syzbot


pool: free list modified: aobjpl (2)

Status: upstream: reported on 2025/03/10 02:51
Reported-by: syzbot+94b1873ca417b622b1eb@syzkaller.appspotmail.com
First crash: 3d17h, last: 3d17h
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: aobjpl C 3 1924d 1937d 3/3 fixed on 2020/03/04 22:54

Sample crash report:
panic: pool_do_get: aobjpl free list modified: page 0xfffffd806f811000; item addr 0xfffffd806f811f30; offset 0x1c=0xdeafbeae
Starting stack trace...
panic(ffffffff833ae28d) at panic+0x1d0 sys/kern/subr_prf.c:229
pool_do_get(ffffffff839122c8,1,ffff8000330ac018) at pool_do_get+0x5da
pool_get(ffffffff839122c8,1) at pool_get+0x149
uao_create(2000,0) at uao_create+0xaa sys/uvm/uvm_aobj.c:697
shmget_allocate_segment(ffff80002a354020,ffff8000330ac2d0,0,ffff8000330ac220) at shmget_allocate_segment+0x42d sys/kern/sysv_shm.c:444
sys_shmget(ffff80002a354020,ffff8000330ac2d0,ffff8000330ac220) at sys_shmget+0x1b2 sys/kern/sysv_shm.c:482
syscall(ffff8000330ac2d0) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000330ac2d0) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x27dc689c050, count: 249
End of stack trace.

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/10 02:50 openbsd 7475d27301c2 163f510d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: aobjpl
* Struck through repros no longer work on HEAD.