syzbot


protection_fault: icmp_mtudisc_timeout (4)

Status: upstream: reported on 2025/07/16 23:24
Reported-by: syzbot+5de334298738b60f07ab@syzkaller.appspotmail.com
First crash: 151d, last: 32d
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: icmp_mtudisc_timeout (2) -1 1 459d 459d 0/3 auto-obsoleted due to no activity on 2024/12/10 05:16
openbsd protection_fault: icmp_mtudisc_timeout -1 3 621d 674d 0/3 auto-obsoleted due to no activity on 2024/07/01 04:08
openbsd protection_fault: icmp_mtudisc_timeout (3) -1 1 297d 297d 0/3 auto-obsoleted due to no activity on 2025/05/21 20:37

Sample crash report:
����kernel: protection fault trap, code=0
Stopped at      icmp_mtudisc_timeout+291:       movq    0(%rax),%rcx
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
icmp_mtudisc_timeout(fffffd806a1df6e8,0) at icmp_mtudisc_timeout+291
rt_timer_queue_flush(ffffffff83976d88) at rt_timer_queue_flush+653
ip_sysctl(ffff80002a3a207c,1,0,ffff80002a3a20a8,200000001300,4) at ip_sysctl+2125
net_sysctl(ffff80002a3a2074,3,0,ffff80002a3a20a8,200000001300,4,5945d10acb2e5a2) at net_sysctl+1614
sys_sysctl(ffff80002ffd8a88,ffff80002a3a21e0,ffff80002a3a2130) at sys_sysctl+997
syscall(ffff80002a3a21e0) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0x8b38e90b080, count: -7
ddb{0}> show registers
rdi                               20
rsi                               20
rbp             18446603336929648304
rbx             18446603336929648129
rdx             18446603336243864064
rcx             18446603337026341512
rax             15596344546196163235
r8              18446744071606457232    tcp_mtudisc_increase
r9                                 0
r10             15630109605865907106
r11             13407625668124744508
r12             18446603336221399128
r13                               20
r14                                0
r15             18446741326710830824
rip             18446744071598054771    icmp_mtudisc_timeout+291
cs                                 8
rflags                         66118    __ALIGN_SIZE+62022
rsp             18446603336929648224
ss                                16
icmp_mtudisc_timeout+291:       movq    0(%rax),%rcx
ddb{0}> show proc
PROC (syz-executor) tid=416643 pid=84088 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002ffd9a18,0xffffffff8395fb80
    process=0xffff8000fffef9e8 user=0xffff80002a39d000, vmspace=0xfffffd800b0273d0
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 84088  220771  44380      0  2           0                syz-executor
*84088  416643  44380      0  7   0x4000000                syz-executor
 70638  100621  74287      0  2    0x100000                sh
 74287  499370  65782      0  3    0x10008a  sigsusp       sh
 83771    3097  92286      0  2           0                syz-executor
 83771   30946  92286      0  3   0x4000080  sbwait        syz-executor
 56028  356017   4315      0  2           0                syz-executor
 56028  361346   4315      0  3   0x4000080  lockf         syz-executor
 56028  269474   4315      0  2   0x4000000                syz-executor
 39658  229186  78626      0  2           0                syz-executor
 39658  133331  78626      0  3   0x4000080  fsleep        syz-executor
 65782  247993  32198      0  3        0x82  wait          syz-executor
 83087  263173  77970      0  3        0x80  nanoslp       syz-executor
 83087  230940  77970      0  3   0x4000080  sbwait        syz-executor
 83087  337196  77970      0  3   0x4000080  fsleep        syz-executor
 11682  396333  74389      0  3        0x80  nanoslp       syz-executor
 11682  270348  74389      0  3   0x4000080  lockf         syz-executor
 11682   54208  74389      0  3   0x4000080  fsleep        syz-executor
 74389  288631  32198      0  3        0x82  nanoslp       syz-executor
 44380   53722  32198      0  3        0x82  nanoslp       syz-executor
 44951  158515  73770      0  3        0x82  sbwait        sshd-session
 92286  119111  32198      0  3        0x82  nanoslp       syz-executor
 22626  346970  32198      0  2         0x2                syz-executor
 96919  243738  73770      0  3        0x82  sbwait        sshd-session
 36375   27345  73770      0  3        0x82  sbwait        sshd-session
 24827   91529  73770      0  3        0x82  sbwait        sshd-session
 78626   11552  32198      0  3        0x82  nanoslp       syz-executor
 77970  455164  32198      0  3        0x82  nanoslp       syz-executor
 31215  242836      1      0  3    0x100083  ttyopn        getty
  4315  161500  32198      0  3        0x82  nanoslp       syz-executor
 32198  512968   5134      0  3        0x82  kqread        syz-executor
  5134  163951  11786      0  3    0x10008a  sigsusp       ksh
 11786  177237  67047      0  3        0x98  kqread        sshd-session
 67047  520443  73770      0  3        0x92  kqread        sshd-session
 73770  272871      1      0  3        0x88  kqread        sshd
 29582   78082  50218     74  3   0x1100092  bpf           pflogd
 50218  508669      1      0  3        0x80  sbwait        pflogd
 41488  301192  22708     73  3   0x1100090  kqread        syslogd
 22708  319025      1      0  3    0x100082  sbwait        syslogd
 51961  353939      1      0  3    0x100080  kqread        resolvd
 46383  385658  51974     77  3    0x100092  kqread        dhcpleased
 28761  500535  51974     77  3    0x100092  kqread        dhcpleased
 51974  163559      1      0  3        0x80  kqread        dhcpleased
 19573  317512      0      0  3     0x14200  bored         smr
 89078  332009      0      0  2     0x14200                zerothread
 84508  409965      0      0  3     0x14200  aiodoned      aiodoned
 58888  208857      0      0  3     0x14200  syncer        update
 65715  478578      0      0  3     0x14200  cleaner       cleaner
 55969  478302      0      0  3     0x14200  reaper        reaper
 53741  200472      0      0  3     0x14200  pgdaemon      pagedaemon
 82831  312814      0      0  3     0x14200  bored         viomb
  1833   35012      0      0  3  0x40014200  acpi0         acpi0
 76017   68691      0      0  7  0x40014200                idle1
 32406   28364      0      0  3     0x14200  bored         softnet1
 51780  208565      0      0  3     0x14200  bored         softnet0
 94734   28997      0      0  2     0x14200                systqmp
 83513  241175      0      0  3     0x14200  bored         systq
  1965   78047      0      0  3     0x14200  tmoslp        softclockmp
 99465  346653      0      0  3  0x40014200  tmoslp        softclock
 30026  266703      0      0  3  0x40014200                idle0
     1  446129      0      0  3     0x80082  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
Process 84088 (syz-executor) thread 0xffff80002ffd8a88 (416643)
exclusive rwlock netlock r = 0 (0xffffffff83829e50)
#0  witness_lock+1521
#1  rw_do_enter_write+1049
#2  ip_sysctl+2104
#3  net_sysctl+1614
#4  sys_sysctl+997
#5  syscall+3028
#6  Xsyscall+296
Process 83771 (syz-executor) thread 0xffff800036bfc568 (30946)
exclusive rwlock sbufrcv r = 0 (0xffff800001565d00)
#0  witness_lock+1521
#1  rw_do_enter_write+1049
#2  sblock+182
#3  soreceive+637
#4  recvit+1035
#5  sys_recvmmsg+1040
#6  syscall+3028
#7  Xsyscall+296
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10263  11153K   12492K 166960K     14730        0
            pcb    20     20K      25K 166960K       735        0
         rtable   240     13K      13K 166960K      1132        0
             pf    41     18K      19K 166960K       214        0
         ifaddr    44      8K       8K 166960K       172        0
        ifgroup    68      2K       3K 166960K       293        0
         sysctl     4      1K       9K 166960K        58        0
       counters    74     37K      38K 166960K       398        0
       ioctlops     0      0K       4K 166960K      2274        0
            iov     2      6K      24K 166960K       139        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1426     90K      90K 166960K      3142        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      2K       9K 166960K        39        0
         VM map     2      1K       1K 166960K         2        0
            sem    22     16K      17K 166960K       179        0
        dirhash    12      2K       2K 166960K        45        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     240K 166960K      2259        0
          sigio     0      0K       0K 166960K       100        0
           proc    73    115K     164K 166960K       962        0
        subproc    72      4K       4K 166960K       135        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       242        0
       in_multi    81      5K       7K 166960K       251        0
    ether_multi     1      0K       0K 166960K        17        0
            mrt     1      0K       0K 166960K        12        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   223    996K     996K 166960K       223        0
           exec     0      0K       1K 166960K       732        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   293    196K     205K 166960K     22422        0
       UVM aobj    54      5K       7K 166960K        62        0
     pinsyscall    51    102K     106K 166960K      3596        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       134        0
            NDP    15      0K       2K 166960K       116        0
           temp    84   8664K    8740K 166960K    115495        0
         kqueue    14     22K      31K 166960K       411        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      588    0      584    10     9     1     3     0     8    0
rtentry    176      310    0      219     6     1     5     6     0     8    0
unpcb      144     1926    0     1894    14    12     2     8     0     8    0
syncache   336       12    0       12     3     3     0     1     0     8    0
tcpqe       32        3    0        3     3     3     0     1     0     8    0
tcpcb      736     1110    0     1095    25    23     2    13     0     8    0
arp        136       36    0       16     1     0     1     1     0     8    0
inpcb      328     3299    0     3278    38    30     8    12     0     8    5
nd6        152       50    0       31     1     0     1     1     0     8    0
pkpcb       40       20    0       19     5     4     1     1     0     8    0
kcovpl      48       15    0        7     1     0     1     1     0     8    0
mppekey    1024       2    0        2     1     1     0     1     0     8    0
ppxss      1192     130    0      130     1     1     0     1     0     8    0
pppxif     1504      19    0       19     3     3     0     1     0     8    0
pffrag     232       21    0       13     1     0     1     1     0   482    0
pffrnode    88       20    0       12     1     0     1     1     0     8    0
pffrent     40       37    0       28     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24      147    0       65     1     0     1     1     0     8    0
pfstkey    128      147    0       65     3     0     3     3     0     8    0
pfstate    448      147    0       65    10     0    10    10     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
rttmr      136        4    0        3     2     1     1     1     0     8    0
art_heap8  4096       4    0        0     4     0     4     4     0     8    0
art_heap4  256     1104    0      728    34     8    26    29     0     8    0
art_table   40     1108    0      728     5     0     5     5     0     8    0
art_node    32      308    0      226     2     1     1     2     0     8    0
sysvmsgpl   40        9    0        6     1     0     1     1     0     8    0
semupl     112        4    0        4     3     3     0     1     0     8    0
semapl     112      166    0      146     1     0     1     1     0     8    0
shmpl      112       57    0        7     2     0     2     2     0     8    0
dirhash    1024      40    0       23     3     0     3     3     0     8    0
dino2pl    256     5549    0     4028    96     0    96    96     0     8    0
ffsino     296     5549    0     4028   118     0   118   118     0     8    0
nchpl      144     8624    0     6897    65     0    65    65     0     8    0
rtmask      32       29    0       29     5     5     0     1     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   31608    0    31608     4     3     1     2     0     8    1
percpumem   16      214    0      162     1     0     1     1     0     8    0
vcpupl     3968       1    0        0     1     0     1     1     0     8    0
vmpool     840        2    0        1     1     0     1     1     0     8    0
kstatmem   264      178    0      142     3     0     3     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72       17    0       17     3     3     0     1     0     8    0
scxspl     216    48520    0    48520    16    15     1     8     1     8    1
plimitpl   152      471    0      453     1     0     1     1     0     8    0
sigapl     424     2544    0     2492     8     1     7     7     0     8    0
knotepl    120      569    0        0    17     0    17    17     0     8    0
kqueuepl   224      836    0      826     7     6     1     5     0     8    0
pipepl     344      381    0      354     9     6     3     9     0     8    0
fdescpl    528     2523    0     2487     3     0     3     3     0     8    0
filepl     160    18786    0    18528    26    12    14    20     0     8    0
lockfpl    104     1058    0     1048     2     1     1     2     0     8    0
lockfspl    48      355    0      350     1     0     1     1     0     8    0
sessionpl  144       38    0       25     1     0     1     1     0     8    0
pgrppl      48      161    0      140     1     0     1     1     0     8    0
ucredpl    104     2595    0     2582     1     0     1     1     0     8    0
zombiepl   144     2492    0     2492     2     1     1     1     0     8    1
processpl  1232    2544    0     2492     6     1     5     5     0     8    0
procpl     664     6005    0     5944     8     1     7     7     0     8    0
sosppl     176       27    0       27     2     2     0     1     0     8    0
sockpl     752     5938    0     5879    73    60    13    23     0     8    6
mcl64k     65536      5    0        0     1     0     1     1     0     8    0
mcl16k     16384      4    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     117    0        0    15     0    15    15     0     8    0
mcl2k2     2112       3    0        0     1     0     1     1     0     8    0
mcl2k      2048      63    0        0     6     0     6     6     0     8    0
mtagpl      96        6    0        0     1     0     1     1     0     8    0
mbufpl     256     6564    0        0   411     0   411   411     0     8    0
bufpl      280    20229    0    14092   439     0   439   439     0     8    0
anonpl      32    18256    0        0   147     0   147   147     0   246    0
amapchunkpl 152   77512    0    76735    51    19    32    36     0   158    0
amappl16   200     8495    0     8315    54    32    22    34     0     8    0
amappl15   192        4    0        4     1     1     0     1     0     8    0
amappl14   184        6    0        6     1     1     0     1     0     8    0
amappl13   176      513    0      511     1     0     1     1     0     8    0
amappl12   168     2947    0     2897     3     0     3     3     0     8    0
amappl11   160        9    0        9     2     2     0     1     0     8    0
amappl10   152       83    0       69     1     0     1     1     0     8    0
amappl9    144      274    0      274     1     1     0     1     0     8    0
amappl8    136       32    0       28     1     0     1     1     0     8    0
amappl7    128      153    0      152     1     0     1     1     0     8    0
amappl6    120      377    0      358     1     0     1     1     0     8    0
amappl5    112      102    0       87     1     0     1     1     0     8    0
amappl4    104      500    0      466     1     0     1     1     0     8    0
amappl3     96    13334    0    13236     4     1     3     3     0     8    0
amappl2     88     2672    0     2566     3     0     3     3     0     8    0
amappl1     80    20153    0    19217    20     0    20    20     0     8    0
amappl      88    21130    0    20945     5     0     5     5     0    92    0
uvmvnodes   80      187    0        0     4     0     4     4     0     8    0
dma65536   65536      2    0        2     2     2     0     1     0     8    0
dma16384   16384      1    0        1     1     1     0     1     0     8    0
dma8192    8192       2    0        2     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        8    0        8     3     3     0     1     0     8    0
dma128     128      260    0      260     4     4     0     1     0     8    0
dma64       64        8    0        8     2     2     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       61    0        8     1     0     1     1     0     8    0
uaddrrnd    24     2523    0     2487     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2523    0     2487     1     0     1     1     0     8    0
vmmpekpl   168    20570    0    20504     4     0     4     4     0     8    0
vmmpepl    168   166072    0   163426   145    21   124   135     0   357    1
vmsppl     488     2522    0     2487     6     1     5     5     0     8    0
rwobjpl     80    44698    0    42955    50     8    42    45     0     8    0
pdppl      4096    5058    0     4977   143    60    83    86     0     8    2
pvpl        32    26774    0        0   216     1   215   215     0   265    0
pmappl     256     2524    0     2488     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      770    0      106    20     0    20    20     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
icmp_mtudisc_timeout(fffffd806a1df6e8,0) at icmp_mtudisc_timeout+291
rt_timer_queue_flush(ffffffff83976d88) at rt_timer_queue_flush+653
ip_sysctl(ffff80002a3a207c,1,0,ffff80002a3a20a8,200000001300,4) at ip_sysctl+2125
net_sysctl(ffff80002a3a2074,3,0,ffff80002a3a20a8,200000001300,4,5945d10acb2e5a2) at net_sysctl+1614
sys_sysctl(ffff80002ffd8a88,ffff80002a3a21e0,ffff80002a3a2130) at sys_sysctl+997
syscall(ffff80002a3a21e0) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0x8b38e90b080, count: -7
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+39:  addq    $8,%rsp
ddb{1}> trace
x86_ipi_db(ffff8000299edff0) at x86_ipi_db+39
x86_ipi_handler() at x86_ipi_handler+217
Xresume_lapic_ipi() at Xresume_lapic_ipi+39
acpicpu_idle() at acpicpu_idle+1111
sched_idle(ffff8000299edff0) at sched_idle+913
end trace frame: 0x0, count: -5

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/12 16:07 openbsd 30ee307006ea 07e030de .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: icmp_mtudisc_timeout
2025/11/03 13:58 openbsd 0214ec5c7fc4 e6c64ba8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: icmp_mtudisc_timeout
2025/08/12 02:52 openbsd 3ae9e49f3bd9 c06e8995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: icmp_mtudisc_timeout
2025/08/02 09:15 openbsd 4c5c4401a4d8 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: icmp_mtudisc_timeout
2025/07/27 17:55 openbsd 7b0d12c26b01 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: icmp_mtudisc_timeout
2025/07/25 17:22 openbsd c5645c128364 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: icmp_mtudisc_timeout
2025/07/16 23:23 openbsd 9ce74a582983 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: icmp_mtudisc_timeout
* Struck through repros no longer work on HEAD.