panic: Caught invalid memory access at ffff8000018c83b0 size 104 op 1 Stopped at db_enter+0x17: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND * 25413 12871 0 0 0x4000000 0K syz-executor 364079 17880 0 0x2 0 1 syz-executor db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84635b4e) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018c83b0,ffff800001d5f398,68) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80003bcac1a8,1,200000000040,ffff80003bcac180) at sysctl_sysvipc+0x422 sys/kern/kern_sysctl.c:2777 kern_sysctl_dirs(33,ffff80003bcac1a8,1,200000000040,ffff80003bcac180,0,1,1ffff000077957ac) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445 kern_sysctl(ffff80003bcac1a4,2,200000000040,ffff80003bcac180,0,0,ffff80003bcac400) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff8000299122a8,ffff80003bcac400,ffff80003bcac360) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff80003bcac400) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003bcac400) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7bfedbc4b80, count: 6 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: Caught invalid memory access at ffff8000018c83b0 size 104 op 1 ddb{0}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84635b4e) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018c83b0,ffff800001d5f398,68) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80003bcac1a8,1,200000000040,ffff80003bcac180) at sysctl_sysvipc+0x422 sys/kern/kern_sysctl.c:2777 kern_sysctl_dirs(33,ffff80003bcac1a8,1,200000000040,ffff80003bcac180,0,1,1ffff000077957ac) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445 kern_sysctl(ffff80003bcac1a4,2,200000000040,ffff80003bcac180,0,0,ffff80003bcac400) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff8000299122a8,ffff80003bcac400,ffff80003bcac360) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff80003bcac400) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003bcac400) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7bfedbc4b80, count: -9 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80003bcab9b0 rbx 0xffff80003bcaba20 rdx 0 rcx 0xffffffff85143ff0 cpu_info_full_primary+0x1ff0 rax 0xffff80000015ca80 r8 0x101010101010101 r9 0x8080808080808080 r10 0xffff80003bcab798 r11 0xffffffff83f284c0 x86_bus_space_io_read_1 r12 0xffffffff84635b4e .str.23+0x9d50e r13 0xffffffff85144c08 cpu_info_full_primary+0x2c08 r14 0xffffffff85144e07 cpu_info_full_primary+0x2e07 r15 0x1 rip 0xffffffff818a32b7 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff80003bcab9b0 ss 0x10 db_enter+0x17: popq %rbp ddb{0}> show proc PROC (syz-executor) tid=25413 pid=12871 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800029912540,0xffffffff854c1040 process=0xffff800045ff09c8 user=0xffff80003bca1000, vmspace=0xffff800001c7c7c0 estcpu=36, cpticks=18, pctcpu=0.0, user=0, sys=18, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 12871 358919 50917 0 2 0 syz-executor *12871 25413 50917 0 7 0x4000000 syz-executor 97597 485170 17880 0 2 0 syz-executor 97597 343256 17880 0 3 0x4000080 kqpoll syz-executor 81388 104263 89187 0 2 0 syz-executor 55959 1568 99426 0 2 0 syz-executor 55959 88499 99426 0 3 0x4000080 sbwait syz-executor 58043 13818 11541 0 2 0xc90 syz-executor 58043 221436 11541 0 3 0x4000090 sbwait syz-executor 3544 192325 67026 0 2 0xc90 syz-executor 3544 134031 67026 0 3 0x4000090 piperd syz-executor 3544 214464 67026 0 3 0x4000090 fsleep syz-executor 3544 163071 67026 0 3 0x4000090 fsleep syz-executor 64483 401006 48550 -1 2 0xc90 syz-executor 64483 339266 48550 -1 3 0x4000090 fsleep syz-executor 64483 101367 48550 -1 3 0x4000090 piperd syz-executor 25885 195485 1 0 3 0x82 nanoslp getty 87889 10218 0 0 3 0x14280 nfsidl nfsio 12293 234465 0 0 3 0x14280 nfsidl nfsio 1076 442944 0 0 3 0x14280 nfsidl nfsio 65630 352826 0 0 3 0x14280 nfsidl nfsio 4494 22582 0 0 3 0x14280 nfsidl nfsio 85723 469454 0 0 3 0x14280 nfsidl nfsio 84636 396958 0 0 3 0x14280 nfsidl nfsio 17934 360467 0 0 3 0x14280 nfsidl nfsio 80411 451249 0 0 3 0x14280 nfsidl nfsio 37152 427730 0 0 3 0x14280 nfsidl nfsio 48426 303832 0 0 3 0x14280 nfsidl nfsio 62472 60834 0 0 3 0x14280 nfsidl nfsio 53923 335297 0 0 3 0x14280 nfsidl nfsio 65548 254262 0 0 3 0x14280 nfsidl nfsio 48724 392783 0 0 3 0x14280 nfsidl nfsio 98494 492280 0 0 3 0x14280 nfsidl nfsio 31312 136505 0 0 3 0x14280 nfsidl nfsio 16381 159722 0 0 3 0x14280 nfsidl nfsio 30497 122834 0 0 3 0x14280 nfsidl nfsio 31690 274393 0 0 3 0x14280 nfsidl nfsio 92313 453375 60506 0 3 0x100082 sbwait ndp 60506 334444 67228 0 3 0x10008a sigsusp sh 89187 115846 21108 0 2 0xc82 syz-executor 67228 87490 21108 0 3 0x82 wait syz-executor 48550 506518 21108 0 2 0xc82 syz-executor 67026 395581 21108 0 2 0xc82 syz-executor 17880 364079 21108 0 7 0x2 syz-executor 99426 326616 21108 0 2 0xc82 syz-executor 11541 89369 21108 0 2 0xc82 syz-executor 50917 209037 21108 0 2 0xc82 syz-executor 21108 313201 1 0 2 0x2 syz-executor 32749 457188 2012 74 3 0x1100092 bpf pflogd 2012 41389 1 0 3 0x80 sbwait pflogd 84218 487696 1 73 2 0x1100090 syslogd 50057 83166 0 0 2 0x14200 smr 83981 481234 0 0 2 0x14200 zerothread 17637 145948 0 0 3 0x14200 aiodoned aiodoned 81056 186244 0 0 3 0x14200 syncer update 87345 48881 0 0 3 0x14200 cleaner cleaner 39277 477371 0 0 3 0x14200 reaper reaper 47549 326445 0 0 3 0x14200 pgdaemon pagedaemon 62394 122964 0 0 3 0x14200 bored viomb 20562 415053 0 0 3 0x40014200 acpi0 acpi0 11535 523199 0 0 3 0x40014200 idle1 78190 468267 0 0 3 0x14200 bored softnet1 90605 277820 0 0 3 0x14200 bored softnet0 62248 19058 0 0 3 0x14200 bored systqmp 26658 253050 0 0 3 0x14200 bored systq 83272 290027 0 0 2 0x14200 softclockmp 20191 469686 0 0 3 0x40014200 tmoslp softclock 53875 108160 0 0 3 0x40014200 idle0 1 188901 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 12871 (syz-executor) thread 0xffff8000299122a8 (25413) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff854812c0) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 sysctl_vslock+0x72 sys/kern/kern_sysctl.c:197 #2 kern_sysctl_dirs+0x2d2 sys/kern/kern_sysctl.c:443 #3 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 #4 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 #5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 exclusive rwlock sysctllk r = 0 (0xffffffff8516b098) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320 #2 sysctl_vslock+0x37 sys/kern/kern_sysctl.c:192 #3 kern_sysctl_dirs+0x2d2 sys/kern/kern_sysctl.c:443 #4 kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 #5 sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 #6 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 #7 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11060 12314K 12389K 166960K 12270 0 pcb 18 28K 30K 166960K 48 0 rtable 239 12K 13K 166960K 351 0 pf 34 22K 38K 166960K 49 0 ifaddr 43 12K 12K 166960K 45 0 ifgroup 55 2K 2K 166960K 55 0 sysctl 2 1K 13K 166960K 6 0 counters 70 42K 42K 166960K 70 0 ioctlops 0 0K 4K 166960K 1489 0 iov 0 0K 0K 166960K 2 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1359 87K 88K 166960K 1539 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 2 2K 10K 166960K 15 0 VM map 2 1K 1K 166960K 2 0 sem 11 0K 0K 166960K 12 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 292K 166960K 11964 0 file desc 19 69K 97K 166960K 246 0 sigio 1 0K 0K 166960K 3 0 proc 34 79K 193K 166960K 579 0 subproc 72 9K 9K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 ip_moptions 0 0K 0K 166960K 2 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 7 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 67 465K 465K 166960K 67 0 exec 0 0K 2K 166960K 387 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 168 147K 269K 166960K 4049 0 UVM aobj 131 7K 7K 166960K 132 0 pinsyscall 1052 1742K 1744K 166960K 1406 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 12 0K 2K 166960K 28 0 temp 39 9178K 9182K 166960K 5266 0 kqueue 5 17K 52K 166960K 53 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 36 0 35 1 0 1 1 0 8 0 rtentry 176 112 0 1 6 0 6 6 0 8 0 unpcb 144 158 0 144 2 0 2 2 0 8 1 syncache 336 4 0 4 2 2 0 1 0 8 0 tcpcb 736 85 0 84 7 0 7 7 0 8 6 arp 136 19 0 0 1 0 1 1 0 8 0 inpcb 328 353 0 348 7 0 7 7 0 8 5 nd6 152 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pftag 88 1 0 0 1 0 1 1 0 8 0 pfqueue 320 1 0 1 1 0 1 1 0 8 1 pfstitem 24 26 0 0 1 0 1 1 0 8 0 pfstkey 128 26 0 0 1 0 1 1 0 8 0 pfstate 448 26 0 0 3 0 3 3 0 8 0 pfrule 1360 22 0 17 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 454 0 0 29 0 29 29 0 8 0 art_table 40 455 0 0 5 0 5 5 0 8 0 art_node 32 112 0 11 1 0 1 1 0 8 0 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 72 9 0 0 1 0 1 1 0 8 0 shmpl 112 129 0 1 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1793 0 324 93 0 93 93 0 8 0 ffsino 296 1793 0 324 114 0 114 114 0 8 0 nchpl 144 2152 0 450 64 0 64 64 0 8 0 vnodes 216 1984 0 0 111 0 111 111 0 8 0 namei 1024 7047 0 7047 2 0 2 2 0 8 2 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 27 0 0 2 0 2 2 0 8 0 scxspl 216 7419 0 7419 2 1 1 2 1 8 1 plimitpl 152 34 0 22 1 0 1 1 0 8 0 sigapl 424 584 0 524 8 0 8 8 0 8 0 knotepl 120 171 0 0 6 0 6 6 0 8 0 kqueuepl 224 68 0 63 1 0 1 1 0 8 0 pipepl 344 159 0 129 4 0 4 4 0 8 1 fdescpl 528 548 0 524 3 0 3 3 0 8 0 filepl 160 2979 0 2785 19 2 17 19 0 8 8 lockfpl 104 335 0 332 4 0 4 4 0 8 3 lockfspl 48 31 0 28 1 0 1 1 0 8 0 sessionpl 144 27 0 22 1 0 1 1 0 8 0 pgrppl 48 36 0 23 1 0 1 1 0 8 0 ucredpl 104 417 0 402 1 0 1 1 0 8 0 zombiepl 144 524 0 524 1 0 1 1 0 8 1 processpl 1232 584 0 524 6 0 6 6 0 8 0 procpl 664 786 0 717 8 0 8 8 0 8 0 sosppl 176 4 0 4 1 0 1 1 0 8 1 sockpl 752 553 0 533 11 0 11 11 0 8 7 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 118 0 0 15 0 15 15 0 8 0 mcl2k 2048 29 0 0 4 0 4 4 0 8 0 mextrefs 64 26 0 0 1 0 1 1 0 8 0 mtagpl 96 4 0 0 1 0 1 1 0 8 0 mbufpl 256 197 0 0 13 0 13 13 0 8 0 bufpl 272 2517 0 105 161 0 161 161 0 8 0 anonpl 32 3848 0 0 32 0 32 32 0 222 0 amapchunkpl 152 11631 0 11233 22 0 22 22 0 158 4 amappl16 200 2074 0 2057 5 3 2 5 0 8 0 amappl15 192 21 0 21 3 2 1 1 0 8 1 amappl14 184 430 0 429 1 0 1 1 0 8 0 amappl13 176 129 0 124 1 0 1 1 0 8 0 amappl12 168 798 0 776 2 0 2 2 0 8 0 amappl11 160 26 0 26 2 1 1 1 0 8 1 amappl10 152 96 0 90 1 0 1 1 0 8 0 amappl9 144 269 0 269 1 1 0 1 0 8 0 amappl8 136 103 0 102 1 0 1 1 0 8 0 amappl7 128 170 0 163 1 0 1 1 0 8 0 amappl6 120 159 0 157 1 0 1 1 0 8 0 amappl5 112 106 0 101 1 0 1 1 0 8 0 amappl4 104 296 0 285 1 0 1 1 0 8 0 amappl3 96 2218 0 2126 4 0 4 4 0 8 0 amappl2 88 548 0 524 2 0 2 2 0 8 0 amappl1 80 11046 0 10797 16 0 16 16 0 8 3 amappl 88 3295 0 3164 4 0 4 4 0 92 0 uvmvnodes 80 101 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 131 0 1 3 0 3 3 0 8 0 uaddrrnd 24 548 0 524 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 548 0 524 1 0 1 1 0 8 0 vmmpekpl 168 6631 0 6591 3 0 3 3 0 8 0 vmmpepl 168 44466 0 43308 90 1 89 89 0 357 26 vmsppl 488 547 0 524 5 0 5 5 0 8 0 rwobjpl 80 16155 0 15415 25 0 25 25 0 8 0 pdppl 4096 1105 0 1048 99 38 61 89 0 8 4 pvpl 32 10186 0 0 83 0 83 83 0 265 0 pmappl 256 547 0 524 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 442 0 43 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 panic(ffffffff84635b4e) at panic+0x270 sys/kern/subr_prf.c:198 kasan_memcpy(ffff8000018c83b0,ffff800001d5f398,68) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80003bcac1a8,1,200000000040,ffff80003bcac180) at sysctl_sysvipc+0x422 sys/kern/kern_sysctl.c:2777 kern_sysctl_dirs(33,ffff80003bcac1a8,1,200000000040,ffff80003bcac180,0,1,1ffff000077957ac) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445 kern_sysctl(ffff80003bcac1a4,2,200000000040,ffff80003bcac180,0,0,ffff80003bcac400) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529 sys_sysctl(ffff8000299122a8,ffff80003bcac400,ffff80003bcac360) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309 syscall(ffff80003bcac400) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003bcac400) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7bfedbc4b80, count: -9 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x19: leave x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412 x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85480ac0) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff85480ac0) at __mp_lock+0x272 sys/kern/kern_lock.c:173 syscall(ffff800029a38470) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline] syscall(ffff800029a38470) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7da735522040, count: 9 ddb{1}> trace x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412 x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85480ac0) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline] __mp_lock(ffffffff85480ac0) at __mp_lock+0x272 sys/kern/kern_lock.c:173 syscall(ffff800029a38470) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline] syscall(ffff800029a38470) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7da735522040, count: -6 ddb{1}>