syzbot


uvm_fault: uvm_aio_aiodone

Status: upstream: reported on 2026/01/14 05:57
Reported-by: syzbot+1da48da04bb08ef91afd@syzkaller.appspotmail.com
First crash: 5d05h, last: 1d12h

Sample crash report:
uvm_fault(0xffffffff83879438, 0x4b, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      uvm_aio_aiodone+0x223:  movl    0x48(%rax),%r12d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*485114  16687      0     0x14000      0x200    0  aiodoned
uvm_aio_aiodone(fffffd806fcebe78) at uvm_aio_aiodone+0x223 sys/uvm/uvm_pager.c:718
uvm_aiodone_daemon(ffff80002a7774c8) at uvm_aiodone_daemon+0x212 sys/uvm/uvm_pdaemon.c:358
end trace frame: 0x0, count: 13
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83879438, 0x4b, 0, 1) -> e
ddb> trace
uvm_aio_aiodone(fffffd806fcebe78) at uvm_aio_aiodone+0x223 sys/uvm/uvm_pager.c:718
uvm_aiodone_daemon(ffff80002a7774c8) at uvm_aiodone_daemon+0x212 sys/uvm/uvm_pdaemon.c:358
end trace frame: 0x0, count: -2
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a7750d0
rbx                                0
rdx                                0
rcx                              0x1
rax                              0x3
r8                0xffffffffffffffff
r9                                 0
r10               0xa42acce596935645
r11               0xdbb8cfa99fc925f4
r12                              0x3
r13               0xffff800011036000
r14               0xfffffd806fcebe78
r15                                0
rip               0xffffffff81e1e283    uvm_aio_aiodone+0x223
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a775000
ss                              0x10
uvm_aio_aiodone+0x223:  movl    0x48(%rax),%r12d
ddb> show proc
PROC (aiodoned) tid=485114 pid=16687 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=4, usrpri=51, slppri=4, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a72d4c0,0xffff80002a776d10
    process=0xffff8000ffffe880 user=0xffff80002a770000, vmspace=0xffffffff83879438
    estcpu=1, cpticks=5, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 66711  346001  64200      0  3      0x3000  suspend       syz-executor
 66711   47328  64200      0  2   0x4081000                syz-executor
  2968  257479  83194      0  2     0x81000                syz-executor
  2968  143351  83194      0  3   0x4003000  suspend       syz-executor
 83194  223320  74755      0  3        0x82  wait          syz-executor
  3230   17640  74755      0  2         0x2                syz-executor
 38517  171171  74755      0  2         0x2                syz-executor
 52934  135786  74755      0  3         0x2  uobjlk        syz-executor
 64200   83671  74755      0  3        0x82  wait          syz-executor
 83944  245837  74755      0  2         0x2                syz-executor
 21629  171774  74755      0  2         0x2                syz-executor
 18681  456638  74755      0  2         0x2                syz-executor
 74755  474648  47463      0  3         0x2  uobjlk        syz-executor
 47463  482889  89161      0  3    0x10008a  sigsusp       ksh
 89161  239972  39060      0  3        0x98  kqread        sshd-session
 39060  278811  17003      0  3        0x92  kqread        sshd-session
 51254  395661      1      0  3    0x100083  ttyin         getty
 17003  196816      1      0  3        0x88  kqread        sshd
 78625  388791  83879     73  2   0x1100010                syslogd
 83879   74421      1      0  3    0x100082  sbwait        syslogd
 80376   54609      1      0  3    0x100080  kqread        resolvd
 83278  120709  34029     77  3    0x100092  kqread        dhcpleased
 93959  222263  34029     77  3    0x100092  kqread        dhcpleased
 34029  225205      1      0  3        0x80  kqread        dhcpleased
  2638  158138      0      0  3     0x14200  bored         smr
 85096  170088      0      0  2     0x14200                zerothread
*16687  485114      0      0  7     0x14200                aiodoned
 79812  417005      0      0  3     0x14200  syncer        update
 42052  303897      0      0  3     0x14200  cleaner       cleaner
  6230   50928      0      0  3     0x14200  reaper        reaper
 13324  390895      0      0  3     0x14200  pgdaemon      pagedaemon
 74598   57646      0      0  3     0x14200  bored         viomb
  1964  223354      0      0  3  0x40014200  acpi0         acpi0
 40194  122549      0      0  3     0x14200  bored         softnet0
 25449  424068      0      0  3     0x14200  bored         systqmp
 58203  516400      0      0  3     0x14200  bored         systq
 79213   67982      0      0  3  0x40014200  tmoslp        softclock
 92942  193941      0      0  3  0x40014200                idle0
     1  278365      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11035  12112K   12557K 166960K     12257        0
            pcb    18     12K      12K 166960K        37        0
         rtable   207      6K       8K 166960K       383        0
             pf    34     17K      17K 166960K        42        0
         ifaddr    37      6K       7K 166960K        48        0
        ifgroup    54      2K       2K 166960K        68        0
         sysctl     1      1K       9K 166960K         5        0
       counters    34     17K      17K 166960K        37        0
       ioctlops     0      0K       4K 166960K        36        0
            iov     0      0K       4K 166960K         4        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1339     84K      85K 166960K      1404        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         3        0
         VM map     2      1K       1K 166960K         2        0
            sem     3      0K       0K 166960K         3        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    12     41K      97K 166960K       182        0
          sigio     0      0K       0K 166960K         1        0
           proc    58     59K     100K 166960K       472        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     2      0K       0K 166960K        73        0
       in_multi    77      5K       7K 166960K       102        0
    ether_multi     1      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    43    201K     201K 166960K        43        0
           exec     0      0K       1K 166960K       358        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   183    150K     158K 166960K      3289        0
       UVM aobj     5      4K       4K 166960K         5        0
     pinsyscall    33     66K      94K 166960K      1250        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    12      0K       2K 166960K        31        0
           temp    34   8914K    8914K 166960K      7002        0
         kqueue    13     20K      24K 166960K        28        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       38    0       35     1     0     1     1     0     8    0
rtentry    136      112    0       23     4     0     4     4     0     8    0
unpcb      144      122    0      106     3     0     3     3     0     8    2
syncache   336        3    0        3     1     0     1     1     0     8    1
tcpcb      736       90    0       82     7     0     7     7     0     8    6
arp         96       18    0        4     1     0     1     1     0     8    0
inpcb      328      160    0      148     7     0     7     7     0     8    5
nd6        112       25    0        6     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      454    0       88    29     0    29    29     0     8    3
art_table   40      455    0       88     5     0     5     5     0     8    0
art_node    32      112    0       31     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        0     1     0     1     1     0     8    0
semapl     112        1    0        0     1     0     1     1     0     8    0
shmpl      112        1    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1642    0      142    95     0    95    95     0     8    0
ffsino     256     1642    0      142    95     0    95    95     0     8    0
nchpl      144     1906    0      223    63     0    63    63     0     8    0
vnodes     216     1754    0        0    98     0    98    98     0     8    0
namei      1024    5565    0     5565     2     0     2     2     0     8    2
vcpupl     3904       1    0        0     1     0     1     1     0     8    0
vmpool     808        1    0        0     1     0     1     1     0     8    0
kstatmem   264       30    0        6     2     0     2     2     0     8    0
scxspl     216     8226    0     8226     9     0     9     9     1     8    9
plimitpl   152       32    0       15     1     0     1     1     0     8    0
sigapl     424      468    0      431     6     0     6     6     0     8    1
knotepl    120     5031    0     4984    10     0    10    10     0     8    7
kqueuepl   184       32    0       23     1     0     1     1     0     8    0
pipepl     304      119    0       92     3     0     3     3     0     8    0
fdescpl    448      455    0      431     5     0     5     5     0     8    1
filepl     120     1797    0     1582    10     0    10    10     0     8    2
lockfpl    104       25    0       22     1     0     1     1     0     8    0
lockfspl    48       14    0       11     1     0     1     1     0     8    0
sessionpl  144       21    0       13     1     0     1     1     0     8    0
pgrppl      48       30    0       14     1     0     1     1     0     8    0
ucredpl    104      101    0       90     1     0     1     1     0     8    0
zombiepl   144      431    0      431     1     0     1     1     0     8    1
processpl  1152     468    0      431     4     0     4     4     0     8    0
procpl     664      549    0      510     5     0     5     5     0     8    1
sockpl     552      321    0      290     7     0     7     7     0     8    4
mcl64k     65536      1    0        1     1     0     1     1     0     8    1
mcl8k      8192       7    0        7     1     0     1     1     0     8    1
mcl4k      4096    2513    0     2463    13     0    13    13     0     8    5
mcl2k      2048     288    0      288     3     0     3     3     0     8    3
mtagpl      96        7    0        5     1     0     1     1     0     8    0
mbufpl     256     4672    0     4516    12     0    12    12     0     8    0
bufpl      280    11334    0     8951   190     1   189   189     0     8   18
anonpl      24    95935    0    91208    32     0    32    32     0   187    0
amapchunkpl 152    9409    0     8967    24     0    24    24     0   158    2
amappl16   200     1594    0     1575     5     0     5     5     0     8    3
amappl15   192       46    0       45     1     0     1     1     0     8    0
amappl14   184        7    0        7     1     0     1     1     0     8    1
amappl13   176      405    0      404     1     0     1     1     0     8    0
amappl12   168      789    0      756     2     0     2     2     0     8    0
amappl11   160        6    0        6     1     0     1     1     0     8    1
amappl10   152       42    0       32     1     0     1     1     0     8    0
amappl9    144      284    0      284     1     0     1     1     0     8    1
amappl8    136       89    0       88     1     0     1     1     0     8    0
amappl7    128       77    0       76     1     0     1     1     0     8    0
amappl6    120      256    0      245     1     0     1     1     0     8    0
amappl5    112       69    0       62     1     0     1     1     0     8    0
amappl4    104      374    0      349     1     0     1     1     0     8    0
amappl3     96     1479    0     1422     3     0     3     3     0     8    0
amappl2     88      573    0      509     2     0     2     2     0     8    0
amappl1     80     9066    0     8556    13     0    13    13     0     8    0
amappl      88     2597    0     2483     4     0     4     4     0    92    0
uvmvnodes   80       97    0        0     2     0     2     2     0     8    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        4    0        0     1     0     1     1     0     8    0
uaoeltpl    96     8681   32     6918    43     0    43    43     0     8    0
uaddrrnd    24      455    0      431     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      455    0      431     1     0     1     1     0     8    0
vmmpekpl   168     5467    0     5429     2     0     2     2     0     8    0
vmmpepl    168    36810    0    35335    81     0    81    81     0   357    4
vmsppl     368      454    0      431     4     0     4     4     0     8    1
rwobjpl     40    13150    0    12288    11     0    11    11     0     8    1
pdppl      4096     919    0      863    97    33    64    83     0     8    8
pvpl        32   807271    0   538028  3196   791  2405  3196     0   265  232
pmappl     216      455    0      431     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      373    0       33    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
uvm_aio_aiodone(fffffd806fcebe78) at uvm_aio_aiodone+0x223 sys/uvm/uvm_pager.c:718
uvm_aiodone_daemon(ffff80002a7774c8) at uvm_aiodone_daemon+0x212 sys/uvm/uvm_pdaemon.c:358
end trace frame: 0x0, count: -2
ddb> machine ddbcpu 1
No such command
ddb> trace
uvm_aio_aiodone(fffffd806fcebe78) at uvm_aio_aiodone+0x223 sys/uvm/uvm_pager.c:718
uvm_aiodone_daemon(ffff80002a7774c8) at uvm_aiodone_daemon+0x212 sys/uvm/uvm_pdaemon.c:358
end trace frame: 0x0, count: -2

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/17 23:31 openbsd f5df22e61f89 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: uvm_aio_aiodone
2026/01/15 19:02 openbsd c600931321c7 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: uvm_aio_aiodone
2026/01/14 05:57 openbsd 3d903ed5427e 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: uvm_aio_aiodone
* Struck through repros no longer work on HEAD.