panic: ffs_valloc: dup alloc Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *144994 86510 0 0x2 0 0 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346bb52) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(ffffef006d4a2300,41ed,ffffef0007ffd4e0,ffff80002a80cbf8) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a80cc60) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(ffffef006d3f07d0,ffff80002a80cdc0,ffff80002a80cdf0,ffff80002a80ccf0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a767c98,ffffff9c,70f17e4f1d90,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3062 syscall(ffff80002a80cf60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a80cf60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x70f17e4f1e30, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: ffs_valloc: dup alloc ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346bb52) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(ffffef006d4a2300,41ed,ffffef0007ffd4e0,ffff80002a80cbf8) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a80cc60) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(ffffef006d3f07d0,ffff80002a80cdc0,ffff80002a80cdf0,ffff80002a80ccf0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a767c98,ffffff9c,70f17e4f1d90,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3062 syscall(ffff80002a80cf60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a80cf60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x70f17e4f1e30, count: -8 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80002a80c980 rbx 0xcbc4 __ALIGN_SIZE+0xbbc4 rdx 0 rcx 0 rax 0xffff80002a767c98 r8 0x101010101010101 r9 0x8080808080808080 r10 0x50dbb7983a47984e r11 0xfade3184f099a86 r12 0 r13 0xffffef006ca74b00 r14 0 r15 0x1 rip 0xffffffff820690a5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a80c970 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=144994 pid=86510 tcnt=1 stat=onproc flags process=2 proc=0 runpri=17, usrpri=50, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a7662a8,0xffff80002a736a78 process=0xffff80002a79c910 user=0xffff80002a808000, vmspace=0xffffef0071465b88 estcpu=36, cpticks=6, pctcpu=0.1, user=2, sys=4, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 46568 81372 33235 0 2 0xc80 syz-executor 46568 286217 33235 0 3 0x4000080 piperd syz-executor 46568 199500 33235 0 3 0x4000080 fsleep syz-executor 26325 271655 94337 0 2 0xc80 syz-executor 26325 170813 94337 0 3 0x4000080 kqsel syz-executor 26325 348006 94337 0 3 0x4000080 fsleep syz-executor 6599 201813 80436 -1 2 0x4000c90 syz-executor 6599 276874 80436 -1 3 0x4000090 ttyout syz-executor 6599 99752 80436 -1 3 0x4000090 fsleep syz-executor 6599 205855 80436 -1 3 0x4000090 fsleep syz-executor 16268 268400 65005 0 2 0xc80 syz-executor 16268 253101 65005 0 3 0x4000080 kqsel syz-executor 16268 37621 65005 0 3 0x4000080 fsleep syz-executor 57220 89094 0 0 3 0x14200 acct acct 94337 216652 8719 0 3 0x82 nanoslp syz-executor 80436 369246 8719 0 3 0x82 nanoslp syz-executor 65005 410292 8719 0 2 0xc82 syz-executor 41479 469326 8719 0 3 0x82 wait syz-executor *86510 144994 8719 0 7 0x2 syz-executor 33235 326780 8719 0 2 0xc82 syz-executor 8719 206987 13627 0 3 0x82 wait syz-executor 13627 3260 89498 0 3 0x10008a sigsusp ksh 89498 271851 54687 0 3 0x98 kqread sshd-session 54687 300884 3183 0 3 0x92 kqread sshd-session 49729 422045 1 0 3 0x100083 ttyin getty 3183 156018 1 0 3 0x88 kqread sshd 27713 217773 38704 73 3 0x1100090 kqread syslogd 38704 345086 1 0 3 0x100082 sbwait syslogd 58791 422933 1 0 3 0x100080 kqread resolvd 82560 389287 36283 77 3 0x100092 kqread dhcpleased 66659 42587 36283 77 3 0x100092 kqread dhcpleased 36283 485478 1 0 3 0x80 kqread dhcpleased 27354 464697 0 0 2 0x14200 smr 34663 215391 0 0 3 0x14200 pgzero zerothread 24492 474206 0 0 3 0x14200 aiodoned aiodoned 57010 519871 0 0 3 0x14200 syncer update 47573 38160 0 0 3 0x14200 cleaner cleaner 20258 172576 0 0 3 0x14200 reaper reaper 20861 188304 0 0 3 0x14200 pgdaemon pagedaemon 37761 375731 0 0 3 0x14200 bored viomb 46528 227826 0 0 3 0x40014200 acpi0 acpi0 45992 419081 0 0 3 0x14200 bored softnet0 99072 171643 0 0 3 0x14200 bored systqmp 96159 22769 0 0 3 0x14200 bored systq 93467 439257 0 0 3 0x40014200 tmoslp softclock 46350 1887 0 0 3 0x40014200 idle0 1 274957 0 0 3 0x80082 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11037 12171K 12378K 166960K 12323 0 pcb 17 12K 12K 166960K 44 0 rtable 244 7K 8K 166960K 388 0 pf 34 13K 19K 166960K 48 0 ifaddr 42 7K 7K 166960K 45 0 ifgroup 50 2K 2K 166960K 52 0 sysctl 1 1K 9K 166960K 6 0 counters 33 17K 17K 166960K 34 0 ioctlops 0 0K 4K 166960K 61 0 iov 0 0K 12K 166960K 6 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1293 81K 82K 166960K 1469 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 4 9K 9K 166960K 6 0 VM map 2 1K 1K 166960K 2 0 sem 10 0K 0K 166960K 16 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 15 53K 93K 166960K 306 0 sigio 0 0K 0K 166960K 6 0 proc 60 59K 100K 166960K 515 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 2 0K 0K 166960K 53 0 in_multi 99 7K 7K 166960K 102 0 ether_multi 1 0K 0K 166960K 1 0 mrt 2 0K 0K 166960K 10 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 67 307K 307K 166960K 67 0 exec 0 0K 1K 166960K 482 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 219 165K 179K 166960K 4329 0 UVM aobj 8 2K 4K 166960K 9 0 pinsyscall 36 72K 92K 166960K 1416 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 2 0K 0K 166960K 17 0 NDP 11 0K 2K 166960K 28 0 temp 40 9111K 9114K 166960K 9280 0 kqueue 15 24K 26K 166960K 52 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 46 0 43 1 0 1 1 0 8 0 rtentry 136 114 0 4 4 0 4 4 0 8 0 unpcb 144 132 0 115 1 0 1 1 0 8 0 syncache 336 5 0 5 1 0 1 1 0 8 1 tcpcb 736 60 0 55 1 0 1 1 0 8 0 arp 96 19 0 1 1 0 1 1 0 8 0 ipq 40 1 0 0 1 0 1 1 0 8 0 ipqe 40 34 0 32 1 0 1 1 0 8 0 inpcb 328 197 0 185 2 0 2 2 0 8 0 ip6q 72 1 0 0 1 0 1 1 0 8 0 ip6af 40 1 0 0 1 0 1 1 0 8 0 nd6 112 24 0 0 1 0 1 1 0 8 0 pkpcb 40 2 0 2 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1072 1 0 1 1 0 1 1 0 8 1 pfstscr 40 16 0 14 1 0 1 1 0 8 0 pfrktable 1344 3 0 3 1 0 1 1 0 8 1 pfanchor 1288 1 0 1 1 0 1 1 0 8 1 pftag 88 1 0 0 1 0 1 1 0 8 0 pfstitem 24 2 0 0 1 0 1 1 0 8 0 pfstkey 128 16 0 14 1 0 1 1 0 8 0 pfstate 384 8 0 7 1 0 1 1 0 8 0 pfrule 1360 2 0 2 1 0 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 485 0 2 31 0 31 31 0 8 0 art_table 40 486 0 2 5 0 5 5 0 8 0 art_node 32 114 0 14 1 0 1 1 0 8 0 sysvmsgpl 40 3 0 2 1 0 1 1 0 8 0 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 72 14 0 6 1 0 1 1 0 8 0 shmpl 112 6 0 1 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1853 0 395 92 0 92 92 0 8 0 ffsino 256 1853 0 395 92 0 92 92 0 8 0 nchpl 144 2305 0 610 64 0 64 64 0 8 0 vnodes 216 2004 0 0 112 0 112 112 0 8 0 namei 1024 7012 0 7011 2 0 2 2 0 8 1 pfiaddrpl 120 1 0 1 1 0 1 1 0 8 1 kstatmem 264 25 0 2 2 0 2 2 0 8 0 scxspl 216 7460 0 7460 5 0 5 5 1 8 5 plimitpl 152 46 0 27 1 0 1 1 0 8 0 sigapl 424 605 0 564 6 0 6 6 0 8 1 knotepl 120 10248 0 9942 23 6 17 17 0 8 7 kqueuepl 184 51 0 39 1 0 1 1 0 8 0 pipepl 304 132 0 104 3 0 3 3 0 8 0 fdescpl 448 591 0 564 5 0 5 5 0 8 1 filepl 120 2449 0 2222 8 0 8 8 0 8 0 lockfpl 104 94 0 90 1 0 1 1 0 8 0 lockfspl 48 46 0 42 1 0 1 1 0 8 0 sessionpl 144 23 0 15 1 0 1 1 0 8 0 pgrppl 48 31 0 15 1 0 1 1 0 8 0 ucredpl 104 319 0 306 1 0 1 1 0 8 0 zombiepl 144 567 0 564 1 0 1 1 0 8 0 processpl 1152 605 0 564 4 0 4 4 0 8 0 procpl 664 848 0 798 6 0 6 6 0 8 1 sockpl 552 383 0 351 3 0 3 3 0 8 0 mcl64k 65536 39 0 38 1 0 1 1 0 8 0 mcl16k 16384 12 0 12 1 0 1 1 0 8 1 mcl12k 12288 5 0 5 1 0 1 1 0 8 1 mcl8k 8192 12 0 12 1 0 1 1 0 8 1 mcl4k 4096 2781 0 2730 13 0 13 13 0 8 6 mcl2k2 2112 1 0 1 1 0 1 1 0 8 1 mcl2k 2048 239 0 238 1 0 1 1 0 8 0 mtagpl 96 4 0 4 1 0 1 1 0 8 1 mbufpl 256 5979 0 5850 11 0 11 11 0 8 0 bufpl 272 2673 0 102 172 0 172 172 0 8 0 anonpl 24 98234 0 93994 44 0 44 44 0 187 15 amapchunkpl 152 13451 0 12953 29 0 29 29 0 158 6 amappl16 200 1553 0 1519 15 5 10 15 0 8 8 amappl15 192 5 0 5 1 0 1 1 0 8 1 amappl14 184 413 0 412 1 0 1 1 0 8 0 amappl13 176 115 0 105 1 0 1 1 0 8 0 amappl12 168 844 0 818 2 0 2 2 0 8 0 amappl11 160 24 0 24 1 0 1 1 0 8 1 amappl10 152 85 0 75 1 0 1 1 0 8 0 amappl9 144 276 0 275 1 0 1 1 0 8 0 amappl8 136 118 0 117 1 0 1 1 0 8 0 amappl7 128 207 0 196 1 0 1 1 0 8 0 amappl6 120 165 0 163 1 0 1 1 0 8 0 amappl5 112 93 0 85 1 0 1 1 0 8 0 amappl4 104 261 0 246 1 0 1 1 0 8 0 amappl3 96 2505 0 2408 3 0 3 3 0 8 0 amappl2 88 534 0 480 2 0 2 2 0 8 0 amappl1 80 10692 0 10153 13 0 13 13 0 8 0 amappl 88 3607 0 3453 5 0 5 5 0 92 0 uvmvnodes 80 105 0 0 3 0 3 3 0 8 0 dma4096 4096 2 0 2 1 0 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 0 1 1 0 8 1 dma128 128 253 0 253 1 0 1 1 0 8 1 dma64 64 6 0 6 1 0 1 1 0 8 1 dma32 32 7 0 7 1 0 1 1 0 8 1 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 8 0 1 1 0 1 1 0 8 0 uaddrrnd 24 591 0 564 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 591 0 564 1 0 1 1 0 8 0 vmmpekpl 168 6478 0 6444 2 0 2 2 0 8 0 vmmpepl 168 45778 0 44090 86 0 86 86 0 357 5 vmsppl 368 590 0 564 4 0 4 4 0 8 1 rwobjpl 40 15445 0 14495 12 0 12 12 0 8 1 pdppl 4096 1188 0 1128 94 28 66 80 0 8 6 pvpl 32 264596 0 253670 103 0 103 103 0 265 6 pmappl 216 590 0 564 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 530 0 28 15 0 15 15 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346bb52) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(ffffef006d4a2300,41ed,ffffef0007ffd4e0,ffff80002a80cbf8) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a80cc60) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(ffffef006d3f07d0,ffff80002a80cdc0,ffff80002a80cdf0,ffff80002a80ccf0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a767c98,ffffff9c,70f17e4f1d90,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3062 syscall(ffff80002a80cf60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a80cf60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x70f17e4f1e30, count: -8 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff8346bb52) at panic+0x1cf sys/kern/subr_prf.c:198 ffs_inode_alloc(ffffef006d4a2300,41ed,ffffef0007ffd4e0,ffff80002a80cbf8) at ffs_inode_alloc+0x94e ufs_mkdir(ffff80002a80cc60) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112 VOP_MKDIR(ffffef006d3f07d0,ffff80002a80cdc0,ffff80002a80cdf0,ffff80002a80ccf0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394 domkdirat(ffff80002a767c98,ffffff9c,70f17e4f1d90,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3062 syscall(ffff80002a80cf60) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80002a80cf60) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x70f17e4f1e30, count: -8