panic: kernel diagnostic assertion "map->limit == rtmap_limit" failed: file "/syzkaller/managers/main/kernel/sys/net/rtable.c", line 131 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *349068 69237 0 0 0x4000000 0 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830af614) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff83069494,ffffffff8303d69e,83,ffffffff830add5a) at __assert+0x29 rtmap_grow(21,21) at rtmap_grow+0x1f3 sys/net/rtable.c:131 rtable_add(20) at rtable_add+0x279 if_createrdomain(20,ffff80000159d000) at if_createrdomain+0x40 sys/net/if.c:1947 ifioctl(fffffd80602be9e0,8020699f,ffff800030da5640,ffff80002a513c08) at ifioctl+0x19be sys/net/if.c:2296 sys_ioctl(ffff80002a513c08,ffff800030da5820,ffff800030da5770) at sys_ioctl+0x678 syscall(ffff800030da5820) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfc5ec468150, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: kernel diagnostic assertion "map->limit == rtmap_limit" failed: file "/syzkaller/managers/main/kernel/sys/net/rtable.c", line 131 ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830af614) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff83069494,ffffffff8303d69e,83,ffffffff830add5a) at __assert+0x29 rtmap_grow(21,21) at rtmap_grow+0x1f3 sys/net/rtable.c:131 rtable_add(20) at rtable_add+0x279 if_createrdomain(20,ffff80000159d000) at if_createrdomain+0x40 sys/net/if.c:1947 ifioctl(fffffd80602be9e0,8020699f,ffff800030da5640,ffff80002a513c08) at ifioctl+0x19be sys/net/if.c:2296 sys_ioctl(ffff80002a513c08,ffff800030da5820,ffff800030da5770) at sys_ioctl+0x678 syscall(ffff800030da5820) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfc5ec468150, count: -10 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff800030da5370 rbx 0x21 rdx 0 rcx 0 rax 0xffff80002a513c08 r8 0 r9 0x8080808080808080 r10 0x6724d4d5a8dd23b2 r11 0x79d60a08ef3fc98d r12 0 r13 0x17 r14 0 r15 0x1 rip 0xffffffff825bfd45 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff800030da5360 ss 0 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=349068 pid=69237 tcnt=4 stat=onproc flags process=0 proc=4000000 runpri=82, usrpri=82, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800037624f58,0xffff80002a512f70 process=0xffff80002a586af0 user=0xffff800030da0000, vmspace=0xfffffd807528dd78 estcpu=32, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 59379 72235 70750 0 2 0 syz-executor 59379 492320 70750 0 3 0x4000080 kqpoll syz-executor 3179 20821 55962 0 2 0 syz-executor 3179 18176 55962 0 2 0x4000000 syz-executor 32235 229842 10476 0 2 0 syz-executor 32235 443711 10476 0 3 0x4000080 fsleep syz-executor 7118 149888 95193 0 2 0x10 syz-executor 7118 5818 95193 0 3 0x4000090 fsleep syz-executor 7118 517903 95193 0 3 0x4000090 fsleep syz-executor 44380 501830 16597 0 2 0 syz-executor 44380 500504 16597 0 3 0x4000080 fsleep syz-executor 69237 249961 56982 0 2 0 syz-executor 69237 314002 56982 0 2 0x4000000 syz-executor *69237 349068 56982 0 7 0x4000000 syz-executor 69237 28094 56982 0 3 0x4000080 fsleep syz-executor 56982 480636 28346 0 2 0x482 syz-executor 55962 116550 28346 0 2 0x3 syz-executor 16597 332088 28346 0 2 0x3 syz-executor 10476 338798 28346 0 2 0x3 syz-executor 95626 77079 28346 0 2 0x3 syz-executor 38037 339505 28346 0 2 0x2 syz-executor 95193 46550 28346 0 2 0x3 syz-executor 70750 191848 28346 0 2 0x482 syz-executor 15678 301890 1 0 3 0x100083 ttyin getty 37949 122896 0 0 3 0x14200 acct acct 96750 411124 0 0 3 0x14200 bored sosplice 66148 166465 0 0 3 0x14280 nfsidl nfsio 70090 348155 0 0 3 0x14280 nfsidl nfsio 24177 503880 0 0 3 0x14280 nfsidl nfsio 85069 27358 0 0 3 0x14280 nfsidl nfsio 23761 327561 0 0 3 0x14280 nfsidl nfsio 4271 146044 0 0 3 0x14280 nfsidl nfsio 56598 409328 0 0 3 0x14280 nfsidl nfsio 10738 242018 0 0 3 0x14280 nfsidl nfsio 51607 37593 0 0 3 0x14280 nfsidl nfsio 42538 94719 0 0 3 0x14280 nfsidl nfsio 5260 287803 0 0 3 0x14280 nfsidl nfsio 46024 175891 0 0 3 0x14280 nfsidl nfsio 20748 357924 0 0 3 0x14280 nfsidl nfsio 91167 324864 0 0 3 0x14280 nfsidl nfsio 41224 301080 0 0 3 0x14280 nfsidl nfsio 53166 298853 0 0 3 0x14280 nfsidl nfsio 45782 353596 0 0 3 0x14280 nfsidl nfsio 33030 400308 0 0 3 0x14280 nfsidl nfsio 81135 341587 0 0 3 0x14280 nfsidl nfsio 24850 353784 0 0 3 0x14280 nfsidl nfsio 28346 51783 33716 0 3 0x82 kqread syz-executor 33716 309660 56465 0 3 0x10008a sigsusp ksh 56465 151437 5401 0 3 0x98 kqread sshd-session 5401 227042 4484 0 3 0x92 kqread sshd-session 4484 138106 1 0 3 0x88 kqread sshd 35516 7688 29440 73 2 0x1100010 syslogd 29440 477736 1 0 3 0x100082 sbwait syslogd 55029 300213 1 0 3 0x100080 kqread resolvd 63891 259390 79091 77 3 0x100092 kqread dhcpleased 42895 234910 79091 77 3 0x100092 kqread dhcpleased 79091 59931 1 0 3 0x80 kqread dhcpleased 17980 88464 0 0 3 0x14200 bored smr 42630 121956 0 0 2 0x14200 zerothread 81885 181990 0 0 3 0x14200 aiodoned aiodoned 97352 86420 0 0 3 0x14200 syncer update 35316 64038 0 0 3 0x14200 cleaner cleaner 10105 459829 0 0 3 0x14200 reaper reaper 20049 422529 0 0 3 0x14200 pgdaemon pagedaemon 29404 296367 0 0 3 0x14200 bored viomb 19141 176492 0 0 3 0x40014200 acpi0 acpi0 89464 250518 0 0 3 0x14200 bored softnet3 37983 29730 0 0 3 0x14200 bored softnet2 59022 195662 0 0 3 0x14200 bored softnet1 45472 252264 0 0 3 0x14200 bored softnet0 60876 60475 0 0 3 0x14200 bored systqmp 22494 316596 0 0 3 0x14200 bored systq 19132 259083 0 0 3 0x40014200 tmoslp softclock 58194 19894 0 0 3 0x40014200 idle0 1 192452 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10185 14127K 14580K 166960K 13622 0 pcb 17 16K 17K 166960K 412 0 rtable 219 8K 8K 166960K 4773 0 pf 34 13K 14K 166960K 324 0 ifaddr 41 8K 9K 166960K 609 0 ifgroup 55 2K 2K 166960K 617 0 sysctl 4 1K 1K 166960K 8 0 counters 31 17K 17K 166960K 175 0 ioctlops 0 0K 4K 166960K 281 0 iov 0 0K 20K 166960K 117 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1459 92K 92K 166960K 4183 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 32 0 VM map 2 1K 1K 166960K 2 0 sem 45 32K 35K 166960K 51 0 dirhash 18 3K 3K 166960K 51 0 ACPI 1690 195K 286K 166960K 12418 0 file desc 18 65K 93K 166960K 3681 0 sigio 0 0K 0K 166960K 69 0 proc 60 59K 91K 166960K 4447 0 subproc 104 6K 6K 166960K 1863 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 344 0 in_multi 90 6K 7K 166960K 1659 0 ether_multi 1 0K 0K 166960K 28 0 mrt 1 0K 0K 166960K 5 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 67 307K 307K 166960K 67 0 exec 0 0K 1K 166960K 2388 0 pfkey data 0 0K 0K 166960K 2 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 223 72K 96K 166960K 27349 0 UVM aobj 86 3K 5K 166960K 91 0 pinsyscall 39 78K 93K 166960K 8247 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 102 0 NDP 12 0K 2K 166960K 444 0 temp 77 6816K 6904K 166960K 139398 0 kqueue 13 20K 30K 166960K 265 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 618 0 615 5 4 1 3 0 8 0 rtentry 112 1657 0 1559 4 1 3 4 0 8 0 unpcb 144 2442 0 2422 10 8 2 7 0 8 1 syncache 336 12 0 12 2 2 0 1 0 8 0 tcpqe 32 8 0 8 1 1 0 1 0 8 0 tcpcb 808 616 0 610 8 7 1 8 0 8 0 arp 88 300 0 281 1 0 1 1 0 8 0 ipq 40 8 0 7 1 0 1 1 0 8 0 ipqe 40 111 0 110 1 0 1 1 0 8 0 inpcb 336 3160 0 3147 22 19 3 12 0 8 1 nd6 104 444 0 420 1 0 1 1 0 8 0 pkpcb 40 10 0 10 3 2 1 1 0 8 1 kcovpl 48 143 0 135 1 0 1 1 0 8 0 ppxss 1072 7 0 7 2 2 0 1 0 8 0 pfrule 1344 1 0 1 1 1 0 1 0 8 0 art_heap8 4096 4 0 0 4 0 4 4 0 8 0 art_heap4 256 6598 0 6205 34 8 26 30 0 8 1 art_table 32 6602 0 6205 4 0 4 4 0 8 0 art_node 16 1653 0 1565 1 0 1 1 0 8 0 sysvmsgpl 40 2 0 0 1 0 1 1 0 8 0 semapl 112 43 0 0 2 0 2 2 0 8 0 shmpl 112 88 0 5 3 0 3 3 0 8 0 dirhash 1024 45 0 23 3 0 3 3 0 8 0 dino2pl 256 4586 0 2821 111 0 111 111 0 8 0 ffsino 240 4586 0 2821 105 0 105 105 0 8 0 nchpl 144 7117 0 5255 70 0 70 70 0 8 0 uvmvnodes 80 7123 0 0 146 0 146 146 0 8 0 vnodes 216 7123 0 0 396 0 396 396 0 8 0 namei 1024 38918 0 38918 3 2 1 2 0 8 1 kstatmem 264 312 0 288 2 0 2 2 0 8 0 acpiwqpl 32 2 0 2 1 0 1 1 1 8 1 scsiplug 72 5 0 5 3 2 1 1 0 8 1 scxspl 216 71479 0 71479 9 8 1 8 1 8 1 plimitpl 152 744 0 728 1 0 1 1 0 8 0 sigapl 424 3720 0 3652 8 0 8 8 0 8 0 futexpl 64 25336 0 25331 2 1 1 1 0 8 0 knotepl 120 76750 0 76703 31 21 10 16 0 8 8 kqueuepl 184 666 0 655 7 6 1 4 0 8 0 pipepl 288 661 0 633 4 1 3 3 0 8 0 fdescpl 432 3682 0 3652 5 1 4 5 0 8 0 filepl 120 20035 0 19785 22 10 12 16 0 8 3 lockfpl 104 798 0 796 3 2 1 2 0 8 0 lockfspl 48 294 0 292 1 0 1 1 0 8 0 sessionpl 144 163 0 155 1 0 1 1 0 8 0 pgrppl 48 460 0 444 1 0 1 1 0 8 0 ucredpl 104 2721 0 2708 1 0 1 1 0 8 0 zombiepl 144 3846 0 3844 2 1 1 1 0 8 0 processpl 1096 3720 0 3652 6 0 6 6 0 8 0 procpl 648 6107 0 6029 10 2 8 8 0 8 1 sosppl 168 8 0 8 2 1 1 1 0 8 1 sockpl 504 6257 0 6221 101 95 6 36 0 8 1 mcl64k 65536 58 0 58 3 2 1 1 0 8 1 mcl12k 12288 2 0 2 2 2 0 1 0 8 0 mcl9k 9216 4 0 4 2 1 1 1 0 8 1 mcl8k 8192 36 0 36 3 2 1 1 0 8 1 mcl4k 4096 15 0 15 3 2 1 1 0 8 1 mcl2k 2048 12255 0 12159 36 20 16 31 0 8 3 mtagpl 96 81 0 81 2 1 1 1 0 8 1 mbufpl 256 36085 0 35872 51 29 22 39 0 8 7 bufpl 280 14043 0 5547 608 0 608 608 0 8 0 anonpl 24 541745 0 538419 93 43 50 78 0 187 11 amapchunkpl 152 88073 0 87587 58 27 31 41 0 158 10 amappl16 200 9001 0 8981 56 46 10 15 0 8 8 amappl15 192 6 0 6 1 1 0 1 0 8 0 amappl14 184 435 0 425 1 0 1 1 0 8 0 amappl13 176 13 0 13 1 1 0 1 0 8 0 amappl12 168 6455 0 6426 3 1 2 3 0 8 0 amappl11 160 52 0 40 1 0 1 1 0 8 0 amappl10 152 12 0 12 1 1 0 1 0 8 0 amappl9 144 147 0 147 1 1 0 1 0 8 0 amappl8 136 31 0 29 1 0 1 1 0 8 0 amappl7 128 410 0 400 1 0 1 1 0 8 0 amappl6 120 1530 0 1529 1 0 1 1 0 8 0 amappl5 112 673 0 663 1 0 1 1 0 8 0 amappl4 104 720 0 705 1 0 1 1 0 8 0 amappl3 96 16339 0 16227 4 0 4 4 0 8 0 amappl2 88 2627 0 2565 2 0 2 2 0 8 0 amappl1 80 27360 0 26846 14 2 12 13 0 8 0 amappl 88 25813 0 25643 5 0 5 5 0 92 0 dma65536 65536 1 0 1 1 1 0 1 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma2048 2048 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 255 0 255 2 2 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 19 0 18 1 0 1 1 0 8 0 aobjpl 72 90 0 5 2 0 2 2 0 8 0 uaddrrnd 24 3682 0 3652 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 3682 0 3652 1 0 1 1 0 8 0 vmmpekpl 168 29265 0 29225 3 0 3 3 0 8 0 vmmpepl 168 230254 0 228505 106 16 90 90 0 357 12 vmsppl 344 3681 0 3652 4 1 3 4 0 8 0 rwobjpl 24 71540 0 63486 49 0 49 49 0 8 0 pdppl 4096 7370 0 7304 277 211 66 80 0 8 0 pvpl 32 1778180 0 1768542 492 269 223 361 0 265 125 pmappl 216 3681 0 3652 3 1 2 3 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 775 0 404 12 0 12 12 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830af614) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff83069494,ffffffff8303d69e,83,ffffffff830add5a) at __assert+0x29 rtmap_grow(21,21) at rtmap_grow+0x1f3 sys/net/rtable.c:131 rtable_add(20) at rtable_add+0x279 if_createrdomain(20,ffff80000159d000) at if_createrdomain+0x40 sys/net/if.c:1947 ifioctl(fffffd80602be9e0,8020699f,ffff800030da5640,ffff80002a513c08) at ifioctl+0x19be sys/net/if.c:2296 sys_ioctl(ffff80002a513c08,ffff800030da5820,ffff800030da5770) at sys_ioctl+0x678 syscall(ffff800030da5820) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfc5ec468150, count: -10 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff830af614) at panic+0x1cf sys/kern/subr_prf.c:198 __assert(ffffffff83069494,ffffffff8303d69e,83,ffffffff830add5a) at __assert+0x29 rtmap_grow(21,21) at rtmap_grow+0x1f3 sys/net/rtable.c:131 rtable_add(20) at rtable_add+0x279 if_createrdomain(20,ffff80000159d000) at if_createrdomain+0x40 sys/net/if.c:1947 ifioctl(fffffd80602be9e0,8020699f,ffff800030da5640,ffff80002a513c08) at ifioctl+0x19be sys/net/if.c:2296 sys_ioctl(ffff80002a513c08,ffff800030da5820,ffff800030da5770) at sys_ioctl+0x678 syscall(ffff800030da5820) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xfc5ec468150, count: -10