syzbot


protection_fault: mtx_enter (3)

Status: upstream: reported on 2025/10/24 21:16
Reported-by: syzbot+69404101963633b56833@syzkaller.appspotmail.com
First crash: 2d07h, last: 2d07h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: mtx_enter -1 1 345d 345d 0/3 auto-obsoleted due to no activity on 2025/02/14 01:15
openbsd protection_fault: mtx_enter (2) -1 1 129d 129d 0/3 auto-obsoleted due to no activity on 2025/09/17 09:58

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      mtx_enter+0x6e: movq    0(%r14),%rax
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
mtx_enter(deafbeaddeafbf8d) at mtx_enter+0x6e sys/kern/kern_lock.c:335
prsignal(deafbeaddeafbead,14) at prsignal+0x36 sys/kern/kern_sig.c:904
reaper(ffff80002a73d758) at reaper+0x29c sys/kern/kern_exit.c:516
end trace frame: 0x0, count: -3
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a773330
rbx                          0x40000    acpi_pdirpa+0x2be71
rdx                                0
rcx               0xffffffff8377cff0    cpu_info_full_primary+0x1ff0
rax               0xffff80002a73d700
r8                               0x9
r9                                 0
r10               0xc0d95fbd8563b237
r11               0xabe23a68aa984777
r12               0xdeafbeaddeafbead
r13                          0x40000    acpi_pdirpa+0x2be71
r14               0xdeafbeaddeafbf8d
r15                                0
rip               0xffffffff82dcc79e    mtx_enter+0x6e
cs                               0x8
rflags                       0x10297    __ALIGN_SIZE+0xf297
rsp               0xffff80002a773300
ss                              0x10
mtx_enter+0x6e: movq    0(%r14),%rax
ddb> show proc
PROC (reaper) tid=405379 pid=14331 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a73d4c0,0xffff80002a73da00
    process=0xffff8000ffffd200 user=0xffff80002a76e000, vmspace=0xffffffff83986ec0
    estcpu=0, cpticks=5, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 52192  238972      0      0  3     0x14280  nfsidl        nfsio
 60515   18221  82550      0  2           0                syz-executor
 60515  394624  82550      0  2   0x4000000                syz-executor
 63192  441523      0      0  3     0x14280  nfsidl        nfsio
 72882  484629      0      0  3     0x14280  nfsidl        nfsio
 94733  390742   8668      0  2           0                syz-executor
 94733  291601   8668      0  3   0x4000080  sysctllk      syz-executor
  1601  294842      0      0  3     0x14280  nfsidl        nfsio
 98015  108531  37006     -1  2        0x10                syz-executor
 98015  352953  37006     -1  3   0x4000090  fsleep        syz-executor
 71332  359610  64365      0  2           0                syz-executor
 71332  332292  64365      0  3   0x4000080  fsleep        syz-executor
 83781  166764  85622      0  2           0                syz-executor
 83781  147844  85622      0  3   0x4000080  fsleep        syz-executor
 83781  158784  85622      0  3   0x4000080  fsleep        syz-executor
  8896  462103  77356      0  2           0                syz-executor
  8896  240976  77356      0  2   0x4000000                syz-executor
  8896  399340  77356      0  2   0x4000080                syz-executor
 82550  433681  56366      0  3        0x82  nanoslp       syz-executor
 18987  478533      1      0  3    0x100083  ttyin         getty
  8668  487190  56366      0  3        0x82  nanoslp       syz-executor
 49044   80231  56366      0  3        0x82  wait          syz-executor
 85622  170473  56366      0  3        0x82  nanoslp       syz-executor
 64365  266684  56366      0  3        0x82  nanoslp       syz-executor
 37006    6146  56366      0  3        0x82  nanoslp       syz-executor
 36120  441493  56366      0  2         0x2                syz-executor
 77356  171232  56366      0  3        0x82  nanoslp       syz-executor
 56366  111573  67163      0  3        0x82  kqread        syz-executor
 67163   41076  33061      0  3    0x10008a  sigsusp       ksh
 33061  253414  46725      0  3        0x98  kqread        sshd-session
 46725  485357  56724      0  3        0x92  kqread        sshd-session
 56724  302033      1      0  3        0x88  kqread        sshd
 39096  140105   1697     73  3   0x1100090  kqread        syslogd
  1697   39027      1      0  3    0x100082  sbwait        syslogd
 51267  247469      1      0  3    0x100080  kqread        resolvd
 30294   29978   4113     77  3    0x100092  kqread        dhcpleased
  2161  390637   4113     77  3    0x100092  kqread        dhcpleased
  4113  170824      1      0  3        0x80  kqread        dhcpleased
 28504  360255      0      0  3     0x14200  bored         smr
 31467   39783      0      0  2     0x14200                zerothread
 40466  408307      0      0  3     0x14200  aiodoned      aiodoned
 69465  339580      0      0  3     0x14200  syncer        update
 37243  458904      0      0  3     0x14200  cleaner       cleaner
*14331  405379      0      0  7     0x14200                reaper
 23400  281720      0      0  3     0x14200  pgdaemon      pagedaemon
 22429  232005      0      0  3     0x14200  bored         viomb
 20096   19227      0      0  3  0x40014200  acpi0         acpi0
 71260  301637      0      0  2     0x14200                softnet0
 78733  373251      0      0  3     0x14200  bored         systqmp
 93491  175286      0      0  3     0x14200  bored         systq
 64595  408083      0      0  3  0x40014200  tmoslp        softclock
 64508  127427      0      0  3  0x40014200                idle0
     1   37738      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10213  11206K   11562K 166960K     13031        0
            pcb    17     14K      16K 166960K       390        0
         rtable   224     10K      10K 166960K       600        0
             pf    32     13K      14K 166960K       105        0
         ifaddr    39      6K       7K 166960K        95        0
        ifgroup    54      2K       2K 166960K       126        0
         sysctl     4      1K       9K 166960K        12        0
       counters    33     17K      18K 166960K        90        0
       ioctlops     0      0K       4K 166960K       212        0
            iov     0      0K      17K 166960K        80        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1473     93K      93K 166960K      2435        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        15        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      1K       1K 166960K        87        0
        dirhash    12      2K       2K 166960K        27        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      93K 166960K       983        0
          sigio     0      0K       0K 166960K        76        0
           proc    60     59K     100K 166960K       636        0
        subproc    72      4K       4K 166960K        81        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       126        0
       in_multi    87      6K       7K 166960K       160        0
    ether_multi     1      0K       0K 166960K        13        0
            mrt     2      0K       0K 166960K        10        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   187    837K     837K 166960K       187        0
           exec     0      0K       1K 166960K       540        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   235    143K     159K 166960K     10413        0
       UVM aobj    26      2K       2K 166960K        30        0
     pinsyscall    38     76K      92K 166960K      2061        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        50        0
            NDP    12      0K       2K 166960K        63        0
           temp    54   8646K    8714K 166960K     29640        0
         kqueue    17     24K      32K 166960K       217        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      100    0       96     1     0     1     1     0     8    0
rtentry    136      155    0       68     4     0     4     4     0     8    0
unpcb      144      762    0      745     6     5     1     6     0     8    0
syncache   336        3    0        3     1     1     0     1     0     8    0
tcpcb      736      345    0      341     7     6     1     7     0     8    0
arp         96       21    0        7     1     0     1     1     0     8    0
ipq         40        4    0        0     1     0     1     1     0     8    0
ipqe        40        4    0        0     1     0     1     1     0     8    0
inpcb      328     1060    0     1052    17    10     7    12     0     8    6
ip6q        72        3    0        1     1     0     1     1     0     8    0
ip6af       40        5    0        2     1     0     1     1     0     8    0
nd6        112       34    0       10     1     0     1     1     0     8    0
pkpcb       40        5    0        5     2     1     1     1     0     8    1
kcovpl      48        9    0        1     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     1     0     1     0     8    0
ppxss      1072      54    0       54     2     1     1     1     0     8    1
pppxif     1384       2    0        2     1     1     0     1     0     8    0
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pfrule     1344       1    0        1     1     1     0     1     0     8    0
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      826    0      347    35     5    30    30     0     8    0
art_table   40      828    0      347     5     0     5     5     0     8    0
art_node    32      154    0       75     1     0     1     1     0     8    0
sysvmsgpl   40       10    0        8     1     0     1     1     0     8    0
semapl     112       85    0       75     1     0     1     1     0     8    0
shmpl      112       27    0        4     1     0     1     1     0     8    0
dirhash    1024      27    0       10     3     0     3     3     0     8    0
dino2pl    256     3239    0     1736    95     0    95    95     0     8    0
ffsino     256     3239    0     1736    95     0    95    95     0     8    0
nchpl      144     4621    0     2925    64     0    64    64     0     8    0
rtmask      32        9    0        9     2     1     1     1     0     8    1
vnodes     216     3980    0        0   222     0   222   222     0     8    0
namei      1024   16797    0    16797     3     2     1     2     0     8    1
kstatmem   264       88    0       64     2     0     2     2     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        5    0        5     1     1     0     1     0     8    0
scxspl     216    15571    0    15571    15     7     8     8     1     8    8
plimitpl   152      290    0      273     1     0     1     1     0     8    0
sigapl     424     1286    0     1240     9     3     6     8     0     8    0
knotepl    120    64634    0    64579    33    23    10    17     0     8    8
kqueuepl   184      405    0      393     5     3     2     4     0     8    1
pipepl     304      279    0      252     7     4     3     7     0     8    0
fdescpl    448     1249    0     1220     5     1     4     5     0     8    0
filepl     120     8691    0     8474    17     6    11    15     0     8    2
lockfpl    104      312    0      310     1     0     1     1     0     8    0
lockfspl    48      124    0      122     1     0     1     1     0     8    0
sessionpl  144       23    0       15     1     0     1     1     0     8    0
pgrppl      48       35    0       19     1     0     1     1     0     8    0
ucredpl    104     1398    0     1384     1     0     1     1     0     8    0
zombiepl   144     1476    0     1475     1     0     1     1     0     8    0
processpl  1152    1286    0     1240     5     1     4     5     0     8    0
procpl     664     2680    0     2625     7     1     6     7     0     8    1
sosppl     176        7    0        7     2     1     1     1     0     8    1
sockpl     552     1952    0     1922    21    13     8    12     0     8    5
mcl64k     65536    143    0      143     2     1     1     1     0     8    1
mcl16k     16384      3    0        3     1     1     0     1     0     8    0
mcl12k     12288      1    0        1     1     1     0     1     0     8    0
mcl9k      9216       1    0        1     1     1     0     1     0     8    0
mcl8k      8192      10    0       10     2     1     1     1     0     8    1
mcl4k      4096    3596    0     3543    14     6     8    13     0     8    0
mcl2k2     2112       5    0        5     2     1     1     1     0     8    1
mcl2k      2048    1489    0     1481     5     3     2     5     0     8    0
mtagpl      96       19    0       11     1     0     1     1     0     8    0
mbufpl     256    16316    0    16131   188   111    77    77     0     8   62
bufpl      280     5866    0      120   411     0   411   411     0     8    0
anonpl      24   220426    0   216364    78    16    62    62     0   187   28
amapchunkpl 152   36674    0    36170    43    12    31    37     0   158    7
amappl16   200     4331    0     4274    41    30    11    15     0     8    7
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184        6    0        6     1     1     0     1     0     8    0
amappl13   176      412    0      410     1     0     1     1     0     8    0
amappl12   168     1591    0     1553     3     1     2     3     0     8    0
amappl11   160        7    0        7     1     1     0     1     0     8    0
amappl10   152       41    0       31     1     0     1     1     0     8    0
amappl9    144      251    0      251     1     1     0     1     0     8    0
amappl8    136       22    0       20     1     0     1     1     0     8    0
amappl7    128       82    0       81     1     0     1     1     0     8    0
amappl6    120      292    0      280     1     0     1     1     0     8    0
amappl5    112       68    0       61     1     0     1     1     0     8    0
amappl4    104      400    0      375     1     0     1     1     0     8    0
amappl3     96     6086    0     5998     3     0     3     3     0     8    0
amappl2     88     1358    0     1287     2     0     2     2     0     8    0
amappl1     80    12210    0    11676    13     1    12    13     0     8    0
amappl      88     9561    0     9393     5     0     5     5     0    92    0
uvmvnodes   80     3980    0        0    82     0    82    82     0     8    0
dma8192    8192       1    0        1     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        8    0        8     2     1     1     1     0     8    1
dma128     128      256    0      256     1     1     0     1     0     8    0
dma64       64        7    0        7     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       29    0        4     1     0     1     1     0     8    0
uaddrrnd    24     1249    0     1220     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1249    0     1220     1     0     1     1     0     8    0
vmmpekpl   168    11443    0    11404     3     0     3     3     0     8    0
vmmpepl    168    84130    0    82310   100     8    92    92     0   357   10
vmsppl     368     1248    0     1220     4     1     3     4     0     8    0
rwobjpl     40    27986    0    23106    53     2    51    51     0     8    1
pdppl      4096    2504    0     2440   100    34    66    80     0     8    2
pvpl        32   570491    0   559844   149    13   136   136     0   265   39
pmappl     216     1248    0     1220     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      568    0      177    13     1    12    12     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
mtx_enter(deafbeaddeafbf8d) at mtx_enter+0x6e sys/kern/kern_lock.c:335
prsignal(deafbeaddeafbead,14) at prsignal+0x36 sys/kern/kern_sig.c:904
reaper(ffff80002a73d758) at reaper+0x29c sys/kern/kern_exit.c:516
end trace frame: 0x0, count: -3
ddb> machine ddbcpu 1
No such command
ddb> trace
mtx_enter(deafbeaddeafbf8d) at mtx_enter+0x6e sys/kern/kern_lock.c:335
prsignal(deafbeaddeafbead,14) at prsignal+0x36 sys/kern/kern_sig.c:904
reaper(ffff80002a73d758) at reaper+0x29c sys/kern/kern_exit.c:516
end trace frame: 0x0, count: -3

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/24 21:15 openbsd 710ece6a621e c0460fcd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: mtx_enter
* Struck through repros no longer work on HEAD.