syzbot


uvm_fault: alltraps_kern_meltdown (2)

Status: upstream: reported on 2026/04/16 07:46
Reported-by: syzbot+742febd2e60866693d2b@syzkaller.appspotmail.com
First crash: 58d, last: 2d08h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: alltraps_kern_meltdown -1 5 156d 307d 0/3 auto-obsoleted due to no activity on 2026/04/08 12:46

Sample crash report:
login: uvm_fault(0xfffff7006e83e3e0, 0x98, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff81f5e008 cs 8 rflags 10246 cr2 98 cpl 0 rsp ffff80002a29ebb0
gsbase 0xffff80002999dff0  kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff81f5e008
Starting stack trace...
panic(ffffffff834f0132) at panic+0x1d0 sys/kern/subr_prf.c:229
kerntrap(ffff80002a29eb00) at kerntrap+0x30b
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
dovutimens(ffff80003c4274f0,fffff7006b5de370,ffff80002a29ece0) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2690
sys_futimes(ffff80003c4274f0,ffff80002a29ee30,ffff80002a29ed80) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2732
syscall(ffff80002a29ee30) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a29ee30) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa5a393b7c30, count: 250
End of stack trace.
WARNING: SPL NOT LOWERED ON TRAP EXIT 4 0
Stopped at      alltraps_kern_meltdown+0xb8:    movl    %ebx,%gs:0x688
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*462697   2908      0      0x1044          0    1K syz-executor
 496262  74413      0           0          0    0  syz-executor
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copyout() at copyout+0x64
exec_process_vmcmds(ffff80003c427258,ffff80002a2d1ab0) at exec_process_vmcmds+0xef sys/kern/exec_subr.c:139
sys_execve(ffff80003c427258,ffff80002a2d1f70,ffff80002a2d1ec0) at sys_execve+0xd6d sys/kern/kern_exec.c:492
syscall(ffff80002a2d1f70) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2d1f70) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7a2bd651d7a0, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffff7006e83e3e0, 0x98, 0, 1) -> e
ddb{1}> trace
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copyout() at copyout+0x64
exec_process_vmcmds(ffff80003c427258,ffff80002a2d1ab0) at exec_process_vmcmds+0xef sys/kern/exec_subr.c:139
sys_execve(ffff80003c427258,ffff80002a2d1f70,ffff80002a2d1ec0) at sys_execve+0xd6d sys/kern/kern_exec.c:492
syscall(ffff80002a2d1f70) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2d1f70) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7a2bd651d7a0, count: -6
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a2d1840
rbx                                0
rdx                                0
rcx               0xffff80003c427258
rax                             0x2a
r8                0xffff80002a2d1770
r9                                 0
r10               0xd9679855a56226bc
r11               0xe4cbb182131972a5
r12                                0
r13                                0
r14                           0x24a0    __ALIGN_SIZE+0x14a0
r15               0xffff800001600000
rip               0xffffffff8342520b    alltraps_kern_meltdown+0xb8
cs                               0x8
rflags                         0x246
rsp               0xffff80002a2d17c0
ss                              0x10
alltraps_kern_meltdown+0xb8:    movl    %ebx,%gs:0x688
ddb{1}> show proc
PROC (syz-executor) tid=462697 pid=2908 tcnt=1 stat=onproc
    flags process=1044<INEXEC,PPWAIT,SINGLEEXIT> proc=0
    runpri=86, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff80003c427258 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c4274f0,0xffff80003c426808
    process=0xffff80002ebe3050 user=0xffff80002a2cd000, vmspace=0xfffff7006e83e998
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
* 2908  462697  51559      0  7      0x1044                syz-executor
 14883   58180  65742      0  2           0                syz-executor
 14883  192248  65742      0  2   0x4000000                syz-executor
 14883  484884  65742      0  2   0x4000000                syz-executor
 69924  447531  57903      0  2           0                syz-executor
 69924  334498  57903      0  3   0x4000000  vmmaplk       syz-executor
 69924  496740  57903      0  3   0x4000080  fsleep        syz-executor
 74413  496262  48797      0  7           0                syz-executor
 74413  168304  48797      0  2   0x4000000                syz-executor
 74413  211025  48797      0  3   0x4000000  sbar          syz-executor
 15398  240725   5157      0  2         0x2                syz-executor
 54032  426992  16645      0  3        0x80  nanoslp       syz-executor
 54032   24514  16645      0  3   0x4000080  lockf         syz-executor
 54032  508955  16645      0  3   0x4000080  fsleep        syz-executor
 51559  228270   5157      0  3        0x82  ppwait        syz-executor
 65742  159472   5157      0  3        0x82  nanoslp       syz-executor
 12785  302402      0      0  3     0x14280  nfsidl        nfsio
 19457  490408      0      0  3     0x14280  nfsidl        nfsio
 21864  303867      0      0  3     0x14280  nfsidl        nfsio
 61089  390274      0      0  3     0x14280  nfsidl        nfsio
 65192   78386      0      0  3     0x14280  nfsidl        nfsio
 74472   29445      0      0  3     0x14280  nfsidl        nfsio
 68324  447936      0      0  3     0x14280  nfsidl        nfsio
 64819  452160      0      0  3     0x14280  nfsidl        nfsio
 53961  160629      0      0  3     0x14280  nfsidl        nfsio
 53160  235721      0      0  3     0x14280  nfsidl        nfsio
 43648  501495      0      0  3     0x14280  nfsidl        nfsio
   299  248625      0      0  3     0x14280  nfsidl        nfsio
 66783  325392      0      0  3     0x14280  nfsidl        nfsio
 77279  367473      0      0  3     0x14280  nfsidl        nfsio
 11348  474022      0      0  3     0x14280  nfsidl        nfsio
 60506  250147      0      0  3     0x14280  nfsidl        nfsio
 31518   99911      0      0  3     0x14280  nfsidl        nfsio
 31190  365603      0      0  3     0x14280  nfsidl        nfsio
 37019  429272      0      0  3     0x14280  nfsidl        nfsio
 97123  215065      0      0  3     0x14280  nfsidl        nfsio
 51433  497845  21223      0  3      0x3000  suspend       syz-executor
 51433  101277  21223      0  3   0x4081000  inode         syz-executor
 51433   84603  21223      0  3   0x4081000  inode         syz-executor
 42736  507434      1      0  3    0x100083  ttyin         getty
 16645  353608   5157      0  3        0x82  nanoslp       syz-executor
 21223  104978   5157      0  3        0x82  wait          syz-executor
 57903  397279   5157      0  3        0x82  nanoslp       syz-executor
 48797  160898   5157      0  3        0x82  nanoslp       syz-executor
  5157  370842      1      0  2         0x2                syz-executor
 44951  136951      1     74  3   0x1100092  bpf           pflogd
 39777  385710      1     73  3   0x1100090  kqread        syslogd
 85481  499266      0      0  3     0x14200  bored         smr
 24507  379367      0      0  2     0x14200                zerothread
 48564  244968      0      0  3     0x14200  aiodoned      aiodoned
 99127   67425      0      0  3     0x14200  syncer        update
 30054   36904      0      0  3     0x14200  cleaner       cleaner
 92711  348006      0      0  3     0x14200  reaper        reaper
 16437  437228      0      0  3     0x14200  pgdaemon      pagedaemon
 72684  399126      0      0  3     0x14200  bored         viomb
 39624   30954      0      0  3  0x40014200  acpi0         acpi0
 23399  163748      0      0  3  0x40014200                idle1
 88733  332851      0      0  3     0x14200  bored         softnet1
 62871  111582      0      0  3     0x14200  netlock       softnet0
 28075  250836      0      0  3     0x14200  smrbar        systqmp
 84438  368960      0      0  3     0x14200  bored         systq
 38382  173920      0      0  3     0x14200  tmoslp        softclockmp
 92827  345749      0      0  3  0x40014200  tmoslp        softclock
 73752  438054      0      0  3  0x40014200                idle0
     1  487831      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 2908 (syz-executor) thread 0xffff80003c427258 (462697)
exclusive rwlock vmmaplk r = 0 (0xfffff7006e83ea98)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
#3  uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
#4  uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#5  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
#6  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
#7  alltraps_kern_meltdown+0x7b
#8  copyout+0x64
#9  exec_process_vmcmds+0xef sys/kern/exec_subr.c:139
#10 sys_execve+0xd6d sys/kern/kern_exec.c:492
#11 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#12 Xsyscall+0x128
Process 69924 (syz-executor) thread 0xffff80002a223c98 (447531)
exclusive rwlock vmmaplk r = 0 (0xfffff7006f37e8a8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
#3  uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
#4  uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#5  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#6  usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#7  recall_trap+0x8
Process 74413 (syz-executor) thread 0xffff80003c4274f0 (211025)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b13a80)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
#2  Xsyscall+0x128
Process 51433 (syz-executor) thread 0xffff8000fffef240 (101277)
exclusive rrwlock inode r = 0 (0xfffff7006ee9f6e0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vget+0x2a2 sys/kern/vfs_subr.c:686
#6  ufs_ihashget+0x185 sys/ufs/ufs/ufs_ihash.c:98
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1203
#8  ufs_lookup+0x16bd sys/ufs/ufs/ufs_lookup.c:573
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/11 16:25 openbsd 28cce1e713d0 d93a6ab6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
2026/05/13 23:09 openbsd ed5454cb43ec 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
2026/04/16 07:45 openbsd 2a36b3c3c2a3 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
* Struck through repros no longer work on HEAD.