login: panic: kernel diagnostic assertion "map->limit == rtmap_limit" failed: file "/syzkaller/managers/main/kernel/sys/net/rtable.c", line 132 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *237356 29351 0 0 0x4000000 0 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8335643d) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff833982ee,ffffffff8337340c,84,ffffffff833e8215) at __assert+0x29 sys/kern/subr_prf.c:-1 rtmap_grow(9,21) at rtmap_grow+0x1f2 rtable_add(8) at rtable_add+0x289 rtable_alloc sys/net/rtable.c:370 [inline] rtable_add(8) at rtable_add+0x289 sys/net/rtable.c:223 if_createrdomain(8,ffff80000145a000) at if_createrdomain+0x40 sys/net/if.c:1978 ifioctl(ffff8000014a35e0,8020699f,ffff80003c95bbb0,ffff80003c9e22c8) at ifioctl+0x1c06 sys/net/if.c:2327 sys_ioctl(ffff80003c9e22c8,ffff80003c95bd80,ffff80003c95bcd0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80003c95bd80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c95bd80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:765 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x37680e67620, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: kernel diagnostic assertion "map->limit == rtmap_limit" failed: file "/syzkaller/managers/main/kernel/sys/net/rtable.c", line 132 ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8335643d) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff833982ee,ffffffff8337340c,84,ffffffff833e8215) at __assert+0x29 sys/kern/subr_prf.c:-1 rtmap_grow(9,21) at rtmap_grow+0x1f2 rtable_add(8) at rtable_add+0x289 rtable_alloc sys/net/rtable.c:370 [inline] rtable_add(8) at rtable_add+0x289 sys/net/rtable.c:223 if_createrdomain(8,ffff80000145a000) at if_createrdomain+0x40 sys/net/if.c:1978 ifioctl(ffff8000014a35e0,8020699f,ffff80003c95bbb0,ffff80003c9e22c8) at ifioctl+0x1c06 sys/net/if.c:2327 sys_ioctl(ffff80003c9e22c8,ffff80003c95bd80,ffff80003c95bcd0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80003c95bd80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c95bd80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:765 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x37680e67620, count: -10 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80003c95b8e0 rbx 0x21 rdx 0 rcx 0 rax 0xffff80003c9e22c8 r8 0x101010101010101 r9 0x8080808080808080 r10 0x5ba15685619daf3c r11 0x28697693942b5ba5 r12 0 r13 0x6 r14 0 r15 0x1 rip 0xffffffff8114f2b5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003c95b8d0 ss 0 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=237356 pid=29351 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=80, usrpri=81, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003c9e34f0,0xffff80003c9e2040 process=0xffff8000ffff8498 user=0xffff80003c956000, vmspace=0xfffffd806c230e70 estcpu=31, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 25616 344023 65018 0 2 0 syz-executor 25616 408734 65018 0 3 0x4000080 fsleep syz-executor 50932 128156 6296 0 2 0 syz-executor 50932 441056 6296 0 2 0x4000000 syz-executor 50932 116375 6296 0 3 0x4000080 fsleep syz-executor 93388 292456 12327 0 2 0 syz-executor 93388 34942 12327 0 3 0x4000080 fsleep syz-executor 93388 105869 12327 0 3 0x4000080 fsleep syz-executor 93388 336094 12327 0 2 0x4000000 syz-executor 29351 45511 37878 0 2 0 syz-executor *29351 237356 37878 0 7 0x4000000 syz-executor 29351 480768 37878 0 2 0x4000000 syz-executor 23118 476253 60899 0 3 0 vmmaplk syz-executor 23118 510032 60899 0 3 0x4000080 kqread syz-executor 23118 339382 60899 0 3 0x4000080 fsleep syz-executor 23118 115954 60899 0 2 0x4000000 syz-executor 99859 47494 1 0 3 0x100083 ttyin getty 33260 164326 0 0 3 0x14280 nfsidl nfsio 33879 220940 0 0 3 0x14280 nfsidl nfsio 21631 250748 0 0 3 0x14280 nfsidl nfsio 55326 295230 0 0 3 0x14280 nfsidl nfsio 87832 383608 0 0 3 0x14280 nfsidl nfsio 92899 6435 0 0 3 0x14280 nfsidl nfsio 42345 2030 0 0 3 0x14280 nfsidl nfsio 62624 329836 0 0 3 0x14280 nfsidl nfsio 89675 411752 0 0 3 0x14280 nfsidl nfsio 52877 431277 0 0 3 0x14280 nfsidl nfsio 61815 19756 0 0 3 0x14280 nfsidl nfsio 55642 69673 0 0 3 0x14280 nfsidl nfsio 6029 89121 0 0 3 0x14280 nfsidl nfsio 64854 142962 0 0 3 0x14280 nfsidl nfsio 89194 178979 0 0 3 0x14280 nfsidl nfsio 38069 438762 0 0 3 0x14280 nfsidl nfsio 42352 520352 0 0 3 0x14280 nfsidl nfsio 20618 32532 0 0 3 0x14280 nfsidl nfsio 82128 210144 0 0 3 0x14280 nfsidl nfsio 41979 374036 0 0 3 0x14280 nfsidl nfsio 93324 345801 0 0 3 0x14200 acct acct 96218 417368 24293 0 2 0x3 syz-executor 6296 144081 24293 0 2 0x3 syz-executor 18690 68310 24293 0 2 0x2 syz-executor 97790 501223 24293 0 3 0x82 wait syz-executor 12327 377890 24293 0 2 0x3 syz-executor 65018 511316 24293 0 2 0x3 syz-executor 37878 48623 24293 0 2 0x3 syz-executor 60899 451441 24293 0 2 0x3 syz-executor 24293 341568 98359 0 3 0x82 kqread syz-executor 98359 118372 99551 0 3 0x10008a sigsusp ksh 99551 431662 26758 0 3 0x98 kqread sshd-session 26758 348554 34322 0 3 0x92 kqread sshd-session 34322 280385 1 0 3 0x88 kqread sshd 26474 431673 34460 73 3 0x1100090 kqread syslogd 34460 484610 1 0 3 0x100082 sbwait syslogd 86800 260413 1 0 3 0x100080 kqread resolvd 92841 420920 43651 77 3 0x100092 kqread dhcpleased 7874 276559 43651 77 3 0x100092 kqread dhcpleased 43651 140623 1 0 3 0x80 kqread dhcpleased 82065 366758 0 0 3 0x14200 bored smr 14010 492957 0 0 2 0x14200 zerothread 98651 154974 0 0 3 0x14200 aiodoned aiodoned 37126 290926 0 0 3 0x14200 syncer update 81633 71655 0 0 3 0x14200 cleaner cleaner 8598 435188 0 0 3 0x14200 reaper reaper 63270 107262 0 0 3 0x14200 pgdaemon pagedaemon 54178 100180 0 0 3 0x14200 bored viomb 74953 43309 0 0 3 0x40014200 acpi0 acpi0 64479 314591 0 0 3 0x14200 bored softnet0 90812 385077 0 0 3 0x14200 bored systqmp 73106 222048 0 0 3 0x14200 bored systq 11784 83546 0 0 3 0x40014200 tmoslp softclock 4887 413925 0 0 3 0x40014200 idle0 1 337752 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10180 11066K 11244K 166960K 11523 0 pcb 19 12K 12K 166960K 60 0 rtable 237 7K 7K 166960K 382 0 pf 32 13K 17K 166960K 42 0 ifaddr 41 7K 7K 166960K 51 0 ifgroup 54 2K 2K 166960K 64 0 sysctl 2 1K 9K 166960K 6 0 counters 33 17K 18K 166960K 37 0 ioctlops 0 0K 4K 166960K 58 0 iov 0 0K 12K 166960K 11 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1349 85K 85K 166960K 1502 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 6 0 VM map 2 1K 1K 166960K 2 0 sem 9 0K 0K 166960K 10 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 16 57K 93K 166960K 333 0 sigio 0 0K 0K 166960K 1 0 proc 60 59K 108K 166960K 497 0 subproc 72 4K 4K 166960K 73 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 30 0 in_multi 89 6K 7K 166960K 107 0 ether_multi 1 0K 0K 166960K 5 0 mrt 0 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 79 360K 360K 166960K 79 0 exec 0 0K 1K 166960K 378 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 230 142K 161K 166960K 4762 0 UVM aobj 8 4K 4K 166960K 9 0 pinsyscall 38 76K 95K 166960K 1411 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 9 0 NDP 12 0K 2K 166960K 32 0 temp 46 8644K 8711K 166960K 9322 0 kqueue 14 22K 28K 166960K 55 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 41 0 38 1 0 1 1 0 8 0 rtentry 136 114 0 9 4 0 4 4 0 8 0 unpcb 144 167 0 152 1 0 1 1 0 8 0 syncache 336 4 0 4 2 1 1 1 0 8 1 tcpqe 32 1 0 1 1 0 1 1 0 8 1 tcpcb 736 92 0 87 4 3 1 4 0 8 0 arp 96 19 0 0 1 0 1 1 0 8 0 inpcb 328 293 0 282 11 9 2 10 0 8 0 ip6q 72 3 0 3 2 1 1 1 0 8 1 ip6af 40 6 0 6 2 1 1 1 0 8 1 nd6 112 25 0 3 1 0 1 1 0 8 0 pkpcb 40 2 0 2 2 1 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1072 3 0 3 2 1 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 487 0 71 31 4 27 31 0 8 0 art_table 40 488 0 71 5 0 5 5 0 8 0 art_node 32 114 0 18 1 0 1 1 0 8 0 sysvmsgpl 40 2 0 0 1 0 1 1 0 8 0 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 112 7 0 0 1 0 1 1 0 8 0 shmpl 112 6 0 1 1 0 1 1 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 1920 0 415 95 0 95 95 0 8 0 ffsino 256 1920 0 415 95 0 95 95 0 8 0 nchpl 144 2408 0 715 63 0 63 63 0 8 0 vnodes 216 2080 0 0 116 0 116 116 0 8 0 namei 1024 7329 0 7328 5 2 3 3 0 8 2 kstatmem 264 32 0 8 2 0 2 2 0 8 0 scsiplug 72 3 0 3 2 1 1 1 0 8 1 scxspl 216 7535 0 7535 2 1 1 2 1 8 1 plimitpl 152 60 0 43 1 0 1 1 0 8 0 sigapl 424 642 0 580 9 1 8 8 0 8 0 knotepl 120 10516 0 10466 15 0 15 15 0 8 13 kqueuepl 184 88 0 77 1 0 1 1 0 8 0 pipepl 304 121 0 93 3 0 3 3 0 8 0 fdescpl 448 609 0 580 5 1 4 5 0 8 0 filepl 120 2809 0 2589 10 2 8 10 0 8 0 lockfpl 104 71 0 69 1 0 1 1 0 8 0 lockfspl 48 32 0 30 1 0 1 1 0 8 0 sessionpl 144 23 0 15 1 0 1 1 0 8 0 pgrppl 48 34 0 18 1 0 1 1 0 8 0 ucredpl 104 355 0 344 1 0 1 1 0 8 0 zombiepl 144 668 0 667 1 0 1 1 0 8 0 processpl 1152 643 0 580 5 0 5 5 0 8 0 procpl 664 977 0 902 7 0 7 7 0 8 0 sosppl 176 4 0 4 1 1 0 1 0 8 0 sockpl 552 514 0 485 11 7 4 10 0 8 1 mcl64k 65536 25 0 25 1 0 1 1 0 8 1 mcl16k 16384 1 0 1 1 1 0 1 0 8 0 mcl12k 12288 1 0 1 1 0 1 1 0 8 1 mcl9k 9216 1 0 1 1 1 0 1 0 8 0 mcl8k 8192 8 0 8 1 0 1 1 0 8 1 mcl4k 4096 2732 0 2677 16 8 8 16 0 8 0 mcl2k2 2112 1 0 1 1 0 1 1 0 8 1 mcl2k 2048 452 0 450 3 2 1 2 0 8 0 mtagpl 96 4 0 4 1 1 0 1 0 8 0 mbufpl 256 6135 0 5943 13 0 13 13 0 8 0 bufpl 280 2717 0 122 186 0 186 186 0 8 0 anonpl 24 120605 0 117532 58 11 47 47 0 187 19 amapchunkpl 152 14714 0 14237 33 6 27 28 0 158 6 amappl16 200 2229 0 2198 17 5 12 14 0 8 8 amappl15 192 6 0 5 1 0 1 1 0 8 0 amappl14 184 7 0 7 1 1 0 1 0 8 0 amappl13 176 403 0 402 1 0 1 1 0 8 0 amappl12 168 997 0 960 2 0 2 2 0 8 0 amappl11 160 3 0 3 1 1 0 1 0 8 0 amappl10 152 46 0 36 1 0 1 1 0 8 0 amappl9 144 265 0 265 1 1 0 1 0 8 0 amappl8 136 30 0 29 1 0 1 1 0 8 0 amappl7 128 99 0 98 1 0 1 1 0 8 0 amappl6 120 280 0 269 1 0 1 1 0 8 0 amappl5 112 65 0 57 1 0 1 1 0 8 0 amappl4 104 379 0 356 1 0 1 1 0 8 0 amappl3 96 2418 0 2329 3 0 3 3 0 8 0 amappl2 88 728 0 659 2 0 2 2 0 8 0 amappl1 80 9742 0 9211 14 1 13 13 0 8 1 amappl 88 4016 0 3854 5 0 5 5 0 92 0 uvmvnodes 80 2080 0 0 43 0 43 43 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 8 0 1 1 0 1 1 0 8 0 uaddrrnd 24 608 0 580 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 608 0 580 1 0 1 1 0 8 0 vmmpekpl 168 6565 0 6535 2 0 2 2 0 8 0 vmmpepl 168 46417 0 44668 91 0 91 91 0 357 8 vmsppl 368 607 0 580 4 1 3 4 0 8 0 rwobjpl 40 17575 0 14643 32 0 32 32 0 8 0 pdppl 4096 1223 0 1160 99 32 67 81 0 8 4 pvpl 32 292413 0 283661 119 19 100 100 0 265 18 pmappl 216 607 0 580 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 382 0 57 11 0 11 11 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8335643d) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff833982ee,ffffffff8337340c,84,ffffffff833e8215) at __assert+0x29 sys/kern/subr_prf.c:-1 rtmap_grow(9,21) at rtmap_grow+0x1f2 rtable_add(8) at rtable_add+0x289 rtable_alloc sys/net/rtable.c:370 [inline] rtable_add(8) at rtable_add+0x289 sys/net/rtable.c:223 if_createrdomain(8,ffff80000145a000) at if_createrdomain+0x40 sys/net/if.c:1978 ifioctl(ffff8000014a35e0,8020699f,ffff80003c95bbb0,ffff80003c9e22c8) at ifioctl+0x1c06 sys/net/if.c:2327 sys_ioctl(ffff80003c9e22c8,ffff80003c95bd80,ffff80003c95bcd0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80003c95bd80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c95bd80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:765 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x37680e67620, count: -10 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8335643d) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff833982ee,ffffffff8337340c,84,ffffffff833e8215) at __assert+0x29 sys/kern/subr_prf.c:-1 rtmap_grow(9,21) at rtmap_grow+0x1f2 rtable_add(8) at rtable_add+0x289 rtable_alloc sys/net/rtable.c:370 [inline] rtable_add(8) at rtable_add+0x289 sys/net/rtable.c:223 if_createrdomain(8,ffff80000145a000) at if_createrdomain+0x40 sys/net/if.c:1978 ifioctl(ffff8000014a35e0,8020699f,ffff80003c95bbb0,ffff80003c9e22c8) at ifioctl+0x1c06 sys/net/if.c:2327 sys_ioctl(ffff80003c9e22c8,ffff80003c95bd80,ffff80003c95bcd0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1 syscall(ffff80003c95bd80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c95bd80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:765 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x37680e67620, count: -10