syzbot


uvm_fault: blf_cbc_decrypt

Status: upstream: reported on 2026/05/01 14:30
Reported-by: syzbot+98160f6454a7da92bb0c@syzkaller.appspotmail.com
First crash: 39d, last: 39d

Sample crash report:
uvm_fault(0xffffffff83a75668, 0xffff80001b2b21f8, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      blf_cbc_decrypt+0x90:   movl    0(%rbx),%eax
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*249792  80133      0      0x1000  0x4080000    0  syz-executor
blf_cbc_decrypt(ffff800001633000,ffff8000318ccb60,ffff80001b2b2000,200) at blf_cbc_decrypt+0x90 sys/crypto/blf.c:611
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac vndencrypt sys/dev/vnd.c:-1 [inline]
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac vndencryptbuf sys/dev/vnd.c:144 [inline]
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac sys/dev/vnd.c:350
readdisksector(fffffd807b60e240,ffffffff81cf7100,ffff8000015d0800,0) at readdisksector+0x6e sys/kern/subr_disk.c:-1
writedisklabel(e02,ffffffff81cf7100,ffff8000015d0800) at writedisklabel+0xe6 sys/arch/amd64/amd64/disksubr.c:140
vndioctl(e02,84946467,ffff80000163a800,3,ffff800035cd87e8) at vndioctl+0x83a sys/dev/vnd.c:651
VOP_IOCTL(fffffd806c932888,84946467,ffff80000163a800,3,fffffd8007ffd410,ffff800035cd87e8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806c894960,84946467,ffff80000163a800,ffff800035cd87e8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800035cd87e8,ffff8000318cd660,ffff8000318cd5b0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff8000318cd660) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000318cd660) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8148de7fea0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83a75668, 0xffff80001b2b21f8, 0, 1) -> d
ddb> trace
blf_cbc_decrypt(ffff800001633000,ffff8000318ccb60,ffff80001b2b2000,200) at blf_cbc_decrypt+0x90 sys/crypto/blf.c:611
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac vndencrypt sys/dev/vnd.c:-1 [inline]
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac vndencryptbuf sys/dev/vnd.c:144 [inline]
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac sys/dev/vnd.c:350
readdisksector(fffffd807b60e240,ffffffff81cf7100,ffff8000015d0800,0) at readdisksector+0x6e sys/kern/subr_disk.c:-1
writedisklabel(e02,ffffffff81cf7100,ffff8000015d0800) at writedisklabel+0xe6 sys/arch/amd64/amd64/disksubr.c:140
vndioctl(e02,84946467,ffff80000163a800,3,ffff800035cd87e8) at vndioctl+0x83a sys/dev/vnd.c:651
VOP_IOCTL(fffffd806c932888,84946467,ffff80000163a800,3,fffffd8007ffd410,ffff800035cd87e8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806c894960,84946467,ffff80000163a800,ffff800035cd87e8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800035cd87e8,ffff8000318cd660,ffff8000318cd5b0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff8000318cd660) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000318cd660) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8148de7fea0, count: -10
ddb> show registers
rdi                              0x7
rsi                            0x1f8
rbp               0xffff8000318ccb40
rbx               0xffff80001b2b21f8
rdx               0xffff8000015d59c0
rcx                            0x200
rax               0xffff800035cd87e8
r8                            0xf360    __ALIGN_SIZE+0xe360
r9                        0x3edfc6d7
r10               0x9f70480a9881884f
r11               0x99c6d8f2b05da7e1
r12                            0x1f0
r13               0xffff8000318ccae8
r14                            0x200
r15               0xffff800001633000
rip               0xffffffff827d9870    blf_cbc_decrypt+0x90
cs                               0x8
rflags                       0x10207    __ALIGN_SIZE+0xf207
rsp               0xffff8000318ccad0
ss                              0x10
blf_cbc_decrypt+0x90:   movl    0(%rbx),%eax
ddb> show proc
PROC (syz-executor) tid=249792 pid=80133 tcnt=2 stat=onproc
    flags process=1000<SINGLEEXIT> proc=4080000<SUSPSINGLE,THREAD>
    runpri=64, usrpri=65, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff800035cd8d18 scnt=1 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800035cd8a80,0xffff80003c9aefd0
    process=0xffff800035cd5698 user=0xffff8000318c8000, vmspace=0xfffffd807dfe62f8
    estcpu=15, cpticks=17, pctcpu=0.0, user=0, sys=17, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 80002  316825  55890      0  2           0                syz-executor
 80002  146221  55890      0  3   0x4000080  piperd        syz-executor
 87019  411014    450      0  2           0                syz-executor
 87019  293519    450      0  3   0x4000080  fsleep        syz-executor
 47064   37011  61157      0  2           0                syz-executor
 47064  242774  61157      0  2   0x4000000                syz-executor
 13951  394588  69860      0  2           0                syz-executor
 13951  176942  69860      0  2   0x4000000                syz-executor
 50124  378595   5937      0  2           0                syz-executor
 50124  443429   5937      0  3   0x4000080  fsleep        syz-executor
 80133  372261  38452      0  3      0x3000  suspend       syz-executor
*80133  249792  38452      0  7   0x4081000                syz-executor
 55169  294564  32877      0  3      0x3000  suspend       syz-executor
 55169   56735  32877      0  2   0x4081000                syz-executor
 56425  126217      0      0  3     0x14280  nfsidl        nfsio
 66104  112971      0      0  3     0x14280  nfsidl        nfsio
 54150  256844      0      0  3     0x14280  nfsidl        nfsio
 11194  227338      0      0  3     0x14280  nfsidl        nfsio
 94761   80273      0      0  3     0x14280  nfsidl        nfsio
 24156   57379      0      0  3     0x14280  nfsidl        nfsio
 57406  295444      0      0  3     0x14280  nfsidl        nfsio
 74157  373124      0      0  3     0x14280  nfsidl        nfsio
 55186  158633      0      0  3     0x14280  nfsidl        nfsio
 29379  140518      0      0  3     0x14280  nfsidl        nfsio
  6285  149041      0      0  3     0x14280  nfsidl        nfsio
 31706  301275      0      0  3     0x14280  nfsidl        nfsio
 64662  106511      0      0  3     0x14280  nfsidl        nfsio
 71347  459591      0      0  3     0x14280  nfsidl        nfsio
 30660  423209      0      0  3     0x14280  nfsidl        nfsio
 23547   52028      0      0  3     0x14280  nfsidl        nfsio
 30631  381873      0      0  3     0x14280  nfsidl        nfsio
 40725  477697      0      0  3     0x14280  nfsidl        nfsio
 78764  519336      0      0  3     0x14280  nfsidl        nfsio
 96344  295966      0      0  3     0x14280  nfsidl        nfsio
 61157   78271  35411      0  2       0xc82                syz-executor
   450  369936  35411      0  2       0xc82                syz-executor
 69860  445309  35411      0  2       0xc82                syz-executor
 38452  241535  35411      0  2       0xc82                syz-executor
 32877  511307  35411      0  2       0xc82                syz-executor
 13772  364367  35411      0  2         0x2                syz-executor
  5937  519164  35411      0  2       0xc82                syz-executor
 55890   75804  35411      0  2       0xc82                syz-executor
 35411  448131   9415      0  3        0x82  kqread        syz-executor
  9415  483142  22143      0  3    0x10008a  sigsusp       ksh
 22143  111308  82598      0  3        0x98  kqread        sshd-session
 82598   68223  32438      0  3        0x92  kqread        sshd-session
 78911  499915      1      0  3    0x100083  ttyin         getty
 32438  311633      1      0  3        0x88  kqread        sshd
 81173   95350  34184     73  3   0x1100090  kqread        syslogd
 34184   84477      1      0  3    0x100082  sbwait        syslogd
 52670  511828      1      0  3    0x100080  kqread        resolvd
 94170  122269  71746     77  3    0x100092  kqread        dhcpleased
 67045    5651  71746     77  3    0x100092  kqread        dhcpleased
 71746    9454      1      0  3        0x80  kqread        dhcpleased
 31263  187864      0      0  3     0x14200  bored         smr
 51322  316616      0      0  2     0x14200                zerothread
 35500  485934      0      0  3     0x14200  aiodoned      aiodoned
 27008   64950      0      0  3     0x14200  syncer        update
 10305   58839      0      0  3     0x14200  cleaner       cleaner
 99446  187189      0      0  3     0x14200  reaper        reaper
  3288  234208      0      0  3     0x14200  pgdaemon      pagedaemon
 72668   45206      0      0  3     0x14200  bored         viomb
 54551  116909      0      0  3  0x40014200  acpi0         acpi0
 11588  378668      0      0  3     0x14200  bored         softnet0
 27339  158197      0      0  3     0x14200  bored         systqmp
 49647   89280      0      0  3     0x14200  bored         systq
 58280  386516      0      0  3  0x40014200  tmoslp        softclock
 37922  408556      0      0  3  0x40014200                idle0
     1  344865      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11044  12139K   12611K 166960K     12673        0
            pcb    18     13K      14K 166960K       100        0
         rtable   244      8K       9K 166960K       432        0
             pf    30     12K      14K 166960K        51        0
         ifaddr    39      6K       7K 166960K        58        0
        ifgroup    50      2K       2K 166960K        81        0
         sysctl     1      1K       9K 166960K         6        0
       counters    33     17K      18K 166960K        46        0
       ioctlops     1      2K       4K 166960K        97        0
            iov     0      0K      16K 166960K        10        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1292     81K      82K 166960K      1533        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         7        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      1K       1K 166960K        21        0
        dirhash    12      2K       2K 166960K        18        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      85K 166960K       371        0
          sigio     0      0K       0K 166960K         2        0
           proc    60     59K      91K 166960K       526        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        25        0
       in_multi    88      6K       6K 166960K       107        0
    ether_multi     1      0K       0K 166960K         3        0
            mrt     0      0K       0K 166960K         9        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    73    334K     334K 166960K        73        0
           exec     0      0K       1K 166960K       375        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   213    151K     164K 166960K      4948        0
       UVM aobj    12      4K       4K 166960K        15        0
     pinsyscall    38     76K      90K 166960K      1455        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        10        0
            NDP    11      0K       1K 166960K        36        0
           temp    41   9071K    9143K 166960K      5169        0
         kqueue    13     20K      32K 166960K        66        0
      SYN cache     2     16K      24K 166960K         3        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       57    0       54     1     0     1     1     0     8    0
rtentry    136      125    0       22     4     0     4     4     0     8    0
unpcb      144      132    0      113     1     0     1     1     0     8    0
syncache   336        4    0        4     2     1     1     1     0     8    1
tcpcb      736      101    0       96     4     0     4     4     0     8    3
arp         96       19    0        3     1     0     1     1     0     8    0
ipq         40        2    0        0     1     0     1     1     0     8    0
ipqe        40        2    0        0     1     0     1     1     0     8    0
inpcb      328      451    0      442     7     0     7     7     0     8    6
nd6        112       27    0        4     1     0     1     1     0     8    0
pkpcb       40        1    0        1     1     0     1     1     0     8    1
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1072       8    0        8     1     0     1     1     0     8    1
pppxif     1416       3    0        3     1     0     1     1     0     8    1
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      509    0       60    29     0    29    29     0     8    0
art_table   40      511    0       60     5     0     5     5     0     8    0
art_node    32      122    0       29     1     0     1     1     0     8    0
sysvmsgpl   40       68    0       66     1     0     1     1     0     8    0
semupl     112        1    0        1     1     0     1     1     0     8    1
semapl     112       17    0        7     1     0     1     1     0     8    0
shmpl      112       12    0        3     1     0     1     1     0     8    0
dirhash    1024      21    0        4     3     0     3     3     0     8    0
dino2pl    256     2014    0      560    92     0    92    92     0     8    0
ffsino     256     2014    0      560    92     0    92    92     0     8    0
nchpl      144     2527    0      835    64     0    64    64     0     8    0
rtmask      32        1    0        1     1     0     1     1     0     8    1
vnodes     216     2169    0        0   121     0   121   121     0     8    0
namei      1024    8069    0     8069     2     1     1     1     0     8    1
kstatmem   264       41    0       18     2     0     2     2     0     8    0
scsiplug    72        4    0        4     1     0     1     1     0     8    1
scxspl     216     8236    0     8236    10     2     8     8     1     8    8
plimitpl   152      152    0      135     1     0     1     1     0     8    0
sigapl     424      682    0      620     8     0     8     8     0     8    0
knotepl    120    12657    0    12610    10     0    10    10     0     8    8
kqueuepl   184      221    0      212     4     0     4     4     0     8    3
pipepl     304      134    0      106     3     0     3     3     0     8    0
fdescpl    448      649    0      620     4     0     4     4     0     8    0
filepl     120     3388    0     3169    13     0    13    13     0     8    4
lockfpl    104       99    0       97     1     0     1     1     0     8    0
lockfspl    48       45    0       43     1     0     1     1     0     8    0
sessionpl  144       28    0       20     1     0     1     1     0     8    0
pgrppl      48       43    0       27     1     0     1     1     0     8    0
ucredpl    104      321    0      309     1     0     1     1     0     8    0
zombiepl   144      621    0      620     2     1     1     1     0     8    0
processpl  1152     682    0      620     5     0     5     5     0     8    0
procpl     664     1035    0      966     7     0     7     7     0     8    0
sockpl     552      653    0      622     8     0     8     8     0     8    5
mcl64k     65536     17    0       17     1     0     1     1     0     8    1
mcl16k     16384      4    0        4     1     0     1     1     0     8    1
mcl12k     12288      1    0        1     1     0     1     1     0     8    1
mcl8k      8192       8    0        8     2     1     1     1     0     8    1
mcl4k      4096    2819    0     2764    16     7     9    15     0     8    1
mcl2k      2048     323    0      322     3     0     3     3     0     8    2
mtagpl      96        9    0        5     1     0     1     1     0     8    0
mbufpl     256     6566    0     6390    15     0    15    15     0     8    0
bufpl      280     2541    0      103   175     0   175   175     0     8    0
anonpl      24   125937    0   120749    48     4    44    44     0   187   11
amapchunkpl 152   15450    0    14885    25     0    25    25     0   158    1
amappl16   200     2533    0     2506    18     8    10    14     0     8    8
amappl15   192       42    0       42     1     1     0     1     0     8    0
amappl14   184      409    0      408     1     0     1     1     0     8    0
amappl13   176      106    0       96     1     0     1     1     0     8    0
amappl12   168      881    0      853     2     0     2     2     0     8    0
amappl11   160        9    0        9     1     1     0     1     0     8    0
amappl10   152       85    0       75     1     0     1     1     0     8    0
amappl9    144      266    0      266     1     1     0     1     0     8    0
amappl8    136      108    0      106     1     0     1     1     0     8    0
amappl7    128      138    0      126     1     0     1     1     0     8    0
amappl6    120      155    0      154     1     0     1     1     0     8    0
amappl5    112       87    0       79     1     0     1     1     0     8    0
amappl4    104      253    0      236     1     0     1     1     0     8    0
amappl3     96     2907    0     2804     3     0     3     3     0     8    0
amappl2     88      512    0      455     2     0     2     2     0     8    0
amappl1     80    10021    0     9459    13     0    13    13     0     8    1
amappl      88     4238    0     4088     4     0     4     4     0    92    0
uvmvnodes   80      102    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      254    0      254     2     1     1     1     0     8    1
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       14    0        3     1     0     1     1     0     8    0
uaddrrnd    24      649    0      620     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      649    0      620     1     0     1     1     0     8    0
vmmpekpl   168     6628    0     6596     2     0     2     2     0     8    0
vmmpepl    168    48436    0    46652    93     2    91    91     0   357   10
vmsppl     368      648    0      620     4     0     4     4     0     8    1
rwobjpl     40    16198    0    15248    14     1    13    13     0     8    2
pdppl      4096    1304    0     1240    98    32    66    76     0     8    2
pvpl        32   306004    0   293280   114     2   112   112     0   265    9
pmappl     216      648    0      620     2     0     2     2     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      373    0       44    10     0    10    10     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
blf_cbc_decrypt(ffff800001633000,ffff8000318ccb60,ffff80001b2b2000,200) at blf_cbc_decrypt+0x90 sys/crypto/blf.c:611
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac vndencrypt sys/dev/vnd.c:-1 [inline]
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac vndencryptbuf sys/dev/vnd.c:144 [inline]
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac sys/dev/vnd.c:350
readdisksector(fffffd807b60e240,ffffffff81cf7100,ffff8000015d0800,0) at readdisksector+0x6e sys/kern/subr_disk.c:-1
writedisklabel(e02,ffffffff81cf7100,ffff8000015d0800) at writedisklabel+0xe6 sys/arch/amd64/amd64/disksubr.c:140
vndioctl(e02,84946467,ffff80000163a800,3,ffff800035cd87e8) at vndioctl+0x83a sys/dev/vnd.c:651
VOP_IOCTL(fffffd806c932888,84946467,ffff80000163a800,3,fffffd8007ffd410,ffff800035cd87e8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806c894960,84946467,ffff80000163a800,ffff800035cd87e8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800035cd87e8,ffff8000318cd660,ffff8000318cd5b0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff8000318cd660) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000318cd660) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8148de7fea0, count: -10
ddb> machine ddbcpu 1
No such command
ddb> trace
blf_cbc_decrypt(ffff800001633000,ffff8000318ccb60,ffff80001b2b2000,200) at blf_cbc_decrypt+0x90 sys/crypto/blf.c:611
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac vndencrypt sys/dev/vnd.c:-1 [inline]
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac vndencryptbuf sys/dev/vnd.c:144 [inline]
vndstrategy(fffffd807b60e240) at vndstrategy+0x5ac sys/dev/vnd.c:350
readdisksector(fffffd807b60e240,ffffffff81cf7100,ffff8000015d0800,0) at readdisksector+0x6e sys/kern/subr_disk.c:-1
writedisklabel(e02,ffffffff81cf7100,ffff8000015d0800) at writedisklabel+0xe6 sys/arch/amd64/amd64/disksubr.c:140
vndioctl(e02,84946467,ffff80000163a800,3,ffff800035cd87e8) at vndioctl+0x83a sys/dev/vnd.c:651
VOP_IOCTL(fffffd806c932888,84946467,ffff80000163a800,3,fffffd8007ffd410,ffff800035cd87e8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806c894960,84946467,ffff80000163a800,ffff800035cd87e8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800035cd87e8,ffff8000318cd660,ffff8000318cd5b0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff8000318cd660) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000318cd660) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8148de7fea0, count: -10

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/01 14:30 openbsd d15801fa3705 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: blf_cbc_decrypt
* Struck through repros no longer work on HEAD.