uvm_fault: mtx_enter (2)

Status: upstream: reported on 2026/08/17 05:52
Reported-by: syzbot+7f40bdbe49b65a32f7c8@syzkaller.appspotmail.com
First crash: 3d13h, last: 3d08h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: mtx_enter -1 214 125d 496d 0/4 auto-obsoleted due to no activity on 2026/06/06 00:40

Sample crash report:
login: uvm_fault(0xfffff9806d198a20, 0x18, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff81fa079e cs 8 rflags 10297 cr2 18 cpl 0 rsp ffff800035cc2b60
gsbase 0xffffffff83972ff0  kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff81fa079e
Starting stack trace...
panic(ffffffff834be1ec) at panic+0x1ba sys/kern/subr_prf.c:229
kerntrap(ffff800035cc2ab0) at kerntrap+0x2fb
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
mtx_enter(18) at mtx_enter+0x6e sys/kern/kern_lock.c:549
clockintr_unbind(ffff800001695e30,1) at clockintr_unbind+0x56 sys/kern/kern_clockintr.c:375
dt_ioctl_record_stop(ffff80000160ea00) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:589
dtclose(11e5f,1,2000,ffff80003c8fb778) at dtclose+0xd9 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,1,2000,ffff80003c8fb778) at dtclose+0xd9 sys/dev/dt/dt_dev.c:239
spec_close(ffff800035cc2ce0) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff9805ccd0d80,1,fffff98007ffd618,ffff80003c8fb778) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff980698c9790,ffff80003c8fb778) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff980698c9790,ffff80003c8fb778) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff980698c9790,ffff80003c8fb778) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff980698c9790,ffff80003c8fb778) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80003c8fb778) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80003c8fb778,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80003c8fb778,ffff800035cc3040,ffff800035cc2f90) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800035cc3040) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff800035cc3040) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7af1dab9c570, count: 240
End of stack trace.

dump to dev 4,1 not possible
rebooting...
SeaBIOS (version 1.8.2-google)
Total RAM Size = 0x0000000080000000 = 2048 MiB
CPUs found: 2     Max CPUs supported: 2
SeaBIOS (version 1.8.2-google)
Machine UUID e8ad4952-4afb-9745-48fc-89c076f118d4
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f2600: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Sending Seabios boot VM event.
Booting from Hard Disk 0...
>> OpenBSD/amd64 BOOT 3.67
boot> set $lines = 0
set: syntax error
boot> set $maxwidth = 0
set: syntax error
boot> show panic
boot: illegal argument panic
boot> show kasan
boot> trace
boot> show registers
boot> show proc
boot> ps
boot> show all locks
boot> show malloc
boot> show all pools
boot> machine ddbcpu 0
machine: syntax error
boot> trace
boot> machine ddbcpu 1
machine: syntax error
boot> trace
boot> 

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/17 11:01 openbsd 3b8d610e537f 905244d6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: mtx_enter
2026/08/17 05:51 openbsd 3b8d610e537f 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: mtx_enter
* Struck through repros no longer work on HEAD.