syzbot


uvm_fault: statclock

Status: upstream: reported on 2025/12/09 13:12
Reported-by: syzbot+7bbd903ddba8bcfd576d@syzkaller.appspotmail.com
First crash: 56d, last: 56d

Sample crash report:
kernel: page fault trap, code=0
Stopped at      statclock+0x2cf:        movl    0x140(%rbx),%eax
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
statclock(ffffffff837f9c20,ffff80003c9272c0,0) at statclock+0x2cf sys/kern/kern_clock.c:334
clockintr_dispatch(ffff80003c9272c0) at clockintr_dispatch+0x339 sys/kern/kern_clockintr.c:-1
lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x10
uvm_pagelookup(fffffd806c745648,915e000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline]
uvm_pagelookup(fffffd806c745648,915e000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1214
buf_map(fffffd806c745588) at buf_map+0x2a6 sys/kern/vfs_biomem.c:-1
buf_get(0,0,c450000) at buf_get+0x5be sys/kern/vfs_bio.c:1163
geteblk(c450000) at geteblk+0x3c sys/kern/vfs_bio.c:-1
writedisklabel(d02,ffffffff817f2320,ffff800000039000) at writedisklabel+0x4b sys/arch/amd64/amd64/disksubr.c:133
sdioctl(d02,84946467,ffff80000146c000,6,ffff80002a7bd4d8) at sdioctl+0x959 sys/scsi/sd.c:921
VOP_IOCTL(fffffd806c5dd7b0,84946467,ffff80000146c000,6,fffffd8007bfd9c0,ffff80002a7bd4d8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806bfc70f8,84946467,ffff80000146c000,ffff80002a7bd4d8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:531
sys_ioctl(ffff80002a7bd4d8,ffff80003c927b40,ffff80003c927a90) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c927b40) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c927b40) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf8f5ad99600, count: -16
ddb> show registers
rdi                              0x2
rsi                              0x1
rbp               0xffff80003c927210
rbx                                0
rdx                                0
rcx                           0x15da    __ALIGN_SIZE+0x5da
rax               0xffff80002a7bd4d8
r8                                 0
r9                                 0
r10                                0
r11               0xd1fd9d4ba801a4f5
r12                              0x1
r13               0xffff80002a7bd660
r14               0xffff80002a7bd4d8
r15                              0x1
rip               0xffffffff82d592ff    statclock+0x2cf
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80003c9271b0
ss                              0x10
statclock+0x2cf:        movl    0x140(%rbx),%eax
ddb> show proc
kernel: page fault trap, code=0
Faulted in DDB; continuing...
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 28867  119022      0      0  3        0x80  fsleep        syz-executor
 28867  513008      0      0  3   0x4000080  fifor         syz-executor
 46580   88461      0      0  3        0x82  nanoslp       syz-executor
 20435   73676      1      0  3        0x80  nanoslp       init
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10196  11209K   11568K 166960K     12170        0
            pcb    18     16K      18K 166960K       244        0
         rtable   269     11K      11K 166960K       618        0
             pf    32     13K      17K 166960K        91        0
         ifaddr    43      8K       8K 166960K        84        0
        ifgroup    50      2K       2K 166960K       119        0
         sysctl     4      1K       9K 166960K        13        0
       counters    33     17K      18K 166960K        76        0
       ioctlops     1      2K       4K 166960K       158        0
            iov     0      0K      28K 166960K        25        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1475     93K      93K 166960K      2061        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         9        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        88        0
        dirhash    72     12K      12K 166960K       612        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K     240K 166960K       667        0
          sigio     0      0K       0K 166960K         9        0
           proc    51     50K      91K 166960K       590        0
        subproc    72      4K       4K 166960K        90        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       134        0
       in_multi    99      7K       7K 166960K       145        0
    ether_multi     1      0K       0K 166960K         4        0
            mrt     1      0K       0K 166960K         5        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   109    493K     493K 166960K       109        0
           exec     0      0K       1K 166960K       530        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   231    161K     165K 166960K      7348        0
       UVM aobj    15      4K       4K 166960K        15        0
     pinsyscall    37     74K      93K 166960K      1789        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K        45        0
            NDP    11      0K       2K 166960K        55        0
           temp    54   8666K    8731K 166960K     28873        0
         kqueue    13     20K      32K 166960K       119        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       72    0       69     1     0     1     1     0     8    0
rtentry    136      144    0       30     4     0     4     4     0     8    0
unpcb      144      324    0      306     2     0     2     2     0     8    1
syncache   336        5    0        5     1     0     1     1     0     8    1
tcpcb      736      149    0      144     2     0     2     2     0     8    1
arp         96       23    0        4     1     0     1     1     0     8    0
ipq         40        1    0        0     1     0     1     1     0     8    0
ipqe        40        1    0        0     1     0     1     1     0     8    0
inpcb      328      815    0      804     7     0     7     7     0     8    5
ip6q        72        7    0        4     1     0     1     1     0     8    0
ip6af       40       11    0        8     1     0     1     1     0     8    0
nd6        112       31    0        6     1     0     1     1     0     8    0
pkpcb       40        2    0        2     1     0     1     1     0     8    1
kcovpl      48       10    0        2     1     0     1     1     0     8    0
ppxss      1072      34    0       34     1     0     1     1     0     8    1
pppxif     1384       6    0        6     1     0     1     1     0     8    1
pfstitem    24        2    0        0     1     0     1     1     0     8    0
pfstkey    128        2    0        0     1     0     1     1     0     8    0
pfstate    384        1    0        0     1     0     1     1     0     8    0
pfrule     1344       2    0        2     1     0     1     1     0     8    1
rttmr      136        1    0        1     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      581    0      121    29     0    29    29     0     8    0
art_table   40      582    0      121     5     0     5     5     0     8    0
art_node    32      144    0       41     1     0     1     1     0     8    0
sysvmsgpl   40       43    0       41     1     0     1     1     0     8    0
semapl     112       82    0       72     1     0     1     1     0     8    0
shmpl      112       11    0        0     1     0     1     1     0     8    0
dirhash    1024     218    0      181     5     0     5     5     0     8    0
dirhash: pool(0xffffffff838a2548:dirhash): free list modified: page 0xffff80002a7ba000; item ordinal 0; addr 0xffff80002a7bb000 (p 0xfffffd806fa74000); offset 0x0=0x0
pool(dirhash): free list modified: page 0xffff80002a7ba000; item ordinal 0; addr 0xffff80002a7bb000 (p 0xfffffd806fa74000); offset 0x0=0x0
dirhash: pool(0xffffffff838a2548:dirhash): page inconsistency: page 0xffff80002a7ba000; item ordinal 1; addr 0x1e06198b0a06cabc
dirhash: pool(0xffffffff838a2548:dirhash): free list modified: page 0xffff80002a8aa000; item ordinal 0; addr 0xffff80002a8ab000 (p 0xfffffd806c9de000); offset 0x0=0x0
pool(dirhash): free list modified: page 0xffff80002a8aa000; item ordinal 0; addr 0xffff80002a8ab000 (p 0xfffffd806c9de000); offset 0x0=0x0
dirhash: pool(0xffffffff838a2548:dirhash): page inconsistency: page 0xffff80002a8aa000; item ordinal 1; addr 0x235c2b3588e2abab
dirhash: pool(0xffffffff838a2548:dirhash): free list modified: page 0xffff80002a8c6000; item ordinal 0; addr 0xffff80002a8c7000 (p 0xfffffd806c9de000); offset 0x0=0x0
pool(dirhash): free list modified: page 0xffff80002a8c6000; item ordinal 0; addr 0xffff80002a8c7000 (p 0xfffffd806c9de000); offset 0x0=0x0
dirhash: pool(0xffffffff838a2548:dirhash): page inconsistency: page 0xffff80002a8c6000; item ordinal 1; addr 0x17d2ed7053be1664
dino2pl    256     2630    0     1120    95     0    95    95     0     8    0
ffsino     256     2630    0     1120    95     0    95    95     0     8    0
nchpl      144     3519    0     1815    64     0    64    64     0     8    0
rtmask      32        9    0        9     1     0     1     1     0     8    1
vnodes     216     3109    0        0   173     0   173   173     0     8    0
namei      1024   11698    0    11697     1     0     1     1     0     8    0
namei: pool(0xffffffff8388aa28:namei): free list modified: page 0xffff80002a788000; item ordinal 0; addr 0xffff80002a789c00 (p 0xfffffd807f7e2000); offset 0x0=0x0
pool(namei): free list modified: page 0xffff80002a788000; item ordinal 0; addr 0xffff80002a789c00 (p 0xfffffd807f7e2000); offset 0x0=0x0
namei: pool(0xffffffff8388aa28:namei): page inconsistency: page 0xffff80002a788000; item ordinal 1; addr 0xe122b10d6e1e3a
vcpupl     3904       1    0        0     1     0     1     1     0     8    0
vcpupl: pool(0xffffffff8388a840:vcpupl): page inconsistency: page 0x0; at page head addr 0xffff80002a8bff90 (p 0xffff80002a8b8000)
vmpool     800        1    0        0     1     0     1     1     0     8    0
kstatmem   264       68    0       46     2     0     2     2     0     8    0
scsiplug    72        2    0        2     1     0     1     1     0     8    1
scxspl     216    12063    0    12061     8     0     8     8     1     8    7
plimitpl   152      128    0      110     1     0     1     1     0     8    0
sigapl     424      946    0      904     6     0     6     6     0     8    0
knotepl    120    21196    0    21149    10     0    10    10     0     8    7
kqueuepl   184      324    0      313     7     0     7     7     0     8    6
pipepl     304      182    0      155     5     0     5     5     0     8    2
fdescpl    448      928    0      899     5     0     5     5     0     8    1
filepl     120     5424    0     5178    14     0    14    14     0     8    4
lockfpl    104      170    0      167     1     0     1     1     0     8    0
lockfspl    48       81    0       78     1     0     1     1     0     8    0
sessionpl  144       24    0       17     1     0     1     1     0     8    0
pgrppl      48       36    0       21     1     0     1     1     0     8    0
ucredpl    104      852    0      839     1     0     1     1     0     8    0
zombiepl   144      908    0      904     1     0     1     1     0     8    0
processpl  1152     946    0      904     4     0     4     4     0     8    0
processpl: pool(0xffffffff8395f958:processpl): page inconsistency: page 0x0; at page head addr 0xffff80002a787f90 (p 0xffff80002a784000)
procpl     664     1659    0     1614     6     0     6     6     0     8    1
procpl: pool(0xffffffff8395f7a0:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002a72df90 (p 0xffff80002a72c000)
procpl: pool(0xffffffff8395f7a0:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002a777f90 (p 0xffff80002a776000)
sosppl     176        3    0        3     1     0     1     1     0     8    1
sockpl     552     1234    0     1202     8     0     8     8     0     8    5
mcl64k     65536     26    0       26     1     0     1     1     0     8    1
mcl16k     16384      1    0        1     1     0     1     1     0     8    1
mcl12k     12288      1    0        1     1     0     1     1     0     8    1
mcl8k      8192       6    0        6     1     0     1     1     0     8    1
mcl4k      4096    3114    0     3058    16     1    15    16     0     8    7
mcl2k2     2112       2    0        2     1     0     1     1     0     8    1
mcl2k      2048     923    0      916     5     0     5     5     0     8    3
mtagpl      96       60    0       10     2     0     2     2     0     8    0
mbufpl     256     9947    0     9714    19     0    19    19     0     8    2
bufpl      280     4566    0      121   318     0   318   318     0     8    0
anonpl      24   144914    0   141840    50     0    50    50     0   187   23
amapchunkpl 152   23436    0    22766    28     0    28    28     0   158    1
amappl16   200     2405    0     2370    19     6    13    17     0     8    8
amappl15   192        3    0        3     1     0     1     1     0     8    1
amappl14   184        3    0        2     1     0     1     1     0     8    0
amappl13   176      439    0      438     1     0     1     1     0     8    0
amappl12   168     1285    0     1249     2     0     2     2     0     8    0
amappl11   160        8    0        8     1     0     1     1     0     8    1
amappl10   152       42    0       32     1     0     1     1     0     8    0
amappl9    144      258    0      258     1     0     1     1     0     8    1
amappl8    136       34    0       33     1     0     1     1     0     8    0
amappl7    128       85    0       84     1     0     1     1     0     8    0
amappl6    120      297    0      286     1     0     1     1     0     8    0
amappl5    112       69    0       61     1     0     1     1     0     8    0
amappl4    104      389    0      367     1     0     1     1     0     8    0
amappl3     96     4543    0     4438     3     0     3     3     0     8    0
amappl2     88      528    0      477     2     0     2     2     0     8    0
amappl1     80    11025    0    10514    13     0    13    13     0     8    1
amappl      88     6524    0     6358     5     0     5     5     0    92    1
uvmvnodes   80      110    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        7    0        7     1     0     1     1     0     8    1
dma128     128      254    0      254     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       14    0        0     1     0     1     1     0     8    0
uaddrrnd    24      928    0      899     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      928    0      899     1     0     1     1     0     8    0
vmmpekpl   168     8480    0     8449     2     0     2     2     0     8    0
vmmpepl    168    63690    0    61942    93     0    93    93     0   357   12
vmsppl     368      927    0      899     4     0     4     4     0     8    1
rwobjpl     40    18755    0    17828    13     0    13    13     0     8    1
pdppl      4096    1865    0     1799    98    30    68    79     0     8    2
pvpl        32   401654    0   393157   130     0   130   130     0   265   41
pmappl     216      928    0      899     2     0     2     2     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      382    0       31    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
statclock(ffffffff837f9c20,ffff80003c9272c0,0) at statclock+0x2cf sys/kern/kern_clock.c:334
clockintr_dispatch(ffff80003c9272c0) at clockintr_dispatch+0x339 sys/kern/kern_clockintr.c:-1
lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x10
uvm_pagelookup(fffffd806c745648,915e000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline]
uvm_pagelookup(fffffd806c745648,915e000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1214
buf_map(fffffd806c745588) at buf_map+0x2a6 sys/kern/vfs_biomem.c:-1
buf_get(0,0,c450000) at buf_get+0x5be sys/kern/vfs_bio.c:1163
geteblk(c450000) at geteblk+0x3c sys/kern/vfs_bio.c:-1
writedisklabel(d02,ffffffff817f2320,ffff800000039000) at writedisklabel+0x4b sys/arch/amd64/amd64/disksubr.c:133
sdioctl(d02,84946467,ffff80000146c000,6,ffff80002a7bd4d8) at sdioctl+0x959 sys/scsi/sd.c:921
VOP_IOCTL(fffffd806c5dd7b0,84946467,ffff80000146c000,6,fffffd8007bfd9c0,ffff80002a7bd4d8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806bfc70f8,84946467,ffff80000146c000,ffff80002a7bd4d8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:531
sys_ioctl(ffff80002a7bd4d8,ffff80003c927b40,ffff80003c927a90) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c927b40) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c927b40) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf8f5ad99600, count: -16
ddb> machine ddbcpu 1
No such command
ddb> trace
statclock(ffffffff837f9c20,ffff80003c9272c0,0) at statclock+0x2cf sys/kern/kern_clock.c:334
clockintr_dispatch(ffff80003c9272c0) at clockintr_dispatch+0x339 sys/kern/kern_clockintr.c:-1
lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x10
uvm_pagelookup(fffffd806c745648,915e000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline]
uvm_pagelookup(fffffd806c745648,915e000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1214
buf_map(fffffd806c745588) at buf_map+0x2a6 sys/kern/vfs_biomem.c:-1
buf_get(0,0,c450000) at buf_get+0x5be sys/kern/vfs_bio.c:1163
geteblk(c450000) at geteblk+0x3c sys/kern/vfs_bio.c:-1
writedisklabel(d02,ffffffff817f2320,ffff800000039000) at writedisklabel+0x4b sys/arch/amd64/amd64/disksubr.c:133
sdioctl(d02,84946467,ffff80000146c000,6,ffff80002a7bd4d8) at sdioctl+0x959 sys/scsi/sd.c:921
VOP_IOCTL(fffffd806c5dd7b0,84946467,ffff80000146c000,6,fffffd8007bfd9c0,ffff80002a7bd4d8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806bfc70f8,84946467,ffff80000146c000,ffff80002a7bd4d8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:531
sys_ioctl(ffff80002a7bd4d8,ffff80003c927b40,ffff80003c927a90) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c927b40) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c927b40) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf8f5ad99600, count: -16

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/09 13:11 openbsd bf8f637750de fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: statclock
* Struck through repros no longer work on HEAD.