syzbot


uvm_fault: pmap_page_remove (7)

Status: upstream: reported on 2025/11/11 16:24
Reported-by: syzbot+4f31ad0ccb0a35f3f07a@syzkaller.appspotmail.com
First crash: 9d00h, last: 6d10h
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: pmap_page_remove (4) -1 1 1309d 1309d 0/3 auto-closed as invalid on 2022/07/20 03:20
openbsd uvm_fault: pmap_page_remove (5) -1 16 401d 711d 0/3 auto-obsoleted due to no activity on 2025/01/12 21:41
openbsd uvm_fault: pmap_page_remove -1 7 2253d 2510d 0/3 auto-closed as invalid on 2019/12/19 05:38
openbsd uvm_fault: pmap_page_remove (6) -1 1 132d 132d 0/3 auto-obsoleted due to no activity on 2025/10/08 23:25
openbsd uvm_fault: pmap_page_remove (3) -1 1 1378d 1378d 0/3 closed as invalid on 2022/02/15 06:33
openbsd uvm_fault: pmap_page_remove (2) -1 5 1930d 2106d 0/3 auto-closed as invalid on 2020/11/06 07:50

Sample crash report:
uvm_fault(0xfffffd8073b65738, 0x7f846309e880, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      pmap_page_remove+0x43d: xchgq   %rax,0(%r12,%rcx,1)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
pmap_page_remove(fffffd80070ee400) at pmap_page_remove+0x43d _atomic_swap_64 sys/arch/amd64/compile/SYZKALLER/obj/machine/atomic.h:117 [inline]
pmap_page_remove(fffffd80070ee400) at pmap_page_remove+0x43d sys/arch/amd64/amd64/pmap.c:2014
uvm_anfree_list(fffffd806da237b0,0) at uvm_anfree_list+0xd6 sys/uvm/uvm_anon.c:112
amap_wipeout(fffffd806ffa8b40) at amap_wipeout+0x248 sys/uvm/uvm_amap.c:-1
uvm_unmap_detach(ffff80002a86b450,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353
uvm_map_teardown(fffffd8073b65738) at uvm_map_teardown+0x357 sys/uvm/uvm_map.c:2525
exit1(ffff80002a776008,43,0,1) at exit1+0x6e6 sys/kern/kern_exit.c:259
sys_exit(ffff80002a776008,ffff80002a86b610,ffff80002a86b560) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a86b610) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a86b610) at syscall+0x962 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x781ca38525f0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/14 06:05 openbsd 83ff66b05700 07e030de .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: pmap_page_remove
2025/11/11 16:24 openbsd 05de582f27ae 4e1406b4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pmap_page_remove
* Struck through repros no longer work on HEAD.