syzbot


uvm_fault: witness_checkorder (6)

Status: upstream: reported on 2025/05/16 22:51
Reported-by: syzbot+94c529af6dd3e483cff6@syzkaller.appspotmail.com
First crash: 27d, last: 4d09h
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: witness_checkorder (3) C 212 640d 893d 0/3 auto-obsoleted due to no activity on 2023/11/01 12:30
openbsd uvm_fault: witness_checkorder (2) 1 2032d 2032d 0/3 auto-closed as invalid on 2020/02/18 09:16
openbsd uvm_fault: witness_checkorder syz 2 2063d 2063d 3/3 fixed on 2019/10/22 13:03
openbsd uvm_fault: witness_checkorder (4) 1 567d 567d 0/3 auto-obsoleted due to no activity on 2024/02/21 18:24
openbsd uvm_fault: witness_checkorder (5) 7 211d 445d 0/3 auto-obsoleted due to no activity on 2025/02/12 06:16

Sample crash report:
uvm_fault(0xfffffd8076ab93e8, 0x48, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      witness_checkorder+0xa9:        movl    0x20(%r14),%r15d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
  17215  64881      0     0x14000      0x200    1  reaper
witness_checkorder(28,9,0) at witness_checkorder+0xa9 sys/kern/subr_witness.c:779
mtx_enter(18) at mtx_enter+0x4a sys/kern/kern_lock.c:252
clockintr_unbind(ffff800000b4e130,1) at clockintr_unbind+0x56 sys/kern/kern_clockintr.c:375
dt_ioctl_record_stop(ffff800001494000) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:576
dtclose(11e5f,3,2000,ffff80003940f9d0) at dtclose+0x105 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,3,2000,ffff80003940f9d0) at dtclose+0x105 sys/dev/dt/dt_dev.c:232
spec_close(ffff80003c479b40) at spec_close+0x45f sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd807859e968,3,fffffd80097fb478,ffff80003940f9d0) at VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
vn_closefile(fffffd805f998ec0,ffff80003940f9d0) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd805f998ec0,ffff80003940f9d0) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd805f998ec0,ffff80003940f9d0) at fdrop+0x126 sys/kern/kern_descrip.c:1267
closef(fffffd805f998ec0,ffff80003940f9d0) at closef+0x192 sys/kern/kern_descrip.c:1251
fdfree(ffff80003940f9d0) at fdfree+0x116 sys/kern/kern_descrip.c:1182
exit1(ffff80003940f9d0,0,0,1) at exit1+0x59c sys/kern/kern_exit.c:215
sys_exit(ffff80003940f9d0,ffff80003c479eb0,ffff80003c479e00) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c479eb0) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c479eb0) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
end trace frame: 0xffff80003c479f30, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/09 08:17 openbsd 1d858eebbab4 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/09 02:28 openbsd 1d858eebbab4 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/05 20:40 openbsd c875838447ad 6b6b5f21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/05/18 21:36 openbsd 6decc3d5f4d6 f41472b0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/05/16 22:51 openbsd f47d9bee1200 f41472b0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
* Struck through repros no longer work on HEAD.