login: panic: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 959 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834c0432) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff834ff3b1,ffffffff835111a2,3bf,ffffffff83539d80) at __assert+0x29 sys/kern/subr_prf.c:-1 refcnt_finalize(ffff800039bb7778,ffffffff834b5cb4) at refcnt_finalize+0x1e7 sys/kern/kern_synch.c:960 pppx_if_destroy(205b9a,ffff800039bb7770) at pppx_if_destroy+0x3d sys/net/if_pppx.c:794 pppxclose(205b9a,1,2000,ffff80003bbc62c8) at pppxclose+0xa0 sys/net/if_pppx.c:541 spec_close(ffff80002a24a8c0) at spec_close+0x417 sys/kern/spec_vnops.c:-1 VOP_CLOSE(fffff8006a9e4da8,1,fffff800097fd5b0,ffff80003bbc62c8) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156 vn_closefile(fffff8006fb6d5a8,ffff80003bbc62c8) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffff8006fb6d5a8,ffff80003bbc62c8) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621 fdrop(fffff8006fb6d5a8,ffff80003bbc62c8) at fdrop+0x121 sys/kern/kern_descrip.c:1281 closef(fffff8006fb6d5a8,ffff80003bbc62c8) at closef+0x192 sys/kern/kern_descrip.c:1265 fdfree(ffff80003bbc62c8) at fdfree+0x116 sys/kern/kern_descrip.c:1196 exit1(ffff80003bbc62c8,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215 sys_exit(ffff80003bbc62c8,ffff80002a24ac30,ffff80002a24ab80) at sys_exit+0x1a sys/kern/kern_exit.c:-1 end trace frame: 0xffff80002a24ac20, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 959 ddb{1}> show kasan No such command ddb{1}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834c0432) at panic+0x1e5 sys/kern/subr_prf.c:198 __assert(ffffffff834ff3b1,ffffffff835111a2,3bf,ffffffff83539d80) at __assert+0x29 sys/kern/subr_prf.c:-1 refcnt_finalize(ffff800039bb7778,ffffffff834b5cb4) at refcnt_finalize+0x1e7 sys/kern/kern_synch.c:960 pppx_if_destroy(205b9a,ffff800039bb7770) at pppx_if_destroy+0x3d sys/net/if_pppx.c:794 pppxclose(205b9a,1,2000,ffff80003bbc62c8) at pppxclose+0xa0 sys/net/if_pppx.c:541 spec_close(ffff80002a24a8c0) at spec_close+0x417 sys/kern/spec_vnops.c:-1 VOP_CLOSE(fffff8006a9e4da8,1,fffff800097fd5b0,ffff80003bbc62c8) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156 vn_closefile(fffff8006fb6d5a8,ffff80003bbc62c8) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffff8006fb6d5a8,ffff80003bbc62c8) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621 fdrop(fffff8006fb6d5a8,ffff80003bbc62c8) at fdrop+0x121 sys/kern/kern_descrip.c:1281 closef(fffff8006fb6d5a8,ffff80003bbc62c8) at closef+0x192 sys/kern/kern_descrip.c:1265 fdfree(ffff80003bbc62c8) at fdfree+0x116 sys/kern/kern_descrip.c:1196 exit1(ffff80003bbc62c8,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215 sys_exit(ffff80003bbc62c8,ffff80002a24ac30,ffff80002a24ab80) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a24ac30) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a24ac30) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7222d07b2fc0, count: -16 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff80002a24a680 rbx 0xffff80002999ee07 rdx 0 rcx 0xffff80003bbc62c8 rax 0xffff80002999dff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x85e5bafbb51dc45 r11 0x3b3a9d0cf355994f r12 0xffff80002999ec08 r13 0 r14 0 r15 0x1 rip 0xffffffff8128d135 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a24a670 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=197021 pid=14507 tcnt=0 stat=onproc flags process=1008 proc=2000 runpri=32, usrpri=80, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0xffff80003bbc62c8 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff80003bbc6a90,0xffff80003c402fc8 process=0xffff800045ff39d0 user=0xffff80002a245000, vmspace=0xfffff8006e1c4b80 estcpu=30, cpticks=4, pctcpu=0.3, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 74792 452609 89040 0 2 0 0 syz-executor 74792 192823 89040 0 3 0 0x4000080 fsleep syz-executor 16821 203739 93966 0 2 0 0 syz-executor 16821 353988 93966 0 3 0 0x4000080 fsleep syz-executor 15110 205731 37798 0 2 0 0 syz-executor 15110 96189 37798 0 3 0 0x4000000 smrbar syz-executor 40418 26694 19341 0 3 0 0x80 nanoslp syz-executor 40418 468064 19341 0 2 0 0x4000000 syz-executor 48726 322340 32331 0 2 0 0 syz-executor 48726 7048 32331 0 3 0 0x4000080 ttyout syz-executor 48726 325236 32331 0 3 0 0x4000080 fsleep syz-executor 48726 184451 32331 0 3 0 0x4000080 ttyout syz-executor 51508 501760 61677 60929 2 0x10 0 syz-executor 51508 71313 61677 60929 3 0x10 0x4000080 netcon syz-executor 51508 85907 61677 60929 3 0x10 0x4000080 fsleep syz-executor 92065 338326 1 0 3 0x100003 0x80 ttyin getty 27972 220719 82042 0 2 0x2 0xc80 syz-executor 90059 442461 0 0 3 0x14000 0x200 acct acct 93966 236819 82042 0 2 0x2 0 syz-executor 19341 13959 82042 0 2 0x2 0xc80 syz-executor 89040 52328 82042 0 2 0x2 0xc80 syz-executor 92210 20755 82042 0 3 0x2 0x80 nanoslp syz-executor 37798 191595 82042 0 2 0x2 0 syz-executor 61677 39775 82042 0 3 0x2 0x80 nanoslp syz-executor 32331 428522 82042 0 2 0x2 0xc80 syz-executor 82042 445442 1 0 2 0x2 0x80 syz-executor 35889 49268 0 0 2 0x14000 0x200 smr 90414 496915 0 0 2 0x14000 0x200 zerothread 46111 114439 0 0 3 0x14000 0x200 aiodoned aiodoned 79097 121894 0 0 3 0x14000 0x200 syncer update 87301 117446 0 0 3 0x14000 0x200 cleaner cleaner 67802 231952 0 0 3 0x14000 0x200 reaper reaper 57936 15744 0 0 3 0x14000 0x200 pgdaemon pagedaemon 66385 225680 0 0 3 0x14000 0x200 bored viomb 59737 456217 0 0 3 0x14000 0x40000200 acpi0 acpi0 94155 7505 0 0 3 0x14000 0x40000200 idle1 76630 223612 0 0 3 0x14000 0x200 bored softnet1 53424 418451 0 0 3 0x14000 0x200 bored softnet0 58748 258474 0 0 3 0x14000 0x200 bored systqmp 60466 233169 0 0 3 0x14000 0x200 bored systq 66638 215136 0 0 3 0x14000 0x200 tmoslp softclockmp 24285 215640 0 0 3 0x14000 0x40000200 tmoslp softclock 9511 42666 0 0 3 0x14000 0x40000200 idle0 1 346058 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10010000 0x200 scheduler swapper ddb{1}>