syzbot


uvm_fault: uvm_aio_aiodone

Status: upstream: reported on 2026/01/14 05:57
Reported-by: syzbot+1da48da04bb08ef91afd@syzkaller.appspotmail.com
First crash: 59d, last: 51d

Sample crash report:
uvm_fault(0xffffffff839a2100, 0x4b, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      uvm_aio_aiodone+0x223:  movl    0x48(%rax),%r12d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*484514  52323      0     0x14000      0x200    0  aiodoned
uvm_aio_aiodone(fffffd806fbf17c0) at uvm_aio_aiodone+0x223 sys/uvm/uvm_pager.c:718
uvm_aiodone_daemon(ffff80002a777c90) at uvm_aiodone_daemon+0x212 sys/uvm/uvm_pdaemon.c:358
end trace frame: 0x0, count: 13
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff839a2100, 0x4b, 0, 1) -> e
ddb> trace
uvm_aio_aiodone(fffffd806fbf17c0) at uvm_aio_aiodone+0x223 sys/uvm/uvm_pager.c:718
uvm_aiodone_daemon(ffff80002a777c90) at uvm_aiodone_daemon+0x212 sys/uvm/uvm_pdaemon.c:358
end trace frame: 0x0, count: -2
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a7753e0
rbx                                0
rdx                                0
rcx                              0x1
rax                              0x3
r8                0xffff80002a73909a
r9                                 0
r10               0x7b7c34978c11e80a
r11               0xc6df3b4b56392446
r12                              0x3
r13               0xffff800011036000
r14               0xfffffd806fbf17c0
r15                                0
rip               0xffffffff81cd7313    uvm_aio_aiodone+0x223
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a775310
ss                              0x10
uvm_aio_aiodone+0x223:  movl    0x48(%rax),%r12d
ddb> show proc
PROC (aiodoned) tid=484514 pid=52323 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=4, usrpri=51, slppri=4, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a72dc88,0xffff80002a777770
    process=0xffff8000ffffd200 user=0xffff80002a770000, vmspace=0xffffffff839a2100
    estcpu=1, cpticks=7, pctcpu=0.1, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 94969  149859  65039      0  2           0                syz-executor
 56788   28164  71148      0  2           0                syz-executor
 56788  225621  71148      0  3   0x4000080  fsleep        syz-executor
 40725  393085  17125      0  2         0x2                syz-executor
 60500  318153  17125      0  2         0x2                syz-executor
 68013  371673  17125      0  2         0x2                syz-executor
 65039  351553  17125      0  2         0x2                syz-executor
 71148   35770  17125      0  2       0xc82                syz-executor
 71288  218533   3249      0  3      0x3000  suspend       syz-executor
 71288  376391   3249      0  3   0x4081000  pfioctl_rw    syz-executor
  5470  195320  89859      0  3      0x3000  suspend       syz-executor
  5470  117123  89859      0  3   0x4081000  pfioctl_rw    syz-executor
 59299  132112      1      0  3      0x3000  suspend       syz-executor
 59299  493552      1      0  3   0x4081000  pfioctl_rw    syz-executor
 59299  519332      1      0  3   0x4081000  pfioctl_rw    syz-executor
 19035  215900      1      0  3      0x3000  suspend       syz-executor
 19035  495448      1      0  3   0x4081000  pfioctl_rw    syz-executor
 19035   43588      1      0  3   0x4081000  pfioctl_rw    syz-executor
 26273  351140      1      0  3      0x3000  suspend       syz-executor
 26273  423939      1      0  2   0x4081000                syz-executor
 26273  301977      1      0  3   0x4081000  pfioctl_rw    syz-executor
  3249  219781  17125      0  3        0x82  wait          syz-executor
 76934  344513      1      0  3    0x100083  ttyin         getty
 89859  285278  17125      0  3        0x82  wait          syz-executor
 93384   29138  17125      0  2         0x2                syz-executor
 17125   75905   9369      0  2         0x2                syz-executor
  9369  184918  39836      0  3    0x10008a  sigsusp       ksh
 39836  425414  59423      0  3        0x98  kqread        sshd-session
 59423  148182   7306      0  3        0x92  kqread        sshd-session
  7306    9758      1      0  3        0x88  kqread        sshd
 68690  202283  34155     73  3   0x1100090  kqread        syslogd
 34155  363342      1      0  3    0x100082  sbwait        syslogd
 58503  304456      1      0  3    0x100080  kqread        resolvd
 61649  345198  13424     77  3    0x100092  kqread        dhcpleased
 87709  282981  13424     77  3    0x100092  kqread        dhcpleased
 13424   87862      1      0  3        0x80  kqread        dhcpleased
 74852  240202      0      0  3     0x14200  bored         smr
 82185   43299      0      0  2     0x14200                zerothread
*52323  484514      0      0  7     0x14200                aiodoned
 67613  414269      0      0  3     0x14200  syncer        update
 57778  415770      0      0  3     0x14200  cleaner       cleaner
 18026  403838      0      0  3     0x14200  reaper        reaper
   262  420538      0      0  2     0x14200                pagedaemon
 93143   41694      0      0  3     0x14200  bored         viomb
 34287  102894      0      0  3  0x40014200  acpi0         acpi0
 89877  273086      0      0  2     0x14200                softnet0
 94626  410635      0      0  3     0x14200  bored         systqmp
 66516  524131      0      0  3     0x14200  bored         systq
 13188  336200      0      0  3  0x40014200  tmoslp        softclock
 91926  522983      0      0  3  0x40014200                idle0
     1  276446      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11047  12111K   12474K 166960K     14776        0
            pcb    17     14K      15K 166960K       341        0
         rtable   123      7K       7K 166960K       684        0
             pf    36     14K      16K 166960K       163        0
         ifaddr    49      9K       9K 166960K       169        0
        ifgroup    58      2K       2K 166960K       243        0
         sysctl     4      1K       9K 166960K        24        0
       counters    35     18K      18K 166960K       158        0
       ioctlops     7      7K       8K 166960K       650        0
            iov     0      0K      32K 166960K       172        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1468     92K      92K 166960K      2995        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K      13K 166960K         9        0
         VM map     2      1K       1K 166960K         2        0
            sem    25      5K       5K 166960K        46        0
        dirhash    12      2K       2K 166960K        15        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    19     69K     240K 166960K      1849        0
          sigio     0      0K       0K 166960K        73        0
           proc    60     59K     124K 166960K       662        0
        subproc   104      6K       6K 166960K       149        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       311        0
       in_multi    30      2K       6K 166960K       212        0
    ether_multi     1      0K       0K 166960K        17        0
            mrt     2      0K       0K 166960K         9        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    79    360K     360K 166960K        79        0
           exec     0      0K       1K 166960K       555        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   248    191K     191K 166960K     16952        0
       UVM aobj    63     24K      24K 166960K        79        0
     pinsyscall    40     80K      98K 166960K      3037        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       110        0
            NDP    15      0K       1K 166960K        85        0
           temp    86   8739K    8801K 166960K     28635        0
         kqueue    13     20K      29K 166960K       269        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      139    0      136     2     0     2     2     0     8    1
rtentry    136      200    0      165     4     0     4     4     0     8    1
unpcb      144      775    0      758     2     0     2     2     0     8    1
syncache   336       15    0       15     1     0     1     1     0     8    1
tcpqe       32        3    0        3     1     0     1     1     0     8    1
tcpcb      736      483    0      476     4     0     4     4     0     8    3
arp         96       30    0       24     1     0     1     1     0     8    0
ipq         40        2    0        1     1     0     1     1     0     8    0
ipqe        40        3    0        2     1     0     1     1     0     8    0
inpcb      328     1411    0     1398    10     1     9    10     0     8    7
ip6q        72        1    0        0     1     0     1     1     0     8    0
ip6af       40        1    0        0     1     0     1     1     0     8    0
nd6        112       35    0       29     1     0     1     1     0     8    0
pkpcb       40        7    0        7     1     0     1     1     0     8    1
kcovpl      48       15    0        5     1     0     1     1     0     8    0
ppxss      1072      91    0       91     1     0     1     1     0     8    1
pppxif     1384      63    0       63     1     0     1     1     0     8    1
pfstscr     40       26    0       26     1     0     1     1     0     8    1
pfrktable  1344      11    0       10     1     0     1     1     0     8    0
pfstitem    24       49    0       45     1     0     1     1     0     8    0
pfstkey    128      194    0      162     2     0     2     2     0     8    0
pfstate    384      112    0      110     1     0     1     1     0     8    0
pfrule     1360       3    0        3     1     0     1     1     0     8    1
art_heap8  4096       4    0        0     4     0     4     4     0     8    0
art_heap4  256      792    0      642    27    13    14    27     0     8    4
art_table   40      796    0      642     5     0     5     5     0     8    3
art_node    32      199    0      168     1     0     1     1     0     8    0
sysvmsgpl   40       37    0       35     1     0     1     1     0     8    0
semupl     112        8    0        8     1     0     1     1     0     8    1
semapl     112       40    0       17     1     0     1     1     0     8    0
shmpl      112       63    0       13     2     0     2     2     0     8    0
dirhash    1024      19    0        2     3     0     3     3     0     8    0
dino2pl    256     4463    0     2954    95     0    95    95     0     8    0
ffsino     256     4463    0     2954    95     0    95    95     0     8    0
nchpl      144     6775    0     5070    64     0    64    64     0     8    0
rtmask      32       10    0       10     1     0     1     1     0     8    1
vnodes     216     5587    0        0   311     0   311   311     0     8    0
namei      1024   19646    0    19646     2     0     2     2     0     8    2
vcpupl     3904      10    0        0     2     0     2     2     0     8    0
vmpool     808       12    0        2     1     0     1     1     0     8    0
kstatmem   264      126    0      100     3     0     3     3     0     8    1
scsiplug    72       18    0       18     1     0     1     1     0     8    1
scxspl     216    23814    0    23814     9     1     8     9     1     8    8
plimitpl   152      391    0      368     1     0     1     1     0     8    0
sigapl     424     2123    0     2079     8     0     8     8     0     8    2
knotepl    120    60471    0    60424    10     0    10    10     0     8    6
kqueuepl   184      432    0      422     1     0     1     1     0     8    0
pipepl     304      203    0      173     3     0     3     3     0     8    0
fdescpl    448     2090    0     2059     5     0     5     5     0     8    1
filepl     120     9416    0     9155    11     0    11    11     0     8    3
lockfpl    104      526    0      524     1     0     1     1     0     8    0
lockfspl    48      247    0      245     1     0     1     1     0     8    0
sessionpl  144       41    0       33     1     0     1     1     0     8    0
pgrppl      48       81    0       60     1     0     1     1     0     8    0
ucredpl    104     1038    0     1027     1     0     1     1     0     8    0
zombiepl   144     2081    0     2079     1     0     1     1     0     8    0
processpl  1152    2123    0     2079     5     0     5     5     0     8    0
procpl     664     4148    0     4095     7     0     7     7     0     8    1
sosppl     176        6    0        5     1     0     1     1     0     8    0
sockpl     552     2366    0     2333    11     1    10    11     0     8    6
mcl64k     65536    229    0      229     1     0     1     1     0     8    1
mcl16k     16384     71    0       71     1     0     1     1     0     8    1
mcl12k     12288     41    0       41     1     0     1     1     0     8    1
mcl9k      9216       8    0        8     1     0     1     1     0     8    1
mcl8k      8192     113    0      113     1     0     1     1     0     8    1
mcl4k      4096    5307    0     5255    14     0    14    14     0     8    7
mcl2k2     2112      10    0       10     1     0     1     1     0     8    1
mcl2k      2048    2104    0     2102     4     0     4     4     0     8    3
mtagpl      96       35    0       28     1     0     1     1     0     8    0
mbufpl     256    24282    0    24180   126   108    18    76     0     8    8
bufpl      280    35553    0    30634   362    10   352   352     0     8    0
anonpl      24   269902    0   266464    47     0    47    47     0   187   16
amapchunkpl 152   61122    0    60611    36     0    36    36     0   158   15
amappl16   200     4063    0     4028    15     5    10    15     0     8    7
amappl15   192       38    0       38     1     0     1     1     0     8    1
amappl14   184        8    0        8     1     0     1     1     0     8    1
amappl13   176      440    0      439     1     0     1     1     0     8    0
amappl12   168     2502    0     2463     2     0     2     2     0     8    0
amappl11   160        5    0        5     1     0     1     1     0     8    1
amappl10   152       62    0       52     1     0     1     1     0     8    0
amappl9    144      247    0      247     1     0     1     1     0     8    1
amappl8    136       22    0       21     1     0     1     1     0     8    0
amappl7    128       94    0       93     1     0     1     1     0     8    0
amappl6    120      326    0      315     1     0     1     1     0     8    0
amappl5    112      102    0       93     1     0     1     1     0     8    0
amappl4    104      456    0      431     1     0     1     1     0     8    0
amappl3     96    10300    0    10205     3     0     3     3     0     8    0
amappl2     88     2291    0     2220     2     0     2     2     0     8    0
amappl1     80    19265    0    18713    15     0    15    15     0     8    1
amappl      88    15943    0    15768     5     0     5     5     0    92    0
uvmvnodes   80      138    0        0     3     0     3     3     0     8    0
dma16384   16384      1    0        1     1     0     1     1     0     8    1
dma4096    4096       2    0        2     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       23    0       22     1     0     1     1     0     8    0
aobjpl      72       78    0       16     2     0     2     2     0     8    0
uaoeltpl    96    51743   48    48126    89     0    89    89     0     8    0
uaddrrnd    24     2090    0     2059     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2090    0     2059     1     0     1     1     0     8    0
vmmpekpl   168    16812    0    16766     3     0     3     3     0     8    0
vmmpepl    168   137686    0   135828    94     0    94    94     0   357    9
vmsppl     368     2089    0     2059     4     0     4     4     0     8    1
rwobjpl     40    34561    0    33429    13     0    13    13     0     8    0
pdppl      4096    4210    0     4132   116    36    80    82     0     8    2
pvpl        32  1869463    0  1619054  2936   676  2260  2936     0   265  238
pmappl     216     2101    0     2061     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      509    0      157    12     0    12    12     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
uvm_aio_aiodone(fffffd806fbf17c0) at uvm_aio_aiodone+0x223 sys/uvm/uvm_pager.c:718
uvm_aiodone_daemon(ffff80002a777c90) at uvm_aiodone_daemon+0x212 sys/uvm/uvm_pdaemon.c:358
end trace frame: 0x0, count: -2
ddb> machine ddbcpu 1
No such command
ddb> trace
uvm_aio_aiodone(fffffd806fbf17c0) at uvm_aio_aiodone+0x223 sys/uvm/uvm_pager.c:718
uvm_aiodone_daemon(ffff80002a777c90) at uvm_aiodone_daemon+0x212 sys/uvm/uvm_pdaemon.c:358
end trace frame: 0x0, count: -2

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/21 16:07 openbsd bf8f984edd8f 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: uvm_aio_aiodone
2026/01/17 23:31 openbsd f5df22e61f89 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: uvm_aio_aiodone
2026/01/15 19:02 openbsd c600931321c7 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: uvm_aio_aiodone
2026/01/14 05:57 openbsd 3d903ed5427e 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: uvm_aio_aiodone
* Struck through repros no longer work on HEAD.