panic: Caught invalid memory access at ffff8000018d1490 size 20 op 1 Stopped at db_enter+0x17: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND * 53065 55070 0 0 0x4000000 0 syz-executor 66445 74949 0 0x2 0x1 1 syz-executor db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018d1490,ffff8000299b78d0,14) at kasan_memcpy+0x1ec sysvipc_infoout(200000000180,ffff8000299b7f20,ffff8000299b78d0,14,18,68,1ffff00005336f0c,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713 sysctl_sysvipc(ffff8000299b7f48,1,200000000180,ffff8000299b7f20) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1 kern_sysctl_dirs(33,ffff8000299b7f48,1,200000000180,ffff8000299b7f20,0,1,1ffff00005336f60) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 kern_sysctl(ffff8000299b7f44,2,200000000180,ffff8000299b7f20,0,fffa,ffff8000299b81a0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff800045ff5a10,ffff8000299b81a0,ffff8000299b8100) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff8000299b81a0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff8000299b81a0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdab886c2300, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: Caught invalid memory access at ffff8000018d1490 size 20 op 1 ddb{0}> show kasan KASAN: invalid write of 20 bytes at 0xffff8000018d1490 from pc 0xffffffff83484679 KASAN: first bad byte at 0xffff8000018d1497 (+7); shadow 0x07: partial granule (out-of-bounds) KASAN: 0xffff8000018d1497 is 7 bytes inside the 16-byte malloc slot [0xffff8000018d1490..0xffff8000018d14a0) KASAN: allocated at: #0 malloc+0xda0 sys/kern/kern_malloc.c:446 #1 sysvipc_infoout+0x18e sys/kern/kern_sysctl.c:2711 #2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1 #3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 #4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 #5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 #6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 #7 Xsyscall+0x128 KASAN: pc: sysvipc_infoout+0x1a9 KASAN: call trace: #0 kasan_memcpy+0x1ca kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline] #0 kasan_memcpy+0x1ca sys/kern/subr_kasan.c:1025 #1 sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713 #2 sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1 #3 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 #4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 #5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 #6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 #7 Xsyscall+0x128 KASAN: shadow of 0xffff8000018d1380..0xffff8000018d1600 (1 cell = 8 bytes): 0xffff8000018d1380: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 0xffff8000018d1400: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 04 fb 08 fb >0xffff8000018d1480: 08 fb[07]fb fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 0xffff8000018d1500: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 0xffff8000018d1580: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope ddb{0}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018d1490,ffff8000299b78d0,14) at kasan_memcpy+0x1ec sysvipc_infoout(200000000180,ffff8000299b7f20,ffff8000299b78d0,14,18,68,1ffff00005336f0c,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713 sysctl_sysvipc(ffff8000299b7f48,1,200000000180,ffff8000299b7f20) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1 kern_sysctl_dirs(33,ffff8000299b7f48,1,200000000180,ffff8000299b7f20,0,1,1ffff00005336f60) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 kern_sysctl(ffff8000299b7f44,2,200000000180,ffff8000299b7f20,0,fffa,ffff8000299b81a0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff800045ff5a10,ffff8000299b81a0,ffff8000299b8100) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff8000299b81a0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff8000299b81a0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdab886c2300, count: -10 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff8000299b7610 rbx 0xffff8000299b7680 rdx 0 rcx 0xffffffff850aeff0 cpu_info_full_primary+0x1ff0 rax 0xffff80000016e480 r8 0x101010101010101 r9 0x8080808080808080 r10 0x1 r11 0xffffffff8263c7e0 x86_bus_space_io_read_1 r12 0xffffffff84634053 .str.5+0x9c553 r13 0xffffffff850afc08 cpu_info_full_primary+0x2c08 r14 0xffffffff850afe07 cpu_info_full_primary+0x2e07 r15 0x1 rip 0xffffffff81fd2ec7 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff8000299b7610 ss 0x10 db_enter+0x17: popq %rbp ddb{0}> show proc PROC (syz-executor) tid=53065 pid=55070 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045ff42b8,0xffffffff85e2a4c0 process=0xffff800045ff8018 user=0xffff8000299ad000, vmspace=0xffff800001c767c0 estcpu=36, cpticks=22, pctcpu=0.0, user=0, sys=21, intr=1 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 55070 340976 74949 0 2 0 0xc80 syz-executor *55070 53065 74949 0 7 0 0x4000000 syz-executor 29102 454477 1 0 3 0 0x80 nanoslp init 77526 386741 83593 0 3 0x2 0x80 piperd syz-executor 24656 167418 83593 0 3 0x2 0x80 piperd syz-executor 90894 81421 83593 0 3 0x2 0x80 piperd syz-executor 80377 197604 83593 0 3 0x2 0x80 wait syz-executor 74949 66445 83593 0 7 0x2 0x1 syz-executor 90531 363014 83593 0 3 0x2 0x80 piperd syz-executor 74360 165733 83593 0 2 0x2 0xc80 syz-executor 83593 422835 1 0 3 0x2 0x80 wait syz-executor 36842 492441 93844 74 3 0x1100012 0x80 bpf pflogd 93844 201547 1 0 3 0 0x80 sbwait pflogd 86585 241373 0 0 2 0x14000 0x40000200 smr 56814 196959 0 0 3 0x14000 0x200 pgzero zerothread 68817 248001 0 0 3 0x14000 0x200 aiodoned aiodoned 54536 73805 0 0 3 0x14000 0x200 syncer update 28125 294096 0 0 3 0x14000 0x200 cleaner cleaner 42348 19959 0 0 3 0x14000 0x200 reaper reaper 17647 38888 0 0 3 0x14000 0x200 pgdaemon pagedaemon 3953 30803 0 0 3 0x14000 0x200 bored viomb 69680 61371 0 0 3 0x14000 0x40000200 acpi0 acpi0 58555 196313 0 0 3 0x14000 0x40000200 idle1 45780 22116 0 0 3 0x14000 0x200 bored softnet1 41735 421453 0 0 3 0x14000 0x200 bored softnet0 94180 165172 0 0 3 0x14000 0x200 bored systqmp 46964 296376 0 0 3 0x14000 0x200 bored systq 327 74283 0 0 3 0x14000 0x200 tmoslp softclockmp 84129 211626 0 0 3 0x14000 0x40000200 tmoslp softclock 55275 156778 0 0 3 0x14000 0x40000200 idle0 1 32352 0 0 3 0x80002 0x80 wait init 0 0 -1 0 3 0x10010000 0x200 scheduler swapper ddb{0}> show all locks ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11066 12394K 12405K 166960K 12416 0 pcb 17 28K 30K 166960K 53 0 rtable 237 12K 13K 166960K 471 0 pf 39 23K 26K 166960K 78 0 ifaddr 45 13K 13K 166960K 68 0 ifgroup 62 2K 2K 166960K 89 0 sysctl 3 1K 13K 166960K 9 0 counters 74 43K 43K 166960K 88 0 ioctlops 0 0K 4K 166960K 1540 0 iov 0 0K 16K 166960K 78 0 mount 1 1K 1K 166960K 1 0 log 4 12K 12K 166960K 8 0 vnodes 1301 84K 84K 166960K 1622 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 2 2K 6K 166960K 23 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 1K 166960K 23 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 292K 166960K 11964 0 file desc 12 45K 89K 166960K 463 0 sigio 0 0K 0K 166960K 5 0 proc 23 46K 193K 166960K 701 0 subproc 72 9K 9K 166960K 108 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 ip_moptions 0 0K 0K 166960K 9 0 in_multi 99 7K 7K 166960K 143 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 14 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 67 465K 465K 166960K 67 0 exec 0 0K 2K 166960K 442 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 108 131K 252K 166960K 5686 0 UVM aobj 99 5K 5K 166960K 103 0 pinsyscall 1042 1808K 1819K 166960K 1731 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 2 0 NDP 14 0K 2K 166960K 45 0 temp 37 9162K 9174K 166960K 5161 0 kqueue 2 8K 53K 166960K 80 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 47 0 46 1 0 1 1 0 8 0 rtentry 176 155 0 45 6 0 6 6 0 8 0 unpcb 144 253 0 251 2 1 1 2 0 8 0 syncache 336 4 0 4 1 1 0 1 0 8 0 tcpcb 736 169 0 167 7 3 4 7 0 8 3 arp 136 26 0 8 1 0 1 1 0 8 0 inpcb 328 407 0 405 7 0 7 7 0 8 6 nd6 152 36 0 12 1 0 1 1 0 8 0 kcovpl 48 12 0 4 1 0 1 1 0 8 0 ppxss 1192 2 0 1 2 1 1 1 0 8 0 pffrag 232 2 0 0 1 0 1 1 0 482 0 pffrnode 88 2 0 0 1 0 1 1 0 8 0 pffrent 40 2 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfqueue 320 1 0 1 1 1 0 1 0 8 0 pfstitem 24 34 0 2 1 0 1 1 0 8 0 pfstkey 128 34 0 2 2 0 2 2 0 8 0 pfstate 448 34 0 2 4 0 4 4 0 8 0 pfrule 1360 37 0 32 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 635 0 179 30 1 29 29 0 8 0 art_table 40 636 0 179 5 0 5 5 0 8 0 art_node 32 155 0 55 1 0 1 1 0 8 0 sysvmsgpl 40 3 0 3 1 1 0 1 0 8 0 semupl 112 3 0 3 1 0 1 1 0 8 1 semapl 72 20 0 10 1 0 1 1 0 8 0 shmpl 112 100 0 4 3 0 3 3 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 2070 0 590 93 0 93 93 0 8 0 ffsino 296 2070 0 590 114 0 114 114 0 8 0 nchpl 144 2663 0 953 64 0 64 64 0 8 0 vnodes 216 2298 0 0 128 0 128 128 0 8 0 namei 1024 8624 0 8624 2 1 1 2 0 8 1 percpumem 16 60 0 7 1 0 1 1 0 8 0 kstatmem 264 45 0 14 3 0 3 3 0 8 0 scxspl 216 9290 0 9290 11 4 7 8 1 8 7 plimitpl 152 44 0 34 1 0 1 1 0 8 0 sigapl 424 776 0 743 7 1 6 7 0 8 0 knotepl 120 102 0 0 3 0 3 3 0 8 0 kqueuepl 224 174 0 171 5 0 5 5 0 8 4 pipepl 344 197 0 170 3 0 3 3 0 8 0 fdescpl 528 759 0 742 3 0 3 3 0 8 0 filepl 160 3605 0 3442 16 0 16 16 0 8 3 lockfpl 104 95 0 95 1 0 1 1 0 8 1 lockfspl 48 44 0 44 1 0 1 1 0 8 1 sessionpl 144 39 0 35 1 0 1 1 0 8 0 pgrppl 48 53 0 41 1 0 1 1 0 8 0 ucredpl 104 587 0 582 1 0 1 1 0 8 0 zombiepl 144 746 0 743 1 0 1 1 0 8 0 processpl 1232 776 0 743 5 1 4 5 0 8 0 procpl 664 1241 0 1207 6 0 6 6 0 8 0 sosppl 176 5 0 5 1 0 1 1 0 8 1 sockpl 752 712 0 707 11 1 10 11 0 8 8 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 118 0 0 15 0 15 15 0 8 0 mcl2k 2048 20 0 0 3 0 3 3 0 8 0 mextrefs 64 17 0 0 1 0 1 1 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 160 0 0 10 0 10 10 0 8 0 bufpl 272 2872 0 106 185 0 185 185 0 8 0 anonpl 32 3767 0 0 31 0 31 31 0 222 0 amapchunkpl 152 16818 0 16568 22 2 20 22 0 158 1 amappl16 200 2025 0 2004 5 2 3 5 0 8 1 amappl15 192 59 0 59 1 1 0 1 0 8 0 amappl14 184 526 0 526 1 0 1 1 0 8 1 amappl13 176 133 0 131 1 0 1 1 0 8 0 amappl12 168 1038 0 1023 2 0 2 2 0 8 0 amappl11 160 13 0 13 1 0 1 1 0 8 1 amappl10 152 86 0 81 1 0 1 1 0 8 0 amappl9 144 289 0 289 1 1 0 1 0 8 0 amappl8 136 113 0 111 1 0 1 1 0 8 0 amappl7 128 163 0 159 1 0 1 1 0 8 0 amappl6 120 196 0 195 1 0 1 1 0 8 0 amappl5 112 101 0 97 1 0 1 1 0 8 0 amappl4 104 357 0 350 1 0 1 1 0 8 0 amappl3 96 3391 0 3336 4 1 3 4 0 8 0 amappl2 88 580 0 565 2 0 2 2 0 8 0 amappl1 80 12152 0 12019 15 2 13 15 0 8 2 amappl 88 4848 0 4759 5 1 4 5 0 92 0 uvmvnodes 80 106 0 0 3 0 3 3 0 8 0 dma32768 32768 1 0 1 1 1 0 1 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 7 0 7 2 2 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 102 0 4 2 0 2 2 0 8 0 uaddrrnd 24 759 0 742 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 759 0 742 1 0 1 1 0 8 0 vmmpekpl 168 8175 0 8136 3 0 3 3 0 8 0 vmmpepl 168 56649 0 55924 87 0 87 87 0 357 35 vmsppl 488 758 0 742 5 0 5 5 0 8 1 rwobjpl 80 18475 0 17947 25 1 24 24 0 8 1 pdppl 4096 1527 0 1484 105 52 53 85 0 8 10 pvpl 32 10911 0 0 88 0 88 88 0 265 0 pmappl 256 758 0 742 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 120 471 0 63 14 0 14 14 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84634053) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018d1490,ffff8000299b78d0,14) at kasan_memcpy+0x1ec sysvipc_infoout(200000000180,ffff8000299b7f20,ffff8000299b78d0,14,18,68,1ffff00005336f0c,dfff908000000000) at sysvipc_infoout+0x1a9 sys/kern/kern_sysctl.c:2713 sysctl_sysvipc(ffff8000299b7f48,1,200000000180,ffff8000299b7f20) at sysctl_sysvipc+0x224 sys/kern/kern_sysctl.c:-1 kern_sysctl_dirs(33,ffff8000299b7f48,1,200000000180,ffff8000299b7f20,0,1,1ffff00005336f60) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 kern_sysctl(ffff8000299b7f44,2,200000000180,ffff8000299b7f20,0,fffa,ffff8000299b81a0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff800045ff5a10,ffff8000299b81a0,ffff8000299b8100) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff8000299b81a0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff8000299b81a0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdab886c2300, count: -10 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x19: leave x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412 x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc ktrsysret(ffff800029913c98,5b,0,ffff800029a34200) at ktrsysret+0x14d ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline] ktrsysret(ffff800029913c98,5b,0,ffff800029a34200) at ktrsysret+0x14d sys/kern/kern_ktrace.c:209 syscall(ffff800029a342a0) at syscall+0x473 mi_syscall_return sys/sys/syscall_mi.h:204 [inline] syscall(ffff800029a342a0) at syscall+0x473 sys/arch/amd64/amd64/trap.c:804 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x711d2c6a4f80, count: 8 ddb{1}> trace x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412 x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc ktrsysret(ffff800029913c98,5b,0,ffff800029a34200) at ktrsysret+0x14d ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline] ktrsysret(ffff800029913c98,5b,0,ffff800029a34200) at ktrsysret+0x14d sys/kern/kern_ktrace.c:209 syscall(ffff800029a342a0) at syscall+0x473 mi_syscall_return sys/sys/syscall_mi.h:204 [inline] syscall(ffff800029a342a0) at syscall+0x473 sys/arch/amd64/amd64/trap.c:804 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x711d2c6a4f80, count: -7 ddb{1}>