syzbot


uvm_fault: checkalias

Status: upstream: reported on 2024/04/09 13:45
Reported-by: syzbot+1424572e42b2f2bbe15e@syzkaller.appspotmail.com
First crash: 179d, last: 53d

Sample crash report:
uvm_fault(0xfffffd8065088c18, 0x18, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      checkalias+0xb7:        movl    0x18(%r13),%ebx
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*148791  32585      0   0x8000000  0x4000000    0K syz-executor
 276533  86235      0   0x8000002          0    1  syz-executor
checkalias(fffffd8059b4d210,24900,0) at checkalias+0xb7 sys/kern/vfs_subr.c:564
cdevvp(24900,ffff8000371b7e10) at cdevvp+0xd2 sys/kern/vfs_subr.c:507
spec_open_clone(ffff8000371b7ee8) at spec_open_clone+0x1ee sys/kern/spec_vnops.c:711
spec_open(ffff8000371b7ee8) at spec_open+0x326 sys/kern/spec_vnops.c:148
VOP_OPEN(fffffd806f23c968,83,fffffd807f7d37b8,ffff80002a03f970) at VOP_OPEN+0x8b sys/kern/vfs_vops.c:138
vn_open(ffff8000371b8138,83,0) at vn_open+0x708 sys/kern/vfs_vnops.c:177
doopenat(ffff80002a03f970,ffffff9c,20000700,82,0,ffff8000371b82e0) at doopenat+0x31d sys/kern/vfs_syscalls.c:1123
syscall(ffff8000371b8390) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000371b8390) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x26890ab7a0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xfffffd8065088c18, 0x18, 0, 1) -> e
ddb{0}> trace
checkalias(fffffd8059b4d210,24900,0) at checkalias+0xb7 sys/kern/vfs_subr.c:564
cdevvp(24900,ffff8000371b7e10) at cdevvp+0xd2 sys/kern/vfs_subr.c:507
spec_open_clone(ffff8000371b7ee8) at spec_open_clone+0x1ee sys/kern/spec_vnops.c:711
spec_open(ffff8000371b7ee8) at spec_open+0x326 sys/kern/spec_vnops.c:148
VOP_OPEN(fffffd806f23c968,83,fffffd807f7d37b8,ffff80002a03f970) at VOP_OPEN+0x8b sys/kern/vfs_vops.c:138
vn_open(ffff8000371b8138,83,0) at vn_open+0x708 sys/kern/vfs_vnops.c:177
doopenat(ffff80002a03f970,ffffff9c,20000700,82,0,ffff8000371b82e0) at doopenat+0x31d sys/kern/vfs_syscalls.c:1123
syscall(ffff8000371b8390) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000371b8390) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x26890ab7a0, count: -9
ddb{0}> show registers
rdi               0xffff80002a167000
rsi                            0x9de
rbp               0xffff8000371b7d90
rbx                          0x14900    acpi_pdirpa+0x771
rdx               0xffff80002a167000
rcx                            0x9dd
rax               0xffffffff8240a8e3    checkalias+0x183
r8                                 0
r9                0xffffffffffffffff
r10               0xb4c6291c5dd2c591
r11               0x54c54ee48888bc35
r12                          0x24900    acpi_pdirpa+0x10771
r13                                0
r14                          0x24900    acpi_pdirpa+0x10771
r15               0xfffffd80631d51d0
rip               0xffffffff8240a817    checkalias+0xb7
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000371b7d20
ss                              0x10
checkalias+0xb7:        movl    0x18(%r13),%ebx
ddb{0}> show proc
PROC (syz-executor) tid=148791 pid=32585 tcnt=2 stat=onproc
    flags process=8000000<PIN> proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a03e7b8,0xffffffff83627228
    process=0xffff800029fe96b0 user=0xffff8000371b3000, vmspace=0xfffffd8065088c18
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 32585  162580  83112      0  3   0x8000080  fsleep        syz-executor
*32585  148791  83112      0  7   0xc000000                syz-executor
 12447  268431    905      0  3   0x8000080  fsleep        syz-executor
 12447  353212    905      0  3   0xc000080  netcon        syz-executor
 65091  284600  16511      0  3   0x8000080  fsleep        syz-executor
 65091  141552  16511      0  3   0xc000080  sbwait        syz-executor
 74065  489491  44630      0  3   0x8000080  fsleep        syz-executor
 74065  267914  44630      0  3   0xc000080  ttyin         syz-executor
 46944  338322  76456      0  3   0x8000080  fsleep        syz-executor
 46944  352478  76456      0  3   0xc000080  kqread        syz-executor
 86945  217083  33667      0  3   0x8000080  fsleep        syz-executor
 86945    6947  33667      0  3   0xc000080  pipewr        syz-executor
 75285  387502  89932      0  3   0x8000080  fsleep        syz-executor
 75285  439493  89932      0  3   0xc000080  bell          syz-executor
 86235  276533  85868      0  7   0x8000002                syz-executor
 44630  237569  85868      0  2   0x8000482                syz-executor
   905   14398  85868      0  2   0x8000482                syz-executor
 33667  288442  85868      0  3   0x8000082  nanoslp       syz-executor
 89932  377795  85868      0  2   0x8000482                syz-executor
 76456  126763  85868      0  3   0x8000082  nanoslp       syz-executor
 83112  488495  85868      0  3   0x8000082  nanoslp       syz-executor
 16511   56222  85868      0  3   0x8000082  nanoslp       syz-executor
 82216  279433      1      0  3  0x18100083  ttyin         getty
 69011  507739      0      0  3     0x14200  bored         sosplice
 85868  474857  77565      0  3   0x8000082  kqread        syz-executor
 77565   82175  58713      0  3   0x810008a  sigsusp       ksh
 58713  344755  26291      0  3  0x18000098  kqread        sshd-session
 26291  268887  28299      0  3  0x18000092  kqread        sshd-session
 28299  494550      1      0  3  0x18000088  kqread        sshd
  4497  499743  79320     74  3  0x19100092  bpf           pflogd
 79320   42880      1      0  3  0x18000080  sbwait        pflogd
 56040    8898  18354     73  2  0x19100010                syslogd
 18354  501812      1      0  3  0x18100082  sbwait        syslogd
 47248  124572      1      0  3  0x18100080  kqread        resolvd
 43498  198644   3713     77  3  0x18100092  kqread        dhcpleased
 91501  255232   3713     77  3  0x18100092  kqread        dhcpleased
  3713  199529      1      0  3  0x18000080  kqread        dhcpleased
 53104  125077      0      0  3     0x14200  bored         smr
 92952  410356      0      0  3     0x14200  pgzero        zerothread
 71966  475138      0      0  3     0x14200  aiodoned      aiodoned
   114  420877      0      0  3     0x14200  syncer        update
  1635  129546      0      0  3     0x14200  cleaner       cleaner
 92309  143433      0      0  3     0x14200  reaper        reaper
 18674  349678      0      0  3     0x14200  pgdaemon      pagedaemon
 16058  498715      0      0  3     0x14200  bored         viomb
 69627    3436      0      0  3  0x40014200  acpi0         acpi0
  3868  306788      0      0  3  0x40014200                idle1
 26112  136618      0      0  3     0x14200  bored         softnet3
 79431  412209      0      0  3     0x14200  bored         softnet2
 87799  457578      0      0  3     0x14200  bored         softnet1
 27127  169234      0      0  3     0x14200  bored         softnet0
 39983  337883      0      0  3     0x14200  bored         systqmp
 54585   95907      0      0  3     0x14200  bored         systq
  7522   32712      0      0  3     0x14200  tmoslp        softclockmp
 75276  160590      0      0  3  0x40014200  tmoslp        softclock
 35627  270948      0      0  3  0x40014200                idle0
     1   70477      0      0  3   0x8000082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 32585 (syz-executor) thread 0xffff80002a03f970 (148791)
exclusive rrwlock inode r = 0 (0xfffffd806f1e1928)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  cache_lookup+0x36e sys/kern/vfs_cache.c:222
#7  ufs_lookup+0x218 sys/ufs/ufs/ufs_lookup.c:160
#8  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#9  vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#10 namei+0x7aa sys/kern/vfs_lookup.c:250
#11 vn_open+0x13f sys/kern/vfs_vnops.c:140
#12 doopenat+0x31d sys/kern/vfs_syscalls.c:1123
#13 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#13 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#14 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff835f0020)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  syscall+0xad6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#1  syscall+0xad6 sys/arch/amd64/amd64/trap.c:577
#2  Xsyscall+0x128
Process 86235 (syz-executor) thread 0xffff80002a095470 (276533)
exclusive rrwlock inode r = 0 (0xfffffd8063957d58)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  ufs_ihashget+0x171 sys/ufs/ufs/ufs_ihash.c:95
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1201
#8  ufs_lookup+0x19f8 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#11 namei+0x7aa sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#13 syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#13 syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806be6c708)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1852
#8  syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#8  syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#9  Xsyscall+0x128
Process 56040 (syslogd) thread 0xffff8000ffffdbe8 (8898)
exclusive rrwlock inode r = 0 (0xfffffd806e49b2c0)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  sys_fsync+0x152 sys/kern/vfs_syscalls.c:2927
#6  syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#6  syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#7  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10234  10319K   10682K 166960K     13684        0
            pcb    18     16K      18K 166960K       433        0
         rtable   238     15K      16K 166960K      3345        0
             pf    42     19K      23K 166960K       354        0
         ifaddr    44      9K       9K 166960K       464        0
        ifgroup    63      2K       2K 166960K       517        0
         sysctl     3      0K       0K 166960K         5        0
       counters    68     36K      37K 166960K       306        0
       ioctlops     0      0K       4K 166960K      1859        0
            iov     0      0K      28K 166960K        67        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1457     92K      92K 166960K      4006        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        24        0
         VM map     2      1K       1K 166960K         2        0
            sem    29      2K       2K 166960K        31        0
        dirhash    15      2K       3K 166960K        51        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc    17     61K      93K 166960K      2529        0
          sigio     0      0K       0K 166960K        29        0
           proc    70     91K     140K 166960K      3299        0
        subproc   104      6K       6K 166960K      1339        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     2      0K       0K 166960K       138        0
       in_multi    98      7K       7K 166960K      1177        0
    ether_multi     1      0K       0K 166960K         7        0
            mrt     1      0K       0K 166960K         5        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   229   1023K    1023K 166960K       229        0
           exec     0      0K       1K 166960K      1753        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   252    110K     112K 166960K     19633        0
       UVM aobj   123      7K       7K 166960K       124        0
     pinsyscall    42     84K     106K 166960K      6080        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        53        0
            NDP    24      1K       2K 166960K       339        0
           temp    69   6818K    6953K 166960K    127396        0
         kqueue    14     22K      28K 166960K       174        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      453    0      448     5     4     1     3     0     8    0
rtentry    112     1191    0     1084     7     3     4     4     0     8    0
unpcb      144     1357    0     1333    23    21     2     6     0     8    1
syncache   336        6    0        6     3     3     0     1     0     8    0
tcpcb      808      428    0      421    10     9     1     4     0     8    0
arp        120      211    0      193     1     0     1     1     0     8    0
inpcb      336     2355    0     2343    45    43     2     7     0     8    0
nd6        136      327    0      303     1     0     1     1     0     8    0
pkpcb       40        5    0        5     2     2     0     1     0     8    0
kcovpl      48      103    0       95     1     0     1     1     0     8    0
ppxss      1168      15    0       15     7     6     1     1     0     8    1
pfstscr     40        5    0        4     1     0     1     1     0     8    0
pffrag     232       13    0       10     1     0     1     1     0   482    0
pffrnode    88       13    0       10     1     0     1     1     0     8    0
pffrent     40       61    0       58     2     1     1     1     0     8    0
pfosfp      40     1498    0     1071     5     0     5     5     0     8    0
pfosfpen   112     1498    0      779    21     0    21    21     0     8    0
pfrktable  1344       4    0        4     2     2     0     1     0     8    0
pfanchor   1288       7    0        1     1     0     1     1     0     8    0
pftag       88        5    0        4     3     2     1     1     0     8    0
pfstitem    24      196    0      161     1     0     1     1     0     8    0
pfstkey    128      206    0      169     2     0     2     2     0     8    0
pfstate    376      198    0      165     6     1     5     5     0     8    0
pfrule     1344      40    0       33     2     1     1     2     0     8    0
art_heap8  4096       2    0        1     2     0     2     2     0     8    1
art_heap4  256     4750    0     4292    41    12    29    30     0     8    0
art_table   32     4752    0     4293     5     1     4     4     0     8    0
art_node    16     1187    0     1091     1     0     1     1     0     8    0
sysvmsgpl   40       10    0        3     2     1     1     1     0     8    0
semapl     112       27    0        0     1     0     1     1     0     8    0
shmpl      112      121    0        1     4     0     4     4     0     8    0
dirhash    1024      43    0       24     3     0     3     3     0     8    0
dino2pl    256     3881    0     2194   107     0   107   107     0     8    0
ffsino     272     3881    0     2194   115     1   114   114     0     8    0
nchpl      144     5565    0     3755    68     0    68    68     0     8    0
uvmvnodes   80     6076    0        0   124     0   124   124     0     8    0
vnodes     216     6076    0        0   338     0   338   338     0     8    0
vnodes: pool(0xffffffff835a97b0:vnodes): page inconsistency: page 0x0; at page head addr 0xfffffd80631d5f90 (p 0xfffffd80631d5000)
namei      1024   30483    0    30483     7     6     1     2     0     8    1
percpumem   16      167    0      119     1     0     1     1     0     8    0
vcpupl     3904       6    0        1     1     0     1     1     0     8    0
vmpool     696        9    0        4     1     0     1     1     0     8    0
pfiaddrpl  120        1    0        1     1     1     0     1     0     8    0
kstatmem   264      266    0      238     3     1     2     3     0     8    0
scsiplug    72        3    0        3     3     3     0     1     0     8    0
scxspl     216    62523    0    62523    17    16     1     8     1     8    1
plimitpl   152      562    0      544     1     0     1     1     0     8    0
sigapl     424     2642    0     2592    10     3     7     7     0     8    0
futexpl     64    27934    0    27927     9     8     1     1     0     8    0
knotepl    120      471    0        0    12     1    11    12     0     8    0
kqueuepl   216      497    0      484    11    10     1     5     0     8    0
pipepl     320      500    0      472     3     0     3     3     0     8    0
fdescpl    496     2622    0     2591     8     3     5     5     0     8    0
filepl     152    16098    0    15827    46    34    12    18     0     8    1
lockfpl    104      670    0      667     2     1     1     2     0     8    0
lockfspl    48      255    0      252     1     0     1     1     0     8    0
sessionpl  144      120    0      111     1     0     1     1     0     8    0
pgrppl      48      246    0      229     1     0     1     1     0     8    0
ucredpl    104     2841    0     2828     1     0     1     1     0     8    0
zombiepl   144     2592    0     2592     1     0     1     1     0     8    1
processpl  1160    2642    0     2592     5     1     4     5     0     8    0
procpl     648     4431    0     4374     8     2     6     7     0     8    0
srpgc       96       17    0       17     5     5     0     1     0     8    0
sosppl     168        6    0        6     3     3     0     1     0     8    0
sockpl     664     4180    0     4139    65    59     6    15     0     8    2
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096       3    0        0     1     0     1     1     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     302    0        0    30     1    29    30     0     8    1
mtagpl      96       11    0        0     1     0     1     1     0     8    0
mbufpl     256     1044    0        0    54     0    54    54     0     8    0
bufpl      280    10999    0     2804   586     0   586   586     0     8    0
anonpl      24   417171    0   404583   160    54   106   129     0   185    2
amapchunkpl 152   61890    0    61277    66    30    36    42     0   158   10
amappl16   200     7549    0     7077    52    13    39    39     0     8    0
amappl15   192        8    0        8     2     2     0     1     0     8    0
amappl14   184      311    0      298     1     0     1     1     0     8    0
amappl13   176        5    0        5     1     1     0     1     0     8    0
amappl12   168     4790    0     4759     4     2     2     3     0     8    0
amappl11   160       58    0       44     1     0     1     1     0     8    0
amappl10   152       19    0       19     1     1     0     1     0     8    0
amappl9    144      136    0      135     1     0     1     1     0     8    0
amappl8    136       95    0       92     1     0     1     1     0     8    0
amappl7    128      299    0      287     1     0     1     1     0     8    0
amappl6    120     1115    0     1114     1     0     1     1     0     8    0
amappl5    112      517    0      505     1     0     1     1     0     8    0
amappl4    104      615    0      594     1     0     1     1     0     8    0
amappl3     96    11639    0    11521     5     1     4     4     0     8    0
amappl2     88     1959    0     1893     2     0     2     2     0     8    0
amappl1     80    20716    0    20134    16     2    14    15     0     8    0
amappl      88    18500    0    18317     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      123    0        1     3     0     3     3     0     8    0
uaddrrnd    24     2631    0     2595     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2631    0     2595     1     0     1     1     0     8    0
vmmpekpl   168    23055    0    23011     3     0     3     3     0     8    0
vmmpepl    168   195765    0   193418   153    29   124   124     0   357   13
vmsppl     440     2630    0     2595     7     2     5     5     0     8    0
rwobjpl     56    55127    0    47523   111     3   108   108     0     8    0
pdppl      4096    5269    0     5195   216   137    79    85     0     8    5
pvpl        32    46727    0        0   378     1   377   377     0   265    0
pmappl     248     2630    0     2595     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      647    0      220    13     0    13    13     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
checkalias(fffffd8059b4d210,24900,0) at checkalias+0xb7 sys/kern/vfs_subr.c:564
cdevvp(24900,ffff8000371b7e10) at cdevvp+0xd2 sys/kern/vfs_subr.c:507
spec_open_clone(ffff8000371b7ee8) at spec_open_clone+0x1ee sys/kern/spec_vnops.c:711
spec_open(ffff8000371b7ee8) at spec_open+0x326 sys/kern/spec_vnops.c:148
VOP_OPEN(fffffd806f23c968,83,fffffd807f7d37b8,ffff80002a03f970) at VOP_OPEN+0x8b sys/kern/vfs_vops.c:138
vn_open(ffff8000371b8138,83,0) at vn_open+0x708 sys/kern/vfs_vnops.c:177
doopenat(ffff80002a03f970,ffffff9c,20000700,82,0,ffff8000371b82e0) at doopenat+0x31d sys/kern/vfs_syscalls.c:1123
syscall(ffff8000371b8390) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff8000371b8390) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x26890ab7a0, count: -9
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff835efe18) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835efe18) at __mp_lock+0x192 sys/kern/kern_lock.c:144
__mp_acquire_count(ffffffff835efe18,1) at __mp_acquire_count+0x58
mi_switch() at mi_switch+0x658 sys/kern/sched_bsd.c:460
sleep_finish(0,1) at sleep_finish+0x219 sys/kern/kern_synch.c:416
biowait(fffffd8061ef7c48) at biowait+0xc1 sys/kern/vfs_bio.c:1254
bwrite(fffffd8061ef7c48) at bwrite+0x2e2 sys/kern/vfs_bio.c:766
ufs_dirremove(fffffd807aec4528,fffffd8063957cc0,800c,1) at ufs_dirremove+0x2a9 sys/ufs/ufs/ufs_lookup.c:919
ufs_rmdir(ffff80002a09f078) at ufs_rmdir+0x287 sys/ufs/ufs/ufs_vnops.c:1248
VOP_RMDIR(fffffd807aec4528,fffffd8059b4d138,ffff80002a09f158) at VOP_RMDIR+0x19a sys/kern/vfs_vops.c:413
dounlinkat(ffff80002a095470,ffffff9c,70f881d026b0,8) at dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1885
syscall(ffff80002a09f2d0) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a09f2d0) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
end trace frame: 0xffff80002a09f350, count: 0
ddb{1}> trace
x86_ipi_db(ffff800029b7bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff835efe18) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835efe18) at __mp_lock+0x192 sys/kern/kern_lock.c:144
__mp_acquire_count(ffffffff835efe18,1) at __mp_acquire_count+0x58
mi_switch() at mi_switch+0x658 sys/kern/sched_bsd.c:460
sleep_finish(0,1) at sleep_finish+0x219 sys/kern/kern_synch.c:416
biowait(fffffd8061ef7c48) at biowait+0xc1 sys/kern/vfs_bio.c:1254
bwrite(fffffd8061ef7c48) at bwrite+0x2e2 sys/kern/vfs_bio.c:766
ufs_dirremove(fffffd807aec4528,fffffd8063957cc0,800c,1) at ufs_dirremove+0x2a9 sys/ufs/ufs/ufs_lookup.c:919
ufs_rmdir(ffff80002a09f078) at ufs_rmdir+0x287 sys/ufs/ufs/ufs_vnops.c:1248
VOP_RMDIR(fffffd807aec4528,fffffd8059b4d138,ffff80002a09f158) at VOP_RMDIR+0x19a sys/kern/vfs_vops.c:413
dounlinkat(ffff80002a095470,ffffff9c,70f881d026b0,8) at dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1885
syscall(ffff80002a09f2d0) at syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
syscall(ffff80002a09f2d0) at syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70f881d026a0, count: -15

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/13 03:50 openbsd 6fd6d0214b92 7b0f4b46 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: checkalias
2024/08/12 02:06 openbsd 41141cf040dd 6f4edef4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: checkalias
2024/08/11 09:00 openbsd 6d453ff9e2fb 6f4edef4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: checkalias
2024/08/06 05:46 openbsd 4ad77004d94b e1bdb00a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: checkalias
2024/05/19 23:10 openbsd 676865473293 c0f1611a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: checkalias
2024/05/18 07:33 openbsd 1b2581db680c c0f1611a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: checkalias
2024/05/07 10:48 openbsd debf255c65d9 fa7a5cf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: checkalias
2024/04/09 13:45 openbsd b226cd0be9f7 56086b24 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: checkalias
* Struck through repros no longer work on HEAD.