syzbot
uvm_fault: pfi_kif_update (2)
Status:
upstream: reported on 2026/10/07 01:24
Reported-by: syzbot+4dfe29fc2f86bfd21496@syzkaller.appspotmail.com
First crash: 3d03h, last: 3d03h
Sample crash report:
uvm_fault(0xfffffb806fcb2738, 0xf0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at pfi_kif_update+0x39: movq 0xf0(%r14),%r15
TID PID UID PRFLAGS PFLAGS CPU COMMAND
pfi_kif_update(0) at pfi_kif_update+0x39 sys/net/pf_if.c:522
pfi_kif_update(ffff80000160d800) at pfi_kif_update+0x15c sys/net/pf_if.c:-1
pfi_kifaddr_update(ffff80000160d800) at pfi_kifaddr_update+0xe1 sys/net/pf_if.c:714
if_hooks_run(ffff8000015c6880) at if_hooks_run+0xeb sys/net/if.c:-1
in_ifdetach(ffff8000015c6800) at in_ifdetach+0x8f sys/netinet/in.c:-1
if_detach(ffff8000015c6800) at if_detach+0x322 sys/net/if.c:1311
tun_clone_destroy(ffff8000015c6800) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80002a7d5420) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d01,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a7d54e0) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffb807bb23610,7,fffffb8007ffd750,ffff80002a7a0d10) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffffb80765fd8e8,ffff80002a7a0d10) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffb80765fd8e8,ffff80002a7a0d10) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffffb80765fd8e8,ffff80002a7a0d10) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffb80765fd8e8,ffff80002a7a0d10) at closef+0x190 sys/kern/kern_descrip.c:1265
end trace frame: 0xffff80002a7d56c0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffb806fcb2738, 0xf0, 0, 1) -> e
ddb> show kasan
No such command
ddb>
* Struck through repros no longer work on HEAD.