uvm_fault: rtable_walk

Status: upstream: reported on 2026/09/17 03:44
Reported-by: syzbot+44791316f48e5b03346c@syzkaller.appspotmail.com
First crash: 3d10h, last: 3d10h

Sample crash report:
uvm_fault(0xffffffff83a9dc38, 0x4000009, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      rtable_walk+0xd3:       movq    0(%rax,%rcx,8),%r15
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*439141  94494      0     0x14000      0x200    0  softnet0
rtable_walk(0,2,ffff80002a70bc50,ffffffff8321bad0,ffff8000015e4800) at rtable_walk+0xd3 rtable_get sys/net/rtable.c:260 [inline]
rtable_walk(0,2,ffff80002a70bc50,ffffffff8321bad0,ffff8000015e4800) at rtable_walk+0xd3 sys/net/rtable.c:734
rt_if_track(ffff8000015e4800) at rt_if_track+0x12b sys/net/route.c:1898
if_linkstate_task(19) at if_linkstate_task+0x209 if_linkstate sys/net/if.c:1892 [inline]
if_linkstate_task(19) at if_linkstate_task+0x209 sys/net/if.c:1875
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: 11
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83a9dc38, 0x4000009, 0, 1) -> e
ddb> show kasan
No such command
ddb> trace
rtable_walk(0,2,ffff80002a70bc50,ffffffff8321bad0,ffff8000015e4800) at rtable_walk+0xd3 rtable_get sys/net/rtable.c:260 [inline]
rtable_walk(0,2,ffff80002a70bc50,ffffffff8321bad0,ffff8000015e4800) at rtable_walk+0xd3 sys/net/rtable.c:734
rt_if_track(ffff8000015e4800) at rt_if_track+0x12b sys/net/route.c:1898
if_linkstate_task(19) at if_linkstate_task+0x209 if_linkstate sys/net/if.c:1892 [inline]
if_linkstate_task(19) at if_linkstate_task+0x209 sys/net/if.c:1875
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -4
ddb> show registers
rdi                              0x6
rsi                                0
rbp               0xffff80002a70bc30
rbx                                0
rdx               0xffff8000017972c0
rcx                                0
rax                        0x4000009    __kernel_phys_end+0x400009
r8                0xffff8000015e4800
r9                                 0
r10               0x3e529839b5aab4e0
r11               0xef88c9f1899c01cc
r12               0xffff80002a70bc50
r13               0xffffffff8321bad0    rt_if_linkstate_change
r14                              0x6
r15               0xffff800000c55670
rip               0xffffffff829c81e3    rtable_walk+0xd3
cs                               0x8
rflags                       0x10206    __ALIGN_SIZE+0xf206
rsp               0xffff80002a70bba0
ss                              0x10
rtable_walk+0xd3:       movq    0(%rax,%rcx,8),%r15
ddb> show proc
PROC (softnet0) tid=439141 pid=94494 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=32, usrpri=51, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a6ec530,0xffff80002a6eca70
    process=0xffff800045ffc900 user=0xffff80002a706000, vmspace=0xffffffff83a9dc38
    estcpu=1, cpticks=4, pctcpu=0.1, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 36951  377903  34533     0  2    0x100002          0           sh
 73192   94940  36068     0  2           0          0           syz-executor
 73192  110389  36068     0  2           0  0x4000000           syz-executor
 73192  444598  36068     0  3           0  0x4000080 fsleep    syz-executor
 66967  408760  76126     0  2           0          0           syz-executor
 66967   15844  76126     0  3           0  0x4000080 fsleep    syz-executor
 76177  490155  80495    -1  2        0x10          0           syz-executor
 76177   24552  80495    -1  3        0x10  0x4000080 nanoslp   syz-executor
 76177  101880  80495    -1  3        0x10  0x4000080 fsleep    syz-executor
 96281  190264  81904     0  2           0          0           syz-executor
 96281  379981  81904     0  2           0  0x4000000           syz-executor
 60745  151752  40454     0  2           0          0           syz-executor
 60745  253908  40454     0  3           0  0x4000080 fsleep    syz-executor
 60745  406917  40454     0  3           0  0x4000080 fsleep    syz-executor
 80495  167365  39864     0  2         0x2      0xc80           syz-executor
 34533  229953  39864     0  3         0x2       0x80 wait      syz-executor
 17453  490093  39864     0  2         0x2          0           syz-executor
 76126  474938  39864     0  2         0x2      0xc80           syz-executor
 40454  372738  39864     0  2         0x2      0xc80           syz-executor
 17472  196315  39864     0  2         0x2          0           syz-executor
 36068  382135  39864     0  3         0x2       0x80 nanoslp   syz-executor
 81904   95660  39864     0  2         0x2      0xc80           syz-executor
 39864  455949  37301     0  3         0x2       0x80 kqread    syz-executor
 37301   83568  95822     0  3    0x100002       0x88 sigsusp   ksh
 95822  216004  83049     0  3        0x10       0x88 kqread    sshd-session
 83049  181099  40416     0  3        0x12       0x80 kqread    sshd-session
 40416  115466      1     0  3           0       0x88 kqread    sshd
 20635  115754   8164    73  3   0x1100010       0x80 kqread    syslogd
  8164  504060      1     0  3    0x100002       0x80 sbwait    syslogd
  5329  478460      1     0  3    0x100000       0x80 kqread    resolvd
 68519  470603  34408    77  2    0x100012       0x80           dhcpleased
  1347   13601  34408    77  3    0x100012       0x80 kqread    dhcpleased
 34408  416727      1     0  3           0       0x80 kqread    dhcpleased
 50156  247898      0     0  3     0x14000      0x200 bored     smr
 56809   50679      0     0  2     0x14000      0x200           zerothread
 49391  271426      0     0  3     0x14000      0x200 aiodoned  aiodoned
 34734  223857      0     0  3     0x14000      0x200 syncer    update
 75747   98977      0     0  3     0x14000      0x200 cleaner   cleaner
 98694  114343      0     0  3     0x14000      0x200 reaper    reaper
 16753  502970      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 72327  443141      0     0  3     0x14000      0x200 bored     viomb
 14761  355510      0     0  3     0x14000 0x40000200 acpi0     acpi0
*94494  439141      0     0  7     0x14000      0x200           softnet0
 99444  501459      0     0  3     0x14000      0x200 bored     systqmp
 33157   65684      0     0  3     0x14000      0x200 bored     systq
 58861   94634      0     0  3     0x14000 0x40000200 tmoslp    softclock
 24387  513992      0     0  3     0x14000 0x40000200           idle0
     1  419411      0     0  3         0x2          0 biowait   init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11058  12107K   13240K 166960K     12683        0
            pcb    17     12K      12K 166960K        47        0
         rtable   212      6K      10K 166960K       775        0
             pf    31     13K     652K 166960K        80        0
         ifaddr    37      6K       7K 166960K        98        0
        ifgroup    50      2K       2K 166960K       109        0
         sysctl     2      1K       9K 166960K         6        0
       counters    33     17K      17K 166960K        47        0
       ioctlops     0      0K       4K 166960K       149        0
            iov     0      0K      16K 166960K        70        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1359     86K      86K 166960K      1716        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         3        0
         VM map     2      1K       1K 166960K         2        0
            sem    14      0K       1K 166960K        15        0
        dirhash    12      2K       2K 166960K        15        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    16     57K      93K 166960K       514        0
          sigio     0      0K       0K 166960K         1        0
           proc    51     50K     116K 166960K       868        0
        subproc    72      4K       4K 166960K       198        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       150        0
       in_multi    78      5K       6K 166960K       239        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         8        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   223    996K     996K 166960K       223        0
           exec     0      0K       1K 166960K       555        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   204    147K     167K 166960K      5690        0
       UVM aobj    12      2K       2K 166960K        14        0
     pinsyscall    35     70K      94K 166960K      1959        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         2        0
            NDP    15      0K       1K 166960K        65        0
           temp    39   9107K    9170K 166960K      5800        0
         kqueue    13     20K      29K 166960K        76        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      102    0       99     1     0     1     1     0     8    0
rtentry    136      254    0      160     4     0     4     4     0     8    0
unpcb      144      192    0      177     3     2     1     3     0     8    0
syncache   336        7    0        7     2     1     1     1     0     8    1
tcpcb      736       86    0       82     4     3     1     4     0     8    0
arp         96       44    0       28     1     0     1     1     0     8    0
ipq         40        1    0        0     1     0     1     1     0     8    0
ipqe        40        2    0        1     1     0     1     1     0     8    0
inpcb      328      274    0      266     4     2     2     4     0     8    1
nd6        112       65    0       46     1     0     1     1     0     8    0
kcovpl      48       22    0       14     1     0     1     1     0     8    0
pfrktable  1344       7    0        7     1     1     0     1     0     8    0
pfanchor   1288       2    0        2     1     1     0     1     0     8    0
pfstitem    24        1    0        0     1     0     1     1     0     8    0
pfstkey    128        1    0        0     1     0     1     1     0     8    0
pfstate    384        1    0        0     1     0     1     1     0     8    0
pfrule     1360       9    0        9     2     1     1     1     0     8    1
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256     1019    0      646    32     1    31    32     0     8    7
art_table   40     1021    0      646     6     0     6     6     0     8    0
art_node    32      254    0      168     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        1     1     0     1     1     0     8    0
semapl      72       12    0        0     1     0     1     1     0     8    0
shmpl      120       11    0        2     1     0     1     1     0     8    0
dirhash    1024      19    0        2     3     0     3     3     0     8    0
dino2pl    256     1926    0      436    94     0    94    94     0     8    0
ffsino     256     1926    0      436    94     0    94    94     0     8    0
nchpl      144     2383    0      626    66     0    66    66     0     8    0
vnodes     216     2298    0        0   128     0   128   128     0     8    0
namei      1024   10339    0    10338     4     3     1     3     0     8    0
pfiaddrpl  120        2    0        2     1     1     0     1     0     8    0
kstatmem   264       51    0       28     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     1     0     1     0     8    0
scxspl     216    10691    0    10690    10     2     8     8     1     8    7
plimitpl   152      137    0      121     1     0     1     1     0     8    0
sigapl     424      784    0      744     7     1     6     6     0     8    0
knotepl    120     9104    0     9057    18     8    10    10     0     8    8
kqueuepl   184       88    0       79     1     0     1     1     0     8    0
pipepl     304      183    0      156     3     0     3     3     0     8    0
fdescpl    448      771    0      744     5     1     4     5     0     8    0
filepl     120     3570    0     3362    11     2     9    10     0     8    2
lockfpl    104       83    0       79     1     0     1     1     0     8    0
lockfspl    48       38    0       34     1     0     1     1     0     8    0
sessionpl  144       44    0       37     1     0     1     1     0     8    0
pgrppl      48       68    0       53     1     0     1     1     0     8    0
ucredpl    104      412    0      400     1     0     1     1     0     8    0
zombiepl   144      744    0      744     1     0     1     1     0     8    1
processpl  1152     784    0      744     4     0     4     4     0     8    0
procpl     664     1106    0     1058     7     2     5     6     0     8    0
sockpl     552      639    0      613     7     4     3     7     0     8    1
mcl64k     65536      6    0        6     2     1     1     1     0     8    1
mcl16k     16384      1    0        1     1     0     1     1     0     8    1
mcl8k      8192       8    0        8     1     1     0     1     0     8    0
mcl4k      4096    2752    0     2699    16     7     9    15     0     8    0
mcl2k      2048     508    0      506     5     4     1     4     0     8    0
mextrefs    64      162    0      160     2     1     1     1     0     8    0
mtagpl      96        4    0        4     1     1     0     1     0     8    0
mbufpl     256     7304    0     7168    17     5    12    17     0     8    0
bufpl      272     3913    0      102   255     0   255   255     0     8    0
anonpl      24   107409    0   104474    42    12    30    42     0   187    3
amapchunkpl 152   16090    0    15665    27     3    24    24     0   158    7
amappl16   200     1491    0     1474    14    11     3    14     0     8    0
amappl15   192       54    0       54     1     1     0     1     0     8    0
amappl14   184      570    0      567     1     0     1     1     0     8    0
amappl13   176      140    0      131     1     0     1     1     0     8    0
amappl12   168     1086    0     1060     2     0     2     2     0     8    0
amappl11   160       54    0       53     1     0     1     1     0     8    0
amappl10   152       60    0       50     1     0     1     1     0     8    0
amappl9    144      276    0      276     1     1     0     1     0     8    0
amappl8    136      151    0      150     1     0     1     1     0     8    0
amappl7    128      165    0      154     1     0     1     1     0     8    0
amappl6    120      279    0      277     1     0     1     1     0     8    0
amappl5    112       90    0       83     1     0     1     1     0     8    0
amappl4    104      295    0      280     1     0     1     1     0     8    0
amappl3     96     2984    0     2901     3     0     3     3     0     8    0
amappl2     88      837    0      770     2     0     2     2     0     8    0
amappl1     80    12512    0    11996    13     1    12    13     0     8    0
amappl      88     4758    0     4613     5     1     4     5     0    92    0
uvmvnodes   80       99    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma2048    2048       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       13    0        2     1     0     1     1     0     8    0
uaddrrnd    24      771    0      744     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      771    0      744     1     0     1     1     0     8    0
vmmpekpl   168     7875    0     7836     2     0     2     2     0     8    0
vmmpepl    168    57488    0    55867    87     7    80    87     0   357    1
vmsppl     368      770    0      744     4     1     3     4     0     8    0
rwobjpl     40    18565    0    17666    12     0    12    12     0     8    1
pdppl      4096    1548    0     1488   124    54    70    80     0     8   10
pvpl        32   315981    0   306999   100    10    90   100     0   265    7
pmappl     216      770    0      744     3     1     2     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      671    0       86    17     0    17    17     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
rtable_walk(0,2,ffff80002a70bc50,ffffffff8321bad0,ffff8000015e4800) at rtable_walk+0xd3 rtable_get sys/net/rtable.c:260 [inline]
rtable_walk(0,2,ffff80002a70bc50,ffffffff8321bad0,ffff8000015e4800) at rtable_walk+0xd3 sys/net/rtable.c:734
rt_if_track(ffff8000015e4800) at rt_if_track+0x12b sys/net/route.c:1898
if_linkstate_task(19) at if_linkstate_task+0x209 if_linkstate sys/net/if.c:1892 [inline]
if_linkstate_task(19) at if_linkstate_task+0x209 sys/net/if.c:1875
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -4
ddb> machine ddbcpu 1
No such command
ddb> trace
rtable_walk(0,2,ffff80002a70bc50,ffffffff8321bad0,ffff8000015e4800) at rtable_walk+0xd3 rtable_get sys/net/rtable.c:260 [inline]
rtable_walk(0,2,ffff80002a70bc50,ffffffff8321bad0,ffff8000015e4800) at rtable_walk+0xd3 sys/net/rtable.c:734
rt_if_track(ffff8000015e4800) at rt_if_track+0x12b sys/net/route.c:1898
if_linkstate_task(19) at if_linkstate_task+0x209 if_linkstate sys/net/if.c:1892 [inline]
if_linkstate_task(19) at if_linkstate_task+0x209 sys/net/if.c:1875
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -4

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/17 03:44 openbsd 9fbe383afb1a 95928915 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: rtable_walk
* Struck through repros no longer work on HEAD.