syzbot


pool: free list modified: mbufpl (5)

Status: upstream: reported on 2025/11/29 02:55
Reported-by: syzbot+202933e4acc099883900@syzkaller.appspotmail.com
First crash: 2d10h, last: 2d10h
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: mbufpl (3) -1 1 772d 772d 0/3 auto-obsoleted due to no activity on 2024/01/18 14:10
openbsd pool: free list modified: mbufpl (4) -1 1 577d 577d 0/3 auto-obsoleted due to no activity on 2024/07/31 23:52
openbsd pool: free list modified: mbufpl -1 syz 13 2540d 2554d 3/3 fixed on 2019/01/06 10:35
openbsd pool: free list modified: mbufpl (2) -1 syz 1781 1944d 2273d 0/3 closed as dup on 2020/05/08 06:40

Sample crash report:
panic: pool_p_free: mbufpl free list modified: page 0xfffffd80680c5000; item addr 0xfffffd80680c5e00; offset 0x0=0x0
Starting stack trace...
panic(ffffffff8334d627) at panic+0x1ba sys/kern/subr_prf.c:229
pool_p_free(ffffffff8398f440,fffffd80695bab08) at pool_p_free+0x28c sys/kern/subr_pool.c:1005
pool_reclaim(ffffffff8398f440) at pool_reclaim+0x2c2 sys/kern/subr_pool.c:1152
pool_reclaim_all() at pool_reclaim_all+0x48 sys/kern/subr_pool.c:-1
kern_sysctl(ffff80002a8a8fb4,1,0,ffff80002a8a8fe8,200000001440,4,5635bc0e9d51e5b0) at kern_sysctl+0x1094 sys/kern/kern_sysctl.c:686
sys_sysctl(ffff800031cfda10,ffff80002a8a9110,ffff80002a8a9060) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a8a9110) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8a9110) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xcebc3c6fce0, count: 249
End of stack trace.

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/29 02:54 openbsd f9d861d10df2 01c07bfe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: mbufpl
* Struck through repros no longer work on HEAD.