panic: Caught invalid memory access at ffff8000018d2ec0 size 36 op 1 Stopped at db_enter+0x17: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND *148925 35243 0 0 0x4000000 1 syz-executor 323678 6493 0 0x14000 0x200 0 softnet0 db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff846330ad) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018d2ec0,ffff80002997df00,24) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80002997e5c8,1,200000000180,ffff80002997e5a0) at sysctl_sysvipc+0x3ee sys/kern/kern_sysctl.c:2714 kern_sysctl_dirs(33,ffff80002997e5c8,1,200000000180,ffff80002997e5a0,0,1,1ffff0000532fc30) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 kern_sysctl(ffff80002997e5c4,2,200000000180,ffff80002997e5a0,0,fffa,ffff80002997e820) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff800036b0aa80,ffff80002997e820,ffff80002997e780) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff80002997e820) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002997e820) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdf8f5d6c0c0, count: 6 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: Caught invalid memory access at ffff8000018d2ec0 size 36 op 1 ddb{1}> show kasan KASAN: invalid write of 36 bytes at 0xffff8000018d2ec0 from pc 0xffffffff8204b68e KASAN: first bad byte at 0xffff8000018d2ec4 (+4); shadow 0x04: partial granule (out-of-bounds) KASAN: 0xffff8000018d2ec4 is 4 bytes inside the 16-byte malloc slot [0xffff8000018d2ec0..0xffff8000018d2ed0) KASAN: allocated at: #0 malloc+0xda0 sys/kern/kern_malloc.c:446 #1 sysctl_sysvipc+0x3cb sys/kern/kern_sysctl.c:-1 #2 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 #3 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 #4 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 #5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 KASAN: pc: sysctl_sysvipc+0x3ee KASAN: call trace: #0 kasan_memcpy+0x1ca kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline] #0 kasan_memcpy+0x1ca sys/kern/subr_kasan.c:1025 #1 sysctl_sysvipc+0x3ee sys/kern/kern_sysctl.c:2714 #2 kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 #3 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 #4 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 #5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 KASAN: shadow of 0xffff8000018d2d80..0xffff8000018d3000 (1 cell = 8 bytes): 0xffff8000018d2d80: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 0xffff8000018d2e00: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 >0xffff8000018d2e80: fb 08 fc 08 fc 08 fc 08[04]fb 06 fb 08 08 08 08 0xffff8000018d2f00: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 0xffff8000018d2f80: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope ddb{1}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff846330ad) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018d2ec0,ffff80002997df00,24) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80002997e5c8,1,200000000180,ffff80002997e5a0) at sysctl_sysvipc+0x3ee sys/kern/kern_sysctl.c:2714 kern_sysctl_dirs(33,ffff80002997e5c8,1,200000000180,ffff80002997e5a0,0,1,1ffff0000532fc30) at kern_sysctl_dirs+0x30f sys/kern/kern_sysctl.c:429 kern_sysctl(ffff80002997e5c4,2,200000000180,ffff80002997e5a0,0,fffa,ffff80002997e820) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff800036b0aa80,ffff80002997e820,ffff80002997e780) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff80002997e820) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002997e820) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xdf8f5d6c0c0, count: -9 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff80002997dcf0 rbx 0xffff80002997dd60 rdx 0 rcx 0xffff800028ff3ff0 rax 0 r8 0x101010101010101 r9 0x8080808080808080 r10 0xffff80002997dad8 r11 0xffffffff82b69490 x86_bus_space_io_read_1 r12 0xffffffff846330ad .str.16+0x9a5ad r13 0xffff800028ff4c08 r14 0xffff800028ff4e07 r15 0x1 rip 0xffffffff829a9a77 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff80002997dcf0 ss 0x10 db_enter+0x17: popq %rbp ddb{1}> show proc PROC (syz-executor) tid=148925 pid=35243 tcnt=4 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800036b0a550,0xffff800029980808 process=0xffff800036b0c9c0 user=0xffff800029973000, vmspace=0xffff800000d8a5b8 estcpu=36, cpticks=19, pctcpu=0.0, user=0, sys=19, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 15969 397276 53742 0 2 0 0 syz-executor 15969 151463 53742 0 3 0 0x4000080 bell syz-executor 15969 24962 53742 0 3 0 0x4000080 fsleep syz-executor 69356 5387 27872 0 2 0 0 syz-executor 10761 434811 17394 0 2 0 0 syz-executor 10761 433414 17394 0 3 0 0x4000080 fsleep syz-executor 74934 355838 1460 0 3 0 0x80 nanoslp syz-executor 74934 130006 1460 0 3 0 0x4000088 kqpoll syz-executor 74934 421271 1460 0 3 0 0x4000080 fsleep syz-executor 74934 56681 1460 0 3 0 0x4000080 fsleep syz-executor 58310 96362 27858 0 2 0 0xc80 syz-executor 58310 336233 27858 0 3 0 0x4000080 kqread syz-executor 58310 352771 27858 0 3 0 0x4000080 fsleep syz-executor 35243 306501 10708 0 2 0 0xc80 syz-executor *35243 148925 10708 0 7 0 0x4000000 syz-executor 35243 179512 10708 0 2 0 0x4000000 syz-executor 35243 80469 10708 0 3 0 0x4000080 fsleep syz-executor 64938 137482 52139 0 3 0 0x80 nanoslp syz-executor 64938 517217 52139 0 3 0 0x4000080 kqread syz-executor 64938 454713 52139 0 3 0 0x4000080 fsleep syz-executor 20288 479231 0 0 3 0x14000 0x280 nfsidl nfsio 10231 457552 0 0 3 0x14000 0x280 nfsidl nfsio 87 456230 0 0 3 0x14000 0x280 nfsidl nfsio 81396 422294 0 0 3 0x14000 0x280 nfsidl nfsio 26331 270840 0 0 3 0x14000 0x280 nfsidl nfsio 40418 234246 0 0 3 0x14000 0x280 nfsidl nfsio 21971 175482 0 0 3 0x14000 0x280 nfsidl nfsio 61285 148491 0 0 3 0x14000 0x280 nfsidl nfsio 76345 180662 0 0 3 0x14000 0x280 nfsidl nfsio 93194 467429 0 0 3 0x14000 0x280 nfsidl nfsio 58377 25606 0 0 3 0x14000 0x280 nfsidl nfsio 54572 268812 0 0 3 0x14000 0x280 nfsidl nfsio 43627 486431 0 0 3 0x14000 0x280 nfsidl nfsio 94102 322143 0 0 3 0x14000 0x280 nfsidl nfsio 8807 406999 0 0 3 0x14000 0x280 nfsidl nfsio 4896 32863 0 0 3 0x14000 0x280 nfsidl nfsio 70891 48115 0 0 3 0x14000 0x280 nfsidl nfsio 48153 47643 0 0 3 0x14000 0x280 nfsidl nfsio 77791 123168 0 0 3 0x14000 0x280 nfsidl nfsio 63880 71397 0 0 3 0x14000 0x280 nfsidl nfsio 33356 342147 0 0 3 0x14000 0x200 acct acct 48351 502777 1 0 3 0x100003 0x80 ttyin getty 52139 178857 55501 0 2 0x2 0xc80 syz-executor 17394 373728 55501 0 3 0x2 0x80 nanoslp syz-executor 10708 112583 55501 0 3 0x2 0x80 nanoslp syz-executor 53742 26554 55501 0 3 0x2 0x80 nanoslp syz-executor 12978 56455 55501 0 3 0x2 0x80 nanoslp syz-executor 27872 257255 55501 0 3 0x2 0x80 nanoslp syz-executor 1460 433703 55501 0 3 0x2 0x80 nanoslp syz-executor 27858 379201 55501 0 2 0x2 0xc80 syz-executor 55501 498743 1 0 2 0x2 0x80 syz-executor 30837 462234 0 0 2 0x14000 0x40000200 smr 75386 378383 0 0 2 0x14000 0x200 zerothread 46094 359439 0 0 3 0x14000 0x200 aiodoned aiodoned 64394 344408 0 0 3 0x14000 0x200 syncer update 225 336209 0 0 3 0x14000 0x200 cleaner cleaner 885 428961 0 0 3 0x14000 0x200 reaper reaper 32677 292282 0 0 3 0x14000 0x200 pgdaemon pagedaemon 37861 422100 0 0 3 0x14000 0x200 bored viomb 55671 36589 0 0 3 0x14000 0x40000200 acpi0 acpi0 24883 9791 0 0 3 0x14000 0x40000200 idle1 60386 489949 0 0 3 0x14000 0x200 bored softnet1 6493 323678 0 0 7 0x14000 0x200 softnet0 89401 170659 0 0 3 0x14000 0x200 bored systqmp 37039 239626 0 0 3 0x14000 0x200 bored systq 26705 496678 0 0 3 0x14000 0x200 tmoslp softclockmp 25819 206443 0 0 3 0x14000 0x40000200 tmoslp softclock 41804 383486 0 0 3 0x14000 0x40000200 idle0 1 241368 0 0 3 0x80002 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11052 12177K 12330K 166960K 12381 0 pcb 18 28K 30K 166960K 60 0 rtable 245 13K 13K 166960K 359 0 pf 34 22K 24K 166960K 76 0 ifaddr 43 12K 13K 166960K 57 0 ifgroup 55 2K 2K 166960K 95 0 sysctl 3 1K 13K 166960K 11 0 counters 70 42K 43K 166960K 90 0 ioctlops 0 0K 4K 166960K 1555 0 iov 0 0K 20K 166960K 79 0 mount 1 1K 1K 166960K 1 0 log 7 12K 12K 166960K 11 0 vnodes 1303 84K 84K 166960K 1606 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 2 2K 10K 166960K 25 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 1K 166960K 25 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 292K 166960K 11964 0 file desc 17 65K 93K 166960K 496 0 sigio 0 0K 0K 166960K 9 0 proc 24 62K 161K 166960K 645 0 subproc 72 9K 9K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 ip_moptions 0 0K 0K 166960K 9 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 15 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 67 465K 465K 166960K 67 0 exec 0 0K 2K 166960K 398 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 147 128K 281K 166960K 6323 0 UVM aobj 131 7K 8K 166960K 132 0 pinsyscall 1044 1841K 1841K 166960K 1660 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 1 0 NDP 12 0K 1K 166960K 38 0 temp 44 9164K 9179K 166960K 4924 0 kqueue 3 12K 45K 166960K 112 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 33 0 33 1 1 0 1 0 8 0 rtentry 176 115 0 1 6 0 6 6 0 8 0 unpcb 144 501 0 499 3 0 3 3 0 8 2 syncache 336 4 0 4 1 1 0 1 0 8 0 tcpcb 736 52 0 51 1 0 1 1 0 8 0 arp 136 19 0 0 1 0 1 1 0 8 0 inpcb 328 328 0 322 6 1 5 6 0 8 4 nd6 152 27 0 0 2 0 2 2 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 2 0 2 1 0 1 1 0 8 1 pffrag 232 7 0 4 1 0 1 1 0 482 0 pffrnode 88 7 0 4 1 0 1 1 0 8 0 pffrent 40 17 0 14 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 45 0 1 1 0 1 1 0 8 0 pfstkey 128 45 0 1 2 0 2 2 0 8 0 pfstate 448 45 0 1 5 0 5 5 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 458 0 0 29 0 29 29 0 8 0 art_table 40 459 0 0 5 0 5 5 0 8 0 art_node 32 115 0 11 1 0 1 1 0 8 0 sysvmsgpl 40 7 0 3 1 0 1 1 0 8 0 semapl 72 20 0 10 1 0 1 1 0 8 0 shmpl 112 129 0 1 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3