uvm_fault: pfi_kif_update (2)

Status: upstream: reported on 2026/10/07 01:24
Reported-by: syzbot+4dfe29fc2f86bfd21496@syzkaller.appspotmail.com
First crash: 3d03h, last: 3d03h
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: pfi_kif_update -1 6 2536d 2663d 0/4 auto-closed as invalid on 2020/01/28 17:38

Sample crash report:
uvm_fault(0xfffffb806fcb2738, 0xf0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      pfi_kif_update+0x39:    movq    0xf0(%r14),%r15
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
pfi_kif_update(0) at pfi_kif_update+0x39 sys/net/pf_if.c:522
pfi_kif_update(ffff80000160d800) at pfi_kif_update+0x15c sys/net/pf_if.c:-1
pfi_kifaddr_update(ffff80000160d800) at pfi_kifaddr_update+0xe1 sys/net/pf_if.c:714
if_hooks_run(ffff8000015c6880) at if_hooks_run+0xeb sys/net/if.c:-1
in_ifdetach(ffff8000015c6800) at in_ifdetach+0x8f sys/netinet/in.c:-1
if_detach(ffff8000015c6800) at if_detach+0x322 sys/net/if.c:1311
tun_clone_destroy(ffff8000015c6800) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80002a7d5420) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d01,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a7d54e0) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffb807bb23610,7,fffffb8007ffd750,ffff80002a7a0d10) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffffb80765fd8e8,ffff80002a7a0d10) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffb80765fd8e8,ffff80002a7a0d10) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffffb80765fd8e8,ffff80002a7a0d10) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffb80765fd8e8,ffff80002a7a0d10) at closef+0x190 sys/kern/kern_descrip.c:1265
end trace frame: 0xffff80002a7d56c0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffb806fcb2738, 0xf0, 0, 1) -> e
ddb> show kasan
No such command
ddb> 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/07 01:23 openbsd 10794ab7cbfe f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: pfi_kif_update
* Struck through repros no longer work on HEAD.