uvm_fault: shm_deallocate_segment

Status: upstream: reported on 2026/07/17 11:08
Reported-by: syzbot+44f95ce2e1ffc6dbb452@syzkaller.appspotmail.com
First crash: 34d, last: 7d08h

Sample crash report:
uvm_fault(0xfffffc807ef89d78, 0x0, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff811d8aeb cs 8 rflags 10206 cr2 0 cpl 0 rsp ffff8000377a16a0
gsbase 0xffffffff839afff0  kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff811d8aeb
Starting stack trace...
panic(ffffffff834eb27b) at panic+0x1d0 sys/kern/subr_prf.c:229
kerntrap(ffff8000377a15f0) at kerntrap+0x30b
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
shm_deallocate_segment(fffffc805f17de70) at shm_deallocate_segment+0x3b sys/kern/sysv_shm.c:157
sys_shmctl(ffff80003c4574f0,ffff8000377a1890,ffff8000377a17e0) at sys_shmctl+0x3e5 sys/kern/sysv_shm.c:-1
syscall(ffff8000377a1890) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000377a1890) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8a18540ee0, count: 250
End of stack trace.

dump to dev 4,1 not possible
rebooting...
SeaBIOS (version 1.8.2-google)
Total RAM Size = 0x0000000080000000 = 2048 MiB
CPUs found: 2     Max CPUs supported: 2
SeaBIOS (version 1.8.2-google)
Machine UUID f8e08a03-81bc-3227-53c0-939594373760
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f2600: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Sending Seabios boot VM event.
Booting from Hard Disk 0...
>> OpenBSD/amd64 BOOT 3.67
boot> set $lines = 0
set: syntax error
boot> set $maxwidth = 0
set: syntax error
boot> show panic
boot: illegal argument panic
boot> show kasan
boot> trace
boot> show registers
boot> show proc
boot> ps
boot> show all locks
boot> show malloc
boot> show all pools
boot> machine ddbcpu 0
machine: syntax error
boot> trace
boot> machine ddbcpu 1
machine: syntax error
boot> trace

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/13 10:35 openbsd b8ee6bbd8ccb 4d118901 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: shm_deallocate_segment
2026/08/05 03:31 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: shm_deallocate_segment
2026/07/22 04:22 openbsd e524649e2c66 b561ce9c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: shm_deallocate_segment
2026/07/18 05:40 openbsd 97f4e10dc0be 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: shm_deallocate_segment
2026/07/17 11:08 openbsd 94b919120046 7f27c57a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: shm_deallocate_segment
* Struck through repros no longer work on HEAD.