panic: kernel diagnostic assertion "ifp != NULL" failed: file "/syzkaller/managers/main/kernel/sys/net/rtsock.c", line 939 Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *417478 20151 0 0 0x4000000 0 syz-executor.0 db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic(ffffffff823c4058) at panic+0x15c sys/kern/subr_prf.c:207 __assert(ffffffff8242be75,ffffffff823d9a93,3ab,ffffffff823983a3) at __assert+0x2b sys/kern/subr_prf.c:154 rtm_output(ffff800000b03f00,ffff80001e792610,ffff80001e792568,40,0) at rtm_output+0xba9 sys/net/rtsock.c:1120 route_output(fffffd806bc22100,fffffd805da6be18,0,0) at route_output+0x678 sys/net/rtsock.c:832 route_usrreq(fffffd805da6be18,9,fffffd806bc22100,0,0,ffff80001d6c2878) at route_usrreq+0x36f sys/net/rtsock.c:275 sosend(fffffd805da6be18,0,ffff80001e792800,0,0,0) at sosend+0x669 sys/kern/uipc_socket.c:549 sendit(ffff80001d6c2878,3,ffff80001e7928e0,0,ffff80001e7929c0) at sendit+0x52b sys/kern/uipc_syscalls.c:652 sys_sendto(ffff80001d6c2878,ffff80001e792978,ffff80001e7929c0) at sys_sendto+0x80 sys/kern/uipc_syscalls.c:517 syscall(ffff80001e792a40) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4c8ebb92fa0, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic kernel diagnostic assertion "ifp != NULL" failed: file "/syzkaller/managers/main/kernel/sys/net/rtsock.c", line 939 ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic(ffffffff823c4058) at panic+0x15c sys/kern/subr_prf.c:207 __assert(ffffffff8242be75,ffffffff823d9a93,3ab,ffffffff823983a3) at __assert+0x2b sys/kern/subr_prf.c:154 rtm_output(ffff800000b03f00,ffff80001e792610,ffff80001e792568,40,0) at rtm_output+0xba9 sys/net/rtsock.c:1120 route_output(fffffd806bc22100,fffffd805da6be18,0,0) at route_output+0x678 sys/net/rtsock.c:832 route_usrreq(fffffd805da6be18,9,fffffd806bc22100,0,0,ffff80001d6c2878) at route_usrreq+0x36f sys/net/rtsock.c:275 sosend(fffffd805da6be18,0,ffff80001e792800,0,0,0) at sosend+0x669 sys/kern/uipc_socket.c:549 sendit(ffff80001d6c2878,3,ffff80001e7928e0,0,ffff80001e7929c0) at sendit+0x52b sys/kern/uipc_syscalls.c:652 sys_sendto(ffff80001d6c2878,ffff80001e792978,ffff80001e7929c0) at sys_sendto+0x80 sys/kern/uipc_syscalls.c:517 syscall(ffff80001e792a40) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4c8ebb92fa0, count: -11 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80001e7923e0 rbx 0xffff80001e792490 rdx 0x2 rcx 0 rax 0x1 r8 0xffffffff81c35ebf kprintf+0x15f r9 0x1 r10 0x2 r11 0x1aa96eff1c2bb42 r12 0x3000000008 r13 0xffff80001e7923f0 r14 0x100 r15 0x1 rip 0xffffffff815297e8 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff80001e7923d0 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (syz-executor.0) pid=417478 stat=onproc flags process=0 proc=4000000 pri=32, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff80001d6c2398,0xffffffff8280e640 process=0xffff8000ffff9940 user=0xffff80001e78d000, vmspace=0xfffffd805faeb778 estcpu=36, cpticks=1, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 20151 506158 14699 0 2 0 syz-executor.0 *20151 417478 14699 0 7 0x4000000 syz-executor.0 86115 25194 1 0 3 0x100083 ttyin getty 93774 460857 0 0 3 0x14200 bored sosplice 43507 3222 27162 0 2 0x2 syz-executor.1 14699 88766 27162 0 2 0x482 syz-executor.0 5004 352374 0 0 3 0x14200 acct acct 27162 171747 14066 0 3 0x82 thrsleep syz-fuzzer 27162 92023 14066 0 2 0x4000482 syz-fuzzer 27162 295427 14066 0 3 0x4000082 thrsleep syz-fuzzer 27162 504205 14066 0 3 0x4000082 thrsleep syz-fuzzer 27162 159844 14066 0 3 0x4000082 thrsleep syz-fuzzer 27162 142978 14066 0 3 0x4000082 kqread syz-fuzzer 27162 308037 14066 0 3 0x4000082 thrsleep syz-fuzzer 27162 445725 14066 0 3 0x4000082 thrsleep syz-fuzzer 14066 344679 71814 0 3 0x10008a pause ksh 71814 351798 25790 0 3 0x92 select sshd 25790 303703 1 0 3 0x80 select sshd 17272 207396 66072 73 3 0x100090 kqread syslogd 66072 258921 1 0 3 0x100082 netio syslogd 3921 188685 1 77 3 0x100090 poll dhclient 57571 191669 1 0 3 0x80 poll dhclient 5361 65284 0 0 3 0x14200 bored smr 67490 437015 0 0 2 0x14200 zerothread 47003 492445 0 0 3 0x14200 aiodoned aiodoned 61099 343043 0 0 3 0x14200 syncer update 19575 222796 0 0 3 0x14200 cleaner cleaner 14323 500257 0 0 3 0x14200 reaper reaper 76220 41238 0 0 3 0x14200 pgdaemon pagedaemon 55029 521627 0 0 3 0x14200 bored crynlk 35870 362856 0 0 3 0x14200 bored crypto 20466 5831 0 0 3 0x40014200 acpi0 acpi0 66946 117146 0 0 3 0x14200 bored softnet 94404 232601 0 0 3 0x14200 bored systqmp 11066 250179 0 0 3 0x14200 bored systq 20818 211657 0 0 3 0x40014200 bored softclock 78876 225237 0 0 3 0x40014200 idle0 1 389394 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 9503 6470K 6723K 78643K 11133 0 pcb 13 8K 8K 78643K 66 0 rtable 82 3K 7K 78643K 525 0 ifaddr 73 15K 16K 78643K 190 0 counters 21 16K 16K 78643K 28 0 ioctlops 0 0K 4K 78643K 83 0 iov 0 0K 12K 78643K 34 0 mount 1 1K 1K 78643K 1 0 vnodes 1216 76K 77K 78643K 1441 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 5K 78643K 10 0 VM map 2 0K 0K 78643K 2 0 sem 12 0K 0K 78643K 72 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1809 195K 288K 78643K 12938 0 file desc 5 13K 25K 78643K 339 0 sigio 0 0K 0K 78643K 8 0 proc 49 38K 54K 78643K 468 0 subproc 32 2K 2K 78643K 68 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 22 0 in_multi 65 3K 4K 78643K 118 0 ether_multi 1 0K 0K 78643K 6 0 mrt 0 0K 0K 78643K 2 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 43 201K 201K 78643K 43 0 exec 0 0K 1K 78643K 232 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 7 26K 26K 78643K 7 0 UVM amap 132 55K 55K 78643K 1662 0 UVM aobj 18 2K 2K 78643K 22 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 24 0 NDP 11 0K 0K 78643K 26 0 temp 109 3849K 3913K 78643K 3758 0 kqueue 3 4K 14K 78643K 38 0 SYN cache 2 16K 16K 78643K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 11 0 6 1 0 1 1 0 8 0 rtpcb 80 34 0 31 1 0 1 1 0 8 0 rtentry 112 73 0 45 2 0 2 2 0 8 0 unpcb 120 167 0 159 1 0 1 1 0 8 0 syncache 264 7 0 7 2 2 0 1 0 8 0 tcpqe 32 75 0 75 1 1 0 1 0 8 0 tcpcb 544 77 0 73 1 0 1 1 0 8 0 inpcb 280 694 0 687 2 0 2 2 0 8 1 rttmr 72 1 0 1 1 0 1 1 0 8 1 nd6 48 13 0 10 1 0 1 1 0 8 0 pkpcb 40 2 0 2 1 0 1 1 0 8 1 pfstscr 40 1 0 0 1 0 1 1 0 8 0 pfrktable 1344 83 0 81 1 0 1 1 0 8 0 pftag 88 14 0 14 1 0 1 1 0 8 1 pfstitem 24 1 0 0 1 0 1 1 0 8 0 pfstkey 112 1 0 0 1 0 1 1 0 8 0 pfstate 328 1 0 0 1 0 1 1 0 8 0 pfrule 1360 18 0 14 1 0 1 1 0 8 0 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 331 0 210 13 0 13 13 0 8 3 art_table 32 333 0 210 2 0 2 2 0 8 0 art_node 16 72 0 49 1 0 1 1 0 8 0 sysvmsgpl 40 18 0 8 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 112 66 0 56 1 0 1 1 0 8 0 shmpl 112 20 0 4 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1832 0 436 88 0 88 88 0 8 0 ffsino 240 1832 0 436 83 0 83 83 0 8 0 nchpl 144 2445 0 863 60 0 60 60 0 8 0 uvmvnodes 72 2037 0 0 38 0 38 38 0 8 0 vnodes 208 2037 0 0 108 0 108 108 0 8 0 namei 1024 6735 0 6735 1 0 1 1 0 8 1 vcpupl 1984 3 0 0 1 0 1 1 0 8 0 vmpool 528 5 0 2 1 0 1 1 0 8 0 pfiaddrpl 120 26 0 24 1 0 1 1 0 8 0 scxspl 192 7959 0 7959 1 0 1 1 0 8 1 plimitpl 152 39 0 32 1 0 1 1 0 8 0 sigapl 424 522 0 492 4 0 4 4 0 8 0 futexpl 56 6169 0 6169 1 0 1 1 0 8 1 knotepl 112 142 0 123 1 0 1 1 0 8 0 kqueuepl 144 86 0 82 1 0 1 1 0 8 0 pipelkpl 16 104 0 94 1 0 1 1 0 8 0 pipepl 120 208 0 189 1 0 1 1 0 8 0 fdescpl 432 506 0 492 2 0 2 2 0 8 0 filepl 120 3133 0 3037 4 0 4 4 0 8 0 lockfpl 104 65 0 64 1 0 1 1 0 8 0 lockfspl 48 24 0 23 1 0 1 1 0 8 0 sessionpl 112 20 0 10 1 0 1 1 0 8 0 pgrppl 48 29 0 19 1 0 1 1 0 8 0 ucredpl 96 277 0 270 1 0 1 1 0 8 0 zombiepl 144 492 0 492 1 0 1 1 0 8 1 processpl 920 522 0 492 4 0 4 4 0 8 0 procpl 624 845 0 807 4 0 4 4 0 8 0 sosppl 128 2 0 2 1 0 1 1 0 8 1 sockpl 400 905 0 887 4 0 4 4 0 8 2 mcl64k 65536 24 0 24 1 0 1 1 0 8 1 mcl12k 12288 9 0 9 1 0 1 1 0 8 1 mcl9k 9216 8 0 8 1 0 1 1 0 8 1 mcl8k 8192 8 0 8 1 0 1 1 0 8 1 mcl4k 4096 26 0 26 2 1 1 1 0 8 1 mcl2k2 2112 2 0 2 2 2 0 1 0 8 0 mcl2k 2048 75613 0 75563 16 9 7 13 0 8 0 mtagpl 80 32 0 13 2 1 1 1 0 8 0 mbufpl 256 121822 0 121688 15 1 14 14 0 8 3 bufpl 280 3733 0 132 258 0 258 258 0 8 0 anonpl 16 75081 0 59669 82 3 79 79 0 107 15 amapchunkpl 152 2252 0 2119 9 0 9 9 0 158 2 amappl16 192 2887 0 2030 60 9 51 56 0 8 8 amappl15 184 1 0 0 1 0 1 1 0 8 0 amappl14 176 26 0 19 1 0 1 1 0 8 0 amappl13 168 41 0 38 1 0 1 1 0 8 0 amappl12 160 10 0 9 1 0 1 1 0 8 0 amappl11 152 50 0 41 1 0 1 1 0 8 0 amappl10 144 291 0 284 1 0 1 1 0 8 0 amappl9 136 373 0 371 1 0 1 1 0 8 0 amappl8 128 372 0 332 2 0 2 2 0 8 0 amappl7 120 327 0 311 1 0 1 1 0 8 0 amappl6 112 30 0 24 1 0 1 1 0 8 0 amappl5 104 434 0 422 1 0 1 1 0 8 0 amappl4 96 452 0 426 1 0 1 1 0 8 0 amappl3 88 117 0 112 1 0 1 1 0 8 0 amappl2 80 3088 0 3025 2 0 2 2 0 8 0 amappl1 72 18827 0 18425 24 15 9 17 0 8 0 amappl 80 1120 0 1076 2 0 2 2 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 64 21 0 4 1 0 1 1 0 8 0 uaddrrnd 24 511 0 494 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 511 0 494 1 0 1 1 0 8 0 vmmpekpl 168 7152 0 7122 2 0 2 2 0 8 0 vmmpepl 168 69545 0 67618 124 8 116 116 0 357 31 vmsppl 272 510 0 494 2 0 2 2 0 8 0 pdppl 4096 1028 0 991 7 1 6 6 0 8 1 pvpl 32 228103 0 209692 191 4 187 187 0 265 36 pmappl 200 510 0 494 1 0 1 1 0 8 0 extentpl 40 53 0 36 1 0 1 1 0 8 0 phpool 112 246 0 14 7 0 7 7 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic(ffffffff823c4058) at panic+0x15c sys/kern/subr_prf.c:207 __assert(ffffffff8242be75,ffffffff823d9a93,3ab,ffffffff823983a3) at __assert+0x2b sys/kern/subr_prf.c:154 rtm_output(ffff800000b03f00,ffff80001e792610,ffff80001e792568,40,0) at rtm_output+0xba9 sys/net/rtsock.c:1120 route_output(fffffd806bc22100,fffffd805da6be18,0,0) at route_output+0x678 sys/net/rtsock.c:832 route_usrreq(fffffd805da6be18,9,fffffd806bc22100,0,0,ffff80001d6c2878) at route_usrreq+0x36f sys/net/rtsock.c:275 sosend(fffffd805da6be18,0,ffff80001e792800,0,0,0) at sosend+0x669 sys/kern/uipc_socket.c:549 sendit(ffff80001d6c2878,3,ffff80001e7928e0,0,ffff80001e7929c0) at sendit+0x52b sys/kern/uipc_syscalls.c:652 sys_sendto(ffff80001d6c2878,ffff80001e792978,ffff80001e7929c0) at sys_sendto+0x80 sys/kern/uipc_syscalls.c:517 syscall(ffff80001e792a40) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4c8ebb92fa0, count: -11 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic(ffffffff823c4058) at panic+0x15c sys/kern/subr_prf.c:207 __assert(ffffffff8242be75,ffffffff823d9a93,3ab,ffffffff823983a3) at __assert+0x2b sys/kern/subr_prf.c:154 rtm_output(ffff800000b03f00,ffff80001e792610,ffff80001e792568,40,0) at rtm_output+0xba9 sys/net/rtsock.c:1120 route_output(fffffd806bc22100,fffffd805da6be18,0,0) at route_output+0x678 sys/net/rtsock.c:832 route_usrreq(fffffd805da6be18,9,fffffd806bc22100,0,0,ffff80001d6c2878) at route_usrreq+0x36f sys/net/rtsock.c:275 sosend(fffffd805da6be18,0,ffff80001e792800,0,0,0) at sosend+0x669 sys/kern/uipc_socket.c:549 sendit(ffff80001d6c2878,3,ffff80001e7928e0,0,ffff80001e7929c0) at sendit+0x52b sys/kern/uipc_syscalls.c:652 sys_sendto(ffff80001d6c2878,ffff80001e792978,ffff80001e7929c0) at sys_sendto+0x80 sys/kern/uipc_syscalls.c:517 syscall(ffff80001e792a40) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4c8ebb92fa0, count: -11