protection_fault: pf_anchor_global_RB_REMOVE (3)

Status: upstream: reported on 2026/03/28 06:46
Reported-by: syzbot+839c1d9df91ce3820b90@syzkaller.appspotmail.com
First crash: 119d, last: 15d
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: pf_anchor_global_RB_REMOVE -1 73 1527d 1614d 3/4 fixed on 2022/06/27 02:23
openbsd protection_fault: pf_anchor_global_RB_REMOVE (2) -1 5 241d 388d 0/4 auto-obsoleted due to no activity on 2026/02/24 00:50

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      pf_anchor_global_RB_REMOVE+0x81:        movq    0(%r12),%r15
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
pf_anchor_global_RB_REMOVE(ffffffff83aeeea8,ffff8000016ead48) at pf_anchor_global_RB_REMOVE+0x81 sys/net/pf_ruleset.c:82
pf_remove_if_empty_ruleset(ffff8000016eb1d8) at pf_remove_if_empty_ruleset+0x12d sys/net/pf_ruleset.c:301
pfi_dynaddr_setup(ffff80000162dac0,0,1) at pfi_dynaddr_setup+0x671 sys/net/pf_if.c:508
pf_addr_setup(ffffffff83aef340,ffff80000162dac0,0) at pf_addr_setup+0x46 sys/net/pf_ioctl.c:948
pfioctl(14900,cd60441a,ffff800000c74000,83,ffff80002a772d08) at pfioctl+0x9aba sys/net/pf_ioctl.c:2621
VOP_IOCTL(fffff780666830f0,cd60441a,ffff800000c74000,83,fffff78007ffd750,ffff80002a772d08) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffff78075070170,cd60441a,ffff800000c74000,ffff80002a772d08) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80002a772d08,ffff800035cc3de0,ffff800035cc3d30) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff800035cc3de0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff800035cc3de0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x48db15d6550, count: -10
ddb> show registers
rdi               0xffff800035cc4000
rsi                            0x867
rbp               0xffff800035cc37b0
rbx               0xffffffff83aeeea8    pf_anchors
rdx               0xffff800035cc4000
rcx                            0x866
rax               0xffffffff8336670f    pf_anchor_global_RB_REMOVE+0x2f
r8                             0x3fc
r9                0x8080808080808080
r10               0x85c1054060950a10
r11                0xaf8c47e1cf6adc5
r12               0xfa731f7568ec0029
r13                              0x1
r14               0xffff8000016ead48
r15               0xce0994ddb897c56d
rip               0xffffffff83366761    pf_anchor_global_RB_REMOVE+0x81
cs                               0x8
rflags                       0x10282    __ALIGN_SIZE+0xf282
rsp               0xffff800035cc3760
ss                              0x10
pf_anchor_global_RB_REMOVE+0x81:        movq    0(%r12),%r15
ddb> show proc
PROC (syz-executor) tid=433798 pid=27049 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a7722a8,0xffff80002a7727e8
    process=0xffff800045ffa898 user=0xffff800035cbe000, vmspace=0xfffff7806cfd78b0
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 29875  483130  94949      0  2        0x10                syz-executor
 29875   92983  94949      0  3   0x4000090  fsleep        syz-executor
 27049  404399  18932      0  2           0                syz-executor
*27049  433798  18932      0  7   0x4000000                syz-executor
  8962  256422  43175      0  2       0xc90                syz-executor
  8962   33458  43175      0  3   0x4000090  fsleep        syz-executor
  8962  450043  43175      0  3   0x4000090  fsleep        syz-executor
 25547  300158  30773      0  2       0xc80                syz-executor
 25547  391444  30773      0  3   0x4000080  netcon        syz-executor
 25547  275805  30773      0  3   0x4000080  fsleep        syz-executor
 67315  263988  84892     -1  2       0xc90                syz-executor
 67315  117776  84892     -1  3   0x4000090  netcon        syz-executor
 67315  138264  84892     -1  3   0x4000090  netacc        syz-executor
 45515  368248  34188      0  2       0xc80                syz-executor
 45515  279856  34188      0  3   0x4000080  netcon        syz-executor
 45515   56171  34188      0  3   0x4000080  fsleep        syz-executor
 70096   95213  58437  60928  2       0xc91                syz-executor
 70096   48415  58437  60928  3   0x4000091  netcon        syz-executor
 70096  397491  58437  60928  3   0x4000091  fsleep        syz-executor
 33867  236653   7702      0  2       0xc80                syz-executor
 33867  394499   7702      0  3   0x4000080  pipewr        syz-executor
 33867  144181   7702      0  3   0x4000080  pipewr        syz-executor
 33867  519421   7702      0  3   0x4000080  fsleep        syz-executor
  8010  383568      1      0  3    0x100083  ttyin         getty
 34212  233540      0      0  3     0x14280  nfsidl        nfsio
 18596   56315      0      0  3     0x14280  nfsidl        nfsio
 34559  344834      0      0  3     0x14280  nfsidl        nfsio
 29096   13272      0      0  3     0x14280  nfsidl        nfsio
 11715   59678      0      0  3     0x14280  nfsidl        nfsio
 40308  248283      0      0  3     0x14280  nfsidl        nfsio
   593  226102      0      0  3 

Crashes (27):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/09 21:00 openbsd 3dcca0f3a877 a0c310a3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/07/04 17:16 openbsd f9c9bf9f9903 fcece630 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: pf_anchor_global_RB_REMOVE
2026/06/22 02:52 openbsd 100b8423738f 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/06/17 16:49 openbsd abb34060f546 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/06/15 22:26 openbsd 3894b14b3da6 50bb0618 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/06/14 20:44 openbsd 009b3423c562 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/06/14 01:03 openbsd 4abe9ebbcc38 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/06/08 23:44 openbsd 867bf89e0da6 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/06/06 20:22 openbsd f12de7fa2924 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/06/05 10:44 openbsd ce89dc54e9c4 48b6c3fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/06/04 00:28 openbsd e8e5aa2db9cf 197909be .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/23 18:39 openbsd 19a8be4fa5c4 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/20 03:08 openbsd 3fe334830a75 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: pf_anchor_global_RB_REMOVE
2026/05/04 07:12 openbsd 126c93b16f30 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: pf_anchor_global_RB_REMOVE
2026/05/04 05:44 openbsd 126c93b16f30 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: pf_anchor_global_RB_REMOVE
2026/05/03 11:18 openbsd 3c6f8ccfe730 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/03 09:16 openbsd 3c6f8ccfe730 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/03 01:30 openbsd 3c6f8ccfe730 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/03 01:30 openbsd 3c6f8ccfe730 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/02 20:59 openbsd 3c6f8ccfe730 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/02 11:21 openbsd cdbf859d9674 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/02 08:54 openbsd cdbf859d9674 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/05/01 00:18 openbsd 2117c4c4e299 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/04/13 16:23 openbsd ef90b149a753 9530ccf9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/04/02 01:42 openbsd ffc378411de4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/03/31 04:34 openbsd 0a71aa187b1b 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: pf_anchor_global_RB_REMOVE
2026/03/28 06:45 openbsd 9d790fdba930 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: pf_anchor_global_RB_REMOVE
* Struck through repros no longer work on HEAD.