last executing test programs: 779.424208ms ago: executing program 2 (id=2084): setrlimit(0x1, &(0x7f0000000000)={0xfffffffffffffffd, 0xffffffffffffffff}) sysctl$hw(&(0x7f0000000000)={0x6, 0xb}, 0x5, &(0x7f0000000040), 0x0, 0x0, 0x0) 756.202018ms ago: executing program 0 (id=2087): r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x1000000000029, 0x2a, &(0x7f0000000040)="03000000", 0x4) 645.951744ms ago: executing program 0 (id=2095): r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x1000000000029, 0x39, &(0x7f0000000180)="01000000", 0x4) 645.101384ms ago: executing program 2 (id=2097): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000000100)={0x0, 0xfd57, 0x0, 0x0, &(0x7f00000015c0), 0x10}, 0x2) 567.827991ms ago: executing program 2 (id=2110): ppoll(&(0x7f0000000280)=[{0xffffffffffffffff, 0x80}], 0x1, 0x0, 0x0) unveil(0x0, &(0x7f0000000000)='r\x00') 529.163751ms ago: executing program 7 (id=2126): ppoll(0x0, 0x0, &(0x7f0000000140)={0x7ffffffffffffffe, 0x40}, 0x0) unveil(0x0, &(0x7f00000004c0)='w\x00') 426.375018ms ago: executing program 3 (id=2114): setrlimit(0x1, &(0x7f0000000000)={0xfffffffffffffffd, 0xffffffffffffffff}) sysctl$hw(&(0x7f0000000000)={0x6, 0xb}, 0x5, &(0x7f0000000040), 0x0, 0x0, 0x0) 425.979744ms ago: executing program 2 (id=2115): r0 = socket$unix(0x1, 0x1, 0x0) connect$unix(r0, &(0x7f0000000080)=@file={0x3, 0x1, './file0\x00'}, 0x2) 415.064908ms ago: executing program 5 (id=2116): setitimer(0x2, &(0x7f00000000c0)={{0x800000ffffffff, 0x4}, {0x2273, 0x8}}, 0x0) sysctl$kern(&(0x7f00000000c0)={0x1, 0x3e}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x10, 0x0, 0x37) 412.623367ms ago: executing program 6 (id=2117): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x615, 0x0) mmap(&(0x7f0000013000/0x3000)=nil, 0x3000, 0x2, 0x8012, r0, 0x0) 401.030608ms ago: executing program 3 (id=2118): r0 = socket(0x18, 0x1, 0x0) getsockopt(r0, 0x29, 0x37, 0x0, 0x0) 400.373495ms ago: executing program 5 (id=2119): setitimer(0x0, &(0x7f0000001280)={{0x1}, {0x0, 0x6}}, 0x0) setitimer(0x0, &(0x7f00000025c0)={{0xba}, {0x6, 0x3}}, &(0x7f0000002600)) 388.805415ms ago: executing program 3 (id=2120): r0 = open(&(0x7f0000000000)='./file0\x00', 0x9cab835cfdc52675, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0xa011, r0, 0x0) 370.087055ms ago: executing program 3 (id=2121): r0 = syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000000)={0xfffffffc, 0x1000, 0xffef9ff6, 0xe923, "03000800d632956f000100000013f700", 0x0, 0xd}) 362.289718ms ago: executing program 6 (id=2122): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000000100)={0x0, 0xfd57, 0x0, 0x0, &(0x7f00000015c0), 0x10}, 0x2) 338.018964ms ago: executing program 1 (id=2123): r0 = socket(0x11, 0x3, 0x4) sendto$unix(r0, &(0x7f00000000c0)="b1000504000004000000000010110000331c13fecea10500fef96ec0c72fd3357ae30200004e3003000000acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139b672f4d335c223e7d0c032bfa896443a42112000000720fd18bfbb670c1f5a872c881ea6e3ec5890400000000008000361b44c702fac500002021fbfa0c0f00008abfba221554f4e0f668246c0900002008e371a3f8343712051eea040000000000c992913a57fd06b23a6ca26b7ce4f7b5caea06d6f7d73c64fcda1539a6265c3c43773dec4d5c1e7b02e1386c3c82f8b0f6ce8467a4dedcba02db380f7c63df096748f30fedb961ad4de37bb1426795289a74938e2696a48f6b18e47e0df4a23dd6e0d500f420df3117d4f5b7286ea735f24bc39b086585153b996882d1c7d1a625dd4c39dbd2874cea1f88435898ce07000000000000006d4068e62b90afde855730db573dab673decf2fe8bc09cbef4717b986d31f645b1ac82eb3c8d88feef3d05282c3489827d8d107646dd074f5e3554470625bf68ba6ea447a2188bdaab9464a49aad03335589afdeeeb79f0559d9a7c41381cc30aa62bb3f06c7b93eecb5da79765e359121c19f1e762841f1f7586e25e01353634323d45a2053", 0xb1, 0x0, 0x0, 0x59) 337.902449ms ago: executing program 3 (id=2124): r0 = syz_open_pts() fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x1, 0x0, 0x1000000000000, 0x201000300000083}) 337.706853ms ago: executing program 5 (id=2127): open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7959) chdir(&(0x7f0000000100)='./file0\x00') 337.174907ms ago: executing program 0 (id=2128): symlink(&(0x7f0000000140)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000000)='./file0\x00') open(&(0x7f0000000000)='./file0\x00', 0x9cab835cfdc52675, 0x0) 293.64005ms ago: executing program 0 (id=2129): r0 = syz_open_pts() ioctl$TIOCSETD(r0, 0x8004741b, &(0x7f0000000000)=0x7) 293.4819ms ago: executing program 1 (id=2130): ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000040)={0x2, &(0x7f00000000c0)=[{0x3}, {0x1, 0x0, 0x0, 0x1}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x37}, 0x4, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x3, 0x0, 0x2e) 293.33167ms ago: executing program 3 (id=2131): sync() sync() 293.216293ms ago: executing program 6 (id=2132): r0 = socket(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x1e, 0x0, 0x0) 233.444734ms ago: executing program 7 (id=2133): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x21, &(0x7f0000000180), 0x0) 225.602919ms ago: executing program 2 (id=2145): r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x1000000000029, 0x39, &(0x7f0000000180)="01000000", 0x4) 223.343139ms ago: executing program 0 (id=2134): r0 = socket(0x11, 0x3, 0x0) getpeername$unix(r0, 0x0, 0xffffffffffffffff) 223.242491ms ago: executing program 1 (id=2135): r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x1000000029, 0x37, &(0x7f0000000040)='\x00\x00\x00\x00', 0x4) 181.739413ms ago: executing program 6 (id=2137): setitimer(0x2, &(0x7f00000000c0)={{0x800000ffffffff, 0x4}, {0x2273, 0x8}}, 0x0) sysctl$kern(&(0x7f00000000c0)={0x1, 0x3e}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x10, 0x0, 0x37) 181.656576ms ago: executing program 5 (id=2146): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0xe, 0x1, './file0\x00'}, 0x3) 181.582195ms ago: executing program 4 (id=2138): r0 = socket(0x18, 0x1, 0x0) getsockopt(r0, 0x29, 0x37, 0x0, 0x0) 181.184332ms ago: executing program 7 (id=2139): r0 = open(&(0x7f0000000000)='./file0\x00', 0x9cab835cfdc52675, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0xa011, r0, 0x0) 119.308874ms ago: executing program 6 (id=2140): unveil(&(0x7f0000002400)='.\x00', &(0x7f0000000080)='c\x00') open$dir(&(0x7f0000000b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200, 0x0) 118.513027ms ago: executing program 1 (id=2141): r0 = socket(0x2, 0x4001, 0x0) setsockopt$sock_int(r0, 0xffff, 0x10, 0x0, 0x0) 117.42729ms ago: executing program 5 (id=2142): r0 = syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000000)={0xfffffffc, 0x1000, 0xffef9ff6, 0xe923, "03000800d632956f000100000013f700", 0x0, 0xd}) 105.966383ms ago: executing program 0 (id=2143): symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') rename(&(0x7f0000000100)='./file0/file0/..\x00', &(0x7f00000000c0)='./file1\x00') 105.811228ms ago: executing program 4 (id=2144): setitimer(0x0, &(0x7f0000001280)={{0x1}, {0x0, 0x6}}, 0x0) setitimer(0x0, &(0x7f00000025c0)={{0xba}, {0x6, 0x3}}, &(0x7f0000002600)) 93.128249ms ago: executing program 1 (id=2147): r0 = getegid() setregid(0xffffffffffffffff, r0) 92.081785ms ago: executing program 4 (id=2148): r0 = socket(0x11, 0x3, 0x4) sendto$unix(r0, &(0x7f00000000c0)="b1000504000004000000000010110000331c13fecea10500fef96ec0c72fd3357ae30200004e3003000000acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139b672f4d335c223e7d0c032bfa896443a42112000000720fd18bfbb670c1f5a872c881ea6e3ec5890400000000008000361b44c702fac500002021fbfa0c0f00008abfba221554f4e0f668246c0900002008e371a3f8343712051eea040000000000c992913a57fd06b23a6ca26b7ce4f7b5caea06d6f7d73c64fcda1539a6265c3c43773dec4d5c1e7b02e1386c3c82f8b0f6ce8467a4dedcba02db380f7c63df096748f30fedb961ad4de37bb1426795289a74938e2696a48f6b18e47e0df4a23dd6e0d500f420df3117d4f5b7286ea735f24bc39b086585153b996882d1c7d1a625dd4c39dbd2874cea1f88435898ce07000000000000006d4068e62b90afde855730db573dab673decf2fe8bc09cbef4717b986d31f645b1ac82eb3c8d88feef3d05282c3489827d8d107646dd074f5e3554470625bf68ba6ea447a2188bdaab9464a49aad03335589afdeeeb79f0559d9a7c41381cc30aa62bb3f06c7b93eecb5da79765e359121c19f1e762841f1f7586e25e01353634323d45a2053", 0xb1, 0x0, 0x0, 0x59) 91.942169ms ago: executing program 7 (id=2149): r0 = socket$unix(0x1, 0x1, 0x0) connect$unix(r0, &(0x7f0000000080)=@file={0x3, 0x1, './file0\x00'}, 0x2) 91.522788ms ago: executing program 6 (id=2150): ppoll(0x0, 0x0, &(0x7f0000000140)={0x7ffffffffffffffe, 0x40}, 0x0) unveil(0x0, &(0x7f00000004c0)='w\x00') 85.774207ms ago: executing program 2 (id=2151): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getown(r0, 0x5) 64.865124ms ago: executing program 5 (id=2152): mkdirat(0xffffffffffffff9c, &(0x7f00000011c0)='./file0\x00', 0x14e) chdir(&(0x7f0000000100)='./file0\x00') 64.425117ms ago: executing program 4 (id=2168): r0 = socket(0x2, 0x1, 0x0) fcntl$setown(r0, 0x6, 0x0) 43.098655ms ago: executing program 1 (id=2153): r0 = syz_open_pts() ioctl$TIOCSETD(r0, 0x8004741b, &(0x7f0000000000)=0x7) 42.610286ms ago: executing program 4 (id=2170): r0 = getuid() setreuid(r0, 0x0) 19.313558ms ago: executing program 7 (id=2154): msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000080)={{0x8001, 0x0, 0x0, 0x0, 0x0, 0x85, 0x48e}, 0x5, 0x4, 0x0, 0x0, 0x100000007, 0x4000000000003, 0x20000000007f, 0x40000200000002}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x42}, 0x6, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x1918, 0x0, 0x37) 18.735754ms ago: executing program 4 (id=2172): r0 = socket(0x18, 0x1, 0x0) getsockopt(r0, 0x29, 0x33, 0x0, 0x0) 0s ago: executing program 7 (id=2155): open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7959) chdir(&(0x7f0000000100)='./file0\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.73' (ED25519) to the list of known hosts. panic: ip6_getpcbopt: unexpected option Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *102886 2609 32767 0x10 0x4000000 1 syz-executor 471736 97653 0 0x14000 0x200 0 reaper db_enter() at db_enter+0x25 panic(ffffffff8352a751) at panic+0x1e5 ip6_getpcbopt(0,33,fffffb8064987b00) at ip6_getpcbopt+0x3e3 ip6_ctloutput(0,ffff8000015a11b0,29,33,fffffb8064987b00) at ip6_ctloutput+0xfb2 sogetopt(ffff8000015a11b0,29,33,fffffb8064987b00) at sogetopt+0x128 sys_getsockopt(ffff807ffffe6550,ffff80003c3d2260,ffff80003c3d21b0) at sys_getsockopt+0x1ec syscall(ffff80003c3d2260) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x6ea3c60fc40, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: ip6_getpcbopt: unexpected option ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff8352a751) at panic+0x1e5 ip6_getpcbopt(0,33,fffffb8064987b00) at ip6_getpcbopt+0x3e3 ip6_ctloutput(0,ffff8000015a11b0,29,33,fffffb8064987b00) at ip6_ctloutput+0xfb2 sogetopt(ffff8000015a11b0,29,33,fffffb8064987b00) at sogetopt+0x128 sys_getsockopt(ffff807ffffe6550,ffff80003c3d2260,ffff80003c3d21b0) at sys_getsockopt+0x1ec syscall(ffff80003c3d2260) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x6ea3c60fc40, count: -8 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff80003c3d1ec0 rbx 0xffff80002998ee07 rdx 0xffff8000015df380 rcx 0xffff807ffffe6550 rax 0xffff80002998dff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0xcc0ea1be515b470f r11 0xa78328e19d1e17e9 r12 0xffff80002998ec08 r13 0 r14 0 r15 0x1 rip 0xffffffff824b12a5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003c3d1eb0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=102886 pid=2609 tcnt=2 stat=onproc flags process=10 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff807ffffe62b8,0xffff807ffffe5790 process=0xffff807ffffe0e90 user=0xffff80003c3cd000, vmspace=0xfffffb8068aa5028 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 2609 395661 96310 32767 2 0x10 syz-executor * 2609 102886 96310 32767 7 0x4000010 syz-executor 92324 500324 20145 32767 2 0x10 syz-executor 92324 59821 20145 32767 3 0x4000090 fsleep syz-executor 24642 89587 62606 32767 2 0x10 syz-executor 24642 399410 62606 32767 3 0x4000090 fsleep syz-executor 25248 333850 72157 32767 2 0x10 syz-executor 25248 66449 72157 32767 3 0x4000090 kqpoll syz-executor 28186 390980 17428 32767 2 0x10 syz-executor 28186 271232 17428 32767 2 0x4000010 syz-executor 28186 352969 17428 32767 2 0x4000010 syz-executor 62606 402741 39230 32767 3 0x90 nanoslp syz-executor 72157 286256 78105 32767 3 0x90 nanoslp syz-executor 21350 255698 28719 32767 3 0x10 getblk syz-executor 96310 474295 91555 32767 2 0xc90 syz-executor 63269 352116 1090 32767 3 0x90 nanoslp syz-executor 18363 3297 84645 32767 3 0x10 biowait syz-executor 20145 501619 4606 32767 3 0x90 nanoslp syz-executor 17428 7770 19323 32767 3 0x90 nanoslp syz-executor 28719 53607 89192 0 3 0x82 wait syz-executor 78105 228014 89192 0 3 0x82 wait syz-executor 39230 193782 89192 0 3 0x82 wait syz-executor 91555 386680 89192 0 3 0x82 wait syz-executor 84645 196978 89192 0 3 0x82 wait syz-executor 1090 413288 89192 0 3 0x82 wait syz-executor 4606 195212 89192 0 3 0x82 wait syz-executor 19323 239938 89192 0 3 0x82 wait syz-executor 89192 181157 63483 0 2 0x82 syz-executor 63483 326350 38136 0 3 0x10008a sigsusp ksh 38136 245024 66481 0 3 0x98 kqread sshd-session 66481 481281 55097 0 3 0x92 kqread sshd-session 45546 381278 1 0 3 0x100083 ttyin getty 55097 395262 1 0 3 0x88 kqread sshd 43655 195493 97259 73 3 0x1100090 kqread syslogd 97259 114082 1 0 3 0x100082 sbwait syslogd 6735 443501 1 0 3 0x100080 kqread resolvd 39431 191337 67420 77 3 0x100092 kqread dhcpleased 46462 235269 67420 77 3 0x100092 kqread dhcpleased 67420 332604 1 0 3 0x80 kqread dhcpleased 91878 145260 0 0 3 0x14200 bored smr 21414 3644 0 0 2 0x14200 zerothread 76865 225808 0 0 3 0x14200 aiodoned aiodoned 65886 75218 0 0 3 0x14200 syncer update 88654 225338 0 0 3 0x14200 cleaner cleaner 97653 471736 0 0 7 0x14200 reaper 27033 332823 0 0 3 0x14200 pgdaemon pagedaemon 50902 114622 0 0 3 0x14200 bored viomb 40859 217579 0 0 3 0x40014200 acpi0 acpi0 20886 313119 0 0 3 0x40014200 idle1 55095 286963 0 0 3 0x14200 bored softnet1 622 416264 0 0 3 0x14200 bored softnet0 93167 66594 0 0 3 0x14200 bored systqmp 33815 204479 0 0 3 0x14200 bored systq 9463 506498 0 0 3 0x14200 tmoslp softclockmp 11254 522102 0 0 3 0x40014200 tmoslp softclock 90799 341037 0 0 3 0x40014200 idle0 1 495438 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks CPU 0: exclusive mutex &uvm.pageqlock r = 0 (0xffffffff83a4f280) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 uvm_pageclean+0x29c #3 uvm_pagefree+0x26 #4 uvm_anfree+0xe9 #5 amap_wipeout+0x1d6 #6 uvm_unmap_detach+0x8a #7 uvm_map_teardown+0x360 #8 exit1+0x6fc #9 sys_exit+0x1a #10 syscall+0xb17 #11 Xsyscall+0x128 Process 2609 (syz-executor) thread 0xffff807ffffe6550 (102886) exclusive rwlock netlock r = 0 (0xffffffff839554d0) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 sogetopt+0x105 #3 sys_getsockopt+0x1ec #4 syscall+0xbd4 #5 Xsyscall+0x128 Process 21350 (syz-executor) thread 0xffff807ffffe7248 (255698) exclusive rrwlock inode r = 0 (0xfffffb8068942310) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 vget+0x2a2 #6 ufs_ihashget+0x185 #7 ffs_vget+0x8c #8 ufs_lookup+0x1a36 #9 VOP_LOOKUP+0x6e #10 vfs_lookup+0x963 #11 namei+0x7c5 #12 dounlinkat+0xc1 #13 syscall+0xb17 #14 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffb806b2451e0) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 vfs_lookup+0x12b #6 namei+0x7c5 #7 dounlinkat+0xc1 #8 syscall+0xb17 #9 Xsyscall+0x128 Process 18363 (syz-executor) thread 0xffff807ffffee7e0 (3297) exclusive rrwlock inode r = 0 (0xfffffb8068942c50) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 ufs_ihashins+0x4f #5 ffs_vget+0x187 #6 ffs_inode_alloc+0x279 #7 ufs_mkdir+0xfc #8 VOP_MKDIR+0x101 #9 domkdirat+0x179 #10 syscall+0xb17 #11 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffb806ad817a0) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 vfs_lookup+0x12b #6 namei+0x7c5 #7 domkdirat+0x8b #8 syscall+0xb17 #9 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11047 12018K 12034K 166960K 12138 0 pcb 17 12K 12K 166960K 17 0 rtable 245 7K 7K 166960K 401 0 pf 31 16K 16K 166960K 31 0 ifaddr 42 7K 7K 166960K 44 0 ifgroup 50 2K 2K 166960K 50 0 sysctl 1 1K 9K 166960K 8 0 counters 70 37K 37K 166960K 70 0 ioctlops 0 0K 2K 166960K 35 0 iov 0 0K 16K 166960K 28 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1287 81K 81K 166960K 1355 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 11 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 45 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 23 85K 125K 166960K 2295 0 proc 58 99K 147K 166960K 555 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 69 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 17 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 43 201K 201K 166960K 43 0 exec 0 0K 1K 166960K 378 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 231 183K 199K 166960K 20431 0 UVM aobj 16 2K 2K 166960K 16 0 pinsyscall 44 88K 114K 166960K 3395 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 23 0 NDP 11 0K 2K 166960K 27 0 temp 59 9124K 9132K 166960K 7559 0 kqueue 13 20K 24K 166960K 80 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 128 0 125 1 0 1 1 0 8 0 rtentry 176 115 0 1 6 0 6 6 0 8 0 unpcb 144 296 0 281 1 0 1 1 0 8 0 syncache 336 4 0 4 1 1 0 1 0 8 0 tcpcb 736 365 0 360 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 ipq 40 21 0 7 1 0 1 1 0 8 0 ipqe 40 41 0 26 1 0 1 1 0 8 0 inpcb 328 697 0 689 1 0 1 1 0 8 0 ip6q 72 10 0 1 1 0 1 1 0 8 0 ip6af 40 18 0 5 1 0 1 1 0 8 0 nd6 152 28 0 0 2 0 2 2 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 481 0 0 31 0 31 31 0 8 0 art_table 40 482 0 0 5 0 5 5 0 8 0 art_node 32 115 0 11 1 0 1 1 0 8 0 sysvmsgpl 40 6 0 2 1 0 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 72 41 0 31 1 0 1 1 0 8 0 shmpl 112 13 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 3930 0 2469 92 0 92 92 0 8 0 ffsino 296 3930 0 2469 113 0 113 113 0 8 0 nchpl 144 6489 0 4804 63 0 63 63 0 8 0 vnodes 216 4011 0 0 223 0 223 223 0 8 0 namei 1024 15316 0 15315 2 1 1 2 0 8 0 percpumem 16 50 0 0 1 0 1 1 0 8 0 kstatmem 264 25 0 0 2 0 2 2 0 8 0 scxspl 216 20135 0 20134 10 8 2 7 1 8 1 plimitpl 152 53 0 29 2 0 2 2 0 8 1 sigapl 424 2593 0 2541 7 0 7 7 0 8 0 knotepl 120 315 0 0 10 0 10 10 0 8 0 kqueuepl 224 116 0 106 1 0 1 1 0 8 0 pipepl 344 159 0 132 3 0 3 3 0 8 0 fdescpl 528 2577 0 2542 4 0 4 4 0 8 1 filepl 160 5229 0 5023 9 0 9 9 0 8 0 lockfpl 104 107 0 105 1 0 1 1 0 8 0 lockfspl 48 50 0 48 1 0 1 1 0 8 0 sessionpl 144 25 0 9 1 0 1 1 0 8 0 pgrppl 48 40 0 16 1 0 1 1 0 8 0 ucredpl 104 398 0 379 1 0 1 1 0 8 0 zombiepl 144 2542 0 2541 1 0 1 1 0 8 0 processpl 1232 2593 0 2541 5 0 5 5 0 8 0 procpl 664 4858 0 4800 6 0 6 6 0 8 0 sockpl 752 1121 0 1095 4 0 4 4 0 8 1 mcl64k 65536 12 0 0 2 0 2 2 0 8 0 mcl16k 16384 17 0 0 3 0 3 3 0 8 0 mcl12k 12288 17 0 0 2 0 2 2 0 8 0 mcl9k128 9344 17 0 0 2 0 2 2 0 8 0 mcl8k 8192 20 0 0 3 0 3 3 0 8 0 mcl4k 4096 121 0 0 16 0 16 16 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 22 0 0 3 0 3 3 0 8 0 mtagpl 96 1 0 0 1 0 1 1 0 8 0 mbufpl 256 283 0 0 18 0 18 18 0 8 0 bufpl 272 4425 0 102 289 0 289 289 0 8 0 anonpl 32 5287 0 0 43 0 43 43 0 115 0 amapchunkpl 152 67054 0 66589 34 0 34 34 0 158 12 amappl16 200 3097 0 3077 5 3 2 5 0 8 0 amappl15 192 8 0 8 1 1 0 1 0 8 0 amappl14 184 431 0 430 1 0 1 1 0 8 0 amappl13 176 113 0 103 1 0 1 1 0 8 0 amappl12 168 2818 0 2784 2 0 2 2 0 8 0 amappl11 160 8 0 8 1 1 0 1 0 8 0 amappl10 152 73 0 63 1 0 1 1 0 8 0 amappl9 144 269 0 269 1 1 0 1 0 8 0 amappl8 136 95 0 94 1 0 1 1 0 8 0 amappl7 128 145 0 133 1 0 1 1 0 8 0 amappl6 120 158 0 157 1 0 1 1 0 8 0 amappl5 112 99 0 92 1 0 1 1 0 8 0 amappl4 104 270 0 256 1 0 1 1 0 8 0 amappl3 96 14821 0 14711 5 1 4 4 0 8 0 amappl2 88 520 0 470 2 0 2 2 0 8 0 amappl1 80 17753 0 17186 15 1 14 15 0 8 0 amappl 88 19606 0 19440 5 0 5 5 0 92 0 uvmvnodes 80 100 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 15 0 0 1 0 1 1 0 8 0 uaddrrnd 24 2577 0 2542 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 2577 0 2542 1 0 1 1 0 8 0 vmmpekpl 168 17079 0 17049 2 0 2 2 0 8 0 vmmpepl 168 151228 0 149312 96 4 92 95 0 357 1 vmsppl 488 2576 0 2542 7 1 6 6 0 8 1 rwobjpl 80 33960 0 33040 23 2 21 23 0 8 0 pdppl 4096 5161 0 5084 111 28 83 97 0 8 6 pvpl 32 12419 0 0 101 0 101 101 0 265 0 pmappl 256 2576 0 2542 4 1 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 583 0 33 16 0 16 16 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff838faff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83a4af40) at __mp_lock+0x192 reaper(ffff807fffffdc90) at reaper+0x211 end trace frame: 0x0, count: 10 ddb{0}> trace x86_ipi_db(ffffffff838faff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83a4af40) at __mp_lock+0x192 reaper(ffff807fffffdc90) at reaper+0x211 end trace frame: 0x0, count: -5 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp db_enter() at db_enter+0x25 panic(ffffffff8352a751) at panic+0x1e5 ip6_getpcbopt(0,33,fffffb8064987b00) at ip6_getpcbopt+0x3e3 ip6_ctloutput(0,ffff8000015a11b0,29,33,fffffb8064987b00) at ip6_ctloutput+0xfb2 sogetopt(ffff8000015a11b0,29,33,fffffb8064987b00) at sogetopt+0x128 sys_getsockopt(ffff807ffffe6550,ffff80003c3d2260,ffff80003c3d21b0) at sys_getsockopt+0x1ec syscall(ffff80003c3d2260) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x6ea3c60fc40, count: 7 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff8352a751) at panic+0x1e5 ip6_getpcbopt(0,33,fffffb8064987b00) at ip6_getpcbopt+0x3e3 ip6_ctloutput(0,ffff8000015a11b0,29,33,fffffb8064987b00) at ip6_ctloutput+0xfb2 sogetopt(ffff8000015a11b0,29,33,fffffb8064987b00) at sogetopt+0x128 sys_getsockopt(ffff807ffffe6550,ffff80003c3d2260,ffff80003c3d21b0) at sys_getsockopt+0x1ec syscall(ffff80003c3d2260) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x6ea3c60fc40, count: -8