syzbot
uvm_fault: shm_deallocate_segment
Status:
upstream: reported on 2026/07/17 11:08
Reported-by: syzbot+44f95ce2e1ffc6dbb452@syzkaller.appspotmail.com
First crash: 34d, last: 7d08h
Sample crash report:
uvm_fault(0xfffffc807ef89d78, 0x0, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff811d8aeb cs 8 rflags 10206 cr2 0 cpl 0 rsp ffff8000377a16a0
gsbase 0xffffffff839afff0 kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff811d8aeb
Starting stack trace...
panic(ffffffff834eb27b) at panic+0x1d0 sys/kern/subr_prf.c:229
kerntrap(ffff8000377a15f0) at kerntrap+0x30b
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
shm_deallocate_segment(fffffc805f17de70) at shm_deallocate_segment+0x3b sys/kern/sysv_shm.c:157
sys_shmctl(ffff80003c4574f0,ffff8000377a1890,ffff8000377a17e0) at sys_shmctl+0x3e5 sys/kern/sysv_shm.c:-1
syscall(ffff8000377a1890) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000377a1890) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8a18540ee0, count: 250
End of stack trace.
dump to dev 4,1 not possible
rebooting...
SeaBIOS (version 1.8.2-google)
Total RAM Size = 0x0000000080000000 = 2048 MiB
CPUs found: 2 Max CPUs supported: 2
SeaBIOS (version 1.8.2-google)
Machine UUID f8e08a03-81bc-3227-53c0-939594373760
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f2600: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Sending Seabios boot VM event.
Booting from Hard Disk 0...
>> OpenBSD/amd64 BOOT 3.67
boot> set $lines = 0
set: syntax error
boot> set $maxwidth = 0
set: syntax error
boot> show panic
boot: illegal argument panic
boot> show kasan
boot> trace
boot> show registers
boot> show proc
boot> ps
boot> show all locks
boot> show malloc
boot> show all pools
boot> machine ddbcpu 0
machine: syntax error
boot> trace
boot> machine ddbcpu 1
machine: syntax error
boot> trace
* Struck through repros no longer work on HEAD.