syzbot
malloc: free list modified: ???
Status:
upstream: reported on 2026/08/21 12:47
Reported-by: syzbot+81bce62500049a93833d@syzkaller.appspotmail.com
First crash: 1d09h, last: 1d09h
Sample crash report:
panic: Data modified on freelist: word 4 of object 0xffff8000016274e0 size 0x20 previous type ??? (0x798e2652 != 0xdeaf4152)
Starting stack trace...
panic(ffffffff83484462) at panic+0x1d0 sys/kern/subr_prf.c:229
malloc(20,62,2) at malloc+0xdb6 sys/kern/kern_malloc.c:357
amap_alloc1(40,2,0) at amap_alloc1+0x291 sys/uvm/uvm_amap.c:356
amap_copy(fffff9006f0a7b80,fffff90069bda8f0,2,1,32319282000,32319282001) at amap_copy+0x257 sys/uvm/uvm_amap.c:-1
uvm_fault_check(ffff80002a276d20,ffff80002a276d58,ffff80002a276d90,0) at uvm_fault_check+0x473 sys/uvm/uvm_fault.c:747
uvm_fault(fffff9006f0a7b80,32319282000,0,1) at uvm_fault+0x106 sys/uvm/uvm_fault.c:627
upageflttrap(ffff80002a276ec0,323192829a8) at upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:194
usertrap(ffff80002a276ec0) at usertrap+0x430 sys/arch/amd64/amd64/trap.c:648
recall_trap() at recall_trap+0x8
end of kernel
end trace frame: 0x70f89cf62670, count: 248
End of stack trace.
syncing disks...
* Struck through repros no longer work on HEAD.