syzbot


uvm_fault: pmap_page_remove (7)

Status: upstream: reported on 2025/11/11 16:24
Reported-by: syzbot+4f31ad0ccb0a35f3f07a@syzkaller.appspotmail.com
First crash: 161d, last: 28d
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: pmap_page_remove (4) -1 1 1462d 1462d 0/3 auto-closed as invalid on 2022/07/20 03:20
openbsd uvm_fault: pmap_page_remove (5) -1 16 554d 864d 0/3 auto-obsoleted due to no activity on 2025/01/12 21:41
openbsd uvm_fault: pmap_page_remove -1 7 2405d 2662d 0/3 auto-closed as invalid on 2019/12/19 05:38
openbsd uvm_fault: pmap_page_remove (6) -1 1 285d 285d 0/3 auto-obsoleted due to no activity on 2025/10/08 23:25
openbsd uvm_fault: pmap_page_remove (3) -1 1 1530d 1530d 0/3 closed as invalid on 2022/02/15 06:33
openbsd uvm_fault: pmap_page_remove (2) -1 5 2082d 2259d 0/3 auto-closed as invalid on 2020/11/06 07:50

Sample crash report:
uvm_fault(0xfffffd806ce99468, 0x7f9000000000, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      pmap_page_remove+0x43d: xchgq   %rax,0(%r12,%rcx,1)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
pmap_page_remove(fffffd80072e8b80) at pmap_page_remove+0x43d _atomic_swap_64 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:117 [inline]
pmap_page_remove(fffffd80072e8b80) at pmap_page_remove+0x43d sys/arch/amd64/amd64/pmap.c:2014
uvm_anfree(fffffd80710f7870) at uvm_anfree+0xd8 sys/uvm/uvm_anon.c:111
amap_wipeout(fffffd807a636058) at amap_wipeout+0x246 sys/uvm/uvm_amap.c:-1
uvm_unmap_detach(ffff80003c9018e0,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1359
uvm_map_teardown(fffffd806ce99468) at uvm_map_teardown+0x357 sys/uvm/uvm_map.c:2536
exit1(ffff80002f0bfcb0,0,0,3) at exit1+0x6e6 sys/kern/kern_exit.c:259
proc_suspend_check_locked(ffff80002f0bfcb0,0) at proc_suspend_check_locked+0x4ba sys/kern/kern_sig.c:2235
userret(ffff80002f0bfcb0) at userret+0x8c proc_suspend_check sys/kern/kern_sig.c:-1 [inline]
userret(ffff80002f0bfcb0) at userret+0x8c sys/kern/kern_sig.c:2194
syscall(ffff80003c901b50) at syscall+0xa56 mi_syscall_return sys/sys/syscall_mi.h:203 [inline]
syscall(ffff80003c901b50) at syscall+0xa56 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x76f12ce84b50, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/24 12:40 openbsd 7348976a6ac6 74e70d19 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: pmap_page_remove
2026/03/24 02:17 openbsd 2084961b940b baf8bf12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: pmap_page_remove
2026/03/22 12:22 openbsd 67e6794a9e1c 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: pmap_page_remove
2026/03/13 06:35 openbsd 7210d95da7cb 2f7f359d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
2026/02/09 13:33 openbsd a82d9bb4a825 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
2026/01/19 19:34 openbsd 665aeba05e03 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
2025/12/29 03:14 openbsd 6a98c69fc684 5dc09de1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
2025/12/24 11:02 openbsd 1dc30a6de584 5dc09de1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: pmap_page_remove
2025/12/18 22:56 openbsd 3f23c8878a83 e14dbeb9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
2025/12/11 12:57 openbsd a762189c5efb 48b27acc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: pmap_page_remove
2025/12/11 07:55 openbsd d004c0aeba6f 48b27acc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
2025/11/24 05:53 openbsd 879ea5f6fdb7 4fb8ef37 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
2025/11/14 06:05 openbsd 83ff66b05700 07e030de .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: pmap_page_remove
2025/11/11 16:24 openbsd 05de582f27ae 4e1406b4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
* Struck through repros no longer work on HEAD.