syzbot
protection_fault: mtx_enter (5)
Status:
upstream: reported on 2026/10/26 06:24
Reported-by: syzbot+4c48e4aee170ff3ebd3f@syzkaller.appspotmail.com
First crash: 22h19m, last: 19h53m
Sample crash report:
kernel: protection fault trap, code=0
Stopped at mtx_enter+0x6e: movq 0(%r14),%r15
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> show kasan
No such command
ddb> trace
mtx_enter(dead4110dead41f0) at mtx_enter+0x6e sys/kern/kern_lock.c:550
prsignal(dead4110dead4110,14) at prsignal+0x36 sys/kern/kern_sig.c:905
reaper(ffff80002a6dc7c8) at reaper+0x2ec sys/kern/kern_exit.c:518
end trace frame: 0x0, count: -3
ddb> show registers
rdi 0
rsi 0
rbp 0xffff80002a7132f0
rbx 0xffffffff839a2000 __sancov_gen_cov_switch_values.29+0x10
rdx 0
rcx 0xffffffff838f0ff0 cpu_info_full_primary+0x1ff0
rax 0xffff80002a6dc700
r8 0x7f7fffffc000
r9 0
r10 0x3e41619724a62cdb
r11 0xaddfc449123919a
r12 0xdead4110dead4110
r13 0x40000 acpi_pdirpa+0x2be71
r14 0xdead4110dead41f0
r15 0
rip 0xffffffff82d792ce mtx_enter+0x6e
cs 0x8
rflags 0x10297 __ALIGN_SIZE+0xf297
rsp 0xffff80002a7132c0
ss 0x10
mtx_enter+0x6e: movq 0(%r14),%r15
ddb> show proc
PROC (reaper) tid=217700 pid=45029 tcnt=1 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
runpri=32, usrpri=50, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a6dc530,0xffff80002a6dd238
process=0xffff800045ffdfb8 user=0xffff80002a70e000, vmspace=0xffffffff83a175a8
estcpu=0, cpticks=6, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
2092 135119 0 0 3 0x14000 0x280 nfsidl nfsio
44013 436301 53232 0 3 0x2 0 clonelk ifconfig
53232 65712 10700 0 3 0x100002 0x88 sigsusp sh
9631 492626 44737 0 2 0 0 syz-executor
9631 208820 44737 0 3 0 0x4000080 fsleep syz-executor
9631 274240 44737 0 2 0 0x4000000 syz-executor
10700 138518 12783 0 3 0x2 0x80 wait syz-executor
20882 102039 0 0 3 0x14000 0x200 acct acct
67189 18081 12783 0 3 0x2 0x80 piperd syz-executor
44737 63460 12783 0 3 0x2 0x80 nanoslp syz-executor
12783 375251 43594 0 3 0x2 0x80 nanoslp syz-executor
43594 154469 44861 0 3 0x100002 0x88 sigsusp ksh
44861 262986 56179 0 3 0x10 0x88 kqread sshd-session
56179 258410 13202 0 3 0x12 0x80 kqread sshd-session
82336 403473 1 0 3 0x100003 0x80 ttyin getty
13202 84001 1 0 3 0 0x88 kqread sshd
3018 505806 92273 73 3 0x1100010 0x80 kqread syslogd
92273 27989 1 0 3 0x100002 0x80 sbwait syslogd-parent
71099 127540 1 0 3 0x100000 0x80 kqread resolvd
33996 116962 99426 77 3 0x100012 0x80 kqread dhcpleased
75609 187121 99426 77 3 0x100012 0x80 kqread dhcpleased
99426 144256 1 0 3 0 0x80 kqread dhcpleased
99906 192101 0 0 3 0x14000 0x200 bored smr
86870 43199 0 0 2 0x14000 0x200 zerothread
70229 315931 0 0 3 0x14000 0x200 aiodoned aiodoned
42779 266535 0 0 3 0x14000 0x200 syncer update
71656 459591 0 0 3 0x14000 0x200 cleaner cleaner
*45029 217700 0 0 7 0x14000 0x200 reaper
14543 213068 0 0 3 0x14000 0x200 pgdaemon pagedaemon
34250 455869 0 0 3 0x14000 0x200 bored viomb
24789 416074 0 0 3 0x14000 0x40000200 acpi0 acpi0
80273 366191 0 0 3 0x14000 0x200 bored softnet0
76705 29540 0 0 3 0x14000 0x200 smrbar systqmp
50894 429415 0 0 3 0x14000 0x200 bored systq
1852 291504 0 0 3 0x14000 0x40000200 tmoslp softclock
88083 340672 0 0 3 0x14000 0x40000200 idle0
1 104591 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11026 12095K 12182K 166960K 12480 0
pcb 17 12K 12K 166960K 48 0
rtable 169 6K 8K 166960K 2300 0
pf 22 11K 19K 166960K 198 0
ifaddr 26 5K 7K 166960K 302 0
ifgroup 34 1K 2K 166960K 302 0
sysctl 1 1K 9K 166960K 5 0
counters 29 17K 17K 166960K 96 0
ioctlops 0 0K 4K 166960K 379 0
iov 0 0K 12K 166960K 7 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1360 86K 86K 166960K 2296 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 3 0
VM map 2 1K 1K 166960K 2 0
sem 13 0K 1K 166960K 16 0
dirhash 15 2K 2K 166960K 30 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 11 37K 93K 166960K 1292 0
sigio 0 0K 0K 166960K 5 0
proc 67 67K 92K 166960K 2293 0
subproc 54 3K 4K 166960K 648 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 14 0
in_multi 55 3K 6K 166960K 795 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 31 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 91 413K 413K 166960K 91 0
exec 0 0K 1K 166960K 1208 0
fusefs mount 1 32K 32K 166960K 1 0
pfkey data 0 0K 0K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 156 125K 160K 166960K 10045 0
UVM aobj 5 2K 2K 166960K 6 0
pinsyscall 32 64K 95K 166960K 4038 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 9 0
NDP 11 0K 2K 166960K 216 0
temp 27 9113K 9178K 166960K 25297 0
kqueue 15 22K 28K 166960K 57 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 173 0 170 1 0 1 1 0 8 0
rtentry 136 807 0 740 4 0 4 4 0 8 0
unpcb 144 175 0 160 4 0 4 4 0 8 3
syncache 336 4 0 4 1 1 0 1 0 8 0
tcpcb 736 52 0 48 1 0 1 1 0 8 0
arp 96 144 0 134 1 0 1 1 0 8 0
inpcb 328 417 0 409 3 1 2 2 0 8 1
nd6 112 214 0 202 1 0 1 1 0 8 0
pkpcb 40 1 0 1 1 0 1 1 0 8 1
kcovpl 48 72 0 66 1 0 1 1 0 8 0
pfanchor 1288 4 0 0 1 0 1 1 0 8 0
pfrule 1360 1 0 1 1 0 1 1 0 8 1
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 3249 0 2921 32 2 30 30 0 8 3
art_table 40 3250 0 2921 5 0 5 5 0 8 0
art_node 32 806 0 735 1 0 1 1 0 8 0
semupl 112 4 0 4 2 1 1 1 0 8 1
semapl 72 12 0 1 1 0 1 1 0 8 0
shmpl 120 3 0 1 1 0 1 1 0 8 0
dirhash 1024 29 0 10 3 0 3 3 0 8 0
dino2pl 256 2141 0 513 102 0 102 102 0 8 0
ffsino 256 2141 0 513 102 0 102 102 0 8 0
nchpl 144 2517 0 560 73 0 73 73 0 8 0
vnodes 216 3075 0 0 171 0 171 171 0 8 0
namei 1024 16023 0 16023 4 2 2 2 0 8 2
kstatmem 264 149 0 134 2 0 2 2 0 8 0
scsiplug 72 2 0 2 1 0 1 1 0 8 1
scxspl 216 9999 0 9999 13 5 8 8 1 8 8
plimitpl 152 126 0 111 1 0 1 1 0 8 0
sigapl 424 1456 0 1417 7 1 6 6 0 8 0
knotepl 120 7859 0 7811 10 7 3 10 0 8 1
kqueuepl 184 75 0 64 1 0 1 1 0 8 0
pipepl 304 321 0 294 3 0 3 3 0 8 0
fdescpl 448 1441 0 1418 5 1 4 5 0 8 0
filepl 120 4689 0 4514 9 0 9 9 0 8 1
lockfpl 104 101 0 99 1 0 1 1 0 8 0
lockfspl 48 48 0 46 1 0 1 1 0 8 0
sessionpl 144 97 0 89 1 0 1 1 0 8 0
pgrppl 48 169 0 154 1 0 1 1 0 8 0
ucredpl 104 480 0 469 1 0 1 1 0 8 0
zombiepl 144 1666 0 1662 2 1 1 1 0 8 0
processpl 1160 1456 0 1417 4 0 4 4 0 8 0
procpl 664 1950 0 1909 7 1 6 6 0 8 1
sockpl 552 773 0 747 8 0 8 8 0 8 6
mcl64k 65536 17 0 17 2 1 1 1 0 8 1
mcl16k 16384 6 0 6 1 0 1 1 0 8 1
mcl12k 12288 6 0 6 1 0 1 1 0 8 1
mcl9k128 9344 4 0 4 1 0 1 1 0 8 1
mcl8k 8192 22 0 22 2 1 1 1 0 8 1
mcl4k 4096 2828 0 2775 13 5 8 13 0 8 0
mcl2k 2048 1379 0 1379 6 3 3 3 0 8 3
mextrefs 64 305 0 305 2 1 1 1 0 8 1
mtagpl 96 4 0 4 1 1 0 1 0 8 0
mbufpl 256 11188 0 11093 16 2 14 15 0 8 3
bufpl 272 3620 0 89 236 0 236 236 0 8 0
anonpl 24 177414 0 174805 35 8 27 30 0 187 4
amapchunkpl 152 28660 0 28390 33 2 31 31 0 158 14
amappl16 200 2267 0 2255 9 3 6 6 0 8 4
amappl15 192 18 0 17 1 0 1 1 0 8 0
amappl14 184 1169 0 1167 1 0 1 1 0 8 0
amappl13 176 239 0 229 1 0 1 1 0 8 0
amappl12 168 1926 0 1905 2 0 2 2 0 8 0
amappl11 160 8 0 8 1 1 0 1 0 8 0
amappl10 152 58 0 50 1 0 1 1 0 8 0
amappl9 144 356 0 356 1 1 0 1 0 8 0
amappl8 136 346 0 344 1 0 1 1 0 8 0
amappl7 128 262 0 252 1 0 1 1 0 8 0
amappl6 120 495 0 493 1 0 1 1 0 8 0
amappl5 112 382 0 375 1 0 1 1 0 8 0
amappl4 104 448 0 435 1 0 1 1 0 8 0
amappl3 96 5707 0 5636 5 1 4 4 0 8 0
amappl2 88 698 0 648 2 0 2 2 0 8 0
amappl1 80 18944 0 18424 13 0 13 13 0 8 1
amappl 88 8276 0 8179 4 0 4 4 0 92 0
uvmvnodes 80 113 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 5 0 1 1 0 1 1 0 8 0
uaddrrnd 24 1441 0 1418 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 1441 0 1418 1 0 1 1 0 8 0
vmmpekpl 168 12351 0 12308 3 0 3 3 0 8 0
vmmpepl 168 100977 0 99593 89 7 82 82 0 357 9
vmsppl 368 1440 0 1418 5 1 4 4 0 8 1
rwobjpl 40 30494 0 29640 13 1 12 12 0 8 2
pdppl 4096 2888 0 2836 172 106 66 80 0 8 14
pvpl 32 525447 0 518356 92 8 84 88 0 265 10
pmappl 216 1440 0 1418 3 0 3 3 0 8 1
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 708 0 127 17 0 17 17 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
mtx_enter(dead4110dead41f0) at mtx_enter+0x6e sys/kern/kern_lock.c:550
prsignal(dead4110dead4110,14) at prsignal+0x36 sys/kern/kern_sig.c:905
reaper(ffff80002a6dc7c8) at reaper+0x2ec sys/kern/kern_exit.c:518
end trace frame: 0x0, count: -3
ddb> machine ddbcpu 1
No such command
ddb> trace
mtx_enter(dead4110dead41f0) at mtx_enter+0x6e sys/kern/kern_lock.c:550
prsignal(dead4110dead4110,14) at prsignal+0x36 sys/kern/kern_sig.c:905
reaper(ffff80002a6dc7c8) at reaper+0x2ec sys/kern/kern_exit.c:518
end trace frame: 0x0, count: -3
Struck through repros no longer work on HEAD.