uvm_fault: x86_ipi_db (9)

Status: upstream: reported on 2025/02/14 23:55
Reported-by: syzbot+a157c6e0d81b4f6b71a4@syzkaller.appspotmail.com
First crash: 538d, last: 14m
Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: x86_ipi_db (3) -1 4 1990d 2007d 0/4 auto-closed as invalid on 2021/05/25 04:20
openbsd uvm_fault: x86_ipi_db (6) -1 1 1806d 1806d 0/4 closed as invalid on 2021/08/26 17:38
openbsd uvm_fault: x86_ipi_db (2) -1 1 2040d 2040d 0/4 closed as invalid on 2021/01/29 06:54
openbsd uvm_fault: x86_ipi_db (8) -1 330 646d 1630d 0/4 auto-obsoleted due to no activity on 2024/12/19 15:21
openbsd uvm_fault: x86_ipi_db (5) -1 1 1811d 1811d 0/4 closed as invalid on 2021/08/23 05:23
openbsd uvm_fault: x86_ipi_db (7) -1 4 1681d 1681d 3/4 fixed on 2021/12/30 22:14
openbsd uvm_fault: x86_ipi_db -1 1 2044d 2044d 0/4 closed as invalid on 2021/01/03 08:45
openbsd uvm_fault: x86_ipi_db (4) -1 1 1825d 1825d 0/4 closed as invalid on 2021/08/08 05:33

Sample crash report:
*cpu1: uvm_fault(0xfffff6006cd335d8, 0x98, 0, 1) -> e
ddb{0}> show kasan
No such command
ddb{0}> trace
proc_trampoline() at proc_trampoline+0xc7
end of kernel
end trace frame: 0x727ea8b34410, count: -1
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff80003439a4a0
rbx                                0
rdx                                0
rcx               0xffff80002a2214d8
rax                             0x2a
r8                0xffff80003439a3d0
r9                               0x4
r10               0xe9fa18be6b76f133
r11               0x29fe73ab18d2400c
r12                                0
r13                                0
r14                                0
r15                                0
rip               0xffffffff828434c7    proc_trampoline+0xc7
cs                               0x8
rflags                         0x246
rsp               0xffff80003439a420
ss                                 0
proc_trampoline+0xc7:   movl    $0,%gs:0x688
ddb{0}> show proc
PROC (syz-executor) tid=519618 pid=34849 tcnt=1 stat=onproc
    flags process=0 proc=0
    runpri=50, usrpri=50, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a220548,0xffffffff83b323c8
    process=0xffff800045fec4e8 user=0xffff800034395000, vmspace=0xfffff6006fbcbb78
    estcpu=5, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
*34849  519618  57074     0  7           0          0           syz-executor
 31418  363688  65904     0  2           0          0           syz-executor
 31418  320824  65904     0  3           0  0x4000080 fsleep    syz-executor
 27848  421461  21970     0  2           0          0           syz-executor
 27848  506296  21970     0  7           0  0x4000000           syz-executor
 80237  470964  47622    -1  2        0x10          0           syz-executor
 80237  270051  47622    -1  3        0x10  0x4000080 fsleep    syz-executor
  4211   45657  88271     0  3           0       0x80 nanoslp   syz-executor
  4211   42596  88271     0  3           0  0x4000080 lockf     syz-executor
  4211  156090  88271     0  3           0  0x4000080 fsleep    syz-executor
 55147  176805  30181     0  2         0x1      0xc80           syz-executor
 55147   55146  30181     0  3         0x1  0x4000080 ttyout    syz-executor
 55147  498881  30181     0  3         0x1  0x4000080 fsleep    syz-executor
 29105  444183  54763     0  2         0x2          0           syz-executor
 93613   70961  54763     0  3         0x2          0 biowait   syz-executor
 65904   46358  54763     0  2         0x2      0xc80           syz-executor
 88271  133842  54763     0  2         0x2      0xc80           syz-executor
 47622   54150  54763     0  2         0x2      0xc80           syz-executor
 57074  444818  54763     0  3         0x2       0x80 nanoslp   syz-executor
 30181  414987  54763     0  2         0x2      0xc80           syz-executor
 21970  333881  54763     0  3         0x2       0x80 nanoslp   syz-executor
 54763   15802  59639     0  2         0x2          0           syz-executor
 59639  128657  79932     0  3    0x100002       0x88 sigsusp   ksh
 79932  235510  16307     0  3        0x10       0x88 kqread    sshd-session
 16307  187994  76619     0  3        0x12       0x80 kqread    sshd-session
  3296  327384      1     0  3    0x100003       0x80 ttyin     getty
 76619   36734      1     0  3           0       0x88 kqread    sshd
 43356   72255  71296    74  3   0x1100012       0x80 bpf       pflogd
 71296  298333      1     0  3           0       0x80 sbwait    pflogd
 83889  341585  78686    73  3   0x1100010       0x80 kqread    syslogd
 78686  361646      1     0  3    0x100002       0x80 sbwait    syslogd
 62960  213168      1     0  3    0x100000       0x80 kqread    resolvd
 65558   82147  82920    77  3    0x100012       0x80 kqread    dhcpleased
 96911  189903  82920    77  3    0x100012       0x80 kqread    dhcpleased
 82920   12063      1     0  3           0       0x80 kqread    dhcpleased
 70808  520826      0     0  3     0x14000      0x200 bored     smr
 34734  324432      0     0  2     0x14000      0x200           zerothread
 39531  480047      0     0  3     0x14000      0x200 aiodoned  aiodoned
 79669  358270      0     0  3     0x14000      0x200 syncer    update
 72034  135907      0     0  3     0x14000      0x200 cleaner   cleaner
 61579  478041      0     0  3     0x14000      0x200 reaper    reaper
 45368   45810      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 22858  257516      0     0  3     0x14000      0x200 bored     viomb
 97233  316049      0     0  3     0x14000 0x40000200 acpi0     acpi0
   711  158565      0     0  3     0x14000 0x40000200           idle1
 63356  148188      0     0  3     0x14000      0x200 bored     softnet1
  2220  223899      0     0  3     0x14000      0x200 bored     softnet0
 95160  445546      0     0  3     0x14000      0x200 bored     systqmp
 50086  499975      0     0  3     0x14000      0x200 bored     systq
 60535  419682      0     0  3     0x14000      0x200 tmoslp    softclockmp
 53894   60419      0     0  3     0x14000 0x40000200 tmoslp    softclock
 73091  120589      0     0  3     0x14000 0x40000200           idle0
     1  251167      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex &(curpg)->mdpage.pv_mtx r = 0 (0xfffff600089bb798)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pmap_enter+0x83a pmap_enter_pv sys/arch/amd64/amd64/pmap.c:1104 [inline]
#2  pmap_enter+0x83a sys/arch/amd64/amd64/pmap.c:2888
#3  uvm_fault_lower_lookup+0x369 sys/uvm/uvm_fault.c:-1
#4  uvm_fault_lower+0x89 sys/uvm/uvm_fault.c:1334
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#7  usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#8  recall_trap+0x8
exclusive mutex &pmap->pm_mtx r = 0 (0xfffff6006cc8bf10)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pmap_enter+0x24b rcr3 sys/arch/amd64/compile/SYZKALLER/obj/machine/cpufunc.h:139 [inline]
#2  pmap_enter+0x24b pmap_map_ptes sys/arch/amd64/amd64/pmap.c:441 [inline]
#2  pmap_enter+0x24b sys/arch/amd64/amd64/pmap.c:2777
#3  uvm_fault_lower_lookup+0x369 sys/uvm/uvm_fault.c:-1
#4  uvm_fault_lower+0x89 sys/uvm/uvm_fault.c:1334
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#7  usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#8  recall_trap+0x8
Process 34849 (syz-executor) thread 0xffff80002a2214d8 (519618)
shared rwlock uobjlk r = 0 (0xfffff6006d1af608)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  uvm_fault_lower_lookup+0x53 sys/uvm/uvm_fault.c:1204
#3  uvm_fault_lower+0x89 sys/uvm/uvm_fault.c:1334
#4  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#5  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#6  usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#7  recall_trap+0x8
shared rwlock vmmaplk r = 0 (0xfffff6006fbcbc78)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
#3  uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
#4  uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#5  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#6  usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#7  recall_trap+0x8
exclusive mutex &(curpg)->mdpage.pv_mtx r = 0 (0xfffff600089bb798)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pmap_enter+0x83a pmap_enter_pv sys/arch/amd64/amd64/pmap.c:1104 [inline]
#2  pmap_enter+0x83a sys/arch/amd64/amd64/pmap.c:2888
#3  uvm_fault_lower_lookup+0x369 sys/uvm/uvm_fault.c:-1
#4  uvm_fault_lower+0x89 sys/uvm/uvm_fault.c:1334
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#7  usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#8  recall_trap+0x8
exclusive mutex &pmap->pm_mtx r = 0 (0xfffff6006cc8bf10)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pmap_enter+0x24b rcr3 sys/arch/amd64/compile/SYZKALLER/obj/machine/cpufunc.h:139 [inline]
#2  pmap_enter+0x24b pmap_map_ptes sys/arch/amd64/amd64/pmap.c:441 [inline]
#2  pmap_enter+0x24b sys/arch/amd64/amd64/pmap.c:2777
#3  uvm_fault_lower_lookup+0x369 sys/uvm/uvm_fault.c:-1
#4  uvm_fault_lower+0x89 sys/uvm/uvm_fault.c:1334
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#7  usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#8  recall_trap+0x8
Process 27848 (syz-executor) thread 0xffff80002a220548 (506296)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b165c0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
#2  Xsyscall+0x128
Process 93613 (syz-executor) thread 0xffff80002a220a78 (70961)
exclusive rrwlock inode r = 0 (0xfffff6006f67c930)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4  ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:150
#5  ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ffs_inode_alloc+0x279 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112
#8  VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
#9  domkdirat+0x179 sys/kern/vfs_syscalls.c:3063
#10 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffff6006d7fcd70)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x12b sys/kern/vfs_lookup.c:431
#6  namei+0x7c5 sys/kern/vfs_lookup.c:250
#7  domkdirat+0x8b sys/kern/vfs_syscalls.c:3048
#8  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#9  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11058  12220K   12284K 166960K     12165        0
            pcb    17     12K      12K 166960K        22        0
         rtable   215      6K       7K 166960K       353        0
             pf    34     17K      19K 166960K        49        0
         ifaddr    39      6K       7K 166960K        45        0
        ifgroup    51      2K       2K 166960K        55        0
         sysctl     1      1K       9K 166960K         5        0
       counters    68     36K      37K 166960K        70        0
       ioctlops     0      0K       4K 166960K      1489        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1292     81K      81K 166960K      1381        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     3      0K       0K 166960K         3        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    16     57K      97K 166960K       156        0
           proc    71    115K     164K 166960K       553        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         2        0
       in_multi    88      5K       6K 166960K       100        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     1      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    55    254K     254K 166960K        55        0
           exec     0      0K       1K 166960K       389        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   222    159K     172K 166960K      3206        0
       UVM aobj     3      2K       2K 166960K         3        0
     pinsyscall    41     82K     106K 166960K      1322        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    25      1K       2K 166960K        28        0
           temp    33   9114K    9190K 166960K      3981        0
         kqueue    13     20K      24K 166960K        30        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       34    0       31     1     0     1     1     0     8    0
rtentry    176      111    0       12     5     0     5     5     0     8    0
unpcb      144       44    0       27     1     0     1     1     0     8    0
syncache   336        4    0        4     1     0     1     1     0     8    1
tcpcb      736       11    0        6     1     0     1     1     0     8    0
arp        136       18    0        2     1     0     1     1     0     8    0
inpcb      328       78    0       70     2     0     2     2     0     8    0
nd6        152       24    0        3     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
pfstscr     40        3    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       26    0        0     1     0     1     1     0     8    0
pfstkey    128       26    0        0     1     0     1     1     0     8    0
pfstate    448       24    0        0     3     0     3     3     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      452    0       44    29     0    29    29     0     8    1
art_table   40      453    0       44     5     0     5     5     0     8    0
art_node    32      111    0       21     1     0     1     1     0     8    0
semapl      72        1    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1606    0      138    92     0    92    92     0     8    0
ffsino     296     1606    0      138   114     0   114   114     0     8    0
nchpl      144     1825    0      125    64     0    64    64     0     8    0
vnodes     216     1706    0        0    95     0    95    95     0     8    0
namei      1024    5616    0     5615     2     0     2     2     0     8    1
percpumem   16       51    0        1     1     0     1     1     0     8    0
kstatmem   264       27    0        2     2     0     2     2     0     8    0
scxspl     216     6291    0     6290     4     2     2     3     1     8    1
plimitpl   152       31    0       13     1     0     1     1     0     8    0
sigapl     424      476    0      430     7     0     7     7     0     8    1
knotepl    120      526    0        0    16     0    16    16     0     8    0
kqueuepl   224       29    0       20     1     0     1     1     0     8    0
pipepl     344      130    0      103     3     0     3     3     0     8    0
fdescpl    528      460    0      430     3     0     3     3     0     8    0
filepl     160     1665    0     1445    10     0    10    10     0     8    0
lockfpl    104       12    0        7     1     0     1     1     0     8    0
lockfspl    48        7    0        3     1     0     1     1     0     8    0
sessionpl  144       27    0       17     1     0     1     1     0     8    0
pgrppl      48       35    0       17     1     0     1     1     0     8    0
ucredpl    104      113    0       99     1     0     1     1     0     8    0
zombiepl   144      430    0      430     1     0     1     1     0     8    1
processpl  1232     476    0      430     5     0     5     5     0     8    1
procpl     664      508    0      455     5     0     5     5     0     8    0
sockpl     752      157    0      129     4     0     4     4     0     8    0
mcl64k     65536      9    0        0     2     0     2     2     0     8    0
mcl16k     16384      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k128   9344       2    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     117    0        0    15     0    15    15     0     8    0
mcl2k      2048      15    0        0     2     0     2     2     0     8    0
mextrefs    64       10    0        0     1     0     1     1     0     8    0
mtagpl      96        1    0        0     1     0     1     1     0     8    0
mbufpl     256      126    0        0     8     0     8     8     0     8    0
bufpl      272     2342    0      105   150     0   150   150     0     8    0
anonpl      32     5426    0        0    44     0    44    44     0   247    0
amapchunkpl 152    9207    0     8754    25     0    25    25     0   158    0
amappl16   200     1950    0     1930     5     0     5     5     0     8    3
amappl15   192        9    0        9     1     0     1     1     0     8    1
amappl14   184      430    0      429     1     0     1     1     0     8    0
amappl13   176      122    0      110     1     0     1     1     0     8    0
amappl12   168      711    0      682     2     0     2     2     0     8    0
amappl11   160        5    0        4     1     0     1     1     0     8    0
amappl10   152       88    0       74     1     0     1     1     0     8    0
amappl9    144      276    0      275     1     0     1     1     0     8    0
amappl8    136      102    0      100     1     0     1     1     0     8    0
amappl7    128      151    0      138     1     0     1     1     0     8    0
amappl6    120      181    0      180     1     0     1     1     0     8    0
amappl5    112       98    0       87     1     0     1     1     0     8    0
amappl4    104      295    0      274     1     0     1     1     0     8    0
amappl3     96     1537    0     1447     3     0     3     3     0     8    0
amappl2     88      578    0      505     2     0     2     2     0     8    0
amappl1     80    10518    0     9917    15     0    15    15     0     8    1
amappl      88     2466    0     2317     4     0     4     4     0    92    0
uvmvnodes   80       99    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      460    0      430     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      460    0      430     1     0     1     1     0     8    0
vmmpekpl   168     5814    0     5778     2     0     2     2     0     8    0
vmmpepl    168    39022    0    37179    87     0    87    87     0   357    1
vmsppl     488      459    0      430     5     0     5     5     0     8    1
rwobjpl     80    14869    0    13856    25     0    25    25     0     8    2
pdppl      4096     927    0      860   101    14    87    87     0     8   20
pvpl        32    13051    0        0   106     0   106   106     0   265    0
pmappl     256      459    0      430     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      420    0       17    12     0    12    12     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
proc_trampoline() at proc_trampoline+0xc7
end of kernel
end trace frame: 0x727ea8b34410, count: -1
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_write_1(3f8,0,29) at x86_bus_space_io_write_1+0x40 sys/arch/amd64/amd64/bus_space.c:790
comcnputc(800,29) at comcnputc+0x1ab bus_space_barrier sys/dev/ic/com.c:-1 [inline]
comcnputc(800,29) at comcnputc+0x1ab sys/dev/ic/com.c:1268
cnputc(29) at cnputc+0x67 sys/dev/cons.c:218
db_putchar(29) at db_putchar+0x36d sys/ddb/db_output.c:155
kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1
db_printf(ffffffff834613a7) at db_printf+0x9b sys/kern/subr_prf.c:-1
fault(ffffffff83521c81) at fault+0xa7 sys/arch/amd64/amd64/trap.c:161
kpageflttrap(ffff80002eb82a70,98) at kpageflttrap+0x37d sys/arch/amd64/amd64/trap.c:296
kerntrap(ffff80002eb82a70) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
dovutimens(ffff80002a220548,fffff6006811d6d8,ffff80002eb82c50) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691
end trace frame: 0xffff80002eb82cc0, count: 0
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_write_1(3f8,0,29) at x86_bus_space_io_write_1+0x40 sys/arch/amd64/amd64/bus_space.c:790
comcnputc(800,29) at comcnputc+0x1ab bus_space_barrier sys/dev/ic/com.c:-1 [inline]
comcnputc(800,29) at comcnputc+0x1ab sys/dev/ic/com.c:1268
cnputc(29) at cnputc+0x67 sys/dev/cons.c:218
db_putchar(29) at db_putchar+0x36d sys/ddb/db_output.c:155
kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1
db_printf(ffffffff834613a7) at db_printf+0x9b sys/kern/subr_prf.c:-1
fault(ffffffff83521c81) at fault+0xa7 sys/arch/amd64/amd64/trap.c:161
kpageflttrap(ffff80002eb82a70,98) at kpageflttrap+0x37d sys/arch/amd64/amd64/trap.c:296
kerntrap(ffff80002eb82a70) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
dovutimens(ffff80002a220548,fffff6006811d6d8,ffff80002eb82c50) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2691
sys_futimes(ffff80002a220548,ffff80002eb82da0,ffff80002eb82cf0) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2733
syscall(ffff80002eb82da0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002eb82da0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x4723fb3db90, count: -17

Crashes (8066):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/07 15:56 openbsd 03dd4c68d240 e4ef95d6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/07 13:32 openbsd ea06ec21fb36 c38879ea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/07 11:23 openbsd ea06ec21fb36 c38879ea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/07 09:29 openbsd ea06ec21fb36 c38879ea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/07 07:08 openbsd ea06ec21fb36 c38879ea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/07 05:38 openbsd ea06ec21fb36 c38879ea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/07 04:24 openbsd ea06ec21fb36 c38879ea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/07 02:53 openbsd ea06ec21fb36 c38879ea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 23:14 openbsd 07df0a216fc9 cc56899a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 22:08 openbsd 07df0a216fc9 cc56899a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 19:21 openbsd 07df0a216fc9 cc56899a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 16:39 openbsd 07df0a216fc9 cc56899a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 15:06 openbsd 07df0a216fc9 cc56899a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 13:08 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 12:01 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 10:52 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 09:49 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 08:48 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 05:51 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 02:39 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 01:04 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/06 00:17 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 22:34 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 21:16 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 20:12 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 19:01 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 16:37 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 14:07 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 10:52 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 09:52 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 08:38 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 07:02 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 05:57 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 04:28 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 02:34 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 01:07 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/05 00:55 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/04 23:36 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/04 21:49 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/04 20:40 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/04 19:28 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/04 17:15 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/04 14:03 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/04 13:00 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/08/04 11:45 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/07/29 09:27 openbsd 7c9a09f11f52 19622d9d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid uvm_fault: x86_ipi_db
2025/02/14 23:54 openbsd 8d2464095911 40a34ec9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: x86_ipi_db
2026/07/06 19:26 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 5f617609345c fcece630 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan uvm_fault: x86_ipi_db
* Struck through repros no longer work on HEAD.