syzbot
uvm_fault: rtable_exists
Status:
upstream: reported on 2026/07/19 17:32
Reported-by: syzbot+4884480f6658a84b2428@syzkaller.appspotmail.com
First crash: 8d12h, last: 3d05h
Sample crash report:
uvm_fault(0xfffff70079d46b88, 0x6a63f826, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at rtable_exists+0x11d: cmpq $0,0(%rax,%rcx,8)
TID PID UID PRFLAGS PFLAGS CPU COMMAND
rtable_exists(0) at rtable_exists+0x11d sys/net/rtable.c:278
rtrequest_delete(ffff80002a867388,4,ffff80000160a800,ffff80002a867438,0) at rtrequest_delete+0xea sys/net/route.c:902
rt_ifa_del(ffff800001615c00,800100,ffff800001615c68,0) at rt_ifa_del+0x3a1 sys/net/route.c:1342
in_purgeaddr(ffff800001615c00) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff800001615c00) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff800001615c00) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff80000160a800) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff80000160a800) at if_detach+0x322 sys/net/if.c:1311
tun_clone_destroy(ffff80000160a800) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80002a867670) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a867730) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff70079ae72b0,7,fffff70007ffd7b8,ffff80002a7362a0) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff7007efbbc40,ffff80002a7362a0) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff7007efbbc40,ffff80002a7362a0) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff7007efbbc40,ffff80002a7362a0) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff7007efbbc40,ffff80002a7362a0) at closef+0x190 sys/kern/kern_descrip.c:1265
end trace frame: 0xffff80002a867910, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb>
* Struck through repros no longer work on HEAD.