panic: kernel diagnostic assertion "pg->wire_count == 1" failed: file "/syzkaller/managers/main/kernel/sys/kern/vfs_biomem.c", line 329 Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *445707 47303 0 0x2 0 0 syz-executor.0 db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 __assert(ffffffff821dce4c,ffffffff821ef58a,149,ffffffff821b8b50) at __assert+0x2b sys/kern/subr_prf.c:154 buf_free_pages(fffffd803d9b6e00) at buf_free_pages+0x1ee sys/kern/vfs_biomem.c:318 buf_dealloc_mem(fffffd803d9b6e00) at buf_dealloc_mem+0xe1 sys/kern/vfs_biomem.c:194 buf_put(fffffd803d9b6e00) at buf_put+0x16b sys/kern/vfs_bio.c:131 brelse(fffffd803d9b6e00) at brelse+0x257 sys/kern/vfs_bio.c:922 vinvalbuf(fffffd803c2fc288,2,fffffd803f7c6900,ffff8000ffff2780,0,ffffffffffffffff) at vinvalbuf+0x3b1 sys/kern/vfs_subr.c:1977 ffs_truncate(fffffd8036ae92e0,0,4,fffffd803f7c6900) at ffs_truncate+0xeb1 sys/ufs/ffs/ffs_inode.c:326 ufs_rmdir(ffff80001574e188) at ufs_rmdir+0x3af sys/ufs/ufs/ufs_vnops.c:1357 VOP_RMDIR(fffffd8037b28428,fffffd803c2fc288,ffff80001574e288) at VOP_RMDIR+0xf8 sys/kern/vfs_vops.c:474 dounlinkat(ffff8000ffff2780,ffffff9c,7f7ffffd0d90,8) at dounlinkat+0x14c sys/kern/vfs_syscalls.c:1818 syscall(ffff80001574e400) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555 Xsyscall(6,89,7f7ffffd08d0,89,1329fc66c40,7f7ffffd0d90) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffd0d80, count: 1 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic kernel diagnostic assertion "pg->wire_count == 1" failed: file "/syzkaller/managers/main/kernel/sys/kern/vfs_biomem.c", line 329 ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 __assert(ffffffff821dce4c,ffffffff821ef58a,149,ffffffff821b8b50) at __assert+0x2b sys/kern/subr_prf.c:154 buf_free_pages(fffffd803d9b6e00) at buf_free_pages+0x1ee sys/kern/vfs_biomem.c:318 buf_dealloc_mem(fffffd803d9b6e00) at buf_dealloc_mem+0xe1 sys/kern/vfs_biomem.c:194 buf_put(fffffd803d9b6e00) at buf_put+0x16b sys/kern/vfs_bio.c:131 brelse(fffffd803d9b6e00) at brelse+0x257 sys/kern/vfs_bio.c:922 vinvalbuf(fffffd803c2fc288,2,fffffd803f7c6900,ffff8000ffff2780,0,ffffffffffffffff) at vinvalbuf+0x3b1 sys/kern/vfs_subr.c:1977 ffs_truncate(fffffd8036ae92e0,0,4,fffffd803f7c6900) at ffs_truncate+0xeb1 sys/ufs/ffs/ffs_inode.c:326 ufs_rmdir(ffff80001574e188) at ufs_rmdir+0x3af sys/ufs/ufs/ufs_vnops.c:1357 VOP_RMDIR(fffffd8037b28428,fffffd803c2fc288,ffff80001574e288) at VOP_RMDIR+0xf8 sys/kern/vfs_vops.c:474 dounlinkat(ffff8000ffff2780,ffffff9c,7f7ffffd0d90,8) at dounlinkat+0x14c sys/kern/vfs_syscalls.c:1818 syscall(ffff80001574e400) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555 Xsyscall(6,89,7f7ffffd08d0,89,1329fc66c40,7f7ffffd0d90) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffd0d80, count: -14 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80001574dc60 rbx 0xffff80001574dd10 rdx 0x2 rcx 0 rax 0 r8 0xffff80001574dc20 r9 0x1 r10 0 r11 0xddc395f06baea086 r12 0x3000000008 r13 0xffff80001574dc70 r14 0x100 r15 0x1 rip 0xffffffff8106c198 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff80001574dc50 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (syz-executor.0) pid=445707 stat=onproc flags process=2 proc=0 pri=17, usrpri=51, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffff3650,0xffffffff82569748 process=0xffff8000ffff6370 user=0xffff800015749000, vmspace=0xfffffd803f014dd0 estcpu=1, cpticks=1, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND *47303 445707 61676 0 7 0x2 syz-executor.0 84870 22224 0 0 3 0x14200 acct acct 30129 23081 1 0 3 0x100083 ttyin getty 36481 478542 0 0 3 0x14200 bored sosplice 61676 292331 70059 0 3 0x82 thrsleep syz-fuzzer 61676 84071 70059 0 3 0x4000082 nanosleep syz-fuzzer 61676 370381 70059 0 3 0x4000082 thrsleep syz-fuzzer 61676 177976 70059 0 3 0x4000082 thrsleep syz-fuzzer 61676 259000 70059 0 3 0x4000082 thrsleep syz-fuzzer 61676 105824 70059 0 3 0x4000002 biowait syz-fuzzer 61676 501172 70059 0 3 0x4000082 thrsleep syz-fuzzer 61676 127501 70059 0 3 0x4000082 thrsleep syz-fuzzer 70059 2271 55063 0 3 0x10008a pause ksh 55063 180559 2784 0 3 0x92 select sshd 2784 445882 1 0 3 0x80 select sshd 29644 445485 85134 73 3 0x100010 biowait syslogd 85134 30769 1 0 3 0x100082 netio syslogd 53972 456478 1 77 3 0x100090 poll dhclient 29257 103730 1 0 3 0x80 poll dhclient 17024 205587 0 0 3 0x14200 pgzero zerothread 56256 467412 0 0 3 0x14200 aiodoned aiodoned 14626 382658 0 0 3 0x14200 syncer update 72569 198846 0 0 3 0x14200 cleaner cleaner 87084 20041 0 0 3 0x14200 reaper reaper 31915 470469 0 0 3 0x14200 pgdaemon pagedaemon 71562 207974 0 0 3 0x14200 bored crynlk 28284 347279 0 0 3 0x14200 bored crypto 76478 324476 0 0 3 0x40014200 acpi0 acpi0 11178 345120 0 0 3 0x14200 bored softnet 51254 334073 0 0 3 0x14200 bored systqmp 2248 305853 0 0 3 0x14200 bored systq 12593 24226 0 0 3 0x40014200 bored softclock 96616 161556 0 0 3 0x40014200 idle0 3145 511406 0 0 3 0x14200 bored smr 1 168246 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9601 6388K 6829K 78643K 13753 0 0 pcb 13 10K 12K 78643K 1521 0 0 rtable 119 12K 13K 78643K 4081 0 0 ifaddr 86 23K 28K 78643K 1300 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 0 0K 2K 78643K 442 0 0 iov 0 0K 32K 78643K 1298 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1199 75K 77K 78643K 5528 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 200 0 0 VM map 2 0K 0K 78643K 8 0 0 sem 12 1K 1K 78643K 1362 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1793 195K 288K 78643K 12645 0 0 file desc 3 5K 25K 78643K 11917 0 0 sigio 0 0K 0K 78643K 166 0 0 proc 50 38K 63K 78643K 3311 0 0 subproc 16 1K 2K 78643K 809 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 1214 0 0 in_multi 23 1K 2K 78643K 830 0 0 ether_multi 1 0K 0K 78643K 63 0 0 mrt 0 0K 0K 78643K 53 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 144 636K 636K 78643K 144 0 0 exec 0 0K 1K 78643K 1761 0 0 pfkey data 0 0K 4K 78643K 6 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 124 15K 33K 78643K 29487 0 0 UVM aobj 130 4K 4K 78643K 163 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 1K 78643K 1624 0 0 NDP 22 0K 1K 78643K 408 0 0 temp 224 3536K 4177K 78643K 244161 0 0 kqueue 0 0K 0K 78643K 100 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 110 0 105 1 0 1 1 0 8 0 rtpcb 80 779 0 777 1 0 1 1 0 8 0 rtentry 112 541 0 503 2 0 2 2 0 8 0 unpcb 120 4942 0 4911 9 7 2 2 0 8 0 syncache 264 28 0 28 14 14 0 1 0 8 0 sackhl 24 1 0 1 1 1 0 1 0 8 0 tcpqe 32 5247 0 5247 4 4 0 1 0 8 0 tcpcb 544 9345 0 9341 41 40 1 3 0 8 0 ipq 40 14 0 14 6 6 0 1 0 8 0 ipqe 40 28 0 28 6 6 0 1 0 8 0 inpcb 280 15044 0 15035 38 37 1 13 0 8 0 rttmr 72 13 0 13 10 10 0 1 0 8 0 nd6 48 86 0 84 1 0 1 1 0 8 0 pkpcb 40 54 0 54 19 19 0 1 0 8 0 swfcl 56 6 0 0 1 0 1 1 0 8 0 ppxss 1128 192 0 192 43 43 0 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 2253 0 2049 31 15 16 17 0 8 0 art_table 32 2254 0 2049 3 0 3 3 0 8 0 art_node 16 520 0 486 1 0 1 1 0 8 0 semupl 112 3 0 3 1 1 0 1 0 8 0 semapl 112 1360 0 1350 1 0 1 1 0 8 0 shmpl 112 161 0 33 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 19436 0 18021 46 0 46 46 0 8 0 ffsino 240 19436 0 18021 84 0 84 84 0 8 0 nchpl 144 38881 0 37239 62 1 61 62 0 8 0 uvmvnodes 72 8932 0 0 163 0 163 163 0 8 0 vnodes 208 8932 0 0 471 0 471 471 0 8 0 namei 1024 147728 0 147728 8 7 1 1 0 8 1 vmpool 520 6 0 6 3 3 0 1 0 8 0 scsiplug 64 19 0 19 16 16 0 1 0 8 0 scxspl 192 119823 0 119821 43 42 1 7 0 8 0 plimitpl 152 1026 0 1020 1 0 1 1 0 8 0 sigapl 432 11962 0 11951 2 0 2 2 0 8 0 futexpl 56 275886 0 275886 7 7 0 1 0 8 0 knotepl 112 3096 0 3071 7 6 1 2 0 8 0 kqueuepl 104 3115 0 3113 1 0 1 1 0 8 0 pipepl 112 6636 0 6621 29 28 1 2 0 8 0 fdescpl 424 11963 0 11951 2 0 2 2 0 8 0 filepl 120 99076 0 98998 36 33 3 11 0 8 0 lockfpl 104 3845 0 3844 1 0 1 1 0 8 0 lockfspl 48 1185 0 1184 1 0 1 1 0 8 0 sessionpl 112 71 0 62 1 0 1 1 0 8 0 pgrppl 48 193 0 184 1 0 1 1 0 8 0 ucredpl 96 16150 0 16142 1 0 1 1 0 8 0 zombiepl 144 11953 0 11953 3 2 1 1 0 8 1 processpl 864 11981 0 11953 4 0 4 4 0 8 0 procpl 632 26492 0 26457 5 1 4 5 0 8 0 sosppl 128 129 0 129 42 42 0 1 0 8 0 sockpl 384 21085 0 21045 73 68 5 22 0 8 0 mcl64k 65536 1112 0 1112 123 123 0 33 0 8 0 mcl16k 16384 78 0 78 39 39 0 1 0 8 0 mcl12k 12288 254 0 254 35 35 0 1 0 8 0 mcl9k 9216 137 0 137 42 42 0 1 0 8 0 mcl8k 8192 289 0 289 33 33 0 1 0 8 0 mcl4k 4096 932 0 932 13 13 0 1 0 8 0 mcl2k2 2112 94 0 94 38 38 0 1 0 8 0 mcl2k 2048 80984 0 80944 17 11 6 14 0 8 0 mtagpl 80 10 0 10 3 3 0 1 0 8 0 mbufpl 256 216304 0 216222 128 118 10 30 0 8 0 bufpl 256 37368 0 28438 559 0 559 559 0 8 0 anonpl 16 1150895 0 1135919 360 280 80 93 0 62 13 amapchunkpl 152 55581 0 55481 147 141 6 19 0 158 0 amappl16 192 65092 0 64225 355 298 57 68 0 8 12 amappl15 184 1025 0 1025 10 10 0 1 0 8 0 amappl14 176 3422 0 3419 2 1 1 1 0 8 0 amappl13 168 1227 0 1227 10 10 0 1 0 8 0 amappl12 160 2574 0 2571 1 0 1 1 0 8 0 amappl11 152 487 0 475 1 0 1 1 0 8 0 amappl10 144 1404 0 1403 2 1 1 1 0 8 0 amappl9 136 2910 0 2905 1 0 1 1 0 8 0 amappl8 128 2474 0 2418 2 0 2 2 0 8 0 amappl7 120 1588 0 1581 1 0 1 1 0 8 0 amappl6 112 400 0 381 1 0 1 1 0 8 0 amappl5 104 3111 0 3102 1 0 1 1 0 8 0 amappl4 96 10889 0 10865 1 0 1 1 0 8 0 amappl3 88 5523 0 5516 1 0 1 1 0 8 0 amappl2 80 93047 0 92987 4 2 2 3 0 8 0 amappl1 72 221448 0 221053 26 16 10 20 0 8 0 amappl 80 27479 0 27448 1 0 1 1 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma64 64 259 0 259 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 162 0 33 3 0 3 3 0 8 0 uaddrrnd 24 11969 0 11951 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 11969 0 11951 1 0 1 1 0 8 0 vmmpekpl 168 74379 0 74352 2 0 2 2 0 8 0 vmmpepl 168 1412295 0 1410507 734 631 103 125 0 357 8 vmsppl 272 11962 0 11951 7 6 1 2 0 8 0 pdppl 4096 23944 0 23914 6 1 5 6 0 8 0 pvpl 32 3289774 0 3271836 1045 767 278 295 0 265 119 pmappl 200 11968 0 11957 1 0 1 1 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 1095 0 408 21 0 21 21 0 8 0