syzbot


uvm_fault: sys_shmat (2)

Status: upstream: reported on 2025/10/01 08:49
Reported-by: syzbot+9669e87e543ae1f05884@syzkaller.appspotmail.com
First crash: 193d, last: 24d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: sys_shmat -1 1 288d 288d 0/3 auto-obsoleted due to no activity on 2025/09/26 10:39

Sample crash report:
uvm_fault(0xffffffff839de430, 0xffff800001665000, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      sys_shmat+0xe0: movl    $0xffffffffffffffff,0(%r14)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*503683  79392      0           0  0x4000000    1K syz-executor
 195689  85700      0           0        0x1    0  syz-executor
sys_shmat(ffff800038bbed20,ffff80003c4e9ed0,ffff80003c4e9e20) at sys_shmat+0xe0 sys/kern/sysv_shm.c:235
syscall(ffff80003c4e9ed0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4e9ed0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x34fb789e300, count: 12
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xffffffff839de430, 0xffff800001665000, 0, 2) -> e
ddb{1}> trace
sys_shmat(ffff800038bbed20,ffff80003c4e9ed0,ffff80003c4e9e20) at sys_shmat+0xe0 sys/kern/sysv_shm.c:235
syscall(ffff80003c4e9ed0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4e9ed0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x34fb789e300, count: -3
ddb{1}> show registers
rdi                                0
rsi                       0x3e92675a
rbp               0xffff80003c4e9df0
rbx               0xffff80003c4e9ed0
rdx                                0
rcx               0xffff800038bbed20
rax               0xffff8000299bdff0
r8                                 0
r9                               0x1
r10                                0
r11               0x92e9068b0ae933bb
r12               0xffff800038bbed20
r13               0xffff8000015f4000
r14               0xffff800001665000
r15                           0x7100    __ALIGN_SIZE+0x6100
rip               0xffffffff815268e0    sys_shmat+0xe0
cs                               0x8
rflags                       0x10216    __ALIGN_SIZE+0xf216
rsp               0xffff80003c4e9d60
ss                              0x10
sys_shmat+0xe0: movl    $0xffffffffffffffff,0(%r14)
ddb{1}> show proc
PROC (syz-executor) tid=503683 pid=79392 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=80, usrpri=80, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a3262c8,0xffff80002a332d40
    process=0xffff8000fffe09d0 user=0xffff80003c4e4000, vmspace=0xfffffd80697935e0
    estcpu=30, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 43731  485826  77950      0  2           0                syz-executor
 43731  272299  77950      0  3   0x4000080  fsleep        syz-executor
 79392  511596  60348      0  2           0                syz-executor
 79392  132790  60348      0  3   0x4000080  fsleep        syz-executor
*79392  503683  60348      0  7   0x4000000                syz-executor
 59053  246276  55651      0  2           0                syz-executor
 59053  209238  55651      0  2   0x4000000                syz-executor
 59053  512346  55651      0  3   0x4000080  fsleep        syz-executor
 59053  387765  55651      0  2   0x4000000                syz-executor
 74437  329560      0      0  3     0x14200  acct          acct
 40589  444956  73473      0  2           0                syz-executor
 40589   61448  73473      0  3   0x4000080  ttyopn        syz-executor
 40589  368753  73473      0  3   0x4000080  fsleep        syz-executor
 40589  480203  73473      0  2   0x4000000                syz-executor
 85700  195689  19769      0  7         0x1                syz-executor
 85700  296570  19769      0  3   0x4000080  fsleep        syz-executor
 85700  169008  19769      0  2   0x4000000                syz-executor
 48905  392875  64587      0  3           0  vmmaplk       syz-executor
 48905  210055  64587      0  3   0x4000000  vmmaplk       syz-executor
 48905  230374  64587      0  3   0x4000000  inode         syz-executor
 48905   48716  64587      0  3   0x4000000  inode         syz-executor
 48905  504995  64587      0  2   0x4000000                syz-executor
 48905  485329  64587      0  3   0x4000000  vmmaplk       syz-executor
 77950  314359  21582      0  3        0x82  nanoslp       syz-executor
 19769  237157  21582      0  3        0x82  nanoslp       syz-executor
  4258    8250      0      0  3     0x14280  nfsidl        nfsio
 72347  230144      0      0  3     0x14280  nfsidl        nfsio
 59371  462009      0      0  3     0x14280  nfsidl        nfsio
 75889  237860      0      0  3     0x14280  nfsidl        nfsio
 78369   60669      0      0  3     0x14280  nfsidl        nfsio
 14038  371511      0      0  3     0x14280  nfsidl        nfsio
 89610  249934      0      0  3     0x14280  nfsidl        nfsio
 15161  191253      0      0  3     0x14280  nfsidl        nfsio
 21278  155542      0      0  3     0x14280  nfsidl        nfsio
 62498  468046      0      0  3     0x14280  nfsidl        nfsio
 69405  153732      0      0  3     0x14280  nfsidl        nfsio
 47653  363568      0      0  3     0x14280  nfsidl        nfsio
 75739  506859      0      0  3     0x14280  nfsidl        nfsio
 45345   40475      0      0  3     0x14280  nfsidl        nfsio
 39675  472497      0      0  3     0x14280  nfsidl        nfsio
 99995  412887      0      0  3     0x14280  nfsidl        nfsio
 95860  312570      0      0  3     0x14280  nfsidl        nfsio
 78446  372013      0      0  3     0x14280  nfsidl        nfsio
 60407  100518      0      0  3     0x14280  nfsidl        nfsio
 41082  296812      0      0  3     0x14280  nfsidl        nfsio
 66816  504252      1      0  3    0x100083  ttyopn        getty
 62679  166898  21582      0  3        0x82  nanoslp       syz-executor
    23  456478  21582      0  3        0x82  wait          syz-executor
 73473  467126  21582      0  3        0x82  nanoslp       syz-executor
 64587  154997  21582      0  3        0x82  nanoslp       syz-executor
 55651  449905  21582      0  3        0x82  nanoslp       syz-executor
 60348  314168  21582      0  3        0x82  nanoslp       syz-executor
 21582  126651  14265      0  3        0x82  kqread        syz-executor
 14265  103274  74405      0  3    0x10008a  sigsusp       ksh
 74405  179685  80950      0  3        0x98  kqread        sshd-session
 80950  318183  35751      0  3        0x92  kqread        sshd-session
 35751  488727      1      0  3        0x88  kqread        sshd
 49420  224181  92648     74  3   0x1100092  bpf           pflogd
 92648  311888      1      0  3        0x80  sbwait        pflogd
 91714  368709   9297     73  3   0x1100090  kqread        syslogd
  9297  403631      1      0  3    0x100082  sbwait        syslogd
 20312  447632      1      0  3    0x100080  kqread        resolvd
 57310  358640  12478     77  3    0x100092  kqread        dhcpleased
 58830  392768  12478     77  3    0x100092  kqread        dhcpleased
 12478   58624      1      0  3        0x80  kqread        dhcpleased
  5203  507606      0      0  3     0x14200  bored         smr
 65953  478973      0      0  2     0x14200                zerothread
   961   84076      0      0  3     0x14200  aiodoned      aiodoned
 31060  413114      0      0  3     0x14200  syncer        update
 17861   61054      0      0  3     0x14200  cleaner       cleaner
 94786  479314      0      0  3     0x14200  reaper        reaper
 50488  199267      0      0  3     0x14200  pgdaemon      pagedaemon
 28426  281857      0      0  3     0x14200  bored         viomb
  4014   89942      0      0  3  0x40014200  acpi0         acpi0
 18905   62874      0      0  3  0x40014200                idle1
 45938  410643      0      0  3     0x14200  bored         softnet1
 25313  126117      0      0  3     0x14200  bored         softnet0
 84534   76330      0      0  3     0x14200  bored         systqmp
 99030   21035      0      0  3     0x14200  bored         systq
 89245   70366      0      0  3     0x14200  tmoslp        softclockmp
 37603  419368      0      0  3  0x40014200  tmoslp        softclock
 46614  519282      0      0  3  0x40014200                idle0
     1   60412      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 79392 (syz-executor) thread 0xffff800038bbed20 (503683)
Process 59053 (syz-executor) thread 0xffff800038bbefb8 (209238)
Process 48905 (syz-executor) thread 0xffff800038bbe028 (210055)
Process 48905 (syz-executor) thread 0xffff80002a332568 (230374)
Process 48905 (syz-executor) thread 0xffff80002a332800 (504995)
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11091  12142K   14121K 166960K     14464        0
            pcb    17     14K      20K 166960K       416        0
         rtable   208     11K      11K 166960K       600        0
             pf    43     19K      21K 166960K       238        0
         ifaddr    40      7K       8K 166960K       145        0
        ifgroup    60      2K       2K 166960K       263        0
         sysctl     4      1K       9K 166960K        15        0
       counters    78     37K      38K 166960K       308        0
       ioctlops     0      0K       8K 166960K      1853        0
            iov     0      0K      28K 166960K        98        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1542     97K      97K 166960K      2809        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3      5K       5K 166960K        14        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        64        0
        dirhash    12      2K       2K 166960K        27        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     236K 166960K      1484        0
          sigio     1      0K       0K 166960K        33        0
           proc    73    115K     164K 166960K       801        0
        subproc    72      4K       4K 166960K        99        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       207        0
       in_multi    76      5K       7K 166960K       185        0
    ether_multi     1      0K       0K 166960K        13        0
            mrt     1      0K       0K 166960K        38        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   115    519K     519K 166960K       115        0
           exec     0      0K       1K 166960K       609        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   266    160K     185K 166960K     15204        0
       UVM aobj    56     20K      22K 166960K        59        0
     pinsyscall    43     86K     101K 166960K      2813        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K        99        0
            NDP    15      0K       1K 166960K       112        0
           temp    81   9084K    9153K 166960K     76558        0
         kqueue    14     22K      33K 166960K       296        0
      SYN cache     2      0K      16K 166960K         4        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      206    0      203     3     2     1     3     0     8    0
rtentry    176      172    0       94     6     0     6     6     0     8    0
unpcb      144     1144    0     1127    12     6     6     6     0     8    5
syncache   336       16    0       16     5     4     1     1     0     8    1
tcpqe       32        3    0        3     1     1     0     1     0     8    0
tcpcb      736      375    0      370     9     7     2     7     0     8    1
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 0; addr 0xffff800001647740 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 0; addr 0xffff800001647740 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 1; addr 0xffff800001646ea0 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 1; addr 0xffff800001646ea0 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 2; addr 0xffff800001646040 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 2; addr 0xffff800001646040 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 3; addr 0xffff800001646320 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 3; addr 0xffff800001646320 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 4; addr 0xffff800001646600 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 4; addr 0xffff800001646600 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 5; addr 0xffff8000016468e0 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 5; addr 0xffff8000016468e0 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 6; addr 0xffff800001646bc0 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 6; addr 0xffff800001646bc0 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 7; addr 0xffff800001647180 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 7; addr 0xffff800001647180 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 8; addr 0xffff800001647460 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 8; addr 0xffff800001647460 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 9; addr 0xffff800001647a20 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 9; addr 0xffff800001647a20 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
tcpcb: pool(0xffffffff839cd738:tcpcb): free list modified: page 0xffff800001646000; item ordinal 10; addr 0xffff800001647d00 (p 0xfffffd806c6b2000); offset 0x0=0x9fb10d2fffffffff
pool(tcpcb): free list modified: page 0xffff800001646000; item ordinal 10; addr 0xffff800001647d00 (p 0xfffffd806c6b2000); offset 0x0=0xffffffff
arp        136       27    0       12     1     0     1     1     0     8    0
inpcb      328     1625    0     1617    16    14     2     7     0     8    0
nd6        152       35    0       19     1     0     1     1     0     8    0
pkpcb       40        3    0        3     2     2     0     1     0     8    0
kcovpl      48       11    0        3     1     0     1     1     0     8    0
ppxss      1192      99    0       96     2     1     1     1     0     8    0
pppxif     1504       5    0        5     3     3     0     1     0     8    0
pfstscr     40        2    0        2     1     1     0     1     0     8    0
pffrag     232       16    0        5     1     0     1     1     0   482    0
pffrnode    88       16    0        5     1     0     1     1     0     8    0
pffrent     40       36    0       25     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       90    0       33     1     0     1     1     0     8    0
pfstkey    128       93    0       36     2     0     2     2     0     8    0
pfstate    448       91    0       35     7     0     7     7     0     8    0
pfrule     1360      24    0       19     2     1     1     2     0     8    0
rttmr      136        2    0        2     2     2     0     1     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      758    0      409    31     8    23    29     0     8    0
art_table   40      761    0      409     5     0     5     5     0     8    0
art_node    32      169    0       99     1     0     1     1     0     8    0
sysvmsgpl   40       16    0        9     1     0     1     1     0     8    0
semupl     112        3    0        3     2     2     0     1     0     8    0
semapl     112       60    0       50     1     0     1     1     0     8    0
shmpl      112       47    0        2     2     0     2     2     0     8    0
dirhash    1024      27    0       10     3     0     3     3     0     8    0
dino2pl    256     4332    0     2865    93     0    93    93     0     8    0
ffsino     296     4332    0     2865   114     0   114   114     0     8    0
nchpl      144     6377    0     4662    64     0    64    64     0     8    0
rtmask      32       23    0       22     4     3     1     1     0     8    0
vnodes     216     5194    0        0   289     0   289   289     0     8    0
namei      1024   22792    0    22789     1     0     1     1     0     8    0
percpumem   16      169    0      115     1     0     1     1     0     8    0
vcpupl     3968       9    0        1     2     0     2     2     0     8    0
vmpool     848        9    0        1     1     0     1     1     0     8    0
kstatmem   264      182    0      148     4     1     3     3     0     8    0
scsiplug    72       11    0       11     2     2     0     1     0     8    0
scxspl     216    39129    0    39129    12    11     1     5     1     8    1
plimitpl   152      550    0      530     1     0     1     1     0     8    0
sigapl     424     1828    0     1759     9     1     8     8     0     8    0
knotepl    120      558    0        0    17     0    17    17     0     8    0
kqueuepl   224      534    0      523     4     2     2     3     0     8    1
pipepl     344      238    0      210     3     0     3     3     0     8    0
fdescpl    528     1787    0     1755     3     0     3     3     0     8    0
filepl     160    12360    0    12136    26    10    16    17     0     8    4
lockfpl    104      686    0      683     1     0     1     1     0     8    0
lockfspl    48      246    0      243     1     0     1     1     0     8    0
sessionpl  144       38    0       29     1     0     1     1     0     8    0
pgrppl      48       59    0       42     1     0     1     1     0     8    0
ucredpl    104     1837    0     1824     1     0     1     1     0     8    0
zombiepl   144     1875    0     1873     1     0     1     1     0     8    0
processpl  1232    1828    0     1759     7     1     6     6     0     8    0
procpl     664     4090    0     4005     8     0     8     8     0     8    0
sosppl     176       14    0       14     4     3     1     1     0     8    1
sockpl     752     3052    0     3024    42    30    12    17     0     8    8
sockpl: pool(0xffffffff839d08a0:sockpl): page inconsistency: page 0xffff8000ffffffff; at page head addr 0xffff80000160df90 (p 0xffff80000160c000)
uvm_fault(0xfffffd80697935e0, 0x10000004f, 0, 1) -> e
kernel: page fault trap, code=0
Faulted in DDB; continuing...
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff8389fff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a59900) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a59900) at __mp_lock+0x192 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__mp_lock(ffffffff83a59900) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a59900) at __mp_lock+0x192 sys/kern/kern_lock.c:173
ktrsysret(ffff80002a332fc8,ca,0,ffff80003c4bd4b0) at ktrsysret+0xde ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80002a332fc8,ca,0,ffff80003c4bd4b0) at ktrsysret+0xde sys/kern/kern_ktrace.c:209
syscall(ffff80003c4bd560) at syscall+0xa51 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff80003c4bd560) at syscall+0xa51 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7eb1c3e73e70, count: 4
ddb{0}> trace
x86_ipi_db(ffffffff8389fff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a59900) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a59900) at __mp_lock+0x192 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__mp_lock(ffffffff83a59900) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a59900) at __mp_lock+0x192 sys/kern/kern_lock.c:173
ktrsysret(ffff80002a332fc8,ca,0,ffff80003c4bd4b0) at ktrsysret+0xde ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80002a332fc8,ca,0,ffff80003c4bd4b0) at ktrsysret+0xde sys/kern/kern_ktrace.c:209
syscall(ffff80003c4bd560) at syscall+0xa51 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff80003c4bd560) at syscall+0xa51 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7eb1c3e73e70, count: -11
ddb{0}> machine ddbcpu 1
Stopped at      sys_shmat+0xe0: movl    $0xffffffffffffffff,0(%r14)
sys_shmat(ffff800038bbed20,ffff80003c4e9ed0,ffff80003c4e9e20) at sys_shmat+0xe0 sys/kern/sysv_shm.c:235
syscall(ffff80003c4e9ed0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4e9ed0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x34fb789e300, count: 12
ddb{1}> trace
sys_shmat(ffff800038bbed20,ffff80003c4e9ed0,ffff80003c4e9e20) at sys_shmat+0xe0 sys/kern/sysv_shm.c:235
syscall(ffff80003c4e9ed0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4e9ed0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x34fb789e300, count: -3

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/19 15:48 openbsd e3f28ea82b45 0291cd06 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: sys_shmat
2026/02/11 11:51 openbsd 960213463517 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: sys_shmat
2026/01/18 06:56 openbsd f5df22e61f89 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: sys_shmat
2025/12/05 14:18 openbsd 4f07d5022fc4 cee4cb10 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: sys_shmat
2025/12/01 22:42 openbsd 6cbdb9457802 d4611817 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: sys_shmat
2025/11/18 14:29 openbsd ae8b598acb72 ef766cd7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: sys_shmat
2025/10/01 08:49 openbsd ae814b404f5c 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: sys_shmat
* Struck through repros no longer work on HEAD.