 13K 167 kenv 95 12K 95 GEOM 49 11K 431 CAM queue 5 11K 1528 rman 75 10K 430 shmfd 4 10K 4 rpc 8 9K 8 in6_multi 65 9K 65 bmsafemap 3 9K 147 devstat 4 9K 4 UART 12 9K 12 ksem 1 8K 1 pfs_vncache 1 8K 1 audit_evclass 240 8K 306 taskqueue 69 8K 84 cred 18 7K 198 plimit 17 7K 447 ifnet 7 7K 7 sglist 6 7K 6 CAM DEV 3 6K 510 pfs_nodes 22 6K 22 ufs_dirhash 24 5K 24 UMA 268 5K 268 pf_ifnet 10 5K 19 vt 11 5K 11 memdesc 1 4K 1 MCA 32 4K 32 evdev 4 4K 4 acpisem 28 4K 28 lockf 33 4K 108 kqueue 49 4K 913 pwddesc 46 3K 905 terminal 11 3K 11 DEVFSP 43 3K 55 acpidev 20 3K 20 hhook 8 3K 10 kcovinfo 36 3K 36 netlink 2 3K 70 uidinfo 2 3K 6 local_apic 1 2K 1 io_apic 1 2K 1 ipsec-saq 2 2K 2 clone 8 2K 8 ip6ndp 13 2K 15 proc-args 61 2K 1936 diradd 14 2K 131 Unitno 30 2K 238 sctp_ifa 13 2K 14 session 13 2K 41 CAM XPT 22 2K 543 in_multi 6 2K 9 tun 4 2K 4 toponodes 6 2K 6 freefrag 11 2K 303 ipsecpolicy 2 2K 2 indirdep 5 2K 37 msi 9 2K 9 selfd 17 2K 24126 softdep 1 1K 1 dirrem 4 1K 107 sahead 1 1K 1 secasvar 1 1K 1 nhops 6 1K 8 vnodemarker 2 1K 14 NFSD session 1 1K 1 mld 7 1K 7 igmp 7 1K 7 CAM periph 4 1K 271 sctp_ifn 6 1K 14 sctp_atcl 2 1K 8 ipsec 3 1K 3 pfil 6 1K 6 BPF 6 1K 19 isadev 6 1K 6 mount 16 1K 122 pci_link 10 1K 10 crypto 4 1K 4 CC Mem 5 1K 18 encap_export_host 12 1K 12 osd 10 1K 35 newdirblk 4 1K 66 freefile 4 1K 88 cdev 2 1K 2 lkpikmalloc 8 1K 9 counter_rate 13 1K 13 mkdir 3 1K 132 inpcbpolicy 12 1K 203 chacha20random 1 1K 1 biobuf 1 1K 1 sctp_timw 1 1K 1 vnodes 1 1K 2 select 2 1K 27 NFSD lckfile 1 1K 1 NFSD V4client 1 1K 1 DEVFS 9 1K 10 CAM SIM 2 1K 2 cryptodev 3 1K 41 tcpfunc 3 1K 3 loginclass 3 1K 5 prison 6 1K 6 nexusdev 8 1K 8 apmdev 1 1K 1 atkbddev 2 1K 2 aio 4 1K 4 pmchooks 1 1K 1 CAM path 4 1K 1034 CAM dev queue 2 1K 2 CAM I/O Scheduler 1 1K 1 sctp_vrf 1 1K 1 sctp_atky 2 1K 9 freework 1 1K 163 vnet 1 1K 1 pmc 1 1K 1 entropy 2 1K 32 acpiintr 1 1K 1 sctp_athm 2 1K 8 cpus 2 1K 2 vnet_data_free 1 1K 1 Per-cpu 1 1K 1 p1003.1b 1 1K 1 tcp_pcm_rack 0 0K 0 tcp_do_rack 0 0K 0 tcp_fsb_rack 0 0K 0 sctp_mcore 0