[ 89.3972083] panic: kernel diagnostic assertion "vp->v_specnode == sn" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/miscfs/specfs/spec_vnops.c", line 327 [ 89.4125654] cpu0: Begin traceback... [ 89.4471899] vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288 [ 89.5871917] kern_assert() at netbsd:kern_assert+0x65 sys/arch/amd64/amd64/db_disasm.c:1074 [ 89.7071902] spec_io_exit() at netbsd:spec_io_exit+0x254 sys/miscfs/specfs/spec_vnops.c:327 [ 89.8071903] spec_read() at netbsd:spec_read+0x6c6 sys/miscfs/specfs/spec_vnops.c:1111 [ 89.9071913] layer_bypass() at netbsd:layer_bypass+0x63e sys/miscfs/genfs/layer_vnops.c:294 [ 90.0071926] VOP_READ() at netbsd:VOP_READ+0x138 sys/kern/vnode_if.c:785 [ 90.1071931] vn_read() at netbsd:vn_read+0x5f6 sys/kern/vfs_vnops.c:677 [ 90.2071897] dofileread() at netbsd:dofileread+0x133 sys/kern/sys_generic.c:156 [ 90.2971930] sys_read() at netbsd:sys_read+0xd3 sys/kern/sys_generic.c:121 [ 90.3971927] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline] [ 90.3971927] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90 [ 90.4871977] syscall() at netbsd:syscall+0x28b sy_call sys/sys/syscallvar.h:65 [inline] [ 90.4871977] syscall() at netbsd:syscall+0x28b sy_invoke sys/sys/syscallvar.h:94 [inline] [ 90.4871977] syscall() at netbsd:syscall+0x28b sys/arch/x86/x86/syscall.c:137 [ 90.5179679] --- syscall (number 3 via SYS_syscall) --- [ 90.5471942] netbsd:syscall+0x28b: [ 90.5471942] cpu0: End traceback... [ 90.5471942] fatal breakpoint trap in supervisor mode [ 90.5590533] trap type 1 code 0 rip 0xffffffff80235475 cs 0x8 rflags 0x246 cr2 0xc000258408 ilevel 0 rsp 0xffffa682484aea20 [ 90.5718362] curlwp 0xffffa112cf252040 pid 2363.1345 lowest kstack 0xffffa682484aa2c0 Stopped in pid 2363.1345 (syz-executor.4) at netbsd:breakpoint+0x5: leave ? breakpoint() at netbsd:breakpoint+0x5 db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:71 vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288 kern_assert() at netbsd:kern_assert+0x65 sys/arch/amd64/amd64/db_disasm.c:1074 spec_io_exit() at netbsd:spec_io_exit+0x254 sys/miscfs/specfs/spec_vnops.c:327 spec_read() at netbsd:spec_read+0x6c6 sys/miscfs/specfs/spec_vnops.c:1111 layer_bypass() at netbsd:layer_bypass+0x63e sys/miscfs/genfs/layer_vnops.c:294 VOP_READ() at netbsd:VOP_READ+0x138 sys/kern/vnode_if.c:785 vn_read() at netbsd:vn_read+0x5f6 sys/kern/vfs_vnops.c:677 dofileread() at netbsd:dofileread+0x133 sys/kern/sys_generic.c:156 sys_read() at netbsd:sys_read+0xd3 sys/kern/sys_generic.c:121 sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90 syscall() at netbsd:syscall+0x28b sy_call sys/sys/syscallvar.h:65 [inline] syscall() at netbsd:syscall+0x28b sy_invoke sys/sys/syscallvar.h:94 [inline] syscall() at netbsd:syscall+0x28b sys/arch/x86/x86/syscall.c:137 --- syscall (number 3 via SYS_syscall) --- netbsd:syscall+0x28b: Panic string: kernel diagnostic assertion "vp->v_specnode == sn" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/miscfs/specfs/spec_vnops.c", line 327 PID LID S CPU FLAGS STRUCT LWP * NAME WAIT 1750 1750 2 1 0 ffffa112c241c1c0 syz-executor.3 2489 2489 2 1 140 ffffa112cefc74c0 syz-executor.0 2127 2761 3 1 180 ffffa112c0ebd8c0 syz-executor.2 parked 2127 2127 2 1 10000000 ffffa112ce49e300 syz-executor.2 2363 1356 2 1 100100 ffffa112c0ebd480 syz-executor.4 2363 1090 2 1 100100 ffffa112c66be100 syz-executor.4 2363 1444 2 1 100100 ffffa112cfcc0a00 syz-executor.4 2363 > 1345 7 0 100100 ffffa112cf252040 syz-executor.4 2363 2363 2 0 10040140 ffffa112cf252480 syz-executor.4 1156 1156 3 1 40 ffffa112ce49eb80 syz-executor.2 mutex 1062 1062 3 1 180 ffffa112ceffa340 syz-executor.5 parked 1174 1174 3 1 40 ffffa112c2597200 syz-executor.4 mutex 2028 2028 2 0 0 ffffa112cefbea80 syz-executor.1 2375 2375 2 0 140 ffffa112c1ad1580 syz-executor.5 916 916 3 0 180 ffffa112c1b714c0 syz-executor.4 parked 899 899 3 0 180 ffffa112d3d8f280 syz-executor.4 parked 1129 1129 3 1 180 ffffa112c18eb940 syz-executor.1 parked 2247 2247 3 0 180 ffffa112c1b71900 syz-executor.0 parked 1600 1084 2 0 1140000 ffffa112ceffa780 syz-executor.3 1600 1600 2 1 11000040 ffffa112c66be540 syz-executor.3 482 482 3 1 180 ffffa112c66be980 syz-executor.5 parked 1323 1323 3 0 180 ffffa112c17df100 syz-executor.1 parked 1237 1332 3 1 180 ffffa112c2a092c0 syz-fuzzer wait 1237 1132 3 1 180 ffffa112c18eb500 syz-fuzzer wait 1237 1236 3 1 180 ffffa112c18eb0c0 syz-fuzzer wait 1237 1199 3 1 180 ffffa112c17df540 syz-fuzzer wait 1237 990 2 0 0 ffffa112c1de2180 syz-fuzzer 1237 813 3 1 180 ffffa112c0b2b2c0 syz-fuzzer wait 1237 1241 3 1 180 ffffa112c2584b00 syz-fuzzer parked 1237 1224 3 0 180 ffffa112c2597a80 syz-fuzzer parked 1237 989 3 1 0 ffffa112c1ef7240 syz-fuzzer mutex 1237 1226 3 0 180 ffffa112c1ef7ac0 syz-fuzzer parked 1237 1231 3 1 180 ffffa112c0b2b700 syz-fuzzer parked 1237 1229 2 1 140 ffffa112c09ce280 syz-fuzzer 1237 1237 3 1 180 ffffa112c241c600 syz-fuzzer wait 1235 1235 3 0 180 ffffa112c09ceb00 sshd select 1082 1082 2 0 140 ffffa112c1ef7680 getty 1216 1216 2 1 140 ffffa112c09ce6c0 getty 1195 1195 2 1 140 ffffa112c069cac0 getty 1196 1196 3 1 180 ffffa112c06b7200 getty ttyraw 952 952 3 0 180 ffffa112c25846c0 sshd select 1056 1056 3 0 180 ffffa112c2584280 powerd kqueue 700 700 3 1 180 ffffa112c17df980 syslogd kqueue 747 747 3 0 180 ffffa112c0b2bb40 dhcpcd poll 742 742 3 0 180 ffffa112c0d6fbc0 dhcpcd poll -2087909354address 0x7 is invalid address 0x8 is invalid address 0x9 is invalid address 0xa is invalid address 0xb is invalid address 0xc is invalid address 0xd is invalid [ 90.5795070] Skipping crash dump on recursive panic [ 90.5795070] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/ddb/db_proc.c:202:10, member access within misaligned address 0xffffa68251465320 for type 'struct cpu_info' which requires 64 byte alignment [ 90.5795070] cpu0: Begin traceback... [ 90.5795070] vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288 [ 90.5795070] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352 [ 90.5795070] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0xfc sys/../common/lib/libc/misc/ubsan.c:432 [ 90.5795070] db_show_all_procs() at netbsd:db_show_all_procs+0xe82 sys/ddb/db_proc.c:202 [ 90.5795070] db_command() at netbsd:db_command+0x240 sys/ddb/db_command.c:972 [ 90.5795070] db_command_loop() at netbsd:db_command_loop+0x221 db_execute_commandlist sys/ddb/db_command.c:468 [inline] [ 90.5795070] db_command_loop() at netbsd:db_command_loop+0x221 sys/ddb/db_command.c:618 [ 90.5795070] db_trap() at netbsd:db_trap+0x261 sys/ddb/db_trap.c:94 [ 90.5795070] kdb_trap() at netbsd:kdb_trap+0x1aa sys/arch/amd64/amd64/db_interface.c:252 [ 90.5795070] trap() at netbsd:trap+0x569 sys/arch/amd64/amd64/trap.c:314 [ 90.5795070] --- trap (number 1) --- [ 90.5795070] breakpoint() at netbsd:breakpoint+0x5 [ 90.5795070] db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:71 [ 90.5795070] vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288 [ 90.5795070] kern_assert() at netbsd:kern_assert+0x65 sys/arch/amd64/amd64/db_disasm.c:1074 [ 90.5795070] spec_io_exit() at netbsd:spec_io_exit+0x254 sys/miscfs/specfs/spec_vnops.c:327 [ 90.5795070] spec_read() at netbsd:spec_read+0x6c6 sys/miscfs/specfs/spec_vnops.c:1111 [ 90.5795070] layer_bypass() at netbsd:layer_bypass+0x63e sys/miscfs/genfs/layer_vnops.c:294 [ 90.5795070] VOP_READ() at netbsd:VOP_READ+0x138 sys/kern/vnode_if.c:785 [ 90.5795070] vn_read() at netbsd:vn_read+0x5f6 sys/kern/vfs_vnops.c:677 [ 90.5795070] dofileread() at netbsd:dofileread+0x133 sys/kern/sys_generic.c:156 [ 90.5795070] sys_read() at netbsd:sys_read+0xd3 sys/kern/sys_generic.c:121 [ 90.5795070] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline] [ 90.5795070] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90 [ 90.5795070] syscall() at netbsd:syscall+0x28b sy_call sys/sys/syscallvar.h:65 [inline] [ 90.5795070] syscall() at netbsd:syscall+0x28b sy_invoke sys/sys/syscallvar.h:94 [inline] [ 90.5795070] syscall() at netbsd:syscall+0x28b sys/arch/x86/x86/syscall.c:137 [ 90.5795070] --- syscall (number 3 via SYS_syscall) --- [ 90.5795070] netbsd:syscall+0x28b: [ 90.5795070] cpu0: End traceback... [ 90.5795070] fatal breakpoint trap in supervisor mode [ 90.5795070] trap type 1 code 0 rip 0xffffffff80235475 cs 0x8 rflags 0x246 cr2 0xc000258408 ilevel 0x8 rsp 0xffffa682484adf00 [ 90.5795070] curlwp 0xffffa112cf252040 pid 2363.1345 lowest kstack 0xffffa682484aa2c0 Stopped in pid 2363.1345 (syz-executor.4) at netbsd:breakpoint+0x5: leave