login: panic: pool_do_get: shmpl free list modified: page 0xfffffd806ad6c000; item addr 0xfffffd806ad6c380; offset 0x40=0x682bf40b Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 225253 95780 0 0 0 1 syz-executor *179376 95780 0 0 0x4000000 0K syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff833cc140) at panic+0x1e5 sys/kern/subr_prf.c:198 pool_do_get(ffffffff838dbc50,1,ffff80003bc09d18) at pool_do_get+0x5ea sys/kern/subr_pool.c:-1 pool_get(ffffffff838dbc50,1) at pool_get+0x149 sys/kern/subr_pool.c:-1 shmget_allocate_segment(ffff8000ffff19c0,ffff80003bc09f70,0,ffff80003bc09ec0) at shmget_allocate_segment+0x1a7 sys/kern/sysv_shm.c:-1 sys_shmget(ffff8000ffff19c0,ffff80003bc09f70,ffff80003bc09ec0) at sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 syscall(ffff80003bc09f70) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003bc09f70) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x2ac7e7cccb0, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: pool_do_get: shmpl free list modified: page 0xfffffd806ad6c000; item addr 0xfffffd806ad6c380; offset 0x40=0x682bf40b ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff833cc140) at panic+0x1e5 sys/kern/subr_prf.c:198 pool_do_get(ffffffff838dbc50,1,ffff80003bc09d18) at pool_do_get+0x5ea sys/kern/subr_pool.c:-1 pool_get(ffffffff838dbc50,1) at pool_get+0x149 sys/kern/subr_pool.c:-1 shmget_allocate_segment(ffff8000ffff19c0,ffff80003bc09f70,0,ffff80003bc09ec0) at shmget_allocate_segment+0x1a7 sys/kern/sysv_shm.c:-1 sys_shmget(ffff8000ffff19c0,ffff80003bc09f70,ffff80003bc09ec0) at sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 syscall(ffff80003bc09f70) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003bc09f70) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x2ac7e7cccb0, count: -8 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80003bc09b50 rbx 0xffffffff83852dd7 cpu_info_full_primary+0x2dd7 rdx 0xffff800000045080 rcx 0xffff8000ffff19c0 rax 0xffffffff83851ff0 cpu_info_full_primary+0x1ff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x4093626683170b52 r11 0x348ce81bcb32335e r12 0xffffffff83852bd8 cpu_info_full_primary+0x2bd8 r13 0 r14 0 r15 0x1 rip 0xffffffff83296a45 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003bc09b40 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=179376 pid=95780 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000ffff0f80,0xffffffff83909320 process=0xffff80003bc14020 user=0xffff80003bc05000, vmspace=0xfffffd806aed7d40 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 95780 225253 44465 0 7 0 syz-executor *95780 179376 44465 0 7 0x4000000 syz-executor 41173 307554 76939 0 3 0x90 nanoslp syz-executor 41173 142024 76939 0 3 0x4000090 kqsel syz-executor 41173 152527 76939 0 3 0x4000090 fsleep syz-executor 5311 215925 64262 0 3 0x80 nanoslp syz-executor 5311 441442 64262 0 3 0x4000080 kqsel syz-executor 5311 191994 64262 0 3 0x4000080 fsleep syz-executor 37607 355137 99535 0 3 0x80 nanoslp syz-executor 37607 517856 99535 0 3 0x4000080 rest syz-executor 37607 92406 99535 0 3 0x4000080 fsleep syz-executor 32140 441270 43378 0 3 0x80 nanoslp syz-executor 32140 516220 43378 0 3 0x4000080 kqsel syz-executor 32140 132836 43378 0 3 0x4000080 fsleep syz-executor 72240 422321 69669 0 3 0x80 nanoslp syz-executor 72240 440078 69669 0 3 0x4000080 kqread syz-executor 72240 25573 69669 0 3 0x4000080 fsleep syz-executor 72240 235333 69669 0 3 0x4000080 fsleep syz-executor 76939 1502 64685 0 3 0x82 nanoslp syz-executor 69458 449051 1 0 3 0x100083 ttyin getty 64262 29888 64685 0 3 0x82 nanoslp syz-executor 7723 191236 0 0 3 0x14200 bored sosplice 69741 360628 64685 0 3 0x82 wait syz-executor 99535 362703 64685 0 3 0x82 nanoslp syz-executor 43378 491878 64685 0 3 0x82 nanoslp syz-executor 69669 221908 64685 0 3 0x82 nanoslp syz-executor 23866 489448 64685 0 3 0x82 wait syz-executor 44465 203126 64685 0 3 0x82 nanoslp syz-executor 64685 7838 88103 0 3 0x82 kqread syz-executor 88103 460374 83978 0 3 0x10008a sigsusp ksh 83978 140314 83655 0 3 0x98 kqread sshd-session 83655 41606 13015 0 3 0x92 kqread sshd-session 13015 337245 1 0 3 0x88 kqread sshd 33688 422949 74632 74 3 0x1100092 bpf pflogd 74632 289986 1 0 3 0x80 sbwait pflogd 35268 26162 44434 73 3 0x1100090 kqread syslogd 44434 441759 1 0 3 0x100082 sbwait syslogd 56753 141351 1 0 3 0x100080 kqread resolvd 64765 170561 21950 77 3 0x100092 kqread dhcpleased 55831 48322 21950 77 3 0x100092 kqread dhcpleased 21950 137521 1 0 3 0x80 kqread dhcpleased 997 160787 0 0 3 0x14200 bored smr 9803 386631 0 0 3 0x14200 pgzero zerothread 81599 186480 0 0 3 0x14200 aiodoned aiodoned 97564 97099 0 0 3 0x14200 syncer update 32598 268527 0 0 3 0x14200 cleaner cleaner 42342 295059 0 0 3 0x14200 reaper reaper 31694 117159 0 0 3 0x14200 pgdaemon pagedaemon 61057 357845 0 0 3 0x14200 bored viomb 2969 206947 0 0 3 0x40014200 acpi0 acpi0 31912 470688 0 0 3 0x40014200 idle1 99151 503151 0 0 3 0x14200 bored softnet3 80480 396912 0 0 3 0x14200 bored softnet2 11708 494249 0 0 3 0x14200 bored softnet1 60766 291259 0 0 3 0x14200 bored softnet0 71067 221549 0 0 3 0x14200 bored systqmp 81352 406875 0 0 3 0x14200 bored systq 442 391766 0 0 3 0x14200 tmoslp softclockmp 72595 238303 0 0 3 0x40014200 tmoslp softclock 57837 286526 0 0 3 0x40014200 idle0 1 285020 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex shmpl r = 0 (0xffffffff838dbc68) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 mtx_enter_try+0x178 sys/kern/kern_lock.c:-1 #2 mtx_enter+0x60 sys/kern/kern_lock.c:239 #3 pool_get+0x10b sys/kern/subr_pool.c:583 #4 shmget_allocate_segment+0x1a7 sys/kern/sysv_shm.c:-1 #5 sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 #6 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 #7 Xsyscall+0x128 Process 95780 (syz-executor) thread 0xffff8000ffff19c0 (179376) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff838f47b0) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 syscall+0xae6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #1 syscall+0xae6 sys/arch/amd64/amd64/trap.c:579 #2 Xsyscall+0x128 exclusive mutex shmpl r = 0 (0xffffffff838dbc68) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1160 #1 mtx_enter_try+0x178 sys/kern/kern_lock.c:-1 #2 mtx_enter+0x60 sys/kern/kern_lock.c:239 #3 pool_get+0x10b sys/kern/subr_pool.c:583 #4 shmget_allocate_segment+0x1a7 sys/kern/sysv_shm.c:-1 #5 sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 #6 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 #7 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10225 11099K 12518K 166960K 13136 0 pcb 18 14K 15K 166960K 119 0 rtable 198 10K 11K 166960K 531 0 pf 40 18K 82K 166960K 105 0 ifaddr 40 6K 8K 166960K 86 0 ifgroup 65 2K 2K 166960K 131 0 sysctl 3 1K 9K 166960K 10 0 counters 74 37K 37K 166960K 216 0 ioctlops 0 0K 4K 166960K 1578 0 iov 0 0K 16K 166960K 106 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1465 92K 92K 166960K 2142 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 9K 166960K 10 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 23 0 dirhash 12 2K 2K 166960K 24 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 18 65K 236K 166960K 755 0 sigio 0 0K 0K 166960K 11 0 proc 72 91K 152K 166960K 671 0 subproc 72 4K 4K 166960K 100 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 70 0 in_multi 74 5K 7K 166960K 147 0 ether_multi 1 0K 0K 166960K 5 0 mrt 1 0K 0K 166960K 3 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 73 334K 334K 166960K 73 0 exec 0 0K 1K 166960K 445 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 252 161K 177K 166960K 7970 0 UVM aobj 16 2K 2K 166960K 19 0 pinsyscall 43 86K 104K 166960K 1894 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 120 0 NDP 15 0K 1K 166960K 59 0 temp 56 8682K 8750K 166960K 19902 0 kqueue 15 24K 30K 166960K 132 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 159 0 156 3 2 1 3 0 8 0 rtentry 176 164 0 83 6 1 5 6 0 8 0 unpcb 144 400 0 380 4 2 2 4 0 8 0 syncache 336 4 0 4 2 2 0 1 0 8 0 tcpcb 808 299 0 292 10 2 8 8 0 8 7 arp 128 28 0 12 1 0 1 1 0 8 0 inpcb 384 861 0 847 9 0 9 9 0 8 7 nd6 144 35 0 15 1 0 1 1 0 8 0 pkpcb 40 6 0 6 2 1 1 1 0 8 1 kcovpl 48 11 0 3 1 0 1 1 0 8 0 ppxss 1192 64 0 63 1 0 1 1 0 8 0 pppxif 1504 3 0 3 1 0 1 1 0 8 1 pffrag 232 5 0 3 1 0 1 1 0 482 0 pffrnode 88 5 0 3 1 0 1 1 0 8 0 pffrent 40 8 0 6 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfrktable 1344 2 0 1 2 1 1 1 0 8 0 pftag 88 2 0 0 1 0 1 1 0 8 0 pfstitem 24 50 0 9 1 0 1 1 0 8 0 pfstkey 128 50 0 9 2 0 2 2 0 8 0 pfstate 384 50 0 9 5 0 5 5 0 8 0 pfrule 1344 23 0 17 2 1 1 2 0 8 0 rttmr 136 1 0 1 1 1 0 1 0 8 0 art_heap8 4096 3 0 0 3 0 3 3 0 8 0 art_heap4 256 619 0 292 29 3 26 29 0 8 2 art_table 32 622 0 292 4 0 4 4 0 8 0 art_node 16 163 0 91 1 0 1 1 0 8 0 sysvmsgpl 40 23 0 6 1 0 1 1 0 8 0 semapl 112 21 0 11 1 0 1 1 0 8 0 shmpl 112 16 0 3 1 0 1 1 0 8 0 pool(0xffffffff838dbc50:shmpl): page inconsistency: page 0xfffffd806ad6c000; 21 on list, 13 missing, 35 items per page dirhash 1024 25 0 8 3 0 3 3 0 8 0 dino2pl 256 2627 0 1115 95 0 95 95 0 8 0 ffsino 288 2627 0 1115 109 0 109 109 0 8 0 nchpl 144 3561 0 1856 64 0 64 64 0 8 0 rtmask 32 12 0 12 1 0 1 1 0 8 1 uvmvnodes 80 3271 0 0 67 0 67 67 0 8 0 vnodes 216 3271 0 0 182 0 182 182 0 8 0 namei 1024 12871 0 12871 2 1 1 2 0 8 1 percpumem 16 123 0 71 1 0 1 1 0 8 0 kstatmem 264 80 0 44 3 0 3 3 0 8 0 scsiplug 72 3 0 3 1 1 0 1 0 8 0 scxspl 216 10929 0 10929 10 2 8 8 1 8 8 plimitpl 152 129 0 111 1 0 1 1 0 8 0 sigapl 424 1024 0 973 7 1 6 7 0 8 0 knotepl 120 551 0 0 17 0 17 17 0 8 0 kqueuepl 224 256 0 242 2 0 2 2 0 8 1 pipepl 336 230 0 203 8 0 8 8 0 8 5 fdescpl 520 1005 0 973 3 0 3 3 0 8 0 filepl 160 6334 0 6106 19 1 18 19 0 8 7 lockfpl 104 347 0 344 2 0 2 2 0 8 1 lockfspl 48 137 0 134 1 0 1 1 0 8 0 sessionpl 144 27 0 18 1 0 1 1 0 8 0 pgrppl 48 47 0 30 1 0 1 1 0 8 0 ucredpl 104 714 0 699 1 0 1 1 0 8 0 zombiepl 144 975 0 973 1 0 1 1 0 8 0 processpl 1208 1024 0 973 5 0 5 5 0 8 0 procpl 656 1954 0 1891 6 0 6 6 0 8 0 srpgc 96 8 0 8 1 0 1 1 0 8 1 sockpl 728 1439 0 1402 16 5 11 15 0 8 6 mcl64k 65536 4 0 0 1 0 1 1 0 8 0 mcl16k 16384 1 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl9k 9216 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 116 0 0 15 0 15 15 0 8 0 mcl2k 2048 26 0 0 4 0 4 4 0 8 0 mtagpl 96 93 0 0 3 0 3 3 0 8 0 mbufpl 256 278 0 0 17 0 17 17 0 8 0 bufpl 280 3279 0 124 226 0 226 226 0 8 0 anonpl 32 7655 0 0 62 0 62 62 0 246 0 amapchunkpl 152 26261 0 25723 31 0 31 31 0 158 9 amappl16 200 3327 0 3291 19 8 11 15 0 8 8 amappl15 192 6 0 6 1 1 0 1 0 8 0 amappl14 184 187 0 175 1 0 1 1 0 8 0 amappl13 176 9 0 9 2 2 0 1 0 8 0 amappl12 168 1692 0 1660 4 1 3 3 0 8 0 amappl11 160 50 0 35 1 0 1 1 0 8 0 amappl10 152 6 0 6 1 1 0 1 0 8 0 amappl9 144 317 0 317 1 1 0 1 0 8 0 amappl8 136 43 0 40 1 0 1 1 0 8 0 amappl7 128 112 0 100 1 0 1 1 0 8 0 amappl6 120 207 0 204 1 0 1 1 0 8 0 amappl5 112 141 0 131 1 0 1 1 0 8 0 amappl4 104 325 0 305 1 0 1 1 0 8 0 amappl3 96 5066 0 4944 5 1 4 4 0 8 0 amappl2 88 680 0 617 2 0 2 2 0 8 0 amappl1 80 10942 0 10337 15 0 15 15 0 8 0 amappl 88 7131 0 6952 5 0 5 5 0 92 0 dma16384 16384 1 0 1 1 1 0 1 0 8 0 dma4096 4096 2 0 2 2 2 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 255 0 255 2 2 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 8 0 8 2 2 0 1 0 8 0 dma16 16 19 0 18 1 0 1 1 0 8 0 aobjpl 72 18 0 3 1 0 1 1 0 8 0 uaddrrnd 24 1005 0 973 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1005 0 973 1 0 1 1 0 8 0 vmmpekpl 168 9469 0 9417 3 0 3 3 0 8 0 vmmpepl 168 69016 0 66953 100 0 100 100 0 357 7 vmsppl 480 1004 0 973 5 0 5 5 0 8 0 rwobjpl 72 23432 0 19188 78 0 78 78 0 8 0 pdppl 4096 2017 0 1946 105 32 73 85 0 8 2 pvpl 32 14456 0 0 117 0 117 117 0 265 0 pmappl 256 1004 0 973 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 413 0 44 11 0 11 11 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff833cc140) at panic+0x1e5 sys/kern/subr_prf.c:198 pool_do_get(ffffffff838dbc50,1,ffff80003bc09d18) at pool_do_get+0x5ea sys/kern/subr_pool.c:-1 pool_get(ffffffff838dbc50,1) at pool_get+0x149 sys/kern/subr_pool.c:-1 shmget_allocate_segment(ffff8000ffff19c0,ffff80003bc09f70,0,ffff80003bc09ec0) at shmget_allocate_segment+0x1a7 sys/kern/sysv_shm.c:-1 sys_shmget(ffff8000ffff19c0,ffff80003bc09f70,ffff80003bc09ec0) at sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 syscall(ffff80003bc09f70) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003bc09f70) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x2ac7e7cccb0, count: -8 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 end of kernel end trace frame: 0x77fc4105ab00, count: 12 ddb{1}> trace x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 end of kernel end trace frame: 0x77fc4105ab00, count: -3