uvm_fault: sys_msgget

Status: upstream: reported on 2026/07/21 09:08
Reported-by: syzbot+12c9c5d459cf6f72f3dd@syzkaller.appspotmail.com
First crash: 14d, last: 14d

Sample crash report:
uvm_fault(0xfffff5806d0c5d80, 0x6a5f36b4, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      sys_msgget+0xa0:        movq    0x18(%r14),%r15
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*201337  32626  32767        0x10  0x4000000    1K syz-executor
sys_msgget(ffff80003bbb87e8,ffff80002df92880,ffff80002df927d0) at sys_msgget+0xa0 que_key_lookup sys/kern/sysv_msg.c:477 [inline]
sys_msgget(ffff80003bbb87e8,ffff80002df92880,ffff80002df927d0) at sys_msgget+0xa0 sys/kern/sysv_msg.c:197
syscall(ffff80002df92880) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002df92880) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xfa05d8c2f40, count: 12
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffff5806d0c5d80, 0x6a5f36b4, 0, 1) -> e
ddb{1}> show kasan
No such command
ddb{1}> trace
sys_msgget(ffff80003bbb87e8,ffff80002df92880,ffff80002df927d0) at sys_msgget+0xa0 que_key_lookup sys/kern/sysv_msg.c:477 [inline]
sys_msgget(ffff80003bbb87e8,ffff80002df92880,ffff80002df927d0) at sys_msgget+0xa0 sys/kern/sysv_msg.c:197
syscall(ffff80002df92880) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002df92880) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xfa05d8c2f40, count: -3
ddb{1}> show registers
rdi               0xffff800038b92000
rsi                             0x31
rbp               0xffff80002df927a0
rbx                            0x200
rdx               0xffff800038b92000
rcx                             0x30
rax               0xffffffff83357712    sys_msgget+0xd2
r8                0xffffffff82d2a4b0    uvm_map_inentry_sp
r9                                 0
r10                                0
r11               0x5a82415c45e6051f
r12                             0x22
r13                       0x798e7472
r14                       0x6a5f369c
r15                           0x1000    __ALIGN_SIZE
rip               0xffffffff833576e0    sys_msgget+0xa0
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002df92730
ss                              0x10
sys_msgget+0xa0:        movq    0x18(%r14),%r15
ddb{1}> show proc
PROC (syz-executor) tid=201337 pid=32626 tcnt=2 stat=onproc
    flags process=10<SUGID> proc=4000000<THREAD>
    runpri=32, usrpri=77, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003bbb9a10,0xffff80003bbb8030
    process=0xffff80003177d828 user=0xffff80002df8d000, vmspace=0xfffff5806d0c5d80
    estcpu=27, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 32626  522189  81342 32767  2        0x10          0           syz-executor
*32626  201337  81342 32767  7        0x10  0x4000000           syz-executor
 74126  415504  50139 32767  2        0x10          0           syz-executor
 74126  187550  50139 32767  3        0x10  0x4000080 fsleep    syz-executor
 74126  411134  50139 32767  3        0x10  0x4000080 fsleep    syz-executor
 76443  450733  40920 32767  2        0x10          0           syz-executor
 76443  361998  40920 32767  3        0x10  0x4000080 fsleep    syz-executor
 76443  223172  40920 32767  2        0x10  0x4000000           syz-executor
 90892   21628  40671 32767  3        0x10       0x80 nanoslp   syz-executor
 17432  206502  83071 32767  2        0x10          0           syz-executor
 81342   59262  87132 32767  3        0x10       0x80 nanoslp   syz-executor
 50139   71328  91724 32767  3        0x10       0x80 nanoslp   syz-executor
 38276   32781  47382 32767  3        0x10       0x80 piperd    syz-executor
 40920   11388  31967 32767  3        0x10       0x80 nanoslp   syz-executor
 54321  154564  47853 32767  3        0x10          0 biowait   syz-executor
 87132  169631  44062     0  3         0x2       0x80 wait      syz-executor
 91724  314306  44062     0  3         0x2       0x80 wait      syz-executor
 47382  461928  44062     0  3         0x2       0x80 wait      syz-executor
 31967    6840  44062     0  3         0x2       0x80 wait      syz-executor
 47853  113703  44062     0  3         0x2       0x80 wait      syz-executor
 83071   11959  44062     0  3         0x2       0x80 wait      syz-executor
 40671  149196  44062     0  3         0x2       0x80 wait      syz-executor
 44062  479184  42859     0  3         0x2       0x80 nanoslp   syz-executor
 42859   98107  43729     0  3    0x100002       0x88 sigsusp   ksh
 43729   11042  95028     0  3        0x10       0x88 kqread    sshd-session
 95028   63466  13187     0  3        0x12       0x80 kqread    sshd-session
 97990  337748      1     0  3    0x100003       0x80 ttyin     getty
 13187  271119      1     0  3           0       0x88 kqread    sshd
 78959   64839  36464    73  3   0x1100010       0x80 kqread    syslogd
 36464  319990      1     0  3    0x100002       0x80 sbwait    syslogd
  9406  272373      1     0  3    0x100000       0x80 kqread    resolvd
 45733  411084  72333    77  3    0x100012       0x80 kqread    dhcpleased
 73191   93752  72333    77  3    0x100012       0x80 kqread    dhcpleased
 72333  196886      1     0  3           0       0x80 kqread    dhcpleased
 28358  108297      0     0  3     0x14000      0x200 bored     smr
 54273  193495      0     0  2     0x14000      0x200           zerothread
 70177  450406      0     0  3     0x14000      0x200 aiodoned  aiodoned
 50255   30572      0     0  3     0x14000      0x200 syncer    update
 36844   79305      0     0  3     0x14000      0x200 cleaner   cleaner
 15436  189054      0     0  3     0x14000      0x200 reaper    reaper
 35281   84413      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 76933  470071      0     0  3     0x14000      0x200 bored     viomb
 56813    5032      0     0  3     0x14000 0x40000200 acpi0     acpi0
 39480  340395      0     0  3     0x14000 0x40000200           idle1
 70138  279324      0     0  3     0x14000      0x200 bored     softnet1
 41218  232473      0     0  3     0x14000      0x200 bored     softnet0
 74448     525      0     0  3     0x14000      0x200 bored     systqmp
 42319   39637      0     0  3     0x14000      0x200 bored     systq
  8332  493606      0     0  3     0x14000      0x200 tmoslp    softclockmp
 26145  325827      0     0  3     0x14000 0x40000200 tmoslp    softclock
 28459  111327      0     0  3     0x14000 0x40000200           idle0
     1  384407      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
CPU 0:
exclusive mutex &pmap->pm_mtx r = 0 (0xfffff5806d0c4510)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pmap_do_remove+0xa9 rcr3 sys/arch/amd64/compile/SYZKALLER/obj/machine/cpufunc.h:139 [inline]
#2  pmap_do_remove+0xa9 pmap_map_ptes sys/arch/amd64/amd64/pmap.c:441 [inline]
#2  pmap_do_remove+0xa9 sys/arch/amd64/amd64/pmap.c:1834
#3  uvm_unmap_kill_entry_withlock+0x269 sys/uvm/uvm_map.c:1869
#4  uvm_map_teardown+0x117 uvm_map_addr_RBT_LEFT sys/uvm/uvm_map.h:-1 [inline]
#4  uvm_map_teardown+0x117 sys/uvm/uvm_map.c:2497
#5  exit1+0x71b sys/kern/kern_exit.c:260
#6  sys_exit+0x1a sys/kern/kern_exit.c:-1
#7  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#7  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#8  Xsyscall+0x128
Process 32626 (syz-executor) thread 0xffff80003bbb87e8 (201337)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a3e400)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
#2  Xsyscall+0x128
Process 17432 (syz-executor) thread 0xffff80003bbb8d18 (206502)
exclusive rrwlock inode r = 0 (0xfffff5806959c8e8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vget+0x2a2 sys/kern/vfs_subr.c:692
#6  ufs_ihashget+0x185 sys/ufs/ufs/ufs_ihash.c:98
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1203
#8  ufs_lookup+0x1a36 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x963 sys/kern/vfs_lookup.c:580
#11 namei+0x7c5 sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1807
#13 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffff5806d25ed68)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x12b sys/kern/vfs_lookup.c:431
#6  namei+0x7c5 sys/kern/vfs_lookup.c:250
#7  dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1807
#8  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#9  Xsyscall+0x128
Process 54321 (syz-executor) thread 0xffff800045fee548 (154564)
exclusive rrwlock inode r = 0 (0xfffff5806cec1ea8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4  ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:150
#5  ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ffs_inode_alloc+0x279 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112
#8  VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
#9  domkdirat+0x179 sys/kern/vfs_syscalls.c:3063
#10 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffff5806d25e300)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x12b sys/kern/vfs_lookup.c:431
#6  namei+0x7c5 sys/kern/vfs_lookup.c:250
#7  domkdirat+0x8b sys/kern/vfs_syscalls.c:3048
#8  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#9  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11049  12016K   12034K 166960K     12143        0
            pcb    17     12K      12K 166960K        17        0
         rtable   225      6K       7K 166960K       452        0
             pf    29     16K      16K 166960K        31        0
         ifaddr    38      6K       7K 166960K        44        0
        ifgroup    46      2K       2K 166960K        50        0
         sysctl     2      1K       9K 166960K         8        0
       counters    68     36K      37K 166960K        70        0
       ioctlops     0      0K       4K 166960K       127        0
            iov     0      0K      12K 166960K        48        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1287     81K      81K 166960K      1733        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        21        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K       124        0
        dirhash    12      2K       2K 166960K        21        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    19     69K     121K 166960K       878        0
          sigio     0      0K       0K 166960K        13        0
           proc    58     99K     163K 166960K       587        0
        subproc    63      3K       4K 166960K       234        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       127        0
       in_multi    88      6K       7K 166960K       124        0
    ether_multi     1      0K       0K 166960K         4        0
            mrt     2      0K       0K 166960K        19        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    73    334K     334K 166960K        73        0
           exec     0      0K       1K 166960K       437        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   207    150K     177K 166960K      9313        0
       UVM aobj    95      3K       3K 166960K        98        0
     pinsyscall    40     80K     110K 166960K      1998        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        36        0
            NDP    10      0K       2K 166960K        27        0
           temp    70   9127K    9144K 166960K      5556        0
         kqueue    13     20K      32K 166960K       175        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120      168    0      164     3     2     1     3     0     8    0
rtentry    176      122    0       18     6     0     6     6     0     8    0
unpcb      144      458    0      442     2     1     1     2     0     8    0
syncache   336       13    0       13     3     2     1     1     0     8    1
tcpcb      736      449    0      445    10     9     1     7     0     8    0
arp        136       19    0        2     1     0     1     1     0     8    0
ipq         40        4    0        1     1     0     1     1     0     8    0
ipqe        40        4    0        1     1     0     1     1     0     8    0
inpcb      328     1019    0     1003     9     7     2     8     0     8    0
ip6q        72        7    0        3     1     0     1     1     0     8    0
ip6af       40       11    0        6     1     0     1     1     0     8    0
nd6        152       34    0        9     2     0     2     2     0     8    0
kcovpl      48       26    0       19     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      537    0       96    31     1    30    31     0     8    0
art_table   40      538    0       96     5     0     5     5     0     8    0
art_node    32      122    0       27     1     0     1     1     0     8    0
sysvmsgpl   40       10    0        4     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl      72      116    0      106     1     0     1     1     0     8    0
shmpl      112       95    0        3     3     0     3     3     0     8    0
dirhash    1024      23    0        6     3     0     3     3     0     8    0
dino2pl    256     2730    0     1243    94     0    94    94     0     8    0
ffsino     296     2730    0     1243   115     0   115   115     0     8    0
nchpl      144     3891    0     2181    64     0    64    64     0     8    0
vnodes     216     2973    0        0   166     0   166   166     0     8    0
namei      1024   12615    0    12614     2     1     1     2     0     8    0
percpumem   16       51    0        1     1     0     1     1     0     8    0
kstatmem   264       25    0        2     2     0     2     2     0     8    0
scxspl     216    12403    0    12402    13    10     3     8     1     8    2
plimitpl   152      162    0      140     2     0     2     2     0     8    1
sigapl     424     1141    0     1093     8     1     7     7     0     8    1
knotepl    120      522    0        0    16     0    16    16     0     8    0
kqueuepl   224      239    0      229     3     2     1     3     0     8    0
pipepl     344      258    0      231     3     0     3     3     0     8    0
fdescpl    528     1125    0     1094     3     0     3     3     0     8    0
filepl     160     6677    0     6472    13     3    10    13     0     8    1
lockfpl    104      231    0      229     1     0     1     1     0     8    0
lockfspl    48       85    0       83     1     0     1     1     0     8    0
sessionpl  144       84    0       69     1     0     1     1     0     8    0
pgrppl      48      117    0       95     1     0     1     1     0     8    0
ucredpl    104     1523    0     1505     1     0     1     1     0     8    0
zombiepl   144     1094    0     1093     1     0     1     1     0     8    0
processpl  1232    1141    0     1093     5     0     5     5     0     8    1
procpl     664     2282    0     2229     7     1     6     7     0     8    1
sosppl     176        7    0        7     1     1     0     1     0     8    0
sockpl     752     1654    0     1617    12     8     4    11     0     8    0
mcl64k     65536      6    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k128   9344       4    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     117    0        0    15     0    15    15     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      25    0        0     4     0     4     4     0     8    0
mextrefs    64       17    0        0     1     0     1     1     0     8    0
mtagpl      96        4    0        0     1     0     1     1     0     8    0
mbufpl     256     8638    0        0   540     0   540   540     0     8    0
bufpl      272     3597    0      114   233     0   233   233     0     8    0
anonpl      32    15567    0        0   126     0   126   126     0   247    0
amapchunkpl 152   30064    0    29639    33    11    22    33     0   158    1
amappl16   200     4206    0     4170    28    17    11    26     0     8    5
amappl15   192       47    0       47     1     1     0     1     0     8    0
amappl14   184      415    0      414     1     0     1     1     0     8    0
amappl13   176      131    0      121     1     0     1     1     0     8    0
amappl12   168     1362    0     1332     2     0     2     2     0     8    0
amappl11   160       60    0       60     1     1     0     1     0     8    0
amappl10   152       74    0       64     1     0     1     1     0     8    0
amappl9    144      271    0      271     1     1     0     1     0     8    0
amappl8    136      123    0      121     1     0     1     1     0     8    0
amappl7    128      151    0      139     1     0     1     1     0     8    0
amappl6    120      148    0      146     1     0     1     1     0     8    0
amappl5    112      110    0      102     1     0     1     1     0     8    0
amappl4    104      301    0      285     1     0     1     1     0     8    0
amappl3     96     5988    0     5885     5     1     4     4     0     8    0
amappl2     88      603    0      546     2     0     2     2     0     8    0
amappl1     80    15354    0    14800    20     4    16    16     0     8    2
amappl      88     8446    0     8301     5     0     5     5     0    92    0
uvmvnodes   80      122    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       97    0        3     2     0     2     2     0     8    0
uaddrrnd    24     1125    0     1094     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1125    0     1094     1     0     1     1     0     8    0
vmmpekpl   168    11743    0    11691     3     0     3     3     0     8    0
vmmpepl    168    82809    0    81021   115    14   101   111     0   357   10
vmsppl     488     1124    0     1093     7     2     5     6     0     8    0
rwobjpl     80    26011    0    24983    30     4    26    30     0     8    0
pdppl      4096    2257    0     2186   127    46    81    95     0     8   10
pvpl        32    24253    0        0   198     2   196   196     0   265    0
pmappl     256     1124    0     1093     4     1     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112     1073    0       62    29     0    29    29     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff838f8ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a3dc00) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a3dc00) at __mp_lock+0x199 sys/kern/kern_lock.c:173
exit1(ffff800045fee7e0,0,0,1) at exit1+0x720 sys/kern/kern_exit.c:260
sys_exit(ffff800045fee7e0,ffff80003b3b1330,ffff80003b3b1280) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003b3b1330) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003b3b1330) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ad3bc8bda50, count: 7
ddb{0}> trace
x86_ipi_db(ffffffff838f8ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a3dc00) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a3dc00) at __mp_lock+0x199 sys/kern/kern_lock.c:173
exit1(ffff800045fee7e0,0,0,1) at exit1+0x720 sys/kern/kern_exit.c:260
sys_exit(ffff800045fee7e0,ffff80003b3b1330,ffff80003b3b1280) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003b3b1330) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003b3b1330) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ad3bc8bda50, count: -8
ddb{0}> machine ddbcpu 1
Stopped at      sys_msgget+0xa0:        movq    0x18(%r14),%r15
sys_msgget(ffff80003bbb87e8,ffff80002df92880,ffff80002df927d0) at sys_msgget+0xa0 que_key_lookup sys/kern/sysv_msg.c:477 [inline]
sys_msgget(ffff80003bbb87e8,ffff80002df92880,ffff80002df927d0) at sys_msgget+0xa0 sys/kern/sysv_msg.c:197
syscall(ffff80002df92880) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002df92880) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xfa05d8c2f40, count: 12
ddb{1}> trace
sys_msgget(ffff80003bbb87e8,ffff80002df92880,ffff80002df927d0) at sys_msgget+0xa0 que_key_lookup sys/kern/sysv_msg.c:477 [inline]
sys_msgget(ffff80003bbb87e8,ffff80002df92880,ffff80002df927d0) at sys_msgget+0xa0 sys/kern/sysv_msg.c:197
syscall(ffff80002df92880) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002df92880) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xfa05d8c2f40, count: -3

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/21 09:07 openbsd d55fd7dd01df de6a700d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid uvm_fault: sys_msgget
* Struck through repros no longer work on HEAD.