panic: kernel diagnostic assertion "pg->wire_count != 0" failed: file "/syzkaller/managers/main/kernel/sys/uvm/uvm_page.c", line 1207 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834be76b) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834f9544,ffffffff834e3da2,4b7,ffffffff83451659) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff38007133e00) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff3806d16ae70,200000404000,200000405000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff3806d16ae70,fffff3806d1633b0,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff3806d16ae70) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff3806d16ae70) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80002a74c018,0,0,1) at exit1+0x705 sys/kern/kern_exit.c:259 sys_exit(ffff80002a74c018,ffff800035cb5e40,ffff800035cb5d90) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff800035cb5e40) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff800035cb5e40) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7dbb05f08010, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: kernel diagnostic assertion "pg->wire_count != 0" failed: file "/syzkaller/managers/main/kernel/sys/uvm/uvm_page.c", line 1207 ddb> show kasan No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834be76b) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834f9544,ffffffff834e3da2,4b7,ffffffff83451659) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff38007133e00) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff3806d16ae70,200000404000,200000405000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff3806d16ae70,fffff3806d1633b0,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff3806d16ae70) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff3806d16ae70) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80002a74c018,0,0,1) at exit1+0x705 sys/kern/kern_exit.c:259 sys_exit(ffff80002a74c018,ffff800035cb5e40,ffff800035cb5d90) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff800035cb5e40) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff800035cb5e40) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7dbb05f08010, count: -11 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff800035cb5a80 rbx 0xffff80003acc9318 rdx 0 rcx 0 rax 0xffff80002a74c018 r8 0x101010101010101 r9 0x8080808080808080 r10 0xbfc7f224aa05dc4f r11 0xc2269360cd2d1e4 r12 0 r13 0xffffffff835a5fb0 uvm_map_addr_RBT_INFO r14 0 r15 0x1 rip 0xffffffff813214f5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff800035cb5a70 ss 0 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=320330 pid=20730 tcnt=0 stat=onproc flags process=1009 proc=2000 runpri=16, usrpri=56, slppri=16, nice=20 wchan=0x0, wmesg=, ps_single=0xffff80002a74c018 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff80002a7279f8,0xffff80002a726548 process=0xffff80003acc9238 user=0xffff800035cb0000, vmspace=0xfffff3806d16ae70 estcpu=6, cpticks=8, pctcpu=0.6, user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 36897 196484 37470 0 2 0 0xc80 syz-executor 36897 154336 37470 0 3 0 0x4000080 sbwait syz-executor 97159 11345 69080 0 2 0 0 syz-executor 97159 395218 69080 0 3 0 0x4000080 fsleep syz-executor 14068 428407 9344 0 2 0x2 0 ifconfig 9344 214189 36800 0 3 0x100002 0x88 sigsusp sh 85102 218957 48634 0 2 0 0 syz-executor 36800 225757 17400 0 3 0x2 0x80 wait syz-executor 48634 100133 17400 0 2 0x2 0xc80 syz-executor 36375 343721 17400 0 2 0x2 0 syz-executor 37470 197554 17400 0 2 0x2 0xc80 syz-executor 69080 476839 17400 0 2 0x2 0xc80 syz-executor 37566 104966 17400 0 3 0x2 0x80 piperd syz-executor 21121 194806 17400 0 2 0x2 0xc80 syz-executor 17400 353251 77168 0 3 0x2 0x80 wait syz-executor 77168 113584 86423 0 3 0x100002 0x88 sigsusp ksh 86423 186994 12513 0 3 0x10 0x88 kqread sshd-session 12513 422301 53189 0 3 0x12 0x80 kqread sshd-session 57755 285585 1 0 3 0x100003 0x80 ttyin getty 53189 128056 1 0 3 0 0x88 kqread sshd 55619 479555 42840 73 3 0x1100010 0x80 kqread syslogd 42840 223978 1 0 3 0x100002 0x80 sbwait syslogd 33870 201866 1 0 3 0x100000 0x80 kqread resolvd 3584 167446 29520 77 3 0x100012 0x80 kqread dhcpleased 11643 473929 29520 77 3 0x100012 0x80 kqread dhcpleased 29520 128163 1 0 3 0 0x80 kqread dhcpleased 72446 74301 0 0 3 0x14000 0x200 bored smr 10596 467743 0 0 2 0x14000 0x200 zerothread 40543 497360 0 0 3 0x14000 0x200 aiodoned aiodoned 14728 253621 0 0 3 0x14000 0x200 syncer update 37537 42214 0 0 3 0x14000 0x200 cleaner cleaner 73355 504904 0 0 3 0x14000 0x200 reaper reaper 72657 34282 0 0 3 0x14000 0x200 pgdaemon pagedaemon 49309 427755 0 0 3 0x14000 0x200 bored viomb 62592 121442 0 0 3 0x14000 0x40000200 acpi0 acpi0 63303 132997 0 0 3 0x14000 0x200 bored softnet0 73018 232596 0 0 3 0x14000 0x200 bored systqmp 78525 416370 0 0 3 0x14000 0x200 bored systq 14519 334583 0 0 3 0x14000 0x40000200 tmoslp softclock 36401 16280 0 0 3 0x14000 0x40000200 idle0 1 424573 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11029 12112K 12203K 166960K 12141 0 pcb 18 12K 12K 166960K 28 0 rtable 229 6K 6K 166960K 373 0 pf 31 13K 15K 166960K 40 0 ifaddr 40 7K 7K 166960K 47 0 ifgroup 50 2K 2K 166960K 56 0 sysctl 3 1K 9K 166960K 7 0 counters 33 17K 17K 166960K 35 0 ioctlops 0 0K 4K 166960K 37 0 iov 0 0K 12K 166960K 2 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1294 81K 82K 166960K 1399 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 4 0 VM map 2 1K 1K 166960K 2 0 sem 9 0K 0K 166960K 11 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 15 53K 97K 166960K 194 0 sigio 0 0K 0K 166960K 1 0 proc 59 59K 124K 166960K 525 0 subproc 72 4K 4K 166960K 81 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 6 0 in_multi 89 6K 6K 166960K 100 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 2 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 37 175K 175K 166960K 37 0 exec 0 0K 1K 166960K 414 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 195 156K 161K 166960K 3325 0 UVM aobj 8 3K 3K 166960K 8 0 pinsyscall 36 72K 96K 166960K 1325 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 2 0 NDP 11 0K 2K 166960K 29 0 temp 33 9118K 9182K 166960K 3563 0 kqueue 13 20K 22K 166960K 29 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 40 0 36 1 0 1 1 0 8 0 rtentry 136 118 0 12 4 0 4 4 0 8 0 unpcb 144 57 0 42 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 13 0 9 1 0 1 1 0 8 0 arp 96 20 0 2 1 0 1 1 0 8 0 inpcb 328 124 0 116 4 0 4 4 0 8 3 nd6 112 27 0 3 1 0 1 1 0 8 0 pkpcb 40 2 0 2 1 0 1 1 0 8 1 kcovpl 48 9 0 1 1 0 1 1 0 8 0 ppxss 1072 1 0 1 1 0 1 1 0 8 1 pftag 88 2 0 0 1 0 1 1 0 8 0 pfrule 1360 4 0 4 1 0 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 487 0 44 31 0 31 31 0 8 1 art_table 40 488 0 44 5 0 5 5 0 8 0 art_node 32 118 0 21 1 0 1 1 0 8 0 semapl 72 9 0 2 1 0 1 1 0 8 0 shmpl 120 5 0 0 1 0 1 1 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 1652 0 185 92 0 92 92 0 8 0 ffsino 256 1652 0 185 92 0 92 92 0 8 0 nchpl 144 1897 0 200 64 0 64 64 0 8 0 vnodes 216 1758 0 0 98 0 98 98 0 8 0 namei 1024 6677 0 6677 4 0 4 4 0 8 4 kstatmem 264 27 0 4 2 0 2 2 0 8 0 scxspl 216 6672 0 6672 2 0 2 2 1 8 2 plimitpl 152 33 0 16 1 0 1 1 0 8 0 sigapl 424 490 0 449 6 0 6 6 0 8 1 knotepl 120 4355 0 4308 9 0 9 9 0 8 7 kqueuepl 184 30 0 21 1 0 1 1 0 8 0 pipepl 304 129 0 102 3 0 3 3 0 8 0 fdescpl 448 477 0 450 5 0 5 5 0 8 1 filepl 120 1705 0 1497 8 0 8 8 0 8 0 lockfpl 104 29 0 25 1 0 1 1 0 8 0 lockfspl 48 14 0 10 1 0 1 1 0 8 0 sessionpl 144 27 0 18 1 0 1 1 0 8 0 pgrppl 48 37 0 20 1 0 1 1 0 8 0 ucredpl 104 130 0 118 1 0 1 1 0 8 0 zombiepl 144 451 0 449 1 0 1 1 0 8 0 processpl 1160 490 0 449 4 0 4 4 0 8 0 procpl 664 558 0 515 5 0 5 5 0 8 0 sosppl 176 2 0 2 1 0 1 1 0 8 1 sockpl 552 225 0 198 5 0 5 5 0 8 2 mcl64k 65536 2 0 2 1 0 1 1 0 8 1 mcl12k 12288 1 0 1 1 0 1 1 0 8 1 mcl9k128 9344 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 5 0 5 1 0 1 1 0 8 1 mcl4k 4096 2546 0 2493 15 0 15 15 0 8 7 mcl2k 2048 163 0 162 1 0 1 1 0 8 0 mextrefs 64 50 0 49 1 0 1 1 0 8 0 mtagpl 96 4 0 4 1 0 1 1 0 8 1 mbufpl 256 4580 0 4450 10 0 10 10 0 8 0 bufpl 272 2294 0 103 147 0 147 147 0 8 0 anonpl 24 96502 0 89506 44 0 44 44 0 187 1 amapchunkpl 152 9368 0 8853 29 0 29 29 0 158 5 amappl16 200 1531 0 1400 7 0 7 7 0 8 0 amappl15 192 6 0 6 1 0 1 1 0 8 1 amappl14 184 480 0 478 1 0 1 1 0 8 0 amappl13 176 138 0 128 1 0 1 1 0 8 0 amappl12 168 714 0 689 2 0 2 2 0 8 0 amappl11 160 7 0 7 1 0 1 1 0 8 1 amappl10 152 59 0 49 1 0 1 1 0 8 0 amappl9 144 271 0 271 1 0 1 1 0 8 1 amappl8 136 99 0 98 1 0 1 1 0 8 0 amappl7 128 161 0 150 1 0 1 1 0 8 0 amappl6 120 171 0 168 1 0 1 1 0 8 0 amappl5 112 102 0 95 1 0 1 1 0 8 0 amappl4 104 262 0 247 1 0 1 1 0 8 0 amappl3 96 1675 0 1603 3 0 3 3 0 8 0 amappl2 88 599 0 532 2 0 2 2 0 8 0 amappl1 80 10364 0 9826 13 0 13 13 0 8 1 amappl 88 2610 0 2479 4 0 4 4 0 92 0 uvmvnodes 80 99 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 0 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 0 1 1 0 8 1 dma128 128 253 0 253 1 0 1 1 0 8 1 dma64 64 6 0 6 1 0 1 1 0 8 1 dma32 32 7 0 7 1 0 1 1 0 8 1 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 7 0 0 1 0 1 1 0 8 0 uaddrrnd 24 477 0 449 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 477 0 449 1 0 1 1 0 8 0 vmmpekpl 168 5864 0 5825 2 0 2 2 0 8 0 vmmpepl 168 40216 0 38475 82 0 82 82 0 357 0 vmsppl 368 476 0 449 4 0 4 4 0 8 1 rwobjpl 40 14452 0 13425 11 0 11 11 0 8 0 pdppl 4096 960 0 898 96 26 70 82 0 8 8 pvpl 32 234587 0 226215 111 0 111 111 0 265 13 pmappl 216 476 0 449 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 509 0 26 15 0 15 15 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834be76b) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834f9544,ffffffff834e3da2,4b7,ffffffff83451659) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff38007133e00) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff3806d16ae70,200000404000,200000405000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff3806d16ae70,fffff3806d1633b0,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff3806d16ae70) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff3806d16ae70) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80002a74c018,0,0,1) at exit1+0x705 sys/kern/kern_exit.c:259 sys_exit(ffff80002a74c018,ffff800035cb5e40,ffff800035cb5d90) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff800035cb5e40) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff800035cb5e40) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7dbb05f08010, count: -11 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834be76b) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff834f9544,ffffffff834e3da2,4b7,ffffffff83451659) at __assert+0x29 sys/kern/subr_prf.c:-1 uvm_pageunwire(fffff38007133e00) at uvm_pageunwire+0x17d sys/uvm/uvm_page.c:1206 uvm_fault_unwire_locked(fffff3806d16ae70,200000404000,200000405000) at uvm_fault_unwire_locked+0x33a sys/uvm/uvm_fault.c:1790 uvm_unmap_kill_entry_withlock(fffff3806d16ae70,fffff3806d1633b0,0) at uvm_unmap_kill_entry_withlock+0x81 sys/uvm/uvm_map.c:1866 uvm_map_teardown(fffff3806d16ae70) at uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline] uvm_map_teardown(fffff3806d16ae70) at uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497 exit1(ffff80002a74c018,0,0,1) at exit1+0x705 sys/kern/kern_exit.c:259 sys_exit(ffff80002a74c018,ffff800035cb5e40,ffff800035cb5d90) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff800035cb5e40) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff800035cb5e40) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7dbb05f08010, count: -11